Free C)PTC Practice Questions

Question 1

In ZAP, a tester retains customer A's session cookie but replaces an invoice identifier with the identifier of customer B's invoice. The response contains B's invoice. Both test accounts are ordinary customers, and each must be able to download only their own invoices. Which repair meets that access requirement?

Accepted Answer

Check the authenticated customer's ownership of the requested invoice on every download request.

Answer

Replace sequential invoice identifiers with randomly generated identifiers that are difficult for other customers to guess.

Answer

Require fresh password authentication before processing an invoice download.

Answer

Restrict the download endpoint to administrators and remove direct invoice access from ordinary customer accounts.

Question 2

An isolated 32-bit Windows service strips an 8-byte protocol header before copying the remaining input into a vulnerable stack buffer. The first byte of the saved return address is at offset 268 from the start of that copied input. A harness mistakenly places its four-byte marker at offset 268 from the start of the complete request. All offsets are zero-based, and the header must remain present. What change corrects the marker's placement?

Accepted Answer

Move it to request offset 276, adding the header length to the measured field offset.

Answer

Move it to request offset 260, subtracting the eight bytes that the parser removes before copying.

Answer

Leave it at offset 268; discarding the header also corrects the origin mismatch.

Answer

Move it to request offset 272, allowing four bytes for the return-address width.

Question 3

Two scans of the same approved host produce these observations:
ACK scan, TCP 8443: RST replies.
SYN scan, TCP 8443: no response after retries.
The scanner's location and the target's network policy were unchanged. Select the corresponding Nmap port-state interpretation.

Accepted Answer

ACK: unfiltered; SYN: filtered. Neither result establishes whether a listener exists.

Answer

ACK: closed; SYN: filtered. RST confirms a closed port.

Answer

ACK: open; SYN: open|filtered. The reset confirms a listening service.

Answer

ACK: unfiltered; SYN: closed. The unanswered SYN establishes that the port has no listener.

Question 4

A Windows crash log records ExceptionCode=0xC0000005 and ExceptionInformation[0]=8. The address in ExceptionInformation[1] lies in committed memory that is readable and writable, but not executable. The intended test bytes are intact there. Identify the protection effect that explains this record.

Accepted Answer

Execution from a non-executable page was blocked; the test bytes had still been written there.

Answer

A stack canary detected corruption before the function returned.

Answer

ASLR sent execution to an unmapped address after the module was relocated.

Answer

SafeSEH rejected an exception handler because its target address was absent from the module's handler table.

Question 5

During an approved assessment of a live ordering service, monitoring shows new checkout failures immediately after a test request. The rules of engagement prohibit availability disruption and reserve service restarts for the client's operations team. The tester has not established whether the request caused the failures. What should happen first?

Accepted Answer

Stop requests to the affected service and notify the designated emergency contact, retaining the test evidence.

Answer

Repeat the request at a lower rate to determine whether the checkout failures are caused by testing.

Answer

Restart the affected service using the supplied administrator credentials, then notify the client's operations team.

Answer

Continue the agreed tests while recording the correlation for discussion at the scheduled end-of-day client briefing.

Question 6

A SPIKE campaign should mutate only the body of a lab service's STORE <body> request, preserving the command and its CRLF terminator. A normal request reaches the body parser, and the runner will fuzz every variable field. The script instead uses s_string_variable("STORE "), s_string("AAAA"), and s_string("
"); its mutations are rejected as unknown commands. Select the field layout that targets the intended parser.

Accepted Answer

Use s_string for the prefix and terminator, with s_string_variable for the body.

Answer

Use one s_string_variable for the entire request, including its command prefix and CRLF terminator.

Answer

Use s_string_variable for prefix and body, leaving CRLF fixed.

Answer

Keep command and body fixed; mutate the CRLF with s_string_variable.

Question 7

An approved exercise sends a benign test signature that the client's detection-only IDS is configured to recognize. The IDS raises the expected alert; the request also reaches the test service, which remains healthy. The agreed plan calls for additional tests after alert verification. How should the tester treat this result?

Accepted Answer

Record successful detection and continue the remaining tests within the approved plan.

Answer

Record a detection failure because the service received the request despite the IDS alert.

Answer

Suspend the entire assessment until the client formally closes the expected alert as an incident.

Answer

Disable the matched IDS signature before proceeding so later tests do not produce duplicate alerts.

Question 8

A search endpoint binds values in its SQL WHERE clause but concatenates the request's sort value into ORDER BY. Users need only two sorting choices: Name and Created date. The team must eliminate injection through sorting without losing those choices. Which implementation should replace the untrusted concatenation?

Accepted Answer

Map the two accepted choices to fixed column identifiers and reject any other sort value.

Answer

Use a bound value parameter for the column name in ORDER BY.

Answer

Remove single quotes from sort before inserting it into ORDER BY.

Answer

Move the unchanged dynamic SQL construction into a stored procedure and pass the sort expression to it.

Question 9

A position-independent Linux test program has changing stack and library addresses across fresh terminal launches, but stable addresses across fresh launches through GDB. The kernel's ASLR setting is unchanged, and show disable-randomization reports on. The analyst needs newly launched debug sessions to retain the native address randomization. Which adjustment achieves that?

Accepted Answer

Issue set disable-randomization off in GDB before launching the next inferior process.

Answer

Keep set disable-randomization on to enable randomization in the inferior.

Answer

Rebuild without PIE and retain GDB's current randomization setting.

Answer

Set the kernel's randomize_va_space value to 0 before launching the program under GDB again.

Question 10

Review this Python 3 transport fragment for a blocking TCP socket:
sent = sock.send(request)
sock.close()
The request is 1,600 bytes, but sent is 512 and the capture contains only those 512 bytes. The service never receives the request terminator. Which revision addresses the sender's truncation?

Accepted Answer

Use sendall(request), handling any transmission error before closing the socket.

Answer

Increase the service's receive buffer to 1,600 bytes.

Answer

Repeat send(request) with the full original request until returned counts total 1,600.

Answer

Wait before closing the socket so the unsent bytes can be transmitted.

Free C)PTC Practice Questions

Domain 1: Pentesting Team Foundation

Question 1

Domain 2: NMAP Automation

Question 2

Domain 3: Exploitation Processes

Question 3

Domain 4: Fuzzing with Spike

Question 4

Domain 5: Privilege Escalation

Question 5

Domain 6: Stack Based Windows Buffer Overflow

Question 6

Domain 7: Web Application Security and Exploitation

Question 7

Question 8

Domain 9: Linux Address Space Layout Randomization

Question 9

Domain 10: Windows Exploit Protection

Question 10

The rest of the C)PTC blueprint

That's 10 of 1,030