Browse Python Institute Certification Guides

Python Institute PCES Sample Questions with Explanations

May 23, 2026

Python Institute PCES sample questions with explanations for secure scripting, secrets, files, hashing, authorization, and logs.

On this page

These original sample questions are designed to help you check how PCES topics appear in decision-style prompts. They are not taken from the live exam.

Use these sample questions as a guided self-assessment for PCES-30-0x: Certified Entry-Level Security Specialist with Python topics such as Python foundations, secure coding, input validation, secrets, file handling, authentication, authorization, hashing, encryption, monitoring, and evidence. The prompts focus on safe implementation choices.

Where these questions fit in the PCES guide

The sample set below is part of the Python Institute PCES guide path:

PCES Python security sample questions

Work through each prompt before opening the explanation. PCES questions reward reduced trust, narrow permission, safe failure, and evidence that does not expose sensitive data.

Question 1

Topic: Path traversal

A Python script receives a filename from a user and opens reports/ plus that filename. The script must only read approved report files from the reports directory. Which change is strongest?

  • A. Concatenate the user input to the directory string because the prefix starts with reports/.
  • B. Normalize the final path, verify it stays inside the approved reports directory, and allow only expected filenames or extensions.
  • C. Catch every exception and print access denied for all failures.
  • D. Let the user enter an absolute path because it is more flexible.

Best answer: B

Explanation: User-controlled file paths can escape an intended directory through traversal patterns or absolute paths. The stronger answer constrains the final resolved path and limits what files are acceptable before opening anything.

Why the other choices are weaker:

  • A still allows unsafe path construction.
  • C hides errors after the risky decision instead of preventing the unsafe access.
  • D expands the blast radius.

What this tests: Path safety, input validation, allowlists, and least privilege.

Related topics: File handling; Path traversal; Input validation; Least privilege

Question 2

Topic: Secrets and logs

A beginner script uses an API token. During debugging, the developer prints the full token when a request fails. What is the safest correction?

  • A. Keep printing the token because failed requests need maximum detail.
  • B. Move the token into an approved environment/config source and log only a redacted value or token identifier.
  • C. Rename the token variable to secret so readers know it is sensitive.
  • D. Store the token in a comment at the top of the script for convenience.

Best answer: B

Explanation: Secrets should not be committed, printed, or exposed in routine logs. A safer script reads secrets from an approved runtime source and records useful failure context without revealing the credential.

Why the other choices are weaker:

  • A leaks the credential.
  • C does not protect the value.
  • D stores the secret in source code.

What this tests: Secret handling, redaction, configuration, and log hygiene.

Related topics: Secrets; Environment variables; Logging; Redaction

Question 3

Topic: Hashing vs encryption

A script needs to verify that a downloaded file was not changed during transfer. The script does not need to recover hidden content from the digest. Which technique best fits?

  • A. Hash the file and compare the digest to a trusted expected digest.
  • B. Encrypt the file and then try to decrypt it with the same digest.
  • C. Base64-encode the file and assume the encoded text proves integrity.
  • D. Rename the file after download so attackers cannot identify it.

Best answer: A

Explanation: A hash digest is appropriate for integrity verification when compared to a trusted expected value. Encryption protects confidentiality, while encoding and renaming do not prove the file is unchanged.

Why the other choices are weaker:

  • B confuses encryption with integrity checking.
  • C changes representation, not trust.
  • D is obscurity, not verification.

What this tests: Hashing, integrity, encryption distinction, and evidence.

Related topics: Hashing; Encryption; Integrity; File verification

Question 4

Topic: Authentication vs authorization

A user successfully logs in to an internal tool. The tool then lets the user download every department’s security report. What control is missing?

  • A. Authentication, because the user logged in.
  • B. Authorization, because the tool must check which reports the authenticated user is allowed to access.
  • C. Hashing, because reports need a checksum before download.
  • D. Compression, because reports should be smaller.

Best answer: B

Explanation: Authentication proves identity. Authorization decides what that identity may do. A login alone does not grant access to every resource.

Why the other choices are weaker:

  • A is already present in the scenario.
  • C may support integrity but does not decide access.
  • D is unrelated to the security control needed.

What this tests: Identity, authorization, access control, and least privilege.

Related topics: Authentication; Authorization; Access control; Least privilege

Independent study note

Tech Exam Lexicon and IT Mastery are independent study tools. They are not affiliated with, endorsed by, or sponsored by Python Institute or any certification body.

Revised on Monday, June 15, 2026
Study Plan
FAQ