PT0-002 Practice Test 10 — 10 Questions

Question 1

A penetration tester is writing a report and needs to assign a severity rating to a vulnerability. Which of the following scoring systems is specifically designed to consider Damage, Reproducibility, Exploitability, Affected users, and Discoverability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DREAD. The DREAD model is a risk assessment model that uses these five categories.

Answer

STRIDE

Answer

OWASP Risk Rating

Answer

CVSS

Question 2

A penetration tester is analyzing a Python script that uses the 'paramiko' library. The script reads a list of IP addresses from a file and attempts to connect to each host using the same username and a list of common passwords. Which attack technique is the script most likely performing?

Accepted Answer

Brute-force attack against SSH credentials. The script uses the 'paramiko' library, which is a Python implementation of the SSHv2 protocol. By reading a list of IP addresses and attempting connections with the same username and a list of common passwords, it is performing a brute-force attack against SSH credentials. This technique systematically tries multiple password guesses to gain unauthorized access to SSH services.

Answer

SQL injection attack against a database

Answer

Cross-site scripting (XSS) attack against a web application

Answer

ARP spoofing attack to intercept network traffic

Question 3

A penetration tester is using Hashcat to crack NTLM hashes obtained from a Windows domain controller. Which hash mode should the tester specify for NTLM hashes?

Accepted Answer

-m 1000. Hashcat uses mode -m 1000 for NTLM hashes. Mode 0 is for MD5, mode 13100 is for Kerberoast, and mode 22000 is for WPA2.

Answer

-m 22000

Answer

-m 0

Answer

-m 13100

Question 4

A penetration tester is exploiting a web application and discovers an XML External Entity (XXE) vulnerability. Which TWO attacks can be performed using XXE?

Accepted Answer

Server-Side Request Forgery (SSRF). XXE can be used to read local files via external entities and also to perform SSRF by making the server request internal resources.

Answer

Remote code execution

Answer

Cross-Site Scripting (XSS)

Answer

SQL injection

Question 5

A penetration tester is using Nmap to perform an aggressive scan of a target. Which command combines OS detection, version detection, script scanning, and traceroute?

Accepted Answer

nmap -A target. The -A flag enables aggressive scanning which includes OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (--traceroute).

Answer

nmap -sV -O target

Answer

nmap -sC -O target

Answer

nmap -T4 -sV target

Question 6

A penetration tester is performing an ARP spoofing attack using Bettercap to intercept traffic between a client and the gateway. What is the primary goal of this attack?

Accepted Answer

To intercept and manipulate network traffic. ARP spoofing allows the attacker to intercept traffic, enabling man-in-the-middle attacks to capture or modify data.

Answer

To perform a denial-of-service attack

Answer

To bypass firewall rules

Answer

To crack wireless passwords

Question 7

A penetration tester is conducting a vulnerability scan on a web server using Nikto. The scan report lists several findings, including a directory listing vulnerability and outdated server headers. Which type of scanner is Nikto?

Accepted Answer

Web server vulnerability scanner. Nikto is a web server scanner that tests for misconfigurations, outdated software, and common vulnerabilities. Nessus is a general vulnerability scanner, WPScan is for WordPress, and OpenVAS is also a general vulnerability scanner.

Answer

Network port scanner

Answer

WordPress vulnerability scanner

Answer

General vulnerability scanner

Question 8

During a penetration test, the tester is using Gobuster to enumerate directories on a web server. Which flag would the tester use to specify a list of file extensions to append to each word in the wordlist for discovering files like 'admin.php' or 'config.bak'?

Accepted Answer

-x. The -x flag in Gobuster allows specifying extensions to append to each word during directory/file bruteforcing, enabling discovery of files with those extensions.

Answer

-e

Answer

-w

Answer

-t

Question 9

A penetration tester is hired to perform an assessment where the tester is provided with network diagrams, source code, and administrative credentials. Which type of penetration test is this?

Accepted Answer

White box. In a white box test, the tester has full knowledge of the environment, including credentials and documentation.

Answer

Grey box

Answer

Black box

Answer

Red team

Question 10

A penetration tester uses a custom severity rating based on business context. The tester determines the likelihood of exploitation is high and the business impact is low. According to a standard risk matrix, what should the overall severity be?

Accepted Answer

Medium. In many risk matrices, high likelihood combined with low impact typically results in a medium severity rating.

Answer

High

Answer

Low

Answer

Critical