PWPP Practice Questions - TCM Security Practical Web Pentest Professional Exam - PWPP Practice Questions - TCM Security Practical Web Pentest Professional Exam

Question 1

A web application uses MongoDB and constructs a login query as `db.users.find({username: req.body.username, password: req.body.password})`. An attacker submits `{"username": "admin", "password": {"$ne": null}}`. What type of attack is this?

NoSQL injection using MongoDB operator injection SQL injection using UNION-based technique LDAP injection exploiting DN metacharacters XML injection targeting XPATH queries

Correct Answer:

NoSQL injection using MongoDB operator injection

Question 2

When testing a MongoDB application for NoSQL injection, which of the following payloads injected in a URL parameter is most likely to cause an authentication bypass via operator injection?

' OR '1'='1 admin'-- [$ne]=invalid 1; DROP TABLE users--

Correct Answer:

[$ne]=invalid

Question 3

An application endpoint processes JSON and is vulnerable to NoSQL injection. To extract data character-by-character from a MongoDB field using blind injection, which operator would an attacker use?

$$where with JavaScript sleep for time-based inference $$text for full-text search index abuse $$regex to test field values matching partial patterns $$lookup to join across collections and extract data

Correct Answer:

$$regex to test field values matching partial patterns

Question 4

A banking application transfers funds through a POST endpoint. Two simultaneous requests are sent to transfer the same $500 balance to different accounts. Both requests read the balance as $500 and proceed. This results in $1000 being transferred despite only $500 existing. What vulnerability class is this?

Race condition / TOCTOU vulnerability Insecure Direct Object Reference (IDOR) Mass assignment via unfiltered parameters Business logic flaw via parameter tampering

Correct Answer:

Race condition / TOCTOU vulnerability

Question 5

Which Burp Suite feature is specifically designed to send multiple identical or crafted HTTP requests simultaneously to exploit race conditions?

Repeater with multiple tabs synchronized Intruder with Pitchfork attack type Turbo Intruder with race-condition script Scanner with active race-condition check

Correct Answer:

Turbo Intruder with race-condition script

Exam overview

About this Exam

Prepare with the PWPP Practice Questions - TCM Security Practical Web Pentest Professional Exam practice quiz. This question bank includes 100 questions covering application, attacker, user, uses, and attack. Use it to review important concepts, identify knowledge gaps, and build confidence for the related exam, course, or assessment.

More details

Additional Information

PWPP Practice Questions - TCM Security Practical Web Pentest Professional Exam

This practice set contains 100 questions from the matching question bank and focuses on application, attacker, user, uses, and attack. Work through each question carefully, review the provided solutions, and revisit topics that need more study before your next attempt.

This is an independent study resource intended for practice and review; it is not an official examination or an endorsement by any organization named in the title.

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.

No fixed duration is currently configured for this quiz.

Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.

Yes. You can retake the practice test again as you continue studying during your available access period.

After your access is confirmed, you can continue into the complete practice exam from this quiz flow.

Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.

Correct Answer:

Correct Answer:

Correct Answer:

Correct Answer:

Correct Answer:

About this Exam

Additional Information

PWPP Practice Questions - TCM Security Practical Web Pentest Professional Exam

Frequently Asked Questions

Related Questions

ISC2 Certified in Cybersecurity Practice Exam

Certified Professional Public Buyer (CPPB) Practice Exam

Arizona Security Guard Knowledge Practice Exam

Certified Supplier Quality Professional (CSQP) Practice Exam

Certified Supply Chain Professional (CSCP) Practice Exam

Certified Third-Party Risk Professional (CTPRP) Practice Exam