PracticeVideosBlogFlashcardsEspañol
All Practice Exams

100+ Free CISP-PTS Practice Questions

Prepare for the CISP-PTS Penetration Testing Specialist (注册信息安全专业人员-渗透测试专家) exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
100+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More China CNITSEC CISP Personnel Registration Certifications (注册信息安全专业人员)

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

CISP Certified Information Security Professional (注册信息安全专业人员, China)

Practice Questions

CISP-DSG Data Security Governance Professional (注册数据安全治理专业人员, China)

Practice Questions

CISP-PTE Penetration Testing Engineer (注册信息安全专业人员-渗透测试工程师, China)

Practice Questions

CISP-SSDP Software Security Development Professional (注册信息安全专业人员-软件安全开发, China)

Practice Questions

CISP-TRE Threat Response Engineer (注册威胁响应工程师, formerly CISP-IRE, China)

Practice Questions

CNITSEC CISM Certified Information Security Member (注册信息安全员, China)

Practice Questions
2026 Statistics

Key Facts: CISP-PTS Exam

70/100

CISP-PTS passing score on an all-practical 100-point CNITSEC exam (no official MCQ paper).

CNITSEC CISP-PTE/PTS knowledge system / authorized outline

30/30/10/30

Official PTS weights: Web 30%, OS and middleware 30%, data and logs 10%, penetration testing 30%.

CNITSEC CISP-PTE/PTS knowledge-system structure

CNY 27,800

November 2022 whitepaper initial package: CNY 19,800 training plus CNY 8,000 exam-center fees.

CNITSEC CISP-PTE/CISP-PTS whitepaper (Nov 2022)

3 years

CISP-PTS certificate validity; maintenance requires a CNITSEC offensive-domain maintenance exam.

CNITSEC CISP-PTE/CISP-PTS whitepaper (Nov 2022)

PTS-only middleware

WebLogic, WebSphere, and JBoss are required for PTS and are not required at the same depth for CISP-PTE.

CNITSEC CISP-PTE/PTS knowledge framework (red/PTS-only topics)

PTS-only data stores

Oracle, Redis, and MongoDB are required for PTS in addition to Microsoft SQL Server and MySQL.

CNITSEC CISP-PTE/PTS knowledge framework (red/PTS-only topics)

Chinese practical exam

Official CISP-PTS is delivered in Chinese as practical tasks; this bank is an English MCQ study adaptation only.

CNITSEC / officialLanguages zh

Official CISP-PTS is an all-practical CNITSEC exam (100 points, 70% to pass) in Chinese, with weights Web 30%, OS/middleware 30%, data and logs 10%, and penetration testing 30%. PTS goes beyond PTE by requiring WebLogic, WebSphere, JBoss, Oracle, Redis, MongoDB, and internal-network methods. Initial package fees in the November 2022 whitepaper total CNY 27,800 (CNY 19,800 training + CNY 8,000 exam-center fees). This 100-question bank is a free English-language MCQ study adaptation — not an official translation and not a simulation of the practical exam.

Sample CISP-PTS Practice Questions

Try these sample questions to test your CISP-PTS exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1During a PTS-level web review, a REST create endpoint returns HTTP 200 with an empty body after inserting a row. Which status best matches HTTP semantics for a successful create that also returns a locator for the new resource?
A.202 Accepted because the insert is persisted
B.201 Created with a Location header
C.204 No Content because the body is empty
D.302 Found so the client re-GETs the new object
Explanation: HTTP 201 Created is the success status for a new resource. Pairing it with Location (and often a representation) tells the client where the object lives. 204 is a success with no body for an existing resource, not a create. 302 is a redirect, not a create acknowledgment. 202 means the request was accepted for asynchronous processing, not that the resource already exists.
2A session cookie is readable from document.cookie in a victim browser even though the application already uses HTTPS. Which cookie attribute is the primary control to stop that JavaScript access?
A.SameSite=Strict
B.HttpOnly
C.Path=/
D.Secure
Explanation: HttpOnly instructs the browser not to expose the cookie to JavaScript APIs such as document.cookie, which reduces the impact of XSS on session theft. Secure only requires HTTPS when sending the cookie. SameSite restricts cross-site sending, which is a CSRF control. Path limits which URLs receive the cookie; it is not an XSS control.
3A comment field stores a script that later executes in every moderator's browser when they open the queue. Which XSS class is this?
A.Stored XSS
B.DOM-based XSS with no server persistence
C.Mutation XSS that only exists after HTML rewriting
D.Reflected XSS
Explanation: Stored (persistent) XSS is saved on the server and replayed to other users. That matches a comment queue that infects every moderator who loads the stored content. Reflected XSS is echoed in the immediate response to the submitter. DOM XSS is a client-side source-to-sink flow and need not persist. Mutation XSS is a special case of browser HTML rewriting, not the primary class here.
4Which condition is the core prerequisite for classic cookie-based CSRF against a state-changing request?
A.The victim has no session and the attacker supplies a stolen refresh token in the URL
B.The browser automatically attaches first-party cookies on a cross-site request that the server treats as authenticated
C.The target API requires a custom Authorization header that JavaScript must set
D.CORS is disabled on the target origin
Explanation: Classic CSRF abuses the browser's habit of attaching cookies to requests the attacker can trigger (form POST, some image/fetch modes) while the server still treats those cookies as proof of intent. Custom Authorization headers are not sent automatically, which is why bearer-token APIs are not CSRF'd the same way. CORS governs reading cross-origin responses, not whether a cookie-authenticated POST can fire. A stolen token in a URL is credential theft or session fixation, not CSRF.
5Which coding pattern is the primary cause of SQL injection in application queries?
A.Using a connection pool that reuses TCP sessions
B.Storing passwords with a slow adaptive hash
C.Enabling TLS on the database port
D.Building the SQL statement by concatenating or interpolating attacker-influenced strings into the query text
Explanation: SQL injection happens when untrusted data changes the SQL statement's structure instead of remaining data. Concatenation and string interpolation into query text are the usual root cause. Connection pooling, password hashing, and TLS are important but orthogonal. Parameterized queries (prepared statements with bound parameters) keep data out of the statement structure.
6A registration form stores a profile 'nickname' without executing SQL. Weeks later, an admin report concatenates that nickname into a SELECT and dumps extra tables. What class is this?
A.Insecure direct object reference to the nickname column
B.Reflected XSS in the admin UI
C.Second-order SQL injection
D.CSRF against the registration form
Explanation: Second-order SQL injection stores a payload in one step and triggers it later when a different query interpolates the stored value. That matches a nickname that is inert at registration and dangerous only in the admin report. XSS would execute in a browser. CSRF would forge a state change with the victim's cookies. IDOR is an access-control issue on object identifiers, not query composition.
7An XML upload feature parses documents with a fully featured DTD processor and external-entity resolution enabled. Which outcome is the defining XXE impact class?
A.The browser executes the XML as JavaScript because of MIME sniffing
B.The application switches from UTF-8 to UTF-7 and disables CSRF tokens
C.The parser resolves attacker-supplied external entities, which can disclose local files or force the server to fetch URLs
D.The XML is automatically treated as JSON and bypasses schema validation
Explanation: XML External Entity (XXE) processing lets a document define entities that the parser fetches or expands. That can leak files, cause denial of service via entity expansion, or turn the parser into an SSRF client. XML is not silently reinterpreted as JSON. Browser XSS via MIME sniffing is a different bug class. Character-set tricks are not the XXE definition.
8A server-side PDF renderer accepts a user-supplied URL and fetches it from the application host. Blocking literal IP literals in 169.254.169.254 is the only control. Why is that insufficient against SSRF?
A.DNS rebinding, redirects, alternate encodings, or attacker-controlled names can still cause the server to reach internal or metadata endpoints
B.SSRF only works if the PDF renderer runs as root
C.Browsers will not follow the rendered PDF, so the finding is not exploitable
D.Cloud metadata endpoints ignore HTTP requests that lack a Host header
Explanation: SSRF is a server-side fetch under attacker influence. Hostname allow/deny lists fail when DNS answers change (rebinding), when HTTP redirects hop to another address, or when equivalent URL forms bypass a naive string filter. Privilege of the renderer affects impact, not existence. The victim of SSRF is the server, not the browser. Metadata services are designed to answer local HTTP clients.
9Which CSRF defense combination is the most robust for a cookie-authenticated browser application?
A.Switching all forms from POST to GET so tokens are not required
B.Synchronizer (or double-submit) CSRF tokens plus SameSite cookies plus verifying Origin or Referer on state-changing requests
C.Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true
D.Relying only on a hidden field that never rotates and is copied into every cached page
Explanation: Defense in depth for CSRF is a per-session unguessable token bound to the user, cookie SameSite restrictions, and Origin/Referer checks on mutations. ACAO * with credentials is an invalid/dangerous CORS combination and does not authenticate intent. Static tokens in cacheable pages leak. GET mutations increase CSRF and cache risk.
10Which file-upload control set actually reduces web-shell risk rather than trusting attacker-controlled metadata?
A.Save uploads into the application directory using the original filename so links stay pretty
B.Validate file magic bytes, allowlist extensions, store outside the web root with randomized names, and serve with a non-executable content type
C.Trust Content-Type because browsers set it honestly
D.Allow any extension if the filename contains only ASCII
Explanation: Content-Type and filenames are attacker-controlled. Real controls are content sniffing (magic bytes), a tight extension allowlist, storage outside executable web roots, unpredictable names, and serving with a safe MIME type (and no script execution). Pretty original names in the web root are a classic web-shell pattern.

About the CISP-PTS Exam

CISP-PTS (Certified Information Security Professional — Penetration Testing Specialist; 注册信息安全专业人员-渗透测试专家) is CNITSEC's specialist-level penetration-testing credential above CISP-PTE. Holders are expected to perform vulnerability research and code analysis, follow current offensive-security developments, and design solutions. The official exam is 100% practical (100 points, 70 to pass) and is delivered in Chinese after authorized training. This page is an English-language multiple-choice study adaptation of the official knowledge weights — Web 30%, OS and middleware 30%, data and logs 10%, and penetration testing 30% — with extra PTS depth on WebLogic/WebSphere/JBoss, Oracle/Redis/MongoDB, internal-network methods, and code-analysis concepts. It is not an official lab simulation and does not replace the practical exam.

Assessment

Official CISP-PTS (CNITSEC): all practical operations, 100 points, 70 to pass, delivered in Chinese. Knowledge weights: Web security 30%; operating systems and middleware 30% (Apache, IIS, Tomcat, plus PTS-only WebLogic, WebSphere, and JBoss); data and logs 10% (Microsoft SQL Server and MySQL, plus PTS-only Oracle, Redis, and MongoDB); penetration testing 30% (including internal-network methods, post-exploitation concepts, vulnerability research, and code-analysis concepts). This local bank uses four-option English MCQs to practice those knowledge decisions only.

Time Limit

Authorized providers commonly report 4 hours for the practical sitting; confirm with CNITSEC or your authorized training institution. Official published format is all practical, not a timed MCQ paper.

Passing Score

70%

Exam Fee

CNY 8,000 exam-center fees (exam CNY 5,500 + registration CNY 1,000 + 3-year annuity CNY 1,500); authorized training CNY 19,800; total initial package CNY 27,800 (November 2022 CNITSEC whitepaper). Retake CNY 4,000. (China Information Technology Security Evaluation Center (CNITSEC / 中国信息安全测评中心))

CISP-PTS Exam Content Outline

30%

Web Security

HTTP protocol, injection classes, XSS, SSRF, CSRF, file handling, access control, session management, and code-audit source/sink reasoning.

30%

Operating Systems and Middleware

Windows and Linux privilege and hardening, Apache, IIS, Tomcat, and PTS-only WebLogic, WebSphere, and JBoss management and Java-middleware concepts.

10%

Data and Logs

Microsoft SQL Server and MySQL plus PTS-only Oracle, Redis, and MongoDB controls, dangerous packages/commands, and log-integrity analysis.

30%

Penetration Testing

Authorized recon, vulnerability discovery, exploitation methodology without payloads, internal-network methods, post-exploitation concepts, vulnerability research, and reporting.

How to Pass the CISP-PTS Exam

What You Need to Know

  • Passing score: 70%
  • Assessment: Official CISP-PTS (CNITSEC): all practical operations, 100 points, 70 to pass, delivered in Chinese. Knowledge weights: Web security 30%; operating systems and middleware 30% (Apache, IIS, Tomcat, plus PTS-only WebLogic, WebSphere, and JBoss); data and logs 10% (Microsoft SQL Server and MySQL, plus PTS-only Oracle, Redis, and MongoDB); penetration testing 30% (including internal-network methods, post-exploitation concepts, vulnerability research, and code-analysis concepts). This local bank uses four-option English MCQs to practice those knowledge decisions only.
  • Time limit: Authorized providers commonly report 4 hours for the practical sitting; confirm with CNITSEC or your authorized training institution. Official published format is all practical, not a timed MCQ paper.
  • Exam fee: CNY 8,000 exam-center fees (exam CNY 5,500 + registration CNY 1,000 + 3-year annuity CNY 1,500); authorized training CNY 19,800; total initial package CNY 27,800 (November 2022 CNITSEC whitepaper). Retake CNY 4,000.

Keys to Passing

  • Work through all 100 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

CISP-PTS Study Tips from Top Performers

1Treat this bank as knowledge drill only. The official exam is all practical in Chinese; schedule authorized labs for WebLogic, WebSphere, JBoss, Oracle, Redis, MongoDB, and internal-network workflows.
2Master source-sink-sanitizer reasoning for web and Java middleware so you can explain a finding and a fix without relying on a single tool output.
3Practice interpreting banners, listener exposure (T3/IIOP/AJP/JMX), and default management consoles as risk decisions, not as exploit recipes.
4For data stores, learn privilege models and dangerous built-ins (for example FILE, xp_cmdshell remaining disabled, PUBLIC package grants, Redis bind/AUTH, MongoDB auth/bindIp) and how they show up in logs.
5Build a repeatable methodology: written scope, recon, discovery, authorized verification, evidence, cleanup, and a report that separates executive risk from technical reproduction notes.
6Do not study payload lists. PTS-level scoring rewards safe sequencing, accurate classification, and defensible remediation under authorization.

Frequently Asked Questions

Is the official CISP-PTS exam multiple choice?

No. CNITSEC's CISP-PTS exam is entirely practical operations scored out of 100 points, with 70 required to pass. This site's 100 English multiple-choice items are a study adaptation of PTS knowledge. They are not an official translation, not a lab, and not a simulation of the practical exam.

What score do I need to pass CISP-PTS?

70 points out of 100 (70%). The official exam awards all 100 points on practical tasks. Confirm current scoring details with CNITSEC or your authorized training institution.

How is CISP-PTS different from CISP-PTE?

CISP-PTE is engineer-level and mixes objective items with practical tasks (commonly described as 20 objective points plus 80 practical). CISP-PTS is specialist-level and is 100% practical. PTS also weights OS/middleware and penetration testing more heavily (30% each vs 20% on PTE) and uniquely requires WebLogic, WebSphere, JBoss, Oracle, Redis, MongoDB, and internal-network methods.

What are the official CISP-PTS domain weights?

Web security 30%; operating systems and middleware 30%; data and logs 10%; penetration testing 30%. Those weights come from the CNITSEC CISP-PTE/PTS knowledge-system structure used by authorized training.

What language is the official CISP-PTS exam?

Official CISP-PTS is a Chinese-language practical assessment (officialLanguages: zh). This practice bank is an English-language MCQ study adaptation for people who prepare in English. It is not an official English sitting and not a translation of live tasks.

How much does CISP-PTS cost?

The November 2022 CNITSEC whitepaper lists CNY 19,800 authorized training plus CNY 8,000 exam-center fees (CNY 5,500 exam, CNY 1,000 registration, CNY 1,500 three-year annuity), totaling CNY 27,800. The listed retake fee is CNY 4,000. Fees are collected through authorized training institutions; confirm current amounts before you enroll.

How long is the CISP-PTS certificate valid?

Three years. After expiry, holders maintain the credential through a CNITSEC CISP offensive-domain maintenance examination rather than by sitting the original exam unchanged. The 2022 whitepaper lists a CISP-PTS maintenance package of CNY 6,000.

Can these practice questions replace official lab preparation?

No. CISP-PTS is a performance-based practical exam. Use these MCQs to rehearse specialist knowledge and decision-making (especially middleware, databases, methodology, and code-analysis concepts). You still need authorized training and hands-on lab practice for the official sitting.