The correct answer is command injection. This vulnerability occurs because the Python script uses the `subprocess` module to execute shell commands while passing user-supplied input directly into a command string without any sanitization or validation, allowing an attacker to inject shell metacharacters like `;`, `|`, or `&&` to run arbitrary commands. On the CompTIA PenTest+ PT0-002 exam, this scenario tests your understanding of how improper use of `subprocess` with `shell=True` or string concatenation creates a classic command injection vector, often contrasted with the safer approach of passing arguments as a list. A common trap is confusing command injection with OS command injection or SQL injection, but remember: if the shell interprets the input, it’s command injection. Memory tip: “Shell strings spell trouble—lists keep you safe.”
PT0-002 Tools and Code Analysis Practice Question
This PT0-002 practice question tests your understanding of tools and code analysis. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: command injection allows attackers to execute arbitrary operating system commands.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A penetration tester is analyzing a Python script that uses the 'subprocess' module to execute shell commands. The tester notices that the script passes user-supplied input directly to the shell without any sanitization or validation. Which vulnerability class is most likely present in this script?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Untrusted input passed directly to a shell interpreter allows attackers to execute arbitrary system commands, which is the definition of command injection.
B
SQL injection
Why wrong: SQL injection occurs when user input is improperly sanitized before being included in database queries, not shell commands.
C
Path traversal
Why wrong: Path traversal vulnerabilities involve manipulating file paths to access restricted directories, not command execution.
D
Buffer overflow
Why wrong: Buffer overflow is a memory corruption vulnerability typically found in low-level languages like C, not in Python scripts using the subprocess module.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Command injection
The script uses the `subprocess` module to execute shell commands with user-supplied input passed directly to the shell without sanitization. This allows an attacker to inject arbitrary shell metacharacters (e.g., `;`, `|`, `&&`) to execute unintended commands, which is the classic definition of command injection. The vulnerability arises because the input is concatenated into a command string rather than passed as a list of arguments, bypassing the shell's argument separation.
Key principle: Command injection allows attackers to execute arbitrary operating system commands.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Command injection
Why this is correct
Untrusted input passed directly to a shell interpreter allows attackers to execute arbitrary system commands, which is the definition of command injection.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Command injection allows attackers to execute arbitrary operating system commands.
✗
SQL injection
Why it's wrong here
SQL injection occurs when user input is improperly sanitized before being included in database queries, not shell commands.
✗
Path traversal
Why it's wrong here
Path traversal vulnerabilities involve manipulating file paths to access restricted directories, not command execution.
✗
Buffer overflow
Why it's wrong here
Buffer overflow is a memory corruption vulnerability typically found in low-level languages like C, not in Python scripts using the subprocess module.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may confuse command injection with SQL injection because both involve untrusted input, but the key differentiator is the execution context—shell commands versus database queries—and the specific module (`subprocess`) indicates shell execution, not database interaction.
Trap categories for this question
Command / output trap
SQL injection occurs when user input is improperly sanitized before being included in database queries, not shell commands.
Detailed technical explanation
How to think about this question
Under the hood, the `subprocess` module with `shell=True` invokes `/bin/sh -c` on Unix or `cmd.exe /c` on Windows, which interprets metacharacters like `$(...)` or backticks for command substitution. A real-world scenario is a web application that uses `subprocess.call('ping ' + user_input, shell=True)`; an attacker can input `127.0.0.1; cat /etc/passwd` to execute arbitrary commands, bypassing the intended ping functionality.
KKey Concepts to Remember
Command injection allows attackers to execute arbitrary operating system commands.
It occurs when unsanitized user input is passed to a shell interpreter.
Python's 'subprocess' module can be vulnerable if used improperly with untrusted input.
Shell metacharacters like ';', '&', and '|' are often used in command injection attacks.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Command injection allows attackers to execute arbitrary operating system commands.
Real-world example
How this comes up in practice
A developer is choosing between AES-256 (symmetric) and RSA-2048 (asymmetric) for encrypting a large file that will be sent to a partner. Symmetric encryption is fast but requires key exchange; asymmetric is slower but solves the key distribution problem. A hybrid approach — encrypt the file with AES, encrypt the AES key with RSA — is standard. Questions like this test whether you understand when each approach applies.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this PT0-002 question in full detail.
Review command injection allows attackers to execute arbitrary operating system commands., then practise related PT0-002 questions on the same topic to reinforce the concept.
Tools and Code Analysis — This question tests Tools and Code Analysis — Command injection allows attackers to execute arbitrary operating system commands..
What is the correct answer to this question?
The correct answer is: Command injection — The script uses the `subprocess` module to execute shell commands with user-supplied input passed directly to the shell without sanitization. This allows an attacker to inject arbitrary shell metacharacters (e.g., `;`, `|`, `&&`) to execute unintended commands, which is the classic definition of command injection. The vulnerability arises because the input is concatenated into a command string rather than passed as a list of arguments, bypassing the shell's argument separation.
What should I do if I get this PT0-002 question wrong?
Review command injection allows attackers to execute arbitrary operating system commands., then practise related PT0-002 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Command injection allows attackers to execute arbitrary operating system commands.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.