During a pre-engagement activity with a new customer, a penetration tester looks for assets to test. Which of the following is an example of a target that can be used for testing?

Question

Options

• AAPI
• BHTTP
• CIPA
• DICMP

• A
  92% (58)
• B
  5% (3)
• C
  2% (1)
• D
  2% (1)

Explanation

API (Application Programming Interface) is correct because it represents a concrete target asset that a penetration tester can actively test and probe for vulnerabilities, such as broken authentication, improper data exposure, or injection flaws. APIs are tangible components of a system's attack surface and are commonly included in the scope of penetration testing engagements.

HTTP (B) is incorrect because it is a protocol (a set of communication rules), not a testable asset itself - it's the method of communication, not the target. IPA (C) is a distractor that may reference an iOS App Package file format or simply a nonsensical option in this context, but it is not a standard penetration testing target category. ICMP (D) is incorrect because, like HTTP, it is a network protocol (used for diagnostic tools like ping), not a target asset.

Memory Tip: Think "Assets = things you attack, Protocols = how you attack them." APIs are things (assets), while HTTP and ICMP are how data travels (protocols) - only the thing can be a target for testing.

No community discussion yet for this question.