PT0-002 Practice Test 12 — 15 Questions

Question 1

A penetration tester has completed the test and is writing the executive summary. The CEO wants to understand the overall security posture without technical jargon. Which of the following is the best approach for the executive summary?

Accepted Answer

Provide a high-level overview of the most critical risks, business impact, and recommended strategic improvements.. Option B is correct because an executive summary must communicate the overall security posture in business terms, not technical details. The CEO needs to understand the most critical risks, their potential business impact (e.g., financial loss, reputational damage), and recommended strategic improvements—this aligns with the PT0-002 objective of tailoring reports to the audience. Including CVSS scores or step-by-step attack reproductions would overwhelm non-technical readers and fail to convey the big-picture risk.

Answer

List every vulnerability with its CVSS score and technical remediation steps.

Answer

Include a detailed step-by-step reproduction of all attack scenarios.

Answer

Focus only on network vulnerabilities and omit application-level findings.

Question 2

A penetration tester has completed the test and is writing the technical report. The client's security team is highly skilled and wants detailed information about each vulnerability, including the exact request/response used to exploit it. The team also wants to understand the potential impact on the business. Which of the following is the best way to structure the findings for this audience?

Accepted Answer

Include a separate 'Executive Summary' section that covers business impact, and a 'Technical Appendix' with detailed reproduction steps.. Option B is correct because it separates the business impact discussion into an Executive Summary for the client's leadership while providing the detailed technical reproduction steps (exact request/response pairs) in a Technical Appendix, satisfying the highly skilled security team's need for granular exploit details without diluting the business risk narrative.

Answer

Provide only a list of CVSS scores and short descriptions.

Answer

Combine business impact and technical details in a single paragraph for each finding.

Answer

Omit technical details to keep the report concise.

Question 3

A penetration tester is analyzing a Python script that uses the 'paramiko' library. The script reads a list of IP addresses from a file and attempts to connect to each host using the same username and a list of common passwords. Which attack technique is the script most likely performing?

Accepted Answer

Brute-force attack against SSH credentials. The script uses the 'paramiko' library, which is a Python implementation of the SSHv2 protocol. By reading a list of IP addresses and attempting connections with the same username and a list of common passwords, it is performing a brute-force attack against SSH credentials. This technique systematically tries multiple password guesses to gain unauthorized access to SSH services.

Answer

SQL injection attack against a database

Answer

Cross-site scripting (XSS) attack against a web application

Answer

ARP spoofing attack to intercept network traffic

Question 4

A penetration tester is analyzing a Python script that uses the 'socket' module to create a TCP connection to a target IP and port. The script then sends a payload (e.g., 'GET / HTTP/1.0

') and waits for a response. Which tool function is this script most likely performing?

Accepted Answer

Banner grabbing. The script creates a TCP connection, sends an HTTP GET request, and waits for a response. This is the classic behavior of banner grabbing, where the goal is to retrieve the service banner (e.g., HTTP server version) from the target. The 'socket' module is used to manually craft the connection and payload, which is a low-level technique for service identification, not for scanning multiple ports or assessing vulnerabilities.

Answer

Port scanning

Answer

Vulnerability scanning

Answer

Password cracking

Question 5

A penetration tester is analyzing a Python script that uses the 'paramiko' library to automate SSH key-based authentication across multiple servers. The script fails with 'AuthenticationException' for some servers that the tester is certain have the correct private key configured. Which of the following is the most likely cause of this failure?

Accepted Answer

The SSH server host key is not in the known_hosts file.. The 'paramiko' library in Python handles SSH key-based authentication by first verifying the server's host key against the known_hosts file. If the host key is missing or mismatched, paramiko raises an AuthenticationException before even attempting client key authentication, even if the private key is correct. This is because paramiko enforces host key verification by default to prevent man-in-the-middle attacks, and a failure at this stage blocks the authentication process entirely.

Answer

The servers are running a different SSH version.

Answer

The public key is not in the server's authorized_keys file.

Answer

The username specified is incorrect.

Question 6

A penetration testing firm is scoping a test for a client that uses a hybrid infrastructure with both on-premises servers and cloud-based services (IaaS). The client specifies that only the cloud environment should be tested this year. Which concept is MOST important for the tester to discuss during the scoping meeting to avoid testing out-of-scope assets?

Accepted Answer

The shared responsibility model between the client and the cloud provider. The shared responsibility model defines which security controls and operational tasks are managed by the cloud provider versus the client. In a scoping meeting, understanding this model is critical because the penetration tester must only target the client's side of the responsibility boundary (e.g., guest OS, applications, and IaaS configurations) and avoid testing the provider's underlying infrastructure, which is out-of-scope. Without this discussion, the tester could inadvertently probe the provider's hypervisor or physical network, violating the scope agreement and potentially causing legal or contractual issues.

Answer

The need to test on-premises systems as well to get a complete picture

Answer

The potential for false positives in cloud vulnerability scanners

Answer

The cost of third-party cloud penetration testing tools

Question 7

A penetration tester is writing the executive summary for a report. The client's CEO needs to understand the business impact of a critical SQL injection vulnerability. Which of the following should the tester include?

Accepted Answer

The potential for data breach and financial loss. The CEO needs to understand the business impact, not technical details. Option C directly addresses the core concern: a SQL injection vulnerability can lead to unauthorized data access, resulting in a data breach and significant financial loss from fines, remediation costs, and reputational damage. This aligns with the executive summary's goal of translating technical risk into business risk.

Answer

The exact SQL injection payload used

Answer

The CVSS vector string

Answer

The remediation steps in detail

Question 8

A penetration tester is analyzing a Python script that uses the 'requests' library to send HTTP requests with a custom header that mimics a mobile device. The script also uses 'beautifulsoup4' to parse the response and extract specific data. Which task is this script most likely performing?

Accepted Answer

Web scraping to gather publicly available information.. The script uses the 'requests' library to send HTTP requests with a custom header mimicking a mobile device, and 'beautifulsoup4' to parse the HTML response and extract data. This combination is specifically designed for web scraping, where the custom header helps avoid bot detection by making the request appear to come from a mobile browser, and BeautifulSoup extracts targeted information from the page structure.

Answer

Fuzzing for SQL injection.

Answer

Performing a brute-force attack on a login form.

Answer

Testing for directory traversal vulnerabilities.

Question 9

A penetration tester is performing passive reconnaissance on a target organization. The tester wants to gather information about the target's technology stack, including web server software and frameworks, without directly interacting with the target systems. Which technique is most effective?

Accepted Answer

Querying public records with BuiltWith. BuiltWith is a passive reconnaissance tool that queries public web data and DNS records to identify a target's technology stack, such as web server software (e.g., Apache, Nginx) and frameworks (e.g., React, Django), without sending any packets to the target's systems. This makes it ideal for passive information gathering, as it relies on third-party databases and cached information rather than direct interaction.

Answer

Running Nmap with the -A flag against the target's public IP range

Answer

Using theHarvester to search for email addresses and subdomains

Answer

Performing a DNS zone transfer

Question 10

A penetration tester runs the following command: nmap -sS -p 1-65535 -T4 -A -O --reason target. What is the primary purpose of the -A option in this command?

Accepted Answer

Enables OS detection, version detection, script scanning, and traceroute.. The -A option in nmap is a composite flag that enables OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (--traceroute) in a single switch. This is explicitly documented in nmap's man page and is designed to provide comprehensive reconnaissance in one command, making option A correct.

Answer

Sets the timing template to aggressive (level 4).

Answer

Enables aggressive scanning that is more likely to be detected by the target.

Answer

Performs a SYN (half-open) scan.

Question 11

After completing a penetration test, the client's technical team requests the detailed raw data (e.g., scan results, exploit logs, packet captures) used to support the findings. According to best practices, which of the following should the penetration tester do?

Accepted Answer

Provide the raw data in a separate, sanitized deliverable with a data handling agreement. Option B is correct because raw data such as scan results, exploit logs, and packet captures often contain sensitive information like IP addresses, credentials, or system details. Best practices (e.g., PTES, NIST SP 800-115) dictate that raw data should be provided in a separate, sanitized deliverable accompanied by a data handling agreement to ensure confidentiality and proper data governance, rather than embedding it directly in the final report.

Answer

Include all raw data in the appendices of the final report

Answer

Refuse to provide raw data to protect the confidentiality of the testing process

Answer

Provide the raw data only if the client signs a non-disclosure agreement

Question 12

A penetration testing firm is hired to assess a client's web application that integrates with a third-party payment processor's API. The client wants to include the payment processor's API in the test scope. Which action should the tester take FIRST?

Accepted Answer

Request written permission from the payment processor. The correct first action is to request written permission from the payment processor because the API is owned and operated by a third party, not the client. Testing a third-party API without explicit authorization could violate the Computer Fraud and Abuse Act (CFAA) and the payment processor's terms of service, potentially leading to legal liability for both the tester and the client. The scope of a penetration test must be legally defined and agreed upon by all parties whose systems are being tested.

Answer

Begin testing the API because it is part of the client's environment

Answer

Only test the client's internal systems, excluding the API

Answer

Use the payment processor's sandbox environment without notifying them

Question 13

A penetration tester is performing passive reconnaissance against a target domain. Which of the following resources can be used to gather information about the target without directly sending packets to the target's network? (Select two.) (Choose 2.)

Accepted Answer

Shodan. Shodan is a search engine that scans the internet for devices and services, indexing banners and metadata from publicly exposed systems. Since it queries its own pre-collected database rather than sending packets to the target's network, it qualifies as passive reconnaissance. This allows a penetration tester to discover open ports, services, and even specific vulnerabilities associated with the target domain without direct interaction.

Answer

Nmap

Answer

hping3

Question 14

A penetration tester is analyzing a Bash script used for post-exploitation enumeration. The script contains the line: `cat /etc/shadow | awk -F: '{print $1, $2}'`. What is the primary purpose of this command?

Accepted Answer

Display all usernames and their associated password hashes. The command `cat /etc/shadow | awk -F: '{print $1, $2}'` reads the shadow file, which stores user account information including password hashes. The `-F:` sets the field separator to colon, and `{print $1, $2}` outputs the first field (username) and second field (password hash). This is a common post-exploitation technique to extract password hashes for offline cracking.

Answer

Show the number of users in the system

Answer

Extract the usernames and home directories

Answer

List the account expiration dates

Question 15

A penetration tester is analyzing a Bash script that uses the tool 'curl' to send HTTP requests. The script contains the following line: curl -X POST -d "username=admin&password[$ne]=a" http://target/login. Which type of attack is this script most likely attempting?

Accepted Answer

NoSQL Injection. The payload `password[$ne]=a` uses MongoDB's `$ne` (not equal) operator, which is a NoSQL query operator. When the backend parses this as a MongoDB query, it will match any document where the password is not equal to 'a', effectively bypassing authentication. This is a classic NoSQL injection attack, not SQL injection, because the syntax targets NoSQL databases like MongoDB.

Answer

Cross-Site Scripting (XSS)

Answer

SQL Injection

Answer

Directory Traversal