mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester writes a Python script to…
A penetration tester writes a Python script to test an API for vulnerabilities. The script sends requests with multiple payloads and checks if the response contains an error message indicating a potential injection. Which of the following code snippets would BEST reduce false positives by verifying that the injected parameter is processed?
⚠ Common exam trap
A common mix-up: candidates choose Option C because they assume error messages are reliable indicators of injection success, but in practice, modern APIs suppress detailed errors and may return the same generic error for both benign and malicious inputs, making differential analysis a more robust approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compare the response of the injected request to the response of a benign request with the same parameter structure
Comparing the response of an injected request to a benign request with the same parameter structure directly confirms that the injected parameter was processed and caused a different application behavior, thereby reducing false positives. This technique, often called differential analysis, isolates the effect of the injection from normal variations in the API response, such as dynamic content or session tokens. It is more reliable than checking for specific error messages or status codes, which may be suppressed or generic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check if the response status code is 500 for each payload
Why it's wrong here
A 500 status code is a broad symptom that can result from any unhandled exception, malformed JSON, or server misconfiguration—not just a successful injection. Many injection attacks that retrieve data return 200 OK, and WAFs can return 500 to block traffic, causing false positives. It provides no proof that the payload was executed in a database or command context.
- ✗
Compare the response time of the injected request to a baseline without injection
Why it's wrong here
Time-based detection relies on inducing a measurable delay (e.g., SLEEP), but the elapsed time is influenced by network latency, concurrent load, and query caching, making results non-deterministic. Even a statistically significant delay only shows that the request took longer—it does not demonstrate that the parameter was interpreted as code. An inefficient query or an API rate limiter can produce the same signal without any injection.
- ✗
Check if the response contains a specific error message that is only triggered when the injection is successful
Why it's wrong here
A specific error message can be a highly specific oracle, but it depends on the application exposing detailed errors, which many APIs disable in production. Moreover, the message might be triggered by a WAF or input validation layer that greps for known payload signatures, not by back-end execution of the injection. Thus the error can occur even when the injection is not actually processed, producing a misleading positive.
- ✓
Compare the response of the injected request to the response of a benign request with the same parameter structure
Why this is correct
Differential analysis compares the entire HTTP response—status, headers, body length, and content—of a benign request against an injected request that differs only in the payload. This isolates the variable of interest, so any observed difference that correlates with the payload confirms the parameter is processed. It is inherently robust to environmental noise and is the core technique used by modern DAST scanners to validate injection findings.
Go deeper
Related to this question
About these practice questions
One of 185 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.