PT0-002 Practice Test 10 — 10 Questions

Question 1

A penetration testing firm is hired to assess a client's network that includes both internal servers and external cloud-based services. The client wants to test only the internal network due to compliance concerns about testing cloud infrastructure. Which of the following should the penetration tester MOST strongly emphasize during the scoping meeting?

Accepted Answer

That the test will not provide a complete risk picture without cloud components. Option B is correct because the scope of a penetration test directly determines the validity of its risk assessment. Excluding cloud services creates a significant blind spot, as the client's attack surface includes both internal servers and external cloud-based services; without testing the cloud components, the test cannot provide a complete risk picture. The penetration tester must emphasize this limitation during scoping to ensure the client understands that the final report will not reflect the full security posture of their hybrid environment.

Answer

That cloud services are often the most vulnerable and should be included for a thorough test

Answer

That the client can always test cloud services later in a separate engagement

Answer

That compliance concerns are unfounded and the test should proceed anyway

Question 2

A penetration testing firm is contracted to test a multi-tenant SaaS application. During scoping, the client needs to ensure that testing does not affect other tenants' data. Which scoping control is most important to implement?

Accepted Answer

Isolated testing environment. An isolated testing environment is the most important scoping control because it ensures that the penetration testing activities, including any potentially disruptive scans or exploits, are contained within a dedicated instance of the SaaS application. This prevents any cross-tenant data leakage or service degradation, as the tester's actions are restricted to a logically or physically separate environment that does not share databases or compute resources with production tenants. Without isolation, even read-only testing could inadvertently access or modify data belonging to other tenants due to shared multi-tenant architecture.

Answer

Data anonymization

Answer

Signed waiver from all tenants

Answer

Limit test to read-only operations

Question 3

A penetration testing firm has been hired to test the internal network of a large enterprise. During the scoping meeting, the client states that they want to include all IP ranges, including those used by the HR department's sensitive systems. The tester should recommend which of the following to minimize business impact and avoid disruption?

Accepted Answer

Perform the test during off-peak hours and provide prior notification. Option B is correct because performing the test during off-peak hours and providing prior notification minimizes business impact by reducing the likelihood of disrupting critical HR operations during normal business hours. This approach aligns with the scoping requirement to include all IP ranges while allowing the client to prepare for potential service interruptions, such as those caused by active scanning techniques like TCP SYN scans or service enumeration. Prior notification ensures that HR staff can take precautions, such as backing up sensitive data or pausing batch jobs, thereby avoiding data corruption or system unavailability.

Answer

Exclude the HR department's IP range from the test

Answer

Use only passive reconnaissance techniques on the HR systems

Answer

Include the HR systems but require written authorization from HR management

Question 4

A penetration testing firm is engaged to assess a cloud infrastructure hosted in multiple AWS regions. The client specifies that only systems in US-based regions should be tested due to data sovereignty concerns. Which of the following is the MOST critical documentation to include in the rules of engagement (ROE) to ensure compliance?

Accepted Answer

List of allowed AWS regions and associated VPC CIDR ranges. Option B is correct because the rules of engagement (ROE) must explicitly define the authorized scope to prevent testing outside US-based regions, which could violate data sovereignty laws. Listing allowed AWS regions and their associated VPC CIDR ranges provides a precise technical boundary for the penetration test, ensuring that only in-scope systems are targeted. Without this, the testing team might inadvertently access resources in non-US regions, leading to legal and compliance breaches.

Answer

Statement of Work (SOW)

Answer

Data Processing Agreement (DPA)

Answer

Penetration testing methodology document

Question 5

A penetration testing firm is hired to assess a mobile banking application. The client wants to test both Android and iOS versions, but only the production environment. Which of the following is the MOST important scoping consideration to include in the rules of engagement?

Accepted Answer

Requiring jailbroken/rooted devices for testing. Requiring jailbroken or rooted devices is the most important scoping consideration because mobile banking applications often implement runtime integrity checks (e.g., MagiskHide, Frida detection) that prevent the app from running on compromised devices. Without explicit authorization to bypass these controls, the penetration tester cannot perform deep dynamic analysis, such as hooking API calls or inspecting encrypted local storage, which is essential for a thorough security assessment of the production environment.

Answer

Specifying the number of concurrent users during testing

Answer

Defining the test window to avoid peak hours

Answer

Excluding the backend API from testing

Question 6

A penetration testing firm is hired to perform a test on a multinational company that has offices in Europe and North America. The client wants to test all systems including those in the European office, which is subject to GDPR. Which of the following is the MOST important legal consideration to include in the rules of engagement?

Accepted Answer

Data protection and privacy clauses addressing handling of personal data. The engagement involves testing systems in a European office subject to GDPR, which imposes strict requirements on the processing and protection of personal data. The rules of engagement must include data protection and privacy clauses to define how the penetration tester will handle any personal data encountered during the test, ensuring compliance with GDPR Article 5 (lawfulness, fairness, transparency) and Article 32 (security of processing). Without these clauses, the tester could inadvertently violate GDPR by collecting or storing personal data without a lawful basis, exposing both the client and the testing firm to significant fines.

Answer

A limitation of liability clause

Answer

A non-disclosure agreement

Answer

A schedule of testing hours

Question 7

A tester has low-privilege shell access on a Linux server. Which two checks are most appropriate for local privilege escalation enumeration? (Choose 2.)

Accepted Answer

Review sudo privileges with sudo -l.. Option A is correct because `sudo -l` lists the commands the current user can execute with elevated privileges, which is a standard first step in privilege escalation enumeration. If the user has sudo rights to any command without a password or with a known password, they can potentially run that command as root, leading to full system compromise.

Answer

Run a full SYN scan of the public IP range.

Answer

Send phishing emails to the finance department.

Question 8

After the penetration test, the client requests a one-page summary of the test's scope, key findings, and recommended next steps for the board of directors. Which document should the penetration tester provide?

Accepted Answer

Executive Summary. The executive summary is specifically designed to provide a high-level overview of the penetration test's scope, key findings, and recommended next steps for non-technical stakeholders like the board of directors. It distills complex technical details into business-focused language, enabling informed decision-making without requiring deep cybersecurity expertise.

Answer

Detailed Technical Report

Answer

Vulnerability Scan Report

Answer

Remediation Plan

Question 9

During a penetration test of a large e-commerce platform, the client requests additional testing on a newly discovered microservice mid-engagement. The scope defined in the rules of engagement (ROE) explicitly lists all target systems. What should the penetration tester do FIRST?

Accepted Answer

Inform the client that a scope amendment is needed and pause testing on the microservice until it is approved. Option C is correct because the rules of engagement (ROE) are a legally binding document that defines the scope of testing. Adding a new microservice mid-engagement without an approved scope amendment violates the ROE and could lead to legal or contractual issues. The penetration tester must first pause testing on the microservice and formally request a scope amendment to ensure all activities remain authorized.

Answer

Add the microservice to the test and include it in the final report as an unadvertised finding

Answer

Decline the request because the microservice was not part of the original scope

Answer

Test the microservice only if it is using the same technology stack as other targets

Question 10

During a web application test, a penetration tester discovers that the application exposes internal object references (e.g., user ID in a URL) and does not properly authorize access. The tester can view other users' private data by simply changing the ID parameter. Which type of vulnerability does this represent?

Accepted Answer

Insecure Direct Object Reference (IDOR). The vulnerability is Insecure Direct Object Reference (IDOR) because the application exposes internal object references (e.g., user ID in a URL) and fails to enforce proper authorization checks. By simply changing the ID parameter, the tester can access other users' private data without authentication or permission validation, which is the hallmark of IDOR.

Answer

Cross-Site Request Forgery (CSRF)

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)