mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: During a web application test, a penetration…
During a web application test, a penetration tester suspects an LDAP injection vulnerability. The application uses user input to dynamically construct an LDAP query. The tester submits the following payload in the username field: 'admin)(&)'. The application returns a list of all users instead of the expected single user. Which of the following best describes the reason this payload was effective?
⚠ Common exam trap
Watch out — candidates often confuse the LDAP injection payload with SQL injection patterns, mistakenly thinking the '&' operator creates an OR condition, when in LDAP prefix notation '&' is an AND operator and the tautology works by appending an always-true filter, not by negating the original condition.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The payload closes the original filter and appends a tautology that returns all objects.
The payload 'admin)(&)' closes the original LDAP filter after 'admin' and appends '(&)' which is a tautology (always true). This causes the LDAP query to match all directory objects, returning the full user list instead of a single user. The attack exploits the way LDAP filters are parsed: injecting a closing parenthesis and a new filter that evaluates to true for every entry.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The payload causes an LDAP error that triggers a fallback to list all users.
Why it's wrong here
The injected LDAP payload does not aim to trigger an application error; rather, it modifies the search filter's boolean structure. A malformed filter would typically cause the directory server to return an error or an empty result, and most applications do not implement a fallback that lists all users. Since the payload in this scenario is syntactically valid and produces an always-true filter, the query succeeds and returns all directory objects, not because of error handling.
- ✗
The payload modifies the base DN to search the entire directory.
Why it's wrong here
The base DN is a separately configured component of the LDAP search request that defines the search's starting point, and user-supplied input is usually inserted only into the filter string. Even if the payload contains directory path syntax, the application constructs the base DN from its own configuration, so the injected text cannot alter it. The tautology in the filter simply expands the search results within the existing base DN scope, not the entire directory.
- ✗
The payload introduces a logical OR that negates the original condition.
Why it's wrong here
The payload exploits an empty AND conjunction (`(&)`) rather than an OR clause; in LDAP, an empty `(&)` evaluates to true, which when appended to the original filter yields an always-true overall condition. This does not negate the original condition — the original condition may still be part of the filter tree, but the added conjunction makes it irrelevant. A logical OR would be used in a different injection pattern such as `(|(uid=*)(uid=USERINPUT))`, so this description incorrectly characterizes the mechanism.
- ✓
The payload closes the original filter and appends a tautology that returns all objects.
Why this is correct
The correct technique is to close the application's original search filter with a parenthesis and then inject an always-true sub-filter such as `(&)` or `(objectClass=*)`. This addition creates a boolean expression that evaluates to true for every directory entry, causing the LDAP query to return all objects within the search base. It is a classic LDAP filter injection attack that succeeds when user input is concatenated into the filter without proper escaping.
Go deeper
Related to this question
About these practice questions
One of 185 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.