easyMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester needs to describe a stored…
A penetration tester needs to describe a stored XSS vulnerability to a web developer who will fix it. Which level of detail is most appropriate for this audience?
⚠ Common exam trap
It's easy for candidates to confuse the audience's needs: they may pick business impact (Option B) for a developer, but developers require technical details (Option C) to actually fix the code, not just awareness of consequences.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Include the specific vulnerable URL, the request parameters, the payload used, and a code snippet for proper output encoding.
A web developer needs precise, actionable technical details to remediate the vulnerability: the exact URL, request parameters, the payload that triggered the stored XSS, and a code snippet showing proper output encoding (e.g., using OWASP ESAPI or context-specific escaping). This level of detail enables the developer to locate the vulnerable code, understand the injection point, and apply the correct fix without ambiguity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Provide the CVSS score and risk rating.
Why it's wrong here
A CVSS score and risk rating only quantify severity and business priority; they do not reveal the vulnerable code path, the affected parameter, or the required sanitization. A developer cannot reproduce the stored XSS condition or know whether output encoding is missing at a particular render point from these numbers alone. This makes it a useful prioritization artifact, not a remediation instruction.
- ✗
Describe the business impact and potential regulatory fines.
Why it's wrong here
Describing business impact and regulatory fines explains the consequences of exploitation—such as account takeover or PCI-DSS non-compliance—but omits the technical fingerprint of the vulnerability. The developer is left without the specific input field, storage location, or insecure rendering function that must be changed. Executives need this framing for risk acceptance; developers need an exact repro and fix pattern to act on.
- ✓
Include the specific vulnerable URL, the request parameters, the payload used, and a code snippet for proper output encoding.
Why this is correct
Providing the vulnerable URL, request parameters, the exact payload, and a secure output-encoding snippet gives the developer a complete reproduction script and a drop-in remediation. The payload demonstrates where unvalidated input reaches the DOM, while the encoding snippet shows the precise fix (e.g., htmlspecialchars with ENT_QUOTES for HTML context). This bridges the gap between detection and patch, making the report directly actionable.
- ✗
Use a graph showing the number of vulnerabilities by severity across the application.
Why it's wrong here
A bar graph or trend of vulnerability counts by severity communicates the overall risk posture to management but loses the per-instance details that a developer needs. It does not indicate which URL, which parameter, or which output context is affected by stored XSS. Aggregated metrics cannot guide a code change or verify that a specific injectable sink has been neutralized.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Payload
In IT and cybersecurity, a payload is the core data or malicious code delivered within a packet, file, or attack that performs the actual intended action.
Key term
XSS
Cross-Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.