PT0-001 · Question #163
A penetration tester must assess a web service. Which of the following should the tester request during the scoping phase?
The correct answer is C. WSDLfile. A WSDL (Web Services Description Language) file is an XML document that describes a SOAP-based web service - its endpoints, operations (methods), input/output message formats, and data types. During scoping, requesting the WSDL gives the tester a complete map of the attack…
Question
A penetration tester must assess a web service. Which of the following should the tester request during the scoping phase?
Options
- AXSD
- BAfter-hours contact escalation
- CWSDLfile
- DSOAP project file
How the community answered
(35 responses)- B3% (1)
- C91% (32)
- D6% (2)
Explanation
A WSDL (Web Services Description Language) file is an XML document that describes a SOAP-based web service - its endpoints, operations (methods), input/output message formats, and data types. During scoping, requesting the WSDL gives the tester a complete map of the attack surface: every callable function, expected parameters, and data structures. This is analogous to requesting API documentation before testing a REST API. XSD (choice A) defines XML schemas and may accompany a WSDL, but it is not the primary artifact for web service scoping. A SOAP project file (choice D) is a tool-specific artifact (e.g., SoapUI) and not a standard deliverable. After-hours escalation contacts (choice B) are operational, not technical, and are useful but not the answer to 'what to request for scoping a web service.'
Topics
Community Discussion
No community discussion yet for this question.