PT0-002 Practice Test 5 — 10 Questions

Question 1

A penetration tester is writing the technical report for a client. The client's security team needs detailed, step-by-step instructions on how to reproduce each vulnerability found. In which section of the report should this information be placed?

Accepted Answer

Findings and recommendations. The 'Findings and recommendations' section is the correct location for detailed, step-by-step reproduction instructions because it provides the technical depth needed for the client's security team to validate and remediate each vulnerability. This section typically includes exact commands, payloads, and sequences used during testing, aligning with the PT0-002 objective of delivering actionable technical details.

Answer

Executive summary

Answer

Risk rating section

Answer

Appendix

Question 2

A penetration testing firm is hired to assess a client's hybrid infrastructure with on-premises and cloud servers in multiple regions. The client specifies testing only the on-premises systems due to budget and compliance. Which of the following should the tester emphasize in the rules of engagement (ROE)?

Accepted Answer

Explicit exclusion of all cloud-based assets. The client explicitly restricted testing to on-premises systems due to budget and compliance. The rules of engagement (ROE) must clearly define the authorized scope to prevent accidental testing of cloud assets, which could violate the contract and potentially breach the cloud provider's terms of service. Option B is correct because explicitly excluding all cloud-based assets ensures the tester does not touch any cloud resources, aligning with the client's constraints.

Answer

Detailed network diagrams of the cloud environment

Answer

Approval from the cloud service provider

Answer

A list of all cloud API endpoints

Question 3

A penetration tester needs to describe a stored XSS vulnerability to a web developer who will fix it. Which level of detail is most appropriate for this audience?

Accepted Answer

Include the specific vulnerable URL, the request parameters, the payload used, and a code snippet for proper output encoding.. Option C is correct because a web developer needs precise, actionable technical details to remediate the vulnerability: the exact URL, request parameters, the payload that triggered the stored XSS, and a code snippet showing proper output encoding (e.g., using OWASP ESAPI or context-specific escaping). This level of detail enables the developer to locate the vulnerable code, understand the injection point, and apply the correct fix without ambiguity.

Answer

Provide the CVSS score and risk rating.

Answer

Describe the business impact and potential regulatory fines.

Answer

Use a graph showing the number of vulnerabilities by severity across the application.

Question 4

A penetration tester with a low-privileged domain user account performs a Kerberoasting attack. What is the primary goal of this attack?

Accepted Answer

Obtain the plaintext password of a user account with a Service Principal Name (SPN).. Kerberoasting targets service accounts that have a Service Principal Name (SPN) registered in Active Directory. The attacker requests a Kerberos service ticket (TGS) for the SPN, which is encrypted with the service account's NTLM hash. The attacker then cracks this hash offline to recover the plaintext password, enabling lateral movement or privilege escalation.

Answer

Obtain the NTLM hash of the krbtgt account.

Answer

Obtain a list of all domain users.

Answer

Obtain a Kerberos ticket that can be used to impersonate a domain admin.

Question 5

A penetration tester writes a Python script to test for directory traversal vulnerabilities in a web application. The script uses the requests library to send a payload like '../../etc/passwd' and checks if the response contains the string 'root:'. However, the tester notices many false negatives because the application requires URL encoding of the dots and slashes. Which code modification would BEST improve the detection rate?

Accepted Answer

URL-encode the payload using urllib.parse.quote(). Option B is correct because the penetration tester's script is failing to detect directory traversal vulnerabilities due to the web application requiring URL-encoded characters. By using `urllib.parse.quote()` to URL-encode the dots and slashes in the payload (e.g., `%2e%2e%2f` for `../`), the request matches the application's expected input format, reducing false negatives. This directly addresses the root cause—encoding—rather than adding more payloads or changing the detection method.

Answer

Increase the number of payloads in the list

Answer

Check the HTTP status code instead of response content

Answer

Use raw sockets to send HTTP requests manually

Question 6

A small business hires a penetration tester to assess the security of their network. The owner is concerned about employee data breaches and wants to ensure compliance with industry regulations. Which of the following is the MOST critical document to establish before the test begins?

Accepted Answer

Rules of engagement. The Rules of Engagement (RoE) is the most critical document because it defines the legal boundaries, scope, and authorization for the penetration test. Without a signed RoE, the tester has no legal protection and the test could be considered unauthorized access, violating laws like the Computer Fraud and Abuse Act (CFAA). It also specifies key constraints such as testing times, target IP ranges, and prohibited actions, ensuring compliance with industry regulations like PCI DSS or HIPAA.

Answer

Vulnerability scan report

Answer

Penetration test report

Answer

Risk assessment matrix

Question 7

A penetration tester is scoping an engagement for a client that hosts a public-facing web application and an internal database server. The client wants to ensure that testing does not cause any disruption to the database server. Which of the following should the tester include in the rules of engagement to address this concern?

Accepted Answer

Define the database server as an out-of-scope target.. Option C is correct because defining the database server as out-of-scope explicitly removes it from all testing activities, ensuring zero disruption as requested. This is the only option that fully prevents any interaction with the database server, including passive reconnaissance or exploitation attempts, which could still cause unintended load or queries.

Answer

Specify that only passive reconnaissance techniques will be used on the database server.

Answer

Include a clause that the tester will not attempt to exploit any vulnerabilities on the database server.

Answer

Require that all testing activities be performed during off-peak hours only.

Question 8

A penetration tester is writing a Bash script to automate enumeration of a Linux system after gaining a shell. The script needs to extract user information from the /etc/passwd file. Which command would be most efficient for listing only the usernames?

Accepted Answer

cat /etc/passwd | cut -d: -f1. Option A is correct because the `cut` command with `-d: -f1` splits each line of /etc/passwd on the colon delimiter and extracts the first field, which is the username. This is the most efficient and purpose-built approach for parsing colon-delimited files in Linux, avoiding unnecessary overhead from other tools.

Answer

cat /etc/passwd | awk '{print $1}'

Answer

cat /etc/passwd | head

Answer

grep 'user' /etc/passwd

Question 9

During a penetration test, a tester gains shell access on a Linux server as a low-privileged user. The user is identified to be a member of the 'docker' group. Which technique is most effective for escalating privileges to root?

Accepted Answer

Use docker to mount the entire host filesystem and modify the root password.. Membership in the 'docker' group grants the user effective root-equivalent access because the Docker daemon runs as root and allows any member of the 'docker' group to issue commands that can mount arbitrary host paths. By running a container with the host filesystem mounted (e.g., `docker run -v /:/mnt --privileged -it alpine chroot /mnt`), the tester can directly modify the `/etc/shadow` file or the root password, thereby escalating privileges to root without needing any additional exploit.

Answer

Use docker to run a container with network host mode to access internal services.

Answer

Use docker to pull a malicious image from the internet to compromise other containers.

Answer

Use docker to create a new user with root privileges inside a container.

Question 10

A penetration testing firm is hired to assess a healthcare organization's network. The client has strict regulatory requirements (HIPAA) and wants to ensure that all patient data is protected during testing. Which scoping document should specify the data handling procedures and the destruction of any collected sensitive information?

Accepted Answer

Data Protection Addendum. A Data Protection Addendum (DPA) or equivalent data handling agreement is the appropriate document to define how sensitive data will be handled, stored, and destroyed. The Rules of Engagement cover authorization and constraints, but specific data protection clauses are often in a separate addendum or included in the contract. The Methodology and Scope of Work do not typically detail data destruction procedures.

Answer

Rules of Engagement

Answer

Testing Methodology

Answer

Scope of Work