mediumMultiple Choice
PT0-002 Practice Question: A penetration tester wants to fuzz a network…
A penetration tester wants to fuzz a network protocol to find buffer overflows. Which tool is most appropriate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Peach Fuzzer
Peach Fuzzer (option B) is the correct choice because it is a dedicated fuzzing framework designed to generate malformed inputs for network protocols and file formats, making it well suited to discovering buffer overflows. It supports protocol modeling and mutation-based generation, which aligns directly with the penetration tester's goal of fuzzing a network protocol. John the Ripper (A) is a password-cracking tool, not a fuzzer, so it cannot generate malformed protocol data. Nessus (C) is a vulnerability scanner that checks for known issues rather than performing dynamic input fuzzing, and Wireshark (D) is a packet capture and analysis tool that inspects traffic but does not fuzz protocols.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
John the Ripper
Why it's wrong here
John the Ripper cracks password hashes offline; it has no capability to construct or send malformed protocol payloads. It is the right tool for auditing credential strength and recovering weak passwords from captured hash files, not for fuzzing a network protocol to expose buffer overflows.
- ✓
Peach Fuzzer
Why this is correct
Peach Fuzzer is a dedicated fuzzing framework that generates and mutates inputs against network protocol definitions, making it suited to discovering buffer overflows in protocol parsers. General-purpose scanners lack the stateful, protocol-aware mutation needed for this testing.
- ✗
Nessus
Why it's wrong here
Nessus performs vulnerability scanning against known signatures and configuration checks; it does not generate malformed or mutated protocol inputs to trigger memory corruption. It is the right tool for periodic vulnerability assessment and compliance reporting, not for discovering novel buffer overflows through input fuzzing.
- ✗
Wireshark
Why it's wrong here
Wireshark captures and dissects packets passively, so it observes protocol traffic but never transmits mutated inputs to provoke a crash. It is the correct choice for analysing captured traffic and troubleshooting protocol behaviour, not for actively fuzzing a live network protocol to uncover buffer overflows.
Go deeper
Related to this question
Learn chapter
CVSS Scoring in Penetration Test Reports
Key term
John the Ripper
John the Ripper is a free and open-source password cracking tool used by security professionals to test password strength and by attackers to guess credentials.
Key term
Vulnerability scanner
A vulnerability scanner is an automated tool that identifies security weaknesses in systems, networks, and applications by comparing their configurations and software versions against known vulnerability databases.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 777 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.