PT0-002 Practice Question: A penetration tester is using a vulnerability…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The scanner used a different HTTP method than the one used in manual testing

  Why it's wrong here

  While the HTTP method can alter how a server processes input (e.g., GET versus POST), the scenario states that the same payload was used in both manual and scanner testing, making a method mismatch unlikely. Modern vulnerability scanners typically mirror the exact request method observed during manual testing or default to the most common method for the endpoint. Even if the method differed, cross-site scripting or SQL injection into the same parameter would still manifest consistently unless the application explicitly branches on method, which is rare. Therefore, this is not the most plausible cause of the discrepancy.

• ✗

  The scanner's payloads were URL-encoded differently

  Why it's wrong here

  If the same payload was used in manual testing, the URL encoding should be consistent, as both the browser and the scanner transmit the payload after standard encoding. Differences in encoding (e.g., percent-encoding vs. Unicode encoding) could theoretically cause the server to interpret the payload differently, but scanners normalize encoding and modern web applications decode input automatically. Since manual testing and the scanner received the same response, encoding inconsistency is not a likely reason for the scanner's positive result. This explanation overstates the impact of encoding on detection.

• ✗

  The vulnerability exists only in the scanner's simulated environment

  Why it's wrong here

  Vulnerability scanners do not execute tests in a simulated environment; they send live HTTP requests to the target application and analyze the real responses received. The scanner's payload set or attack signatures are not a 'simulated environment' because the application under test is the actual live system. A finding generated by the scanner is a result of observing real server behavior, not a virtualized sandbox. Therefore, claiming that the vulnerability only exists in a scanner-simulated environment misunderstands the fundamental architecture of automated scanning tools.

• ✓

  The scanner might have generated a false positive due to a misinterpretation of the server's response

  Why this is correct

  Automated vulnerability scanners frequently produce false positives because they rely on heuristic response pattern matching rather than full semantic analysis. For example, a scanner may see the injected payload reflected in the HTML body and flag it as cross-site scripting without checking whether the reflection occurs in a safe, encoded context that prevents execution. Manual testing, which examines the actual response context and confirms exploitability, revealed that the server is not actually vulnerable. This discrepancy is a classic demonstration of why every scanner finding must be verified manually before being reported.