easyMultiple ChoiceObjective-mapped
PT0-002 Practice Question: During a penetration test, a tester discovers a…
During a penetration test, a tester discovers a web application that reflects user input in the HTTP response without proper escaping or encoding. The input is not sanitized and is included in the page's HTML. Which type of vulnerability is most likely present?
⚠ Common exam trap
Test-takers frequently confuse reflected XSS with stored XSS because both involve injecting script into a web page, but the key differentiator is whether the payload is persisted on the server (stored) or immediately reflected in the response (reflected).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cross-Site Scripting (XSS)
The vulnerability is reflected Cross-Site Scripting (XSS) because the web application immediately echoes user-supplied input in the HTTP response without proper escaping or encoding, allowing an attacker to inject arbitrary HTML or JavaScript that executes in the victim's browser. This matches the classic definition of reflected XSS, where the payload is part of the request and reflected back, not stored on the server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SQL injection
Why it's wrong here
SQL injection is a server-side attack that manipulates database queries by injecting SQL syntax through input fields, such as 'OR 1=1. It does not involve client-side script execution, and while a web application might reflect input in an error message or response, SQL injection typically produces database errors, altered query behavior, or data exfiltration—not the direct reflection of the payload as HTML/JavaScript that executes in a victim's browser. The described symptom of input being echoed back exactly is much more characteristic of a script injection vulnerability than a SQLi flaw, so this option is incorrect.
- ✓
Cross-Site Scripting (XSS)
Why this is correct
Reflected Cross-Site Scripting (XSS) occurs when a web application echoes user-supplied input directly into the HTTP response without proper sanitization or encoding. In this scenario, the tester observed the application reflecting input in the response, which is the primary indicator of a reflected XSS flaw because an attacker can craft a URL containing a malicious script payload that gets rendered in the victim's browser. This enables session hijacking, keylogging, or other client-side attacks, and it specifically aligns with the description of input reflection rather than persistence or server-side logic manipulation.
- ✗
Stored XSS
Why it's wrong here
Stored XSS, also known as persistent XSS, differs fundamentally from reflected XSS because the injected script is permanently stored on the server—for example, in a database, message forum, or comment field—and is then served to every user who views that content. The scenario describes a tester discovering reflection of input in the response, which is temporary and tied to the immediate request/response cycle; there is no indication that the input was saved or persisted across sessions. Since stored XSS requires the payload to be saved and later retrieved, this option is not supported by the information given.
- ✗
Cross-Site Request Forgery (CSRF)
Why it's wrong here
Cross-Site Request Forgery (CSRF) is an attack that tricks an authenticated user's browser into sending a forged, unauthorized request to a web application, relying on the application's trust in the user's session. It does not involve the reflection of user input in the HTTP response; rather, it exploits the lack of CSRF tokens or same-site protections to perform actions without the user's consent. The described symptom—input being echoed back in the response—is irrelevant to CSRF, which focuses on state-changing requests rather than script execution or content reflection, making this option incorrect.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
XSS
Cross-Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
Key term
Payload
In IT and cybersecurity, a payload is the core data or malicious code delivered within a packet, file, or attack that performs the actual intended action.
About these practice questions
This PT0-003 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.