PEN-200 Public Exploits Practice Question
Exhibit
searchsploit -w 'Apache' | grep '2.4.49' [+] https://www.exploit-db.com/exploits/50383
Refer to the exhibit. You identify an Apache 2.4.49 vulnerability and locate the exploit. After reviewing the exploit code, you realize it requires a specific input format to trigger the path traversal. What is the most effective way to verify the vulnerability without crashing the server?
⚠ Common exam trap
Test-takers often rush to execute aggressive or destructive exploit payloads to prove a concept, risking accidental service crashes instead of using safe, non-destructive verification methods.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a simple path traversal payload to request a harmless file.
Verification is a critical phase where you test for the vulnerability's presence using non-destructive inputs. By attempting a benign request, such as reading a safe, non-sensitive file like a public README, you confirm the exploit works without risking a Denial of Service. This professional approach demonstrates a cautious mindset, essential for performing assessments that prioritize target stability while successfully confirming the vulnerability exists.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Execute the exploit immediately against the root directory.
Why it's wrong here
Executing an exploit directly against the root or sensitive areas is reckless. It increases the likelihood of crashing the service or triggering automated security responses. Always perform a harmless verification step first to ensure the target is truly vulnerable before attempting more aggressive exploitation techniques.
- ✓
Use a simple path traversal payload to request a harmless file.
Why this is correct
Requesting a harmless file like a public document is a safe way to confirm the path traversal vulnerability exists. If you receive the file content back successfully, you have proven the vulnerability without causing any disruption to the service or damaging the target system's stability.
- ✗
Run the exploit as is and hope the server remains stable.
Why it's wrong here
Relying on hope is not a professional penetration testing methodology. Exploits are often unpolished, and running them blindly can lead to service instability, crashes, or data corruption. Always test the exploit's impact in a controlled manner before applying it to the production or exam target.
- ✗
Modify the exploit to dump the entire password file immediately.
Why it's wrong here
Dumping sensitive files like password databases immediately is aggressive and unnecessary for verifying a vulnerability. It increases the risk of being caught by security monitoring systems and may not even confirm the exploit is working correctly if the file is not found on the system.
About these practice questions
Courseiva writes every PEN-200 question from scratch — 285 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.