PEN-200 Web Application Attacks Practice Question
While auditing a web application, you identify an endpoint that retrieves profile images via a URL parameter: 'image.php?file=profile.jpg'. Changing the parameter to 'image.php?file=/etc/passwd' returns the contents of the system password file. Which vulnerability is present, and what is the primary risk?
⚠ Common exam trap
Test-takers frequently misidentify path traversal vulnerabilities as Local File Inclusion execution vulnerabilities, confusing arbitrary file reading with executing server-side code scripts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Path Traversal, allowing arbitrary file disclosure.
This scenario demonstrates Path Traversal, where improper input validation allows access to unauthorized files outside the web root. Exploiting this flaw can lead to sensitive information disclosure, such as configuration files, credentials, or system binaries. It is a critical finding because it grants an attacker arbitrary file read access, which is often the precursor to full system compromise if sensitive keys or database credentials are exposed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remote Code Execution via file inclusion.
Why it's wrong here
While LFI can lead to RCE, the example specifically illustrates arbitrary file reading. RCE requires the ability to execute the file contents, such as a malicious script injected via log poisoning, which is not described in this scenario. Focus on the direct manifestation of the vulnerability presented.
- ✗
SQL Injection, allowing database schema enumeration.
Why it's wrong here
SQL Injection involves manipulating database queries through input fields to extract or modify data. The provided scenario involves direct file system interaction, not database interaction. Path traversal vulnerabilities do not inherently provide access to database engines unless specific configuration files containing credentials are successfully retrieved.
- ✓
Path Traversal, allowing arbitrary file disclosure.
Why this is correct
The ability to traverse directories using sequences like '../' or absolute paths allows the application to serve files outside the intended directory. This occurs when user-supplied input is passed directly to file system APIs without sanitization, leading to unauthorized disclosure of sensitive data residing on the underlying server.
- ✗
Cross-Site Scripting, allowing session hijacking.
Why it's wrong here
Cross-Site Scripting occurs when an application includes untrusted data in a web page without proper validation or escaping. This allows attackers to execute malicious scripts in the victim's browser. The described scenario involves backend file access, which is distinct from client-side execution flaws typical of XSS.
About these practice questions
One of 285 original PEN-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.