PracticeVideosBlogFlashcardsEspañol
All Practice Exams

100+ Free CISP-PTE Penetration Testing Engineer Practice Questions

Prepare for the Certified Information Security Professional — Penetration Testing Engineer (注册信息安全专业人员-渗透测试工程师, CISP-PTE) exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
100+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More China CNITSEC CISP Personnel Registration Certifications (注册信息安全专业人员)

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

CISP Certified Information Security Professional (注册信息安全专业人员, China)

Practice Questions

CISP-DSG Data Security Governance Professional (注册数据安全治理专业人员, China)

Practice Questions

CISP-PTS Penetration Testing Specialist (注册信息安全专业人员-渗透测试专家, China)

Practice Questions

CISP-SSDP Software Security Development Professional (注册信息安全专业人员-软件安全开发, China)

Practice Questions

CISP-TRE Threat Response Engineer (注册威胁响应工程师, formerly CISP-IRE, China)

Practice Questions

CNITSEC CISM Certified Information Security Member (注册信息安全员, China)

Practice Questions
2026 Statistics

Key Facts: CISP-PTE Penetration Testing Engineer Exam

70/100

Passing score on the mixed CISP-PTE paper

CNITSEC CISP-PTE/PTS knowledge framework (commonly published with the whitepaper)

20 + 80

Objective points plus practical points

CISP-PTE exam structure as published with the official knowledge framework

50%

Web security weight on CISP-PTE

CISP-PTE/PTS knowledge-category table

CNY 19,800

Initial training-plus-exam package

CNITSEC CISP-PTE/PTS whitepaper (November 2022)

3 years

Credential validity before maintenance exam

CNITSEC CISP-PTE/PTS whitepaper (November 2022)

PTE-only stack

Apache/IIS/Tomcat and MSSQL/MySQL; Java app servers and Oracle/Redis/MongoDB are PTS-only

CNITSEC CISP-PTE/PTS whitepaper (November 2022)

CISP-PTE is a CNITSEC registered penetration-testing engineer exam in Chinese: 20 multiple-choice items (20 points) plus practical tasks (80 points), 70/100 to pass, typically after authorized training in a CNY 19,800 package. Official weights are Web security ~50%, OS and middleware ~20%, data and logs ~10%, and penetration testing ~20%. This page is a free English-language MCQ study adaptation, not an official translation or practical simulator.

Sample CISP-PTE Penetration Testing Engineer Practice Questions

Try these sample questions to test your CISP-PTE Penetration Testing Engineer exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1In HTTP, which method is defined as both safe and idempotent and is intended to retrieve a representation without changing server state?
A.GET
B.POST
C.PATCH
D.CONNECT
Explanation: GET is specified as a safe, idempotent retrieval method: a conforming implementation must not use it to cause side effects such as creating, updating, or deleting resources. Using GET for state-changing operations also exposes those actions to prefetch, caching, and cross-site request forgery via simple hyperlinks.
2A web application echoes the HTTP Host header into password-reset links. What is the most direct defensive control?
A.Trust Host whenever TLS is used
B.Allow any Host as long as the path is allowlisted
C.Disable HTTP/1.1 Host checking at the reverse proxy
D.Ignore the request Host and generate links from a server-side configured canonical domain
Explanation: Host header poisoning works when the application treats an attacker-controlled Host as the authority for absolute URLs. Password-reset and other email links must be built from a configured canonical domain (or a strictly validated allowlist of hosts), not from the raw header.
3Which HTTP status code tells clients and caches that the resource has permanently moved to a new URI and that future requests should use that URI?
A.302 Found
B.301 Moved Permanently
C.304 Not Modified
D.307 Temporary Redirect
Explanation: 301 Moved Permanently signals a durable change of URI and is commonly cached. Using 301 for a temporary relocation can send users and crawlers to the wrong place long after the original URL should have been restored.
4Which response header primarily tells the user agent how to interpret the message body, including the media type used for rendering and sniffing decisions?
A.Accept
B.ETag
C.Content-Type
D.Location
Explanation: Content-Type declares the representation's media type (and often charset). Incorrect or missing Content-Type, especially when user-controlled data is returned, can cause browsers to treat JSON or text as HTML and create a cross-site scripting path.
5A reverse proxy and origin disagree about whether a request is framed by Content-Length or Transfer-Encoding. What class of issue should a tester report, and what is the primary mitigation?
A.Clickjacking; set X-Frame-Options only
B.HTTP request smuggling; normalize or reject ambiguous requests at a single HTTP parser
C.Open redirect; allowlist Location hosts
D.Cache poisoning via Vary; disable caching entirely
Explanation: Conflicting Content-Length and Transfer-Encoding handling is the classic HTTP request-smuggling condition: front-end and back-end desynchronize on request boundaries. Defense is to use one consistent parser, reject ambiguous messages, and disable conflicting length encodings rather than trying to interpret both.
6What security properties does HTTPS (HTTP over TLS) primarily add compared with plaintext HTTP?
A.Confidentiality and integrity of the HTTP bytes in transit, plus server authentication
B.Automatic protection against SQL injection and XSS
C.Guaranteed authorization of every application user
D.Elimination of CSRF because cookies are no longer sent
Explanation: TLS authenticates the server (when certificates are validated), encrypts the channel, and protects integrity of the HTTP request and response in transit. It does not fix application-layer injection, access control, or CSRF; cookies are still sent on HTTPS origins.
7An authenticated page containing a session token in HTML is served with Cache-Control: public. What is the main risk?
A.The browser will refuse to store cookies
B.TLS will be downgraded automatically
C.Shared caches may store and later serve another user's authenticated content
D.CSRF tokens become unguessable
Explanation: public allows shared caches (proxies, CDNs) to store the response. Authenticated or personalized pages should use private or, for highly sensitive bodies, no-store, so one user's page is not reused for another.
8What is the primary, durable mitigation for SQL injection in application code?
A.Blacklisting the words SELECT and UNION in a WAF only
B.Parameterized queries (prepared statements) that bind user data separately from SQL
C.Hiding detailed database errors from users and doing nothing else
D.Encrypting the database at rest
Explanation: Parameterized queries send SQL structure and values on separate channels so user input cannot change the statement's meaning. Encryption at rest, error hiding, and WAF signatures are supporting controls; they do not make concatenated SQL safe.
9An application never returns database errors, but a boolean condition in a search parameter consistently changes response time or page content. How should this be classified?
A.Blind SQL injection indicator requiring parameterized-query remediation
B.Reflected XSS because the page content changed
C.CSRF because the request used a cookie
D.A safe search feature because no stack trace was shown
Explanation: Blind SQL injection is identified when injected boolean or time-based conditions change behavior without verbose SQL errors. The fix is still parameterization (and least-privilege DB accounts), not merely hiding errors.
10A filename supplied by a user is concatenated into a shell command that runs an image converter. Which issue is this, and what is the preferred fix?
A.SQL injection; switch to MySQL
B.CSRF; add a SameSite cookie
C.Open redirect; allowlist URLs
D.OS command injection; avoid the shell and call a safe API with a validated argument list
Explanation: Command injection occurs when untrusted data reaches a shell or command interpreter. The robust control is not to invoke a shell at all: use a process API with a fixed executable and an allowlisted argument list, plus strict filename validation.

About the CISP-PTE Penetration Testing Engineer Exam

CISP-PTE (注册信息安全专业人员-渗透测试工程师) is CNITSEC's registered penetration-testing engineer credential. Holders plan test schemes, write project test plans and test cases, and produce test reports for website penetration testing. The official assessment is delivered in Chinese as a mixed paper: 20 single-choice questions (20 points) plus practical tasks (80 points), with 70 out of 100 required to pass. Knowledge coverage is Web security (about 50%); Windows/Linux and Apache/IIS/Tomcat (about 20%); MSSQL/MySQL and logs (about 10%); and penetration-testing process (about 20%). WebLogic, WebSphere, JBoss, Oracle, Redis, and MongoDB are required only for CISP-PTS, not PTE. This independent English-language MCQ bank is a study adaptation of identification, methodology, and defensive knowledge. It is not an official translation, does not simulate the practical exam, and cannot certify hands-on skill.

Assessment

Chinese mixed paper: 20 single-choice items (20 points) plus practical tasks (80 points). Web security about 50%; operating systems and middleware about 20% (Apache/IIS/Tomcat only for PTE); data and log analysis about 10% (MSSQL/MySQL only for PTE); penetration testing about 20%. WebLogic/WebSphere/JBoss and Oracle/Redis/MongoDB are PTS-only.

Time Limit

4 hours (240 minutes) as commonly published by CNITSEC-authorized training organizations for the mixed sitting; confirm the current session with the CISP Offensive-Defensive Examination Center

Passing Score

70 out of 100

Exam Fee

CNY 19,800 package (training CNY 14,800 + examination-center CNY 5,000: exam CNY 3,000, registration CNY 500, three-year annuity CNY 1,500) per the CNITSEC CISP-PTE/PTS whitepaper (China Information Technology Security Evaluation Center (CNITSEC / 中国信息安全测评中心))

CISP-PTE Penetration Testing Engineer Exam Content Outline

50%

Web Security

HTTP protocol, injection, XSS, CSRF, SSRF, file-handling flaws, access-control failures, and session-management issues — recognize them and choose sound fixes.

20%

Operating Systems and Middleware

Windows and Linux accounts, filesystem permissions, and logging; Apache, IIS, and Tomcat hardening. WebLogic, WebSphere, and JBoss are PTS-only.

10%

Data and Log Analysis

MSSQL and MySQL permissions, unsafe features, and defensive configuration, plus using logs to analyze events. Oracle, Redis, and MongoDB are PTS-only.

20%

Penetration Testing

Reconnaissance, discovery, authorized exploitation concepts, reporting, rules of engagement, and CISP professional ethics.

How to Pass the CISP-PTE Penetration Testing Engineer Exam

What You Need to Know

  • Passing score: 70 out of 100
  • Assessment: Chinese mixed paper: 20 single-choice items (20 points) plus practical tasks (80 points). Web security about 50%; operating systems and middleware about 20% (Apache/IIS/Tomcat only for PTE); data and log analysis about 10% (MSSQL/MySQL only for PTE); penetration testing about 20%. WebLogic/WebSphere/JBoss and Oracle/Redis/MongoDB are PTS-only.
  • Time limit: 4 hours (240 minutes) as commonly published by CNITSEC-authorized training organizations for the mixed sitting; confirm the current session with the CISP Offensive-Defensive Examination Center
  • Exam fee: CNY 19,800 package (training CNY 14,800 + examination-center CNY 5,000: exam CNY 3,000, registration CNY 500, three-year annuity CNY 1,500) per the CNITSEC CISP-PTE/PTS whitepaper

Keys to Passing

  • Work through all 100 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

CISP-PTE Penetration Testing Engineer Study Tips from Top Performers

1Remember the official exam is mostly practical and in Chinese: use these MCQs for knowledge, then practice authorized labs for HTTP analysis, injection/XSS/CSRF/SSRF recognition, and safe remediation.
2Spend about half of study time on Web security: HTTP semantics, injection vs XSS vs CSRF vs SSRF, file handling, access control, and session flags.
3For OS and middleware, drill Windows/Linux account and permission findings plus Apache/IIS/Tomcat hardening. Do not treat WebLogic, WebSphere, or JBoss as PTE-required.
4For data and logs, focus on MSSQL and MySQL least privilege (disable xp_cmdshell, restrict FILE), and on reading web and OS logs. Oracle, Redis, and MongoDB are PTS-only.
5Practice reporting and rules of engagement: written authorization, in-scope vs out-of-scope, least-impact evidence, and CISP ethics (no illegal use of skills; protect client data).

Frequently Asked Questions

Is the official CISP-PTE exam a multiple-choice test in English?

No. Official CISP-PTE is a Chinese-language mixed assessment: 20 single-choice questions (20 points) plus practical/hands-on tasks (80 points), with 70 out of 100 to pass. This bank is an original English-language MCQ study adaptation of knowledge and judgment. It is not an official translation and does not simulate the practical exam.

What score do I need to pass CISP-PTE?

70 out of 100 on the mixed paper (20 objective points plus 80 practical points), as commonly published with the official knowledge framework.

What is the difference between CISP-PTE and CISP-PTS?

CISP-PTE is the penetration-testing engineer credential (mixed objective plus practical). CISP-PTS is the specialist credential and is entirely practical, with extra middleware (WebLogic, WebSphere, JBoss) and databases (Oracle, Redis, MongoDB) that PTE does not require. PTS also weights Web security lower (about 30%) and OS/middleware and penetration testing higher (about 30% each).

Are there education or experience prerequisites?

No. The CNITSEC CISP-PTE/PTS whitepaper states there is no education or work-experience requirement. Candidates must complete authorized CISP offensive-defensive training, pass the exam, follow the professional code, and complete registration review.

How much does CISP-PTE cost and how long is it valid?

The November 2022 CNITSEC whitepaper lists CNY 19,800 for the initial package (CNY 14,800 training plus CNY 5,000 examination-center fees) and CNY 2,500 for a retake. The credential is valid for three years; maintenance uses a separate CISP offensive-defensive maintenance exam (listed at CNY 3,750 for PTE in that whitepaper).

Which middleware and databases are in PTE scope?

For PTE, middleware is Apache, IIS, and Tomcat; databases are MSSQL and MySQL. The official whitepaper marks WebLogic, WebSphere, JBoss, Oracle, Redis, and MongoDB as required only for CISP-PTS.