eWPTX practice questions

Q: Is this eWPTX practice test free?

Yes. All 15 eWPTX practice questions on this page are free, with instant scoring and a written explanation for each answer. You do not need an account and there is no time limit.

Q: How much does the real eWPTX exam cost?

The official price is $450. Cyber VK sells the same official eWPTX voucher for $234.99 — a saving of $215.01. The voucher is identical to one bought direct and is emailed within minutes of payment.

Q: Are these questions the same as the real eWPTX exam?

No. These are original practice questions written to match the published exam objectives and difficulty. They are not real exam questions — sharing or reproducing live exam content breaches every certification body's candidate agreement and can void your certification.

Q: How should I use this practice test?

Use it as a readiness check rather than a study tool. Work through the questions without notes, read the explanation for every answer including the ones you got right, and treat any domain where you miss more than a third as the area to revise before booking your exam.

Question 1

During a black-box assessment, you inject `' OR '1'='1` into a login form and the application returns all user records. Which vulnerability class does this most directly demonstrate?

Accepted Answer

The tautology `'1'='1'` alters the SQL WHERE clause so it always evaluates true, bypassing authentication and confirming SQL injection into the query.

Question 2

A parameter is confirmed injectable but the application returns no query output and no visible errors, though a `SLEEP(5)` payload causes a measurable delay. Which technique should you use to extract data?

Accepted Answer

With no output or errors but observable response delays, data must be inferred bit-by-bit through conditional time delays, which is the definition of time-based blind SQL injection.

Question 3

Against a PostgreSQL backend where stacked queries are permitted and you have superuser privileges, which approach is most viable for achieving out-of-band data exfiltration or command execution?

Accepted Answer

PostgreSQL's `COPY ... FROM/TO PROGRAM` executes shell commands as the database user, making it the correct primitive; `LOAD_FILE`/`xp_cmdshell`/`UTL_HTTP` belong to MySQL, MSSQL, and Oracle respectively.

Question 4

Which HTTP response header most directly instructs the browser to restrict the sources from which scripts may be loaded, mitigating many XSS attacks?

Accepted Answer

Content-Security-Policy defines allowed script/resource origins via directives like `script-src`, directly limiting where scripts can execute and reducing XSS impact.

Question 5

A value from `location.hash` is passed directly into `element.innerHTML` by client-side JavaScript, and the payload never reaches the server. What type of XSS is this?

Accepted Answer

Because the tainted source (`location.hash`) flows to a dangerous sink (`innerHTML`) entirely within client-side code without server involvement, this is DOM-based XSS.

Question 6

A target reflects input into an HTML attribute context and strips `<`, `>`, and the word `script`, but does not encode double quotes. Which payload approach is most likely to achieve script execution?

Accepted Answer

Since double quotes are not encoded, you can close the current attribute and introduce a new event-handler attribute (e.g. onfocus with autofocus), avoiding the filtered `<`, `>`, and `script` tokens.

Question 7

An application accepts a full URL parameter that the server fetches on the back end. Requesting `http://169.254.169.254/latest/meta-data/` returns cloud instance metadata. Which vulnerability is present?

Accepted Answer

The server makes attacker-controlled requests to internal resources like the cloud metadata endpoint, which is the hallmark of Server-Side Request Forgery.

Question 8

An SSRF filter blocks requests to `127.0.0.1` and `localhost` but does not normalize alternate IP encodings. Which value is most likely to bypass the blocklist while still targeting the loopback interface?

Accepted Answer

`0177.0.0.1` is the octal representation of `127.0.0.1`, so it resolves to loopback while evading a literal string blocklist that only checks decimal/localhost forms.

Question 9

You have a blind SSRF where responses are not returned, but the server resolves and connects to hostnames you supply. To reach an internal service whose IP is allowlisted only at request-validation time, which technique is most effective?

Accepted Answer

DNS rebinding exploits a time-of-check/time-of-use gap by returning an allowed IP during validation and an internal IP during the actual fetch, defeating hostname-based allowlists.

Question 10

In a JWT-based authentication scheme, which token modification represents the classic `alg` confusion attack that a server may accept if misconfigured?

Accepted Answer

Setting `alg` to `none` tells a permissive server that the token is unsigned, so it accepts a forged, signature-less token; this is the canonical JWT `none` algorithm attack.

Question 11

A user can view invoice `/api/invoice?id=1004` but changing the value to `id=1005` returns another customer's invoice, with no ownership check. Which flaw does this represent?

Accepted Answer

The application exposes a direct reference to an object and fails to enforce authorization on it, allowing horizontal access to other users' records — the definition of IDOR.

Question 12

An application signs JWTs with RS256. You obtain the public key. Which forgery becomes possible if the server's verification code selects the algorithm based on the token's own `alg` header?

Accepted Answer

If the server trusts the token's `alg`, an attacker changes RS256 to HS256 and uses the known public key as the HMAC secret, forging a valid signature the server verifies with that same key.

Question 13

An application loads a page via `?page=about.php` using PHP `include()`. Supplying `?page=../../../../etc/passwd` returns the file contents. Which vulnerability is this?

Accepted Answer

User input traverses the local filesystem and is passed to `include()`, causing the server to read a local file, which defines Local File Inclusion.

Question 14

An endpoint parses user-supplied XML. You submit a document defining `<!ENTITY xxe SYSTEM "file:///etc/passwd">` and reference it, and the file contents appear in the response. Which mitigation would have most directly prevented this?

Accepted Answer

The attack abuses external entity expansion in the XML parser, so disabling DTD/external entity processing removes the root cause of the XXE vulnerability.

Question 15

You have LFI on a PHP application but cannot include remote URLs and find no writable log paths. Which technique most reliably converts the LFI into code execution using only the include primitive and a controllable request?

Accepted Answer

PHP wrappers like `data://` (when permitted) or crafted `php://filter` conversion chains can deliver executable PHP through the include, turning file inclusion into code execution without a remote URL; a plain base64 read only discloses source.

eWPTX — eWPTX Web Application Penetration Tester eXtreme Exam Voucher | INE Advanced Certification Practice Test

Free Practice Test

eWPTX practice test — common questions