Free C)PTE Practice Questions

Question 1

A billing API uses signed access tokens and opaque invoice UUIDs. Two approved test customers have the same role, and each may read only their own invoices. With customer A's unchanged token, a tester requests customer B's invoice UUID and receives B's invoice details. The application log still identifies the caller as A. Which authorization boundary has failed?

Accepted Answer

Object-level authorization: A has read an invoice outside A's permitted ownership.

Answer

Function-level authorization: A has invoked an operation reserved for administrators.

Answer

Property-level authorization: A has modified a protected field on an otherwise permitted invoice.

Answer

Authentication: the API has accepted A's token as proof of customer B's identity.

Question 2

An approved exploit validation produces no reverse session. The evidence for this attempt is:
Host telemetry: the web worker launches the agreed test process as its service account.
Filesystem: the process writes this attempt's unique execution marker.
Firewall: the outbound connection to the approved listener is denied.
What conclusion separates execution from session establishment?

Accepted Answer

Code execution succeeded as the service account, but the callback was blocked.

Answer

The exploit failed because no interactive session was established.

Answer

A listener misconfiguration prevented execution, so another listener is needed to validate the exploit.

Answer

Privilege escalation succeeded, but the firewall blocked the administrator session's return traffic.

Question 3

An Active Directory delegation review finds that an ordinary service account has effective DS-Replication-Get-Changes and DS-Replication-Get-Changes-All rights on the domain naming context. It belongs to no administrative group and cannot log on interactively to a domain controller. The account can reach the domain controller's replication service. What exposure should the tester flag without retrieving real password material?

Accepted Answer

The account can use DCSync to request replicated password material without administrative group membership or interactive logon.

Answer

Replication is limited to nonsecret attributes because the account is not a domain controller computer account.

Answer

Password replication remains unavailable until the account receives interactive logon rights on a domain controller.

Answer

The account can read directory secrets only after separate membership in Domain Admins has been established.

Question 4

A system maintainer disputes a remote-code-execution CVE flagged solely from an SSH service's upstream version banner. Authenticated inspection confirms that the running executable is the unmodified vendor package. The vendor advisory identifies that exact package release as containing the CVE fix through backporting. No independent evidence contradicts the inspection. What disposition is justified for this scanner result?

Accepted Answer

Withdraw this CVE finding, retaining the verified package details and the vendor advisory.

Answer

Retain the finding until the banner shows a newer upstream version.

Answer

Recommend immediate isolation until the service is replaced with a newer release.

Answer

Require a crash-capable exploit attempt before accepting the package inspection as sufficient evidence to resolve the finding.

Question 5

Before a detection rule enters production, a purple team runs 40 valid adversary-emulation tests and 160 representative benign tests. The rule alerts on 36 adversary tests and 24 benign tests. Each test counts once, and all required telemetry is present. The release gates are recall of at least 85% and precision of at least 75%. Select the decision supported by these results.

Accepted Answer

Do not promote: recall is 90%, but precision is only 60%.

Answer

Promote: recall is 90%, and precision is 85%.

Answer

Do not promote: recall is 60%, although the 90% precision meets its release gate.

Answer

Promote: recall and precision both equal the overall accuracy of 86%.

Question 6

A production order-processing service begins restarting during permitted testing, and legitimate orders fail. The timing correlates with the tester's requests. The rules of engagement require an immediate pause for suspected test-induced disruption and reserve recovery changes to the service owner. The operator still has an active session. What takes priority now?

Accepted Answer

Stop test traffic, notify the designated contact, and preserve the activity timeline.

Answer

Restart the service through the active session before notifying its owner.

Answer

Reduce the traffic and repeat one request to confirm causation before escalating.

Answer

Revert the server to its pretest snapshot, then notify the owner of the recovery.

Question 7

Code review of an invoice-search endpoint shows that customer values are correctly bound as SQL parameters. The ORDER BY column, however, is copied from the request's sort field and concatenated into the query. The feature only needs to sort by created_at or total. Which revision removes this injection path while preserving both supported sort choices?

Accepted Answer

Map each supported sort value to a fixed server-side column identifier.

Answer

Bind the requested identifier as an SQL value parameter.

Answer

Escape single quotes before adding the sort value to the SQL statement.

Answer

Grant the database account SELECT-only access without changing query construction.

Question 8

An internal HTTPS server is reachable through an approved application proxy using a browser configured for that proxy. The proxy supports TCP connections but no UDP or raw IP packets. A scanner on the tester's laptop uses ICMP discovery and raw SYN probes and reports that the server is down. Before accepting that conclusion, the tester should:

Accepted Answer

Use a proxy-aware TCP connection test without ICMP discovery.

Answer

Increase timeouts so the ICMP and raw SYN probes can traverse the application proxy.

Answer

Add a subnet route through the proxy listener and repeat the existing raw-packet scan.

Answer

Request a firewall change allowing ICMP before performing any further validation of the HTTPS service.

Question 9

A vulnerability register records a CVSS v4.0 Base score of 8.2, an EPSS probability of 0.12, and an EPSS percentile of 0.96, all dated to the assessment. An executive asks whether this means the organization has a 96% chance of being breached. Which interpretation belongs in the report?

Accepted Answer

High severity; an estimated 12% probability of observed exploitation in the wild over the next 30 days.

Answer

Critical severity; a 96% probability of exploitation in the wild over the next 30 days.

Answer

High severity; a 12% probability that this organization will suffer a breach within the next 30 days.

Answer

High severity; a 96% probability of exploitation in the wild, estimated with a 12% confidence level.

Question 10

During an isolated, authorized evasion exercise, file screening blocks a harmless test artifact before execution. An encoded variant with the same test behavior and a different hash passes that screening and writes its execution marker. EDR then raises the expected process-lineage alert, which is correlated to the test. No safety limit is crossed. The evidence supports which result?

Accepted Answer

File screening allowed the variant; behavioral detection still identified its execution.

Answer

End-to-end evasion succeeded because the variant reached its execution marker.

Answer

Detection effectiveness cannot be assessed until the variant runs with the endpoint agent disabled.

Answer

Testing should stop for incident-response clearance because the variant triggered an EDR alert.

Free C)PTE Practice Questions

Domain 1: Penetration Testing Methodologies

Question 1

Domain 2: Advanced Recon & Attack Surface Mapping

Question 2

Domain 3: Exploitation Techniques (Local & Remote)

Question 3

Domain 4: Post-Exploitation & Lateral Movement

Question 4

Domain 5: Cloud & Active Directory Exploitation

Question 5

Domain 6: Evasion & Payload Crafting

Question 6

Domain 7: Web, API & Mobile Attacks

Question 7

Question 8

Domain 9: Purple Team Collaboration

Question 9

Domain 10: Reporting & Business Risk Analysis

Question 10

The rest of the C)PTE blueprint

That's 10 of 1,030