mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is using Burp Suite to…
A penetration tester is using Burp Suite to intercept and modify HTTP traffic. When browsing to an HTTPS site, the tester observes that the requests are encrypted and not being intercepted by Burp. Which configuration step is most likely missing?
⚠ Common exam trap
Watch out — candidates often confuse proxy configuration (setting the browser to use Burp as a proxy) with TLS interception setup, assuming that simply pointing the browser at the proxy is sufficient to intercept HTTPS traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Burp CA certificate has not been installed in the browser's trust store
Burp Suite intercepts HTTPS traffic by acting as a man-in-the-middle, which requires the browser to trust Burp's self-signed CA certificate. Without installing the Burp CA certificate in the browser's trust store, the browser will refuse to establish a TLS connection through the proxy, leaving requests encrypted end-to-end and invisible to Burp.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The proxy listener is not configured to listen on the correct port
Why it's wrong here
The proxy listener's port (typically 8080) is protocol-agnostic—it receives both HTTP and HTTPS requests from the browser. If the port were wrong, the browser would fail to reach Burp for any traffic, so the issue would not be limited to HTTPS. The symptom of HTTPS-only failure indicates the listener is being reached, but the TLS handshake is being rejected due to an untrusted certificate.
- ✓
The Burp CA certificate has not been installed in the browser's trust store
Why this is correct
Correct. Burp acts as a man-in-the-middle for HTTPS by generating a certificate for each site signed by its own CA. The browser's trust store must contain the Burp CA certificate, or it will reject the connection.
- ✗
The browser's proxy settings are not configured to use Burp
Why it's wrong here
If the browser's proxy settings were missing or incorrect, the browser would connect directly to websites, bypassing Burp entirely; HTTP and HTTPS would both load normally, and no requests would appear in Burp. Since HTTPS is being intercepted (and failing with a certificate error), the proxy settings must be correctly directing traffic to Burp. The actual problem is the browser rejecting Burp's CA-signed certificate, not the proxy configuration.
- ✗
The target site is not in Burp's scope
Why it's wrong here
Burp's scope configuration controls which hosts appear in the Target site map, are actively scanned, and are included in the proxy history; it does not filter which traffic is intercepted on the wire. The proxy intercepts every request that passes through it based on the listener and browser proxy settings, regardless of scope. An out-of-scope target would still be intercepted and modifiable, so scope cannot explain a failure to intercept HTTPS traffic.
Go deeper
Related to this question
About these practice questions
This PT0-003 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.