Application-layer penetration tests must include at least which of the following?

Application-layer penetration tests must include at least which of the following?

• A. Known application-layer vulnerabilities
• B. Only network-layer vulnerabilities
• C. Only authentication weaknesses
• D. Only user authorization issues

Answer: (A)

Application-layer testing focuses on flaws in the software itself, not the network. It targets vulnerabilities that are known and documented for the application layer, such as injection flaws, broken authentication and session management, insecure direct object references, and other common weaknesses tracked by standards like OWASP. Requiring inclusion of known application-layer vulnerabilities ensures the test covers the kinds of flaws attackers have historically exploited. Limiting the scope to only network-layer issues or to a single category like authentication or authorization would miss these broader, critical risks at the app layer. That’s why including known application-layer vulnerabilities is the best answer.

Application-layer testing focuses on flaws in the software itself, not the network. It targets vulnerabilities that are known and documented for the application layer, such as injection flaws, broken authentication and session management, insecure direct object references, and other common weaknesses tracked by standards like OWASP. Requiring inclusion of known application-layer vulnerabilities ensures the test covers the kinds of flaws attackers have historically exploited. Limiting the scope to only network-layer issues or to a single category like authentication or authorization would miss these broader, critical risks at the app layer. That’s why including known application-layer vulnerabilities is the best answer.