hardMultiple ChoiceObjective-mapped
PT0-002 Practice Question: During a penetration test, a vulnerability…
During a penetration test, a vulnerability scanner reports a critical SQL injection vulnerability in a web application. However, manual testing shows that the parameter is not injectable due to proper parameterized queries. Which of the following is the MOST likely cause of this false positive?
⚠ Common exam trap
Test-takers frequently assume a scanner's SQL injection flag must be caused by an actual SQL error, when in fact scanners often rely on generic error message patterns that can be triggered by any application exception.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The scanner matched a generic error message that is not specific to SQL injection
A vulnerability scanner often relies on pattern matching in HTTP responses to flag SQL injection. If the application returns a generic error message (e.g., 'An error occurred') after sending a malicious payload, the scanner may incorrectly classify it as SQL injection. However, because the application uses parameterized queries, the payload is safely handled, and the error is unrelated to SQL syntax — making this a classic false positive caused by generic error message matching.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The scanner used a payload that caused a different error unrelated to SQL injection
Why it's wrong here
This is generally incorrect because modern vulnerability scanners send payloads designed to elicit a database-specific response, and a random, unrelated error would not match the signatures used to flag SQL injection. An unrelated error might be noted, but the scanner would not typically link it to SQL injection without additional corroborating indicators. The standard explanation for a false positive is that the scanner's keyword matching latched onto a generic error string, not that it confused an unrelated payload response.
- ✗
The scanner detected a stored XSS instead
Why it's wrong here
Stored XSS and SQL injection are distinct vulnerability classes with separate test routines and detection signatures; a properly configured scanner does not misidentify one as the other. If the scanner had found XSS, it would have reported XSS, not SQL injection, and the presence of an XSS finding does not invalidate or explain a separate SQLi false positive. Thus this option confuses the issue rather than addressing why the SQL injection report appeared in the first place.
- ✓
The scanner matched a generic error message that is not specific to SQL injection
Why this is correct
This is the correct explanation: many scanners use simple keyword or regex matching against any page data returned after a test, so a generic database error such as 'Microsoft OLE DB Provider for SQL Server error '80040e14'' or 'supplied argument is not a valid MySQL result resource' triggers the SQL injection signature. The error may be generated by any malformed input or a natural application error, not by an actual SQLi flaw. This pattern is a classic source of false positives, especially with error-based detection that does not verify whether the payload actually altered the SQL query logic.
- ✗
The scanner tested a different parameter than what was reported
Why it's wrong here
Vulnerability scanners enumerate and test each parameter independently, and the response that triggers a detection is correlated to the exact parameter that was sent in the request, so a mismatch of this kind is a tool defect, not a standard false-positive cause. Even if the scanner did hit a different parameter, that parameter would still need to produce an SQL-injection-related indicator; without that, the report would simply be unreliable. In practice, a false SQLi report is far more likely derived from response content parsing than from a parameter misattribution.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
False positive
A false positive is an alert or result that indicates a security threat or vulnerability exists when in fact there is no real issue.
Key term
SQL injection
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database, often to read, modify, or destroy data.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.