ECSA Penetration Testing Exam Review | Network, Web
Application & Cloud Security Practice Questions and answers
2026/2027
Question 1
During a network penetration test, an ethical hacker discovers that an
organization's internal switches are vulnerable to VLAN hopping via
dynamic trunking protocol (DTP) negotiation. Which mitigation step is
most effective to prevent this attack?
• A. Enable BPDU guard on all access ports.
• B. Disable DTP negotiation on access ports and manually configure
ports as static access or static trunk.
• C. Implement dynamic ARP inspection (DAI) on all VLAN
interfaces.
• D. Configure storm control to limit broadcast traffic on trunk links.
Correct Answer: B. Disable DTP negotiation on access ports and
manually configure ports as static access or static trunk.
Detailed Rationale: VLAN hopping via DTP occurs when an attacker
connects a device that emulates a switch and negotiates a trunk link
with a switch port set to dynamic negotiation mode. Disabling DTP
negotiation (switchport nonegotiate) and explicitly setting ports to
either static access or static trunk prevents unauthorized trunk
formation.
Question 2
,A penetration tester is analyzing a web application and identifies a
vulnerability where user-supplied input is directly concatenated into an
SQL query without parameterization. However, the database error
messages are suppressed. Which technique is most appropriate for
exploiting this blind SQL injection vulnerability?
• A. Error-based SQL injection using XML parsing functions.
• B. Union-based SQL injection to extract data directly in the HTTP
response body.
• C. Boolean-based (inferential) or time-based blind SQL injection.
• D. Out-of-band SQL injection using stacked queries exclusively.
Correct Answer: C. Boolean-based (inferential) or time-based blind SQL
injection.
Detailed Rationale: When error messages are suppressed and UNION
queries are not feasible due to differing column structures or data
types, inferential (blind) SQL injection is used. This involves asking the
database true/false questions by observing application behavior
changes (boolean-based) or measuring response latency (time-based).
Question 3
When performing a cloud security assessment on an AWS environment,
an auditor finds an Amazon S3 bucket configured with public read
access enabled via an overly permissive bucket policy. Which tool or
service native to AWS is best suited for continuously monitoring and
detecting such public resource configurations?
• A. Amazon Inspector
• B. AWS Trusted Advisor / AWS IAM Access Analyzer
, • C. AWS Shield Advanced
• D. Amazon GuardDuty
Correct Answer: B. AWS Trusted Advisor / AWS IAM Access Analyzer
Detailed Rationale: AWS IAM Access Analyzer and AWS Trusted Advisor
specifically evaluate resource policies to identify resources (such as S3
buckets or IAM roles) that are shared externally or configured with
public access. While GuardDuty detects runtime threats, Access
Analyzer focuses on policy-based access risks.
Question 4
An ethical hacker is conducting post-exploitation enumeration on a
compromised Linux host. They want to identify all SUID (Set User ID)
binaries that could potentially be leveraged for privilege escalation.
Which command should they execute?
• A. find / -perm -4000 2>/dev/null
• B. netstat -tulpn | grep LISTEN
• C. cat /etc/passwd | grep -v nologin
• D. ps aux --forest
Correct Answer: A. find / -perm -4000 2>/dev/null
Detailed Rationale: The permission flag -4000 searches for files with
the SUID bit set across the filesystem. Executing binaries with SUID
permissions runs them with the privileges of the file owner (often root),
making them prime targets for privilege escalation if misconfigured.
Question 5
, During a web application penetration test, an application is found to be
vulnerable to Cross-Site Scripting (XSS). The tester wants to bypass a
basic client-side input filter that strips <script> tags. Which alternative
payload structure is most effective for demonstrating execution?
• A. <img src="x" onerror="alert(document.domain)">
• B. SELECT * FROM users WHERE id = 1;
• C. ../../../etc/passwd
• D. <?php system($_GET['cmd']); ?>
Correct Answer: A. <img src="x" onerror="alert(document.domain)">
Detailed Rationale: When <script> tags are filtered out, attackers utilize
alternative HTML event handlers or tags that execute JavaScript without
relying on the <script> tag. The onerror event handler within an <img>
tag forces script execution when the image fails to load.
Question 6
An assessor is reviewing a Kubernetes cluster's security posture and
discovers that Pods are running with the privileged: true security
context. What is the primary security risk associated with this
configuration?
• A. It restricts network traffic between pods inside the same
namespace.
• B. It grants the container root-level access to the host machine's
kernel and devices.
• C. It prevents the container from mounting persistent volumes.
• D. It enforces mandatory access control (MAC) via SELinux profiles.
Application & Cloud Security Practice Questions and answers
2026/2027
Question 1
During a network penetration test, an ethical hacker discovers that an
organization's internal switches are vulnerable to VLAN hopping via
dynamic trunking protocol (DTP) negotiation. Which mitigation step is
most effective to prevent this attack?
• A. Enable BPDU guard on all access ports.
• B. Disable DTP negotiation on access ports and manually configure
ports as static access or static trunk.
• C. Implement dynamic ARP inspection (DAI) on all VLAN
interfaces.
• D. Configure storm control to limit broadcast traffic on trunk links.
Correct Answer: B. Disable DTP negotiation on access ports and
manually configure ports as static access or static trunk.
Detailed Rationale: VLAN hopping via DTP occurs when an attacker
connects a device that emulates a switch and negotiates a trunk link
with a switch port set to dynamic negotiation mode. Disabling DTP
negotiation (switchport nonegotiate) and explicitly setting ports to
either static access or static trunk prevents unauthorized trunk
formation.
Question 2
,A penetration tester is analyzing a web application and identifies a
vulnerability where user-supplied input is directly concatenated into an
SQL query without parameterization. However, the database error
messages are suppressed. Which technique is most appropriate for
exploiting this blind SQL injection vulnerability?
• A. Error-based SQL injection using XML parsing functions.
• B. Union-based SQL injection to extract data directly in the HTTP
response body.
• C. Boolean-based (inferential) or time-based blind SQL injection.
• D. Out-of-band SQL injection using stacked queries exclusively.
Correct Answer: C. Boolean-based (inferential) or time-based blind SQL
injection.
Detailed Rationale: When error messages are suppressed and UNION
queries are not feasible due to differing column structures or data
types, inferential (blind) SQL injection is used. This involves asking the
database true/false questions by observing application behavior
changes (boolean-based) or measuring response latency (time-based).
Question 3
When performing a cloud security assessment on an AWS environment,
an auditor finds an Amazon S3 bucket configured with public read
access enabled via an overly permissive bucket policy. Which tool or
service native to AWS is best suited for continuously monitoring and
detecting such public resource configurations?
• A. Amazon Inspector
• B. AWS Trusted Advisor / AWS IAM Access Analyzer
, • C. AWS Shield Advanced
• D. Amazon GuardDuty
Correct Answer: B. AWS Trusted Advisor / AWS IAM Access Analyzer
Detailed Rationale: AWS IAM Access Analyzer and AWS Trusted Advisor
specifically evaluate resource policies to identify resources (such as S3
buckets or IAM roles) that are shared externally or configured with
public access. While GuardDuty detects runtime threats, Access
Analyzer focuses on policy-based access risks.
Question 4
An ethical hacker is conducting post-exploitation enumeration on a
compromised Linux host. They want to identify all SUID (Set User ID)
binaries that could potentially be leveraged for privilege escalation.
Which command should they execute?
• A. find / -perm -4000 2>/dev/null
• B. netstat -tulpn | grep LISTEN
• C. cat /etc/passwd | grep -v nologin
• D. ps aux --forest
Correct Answer: A. find / -perm -4000 2>/dev/null
Detailed Rationale: The permission flag -4000 searches for files with
the SUID bit set across the filesystem. Executing binaries with SUID
permissions runs them with the privileges of the file owner (often root),
making them prime targets for privilege escalation if misconfigured.
Question 5
, During a web application penetration test, an application is found to be
vulnerable to Cross-Site Scripting (XSS). The tester wants to bypass a
basic client-side input filter that strips <script> tags. Which alternative
payload structure is most effective for demonstrating execution?
• A. <img src="x" onerror="alert(document.domain)">
• B. SELECT * FROM users WHERE id = 1;
• C. ../../../etc/passwd
• D. <?php system($_GET['cmd']); ?>
Correct Answer: A. <img src="x" onerror="alert(document.domain)">
Detailed Rationale: When <script> tags are filtered out, attackers utilize
alternative HTML event handlers or tags that execute JavaScript without
relying on the <script> tag. The onerror event handler within an <img>
tag forces script execution when the image fails to load.
Question 6
An assessor is reviewing a Kubernetes cluster's security posture and
discovers that Pods are running with the privileged: true security
context. What is the primary security risk associated with this
configuration?
• A. It restricts network traffic between pods inside the same
namespace.
• B. It grants the container root-level access to the host machine's
kernel and devices.
• C. It prevents the container from mounting persistent volumes.
• D. It enforces mandatory access control (MAC) via SELinux profiles.
