PT0-002 Practice Test 12 — 15 Questions

Question 1

A client with a hybrid on-premises and cloud infrastructure requests a penetration test. The client uses an IaaS provider for some servers. Which of the following is the MOST important aspect to clarify in the rules of engagement regarding the cloud environment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The authorization from the cloud provider for testing. The most critical aspect to clarify in the rules of engagement for a cloud environment is obtaining explicit authorization from the IaaS provider. Without this authorization, the penetration test may violate the provider's acceptable use policy or terms of service, potentially leading to legal action or service termination. This is a foundational scoping requirement because the client does not own the underlying infrastructure; the cloud provider retains control over the network and hypervisor layers.

Answer

The list of operating systems used in the cloud

Answer

The public IP addresses of the cloud servers

Answer

The budget allocated for cloud testing

Question 2

A penetration tester is conducting a vulnerability scan of a web application that uses a custom API framework. The scanner reports several potential SQL injection vulnerabilities, but manual testing confirms they are false positives. The tester suspects the scanner is misinterpreting input validation. Which of the following is the most likely reason for these false positives?

Accepted Answer

The application reflects the injected payload in error messages or response content, causing the scanner to think the injection succeeded. The scanner likely detected the injected payload reflected in the application's response (e.g., in an error message or echoed input), which it interpreted as successful SQL execution. In custom API frameworks, input validation may reject the payload but still reflect it back in the response, causing the scanner to flag a false positive. Manual testing confirms the injection fails, so the reflection is merely a side effect of the API's error handling, not a sign of database interaction.

Answer

The scanner used a payload that was blocked by a Web Application Firewall (WAF) before reaching the application

Answer

The scanner used outdated signatures that do not match the custom API's input validation logic

Answer

The application returns a generic 'Invalid input' message for all types of invalid input, confusing the scanner

Question 3

A client wants a penetration test that simulates an external threat actor with no prior access. The client provides a list of public IP ranges and domain names. Which type of test is this?

Accepted Answer

External black-box test.. This is an external black-box test because the client provides only public IP ranges and domain names, simulating an external threat actor with no prior access. The tester has no internal knowledge or credentials, which defines a black-box approach, and the scope is limited to external-facing assets, making it external.

Answer

Internal white-box test.

Answer

Gray-box test.

Answer

Red team exercise.

Question 4

A client engages a penetration testing firm to evaluate the security of their internal network. During the scoping meeting, the client states that they use a network access control (NAC) solution that might block the tester's machine if it is connected to the internal network without prior authorization. Which of the following should be included in the rules of engagement to address this potential issue?

Accepted Answer

Add a clause requiring the client to whitelist the tester's MAC address in the NAC policy before testing.. Whitelisting the tester's MAC address in the NAC policy allows the tester's machine to connect to the internal network without being blocked, while keeping the NAC solution active for other devices. This approach preserves the real-world security posture of the client's environment and ensures the tester can perform internal network assessments as scoped. It is a standard practice in penetration testing to request MAC address whitelisting to avoid false positives from NAC enforcement.

Answer

Include a requirement that the client disables NAC during the testing window.

Answer

State that the tester will not connect to the internal network and will only test externally.

Answer

Specify that the tester will bypass NAC as part of the test objectives.

Question 5

A penetration tester is analyzing a Bash script that performs network scanning. The script contains the following command: 'for ip in $(seq 1 254); do hping3 -S -p 22 -c 1 $TARGET_SUBNET.$ip 2>/dev/null | grep -q "flags=SA" && echo "$TARGET_SUBNET.$ip: open"; done'. What is the primary purpose of this script?

Accepted Answer

Conduct a TCP SYN scan to identify hosts with port 22 open. The script uses hping3 with the -S flag (SYN) and -p 22 (port 22) to send TCP SYN packets to each IP in the target subnet. The grep -q 'flags=SA' checks for a SYN-ACK response, which indicates the port is open and listening. This is the classic behavior of a TCP SYN scan (half-open scan) to identify hosts with port 22 open.

Answer

Perform a vulnerability assessment against SSH services

Answer

Execute an ICMP ping sweep to discover live hosts

Answer

Complete a full TCP three-way handshake and log successful connections

Question 6

A penetration tester wants to quickly identify the listening services on a target Linux server without performing a full port scan. The tester has obtained an unauthenticated shell as a low-privileged user. Which built-in command is most likely available on a modern Linux distribution to list all listening TCP sockets?

Accepted Answer

ss -tlnp. `ss -tlnp` is the modern replacement for `netstat` on Linux distributions that have deprecated `netstat` (e.g., RHEL 7+, Ubuntu 16.04+). It uses the `netlink` interface to read socket information directly from the kernel, making it faster and more reliable than parsing `/proc/net/tcp`. The flags `-t` (TCP), `-l` (listening), `-n` (numeric addresses/ports), and `-p` (show process) precisely list all listening TCP sockets without requiring root privileges for basic socket listing.

Answer

netstat -tlnp

Answer

lsof -i

Answer

ifconfig -a

Question 7

A penetration tester is analyzing a Python script that uses the Impacket library to perform an SMB relay attack. The script is failing to capture NTLM hashes from target machines. Which part of the script is MOST likely misconfigured?

Accepted Answer

The listener IP address. In an SMB relay attack using Impacket, the listener IP address must be set to the attacker's IP address where the relayed authentication is received. If the listener IP is misconfigured (e.g., set to the target's IP or left as localhost), the relay server will not receive the forwarded NTLM hashes, causing the capture to fail. This is a common configuration error when using Impacket's 'smbrelayx' or similar scripts.

Answer

The target IP address

Answer

The SMB version negotiation

Answer

The authentication method (NTLMv1 vs NTLMv2)

Question 8

A penetration tester has gained low-privilege shell access on a Linux server. The tester runs `sudo -l` and sees the following entry: `(root) NOPASSWD: /usr/bin/python3 /opt/scripts/*.py` The `/opt/scripts/` directory is owned by the tester's current user. Which technique is most effective for escalating privileges to root?

Accepted Answer

Write a malicious Python script to /opt/scripts/ that spawns a root shell. The tester's user owns `/opt/scripts/` and can write arbitrary files there. The sudo rule allows executing any `.py` file in that directory as root without a password. By writing a Python script that calls `os.setuid(0); os.system('/bin/bash')` or similar, the tester can spawn a root shell, directly leveraging the misconfigured sudoers entry.

Answer

Create a symbolic link from a Python script to a system file like /etc/shadow

Answer

Exploit a kernel vulnerability to overwrite the sudo binary

Answer

Overwrite an existing Python script in /usr/bin/ with a malicious payload

Question 9

A penetration tester is writing the findings section of a report. The tester identified a critical SQL injection vulnerability that allows extraction of the entire customer database. The client's technical team has already remediated the issue. How should the tester present this finding to ensure clarity and usefulness?

Accepted Answer

Document the vulnerability in full, including reproduction steps, impact, and evidence, and note the remediation status. Penetration testing standards (e.g., PTES, OWASP) require full documentation of all findings regardless of remediation status. Including reproduction steps, impact analysis, and evidence ensures the report serves as a permanent record for compliance, audit, and future reference. Noting the remediation status provides clear context that the issue has been resolved, which is critical for stakeholders who need to verify the fix.

Answer

Include the vulnerability with the risk rating, a brief description, and a note that it was remediated during the test

Answer

Exclude the vulnerability from the report because it has already been fixed

Answer

Reduce the risk rating of the vulnerability because it has been fixed, and include it in an appendix

Question 10

After completing a penetration test, the lead tester is preparing the executive summary. The client's CISO wants to understand the business impact of a critical vulnerability found in the customer-facing web application. Which of the following is the BEST way to convey this in the report?

Accepted Answer

Describe the attack scenario and potential financial loss. The executive summary must communicate business risk, not technical details. Describing the attack scenario and potential financial loss directly addresses the CISO's need to understand the business impact, such as revenue loss from a data breach or regulatory fines. This aligns with the PT0-002 objective of tailoring reports to the audience, where executives require risk context rather than exploit mechanics.

Answer

List the CVSS score and exploitability metrics

Answer

Provide the raw log entries showing the exploitation

Answer

Recommend a specific patch version

Question 11

During a penetration test, a vulnerability scanner reports a critical SQL injection vulnerability in a web application. However, manual testing shows that the parameter is not injectable due to proper parameterized queries. Which of the following is the MOST likely cause of this false positive?

Accepted Answer

The scanner matched a generic error message that is not specific to SQL injection. A vulnerability scanner often relies on pattern matching in HTTP responses to flag SQL injection. If the application returns a generic error message (e.g., 'An error occurred') after sending a malicious payload, the scanner may incorrectly classify it as SQL injection. However, because the application uses parameterized queries, the payload is safely handled, and the error is unrelated to SQL syntax — making this a classic false positive caused by generic error message matching.

Answer

The scanner used a payload that caused a different error unrelated to SQL injection

Answer

The scanner detected a stored XSS instead

Answer

The scanner tested a different parameter than what was reported

Question 12

A penetration testing firm has been hired to test the internal network of a large enterprise. During the scoping meeting, the client states that they want to include all IP ranges, including those used by the HR department's sensitive systems. The tester should recommend which of the following to minimize business impact and avoid disruption?

Accepted Answer

Perform the test during off-peak hours and provide prior notification. Performing the test during off-peak hours and providing prior notification minimizes business impact by reducing the likelihood of disrupting critical HR operations during normal business hours. This approach aligns with the scoping requirement to include all IP ranges while allowing the client to prepare for potential service interruptions, such as those caused by active scanning techniques like TCP SYN scans or service enumeration. Prior notification ensures that HR staff can take precautions, such as backing up sensitive data or pausing batch jobs, thereby avoiding data corruption or system unavailability.

Answer

Exclude the HR department's IP range from the test

Answer

Use only passive reconnaissance techniques on the HR systems

Answer

Include the HR systems but require written authorization from HR management

Question 13

A penetration tester is performing a wireless penetration test. The RoE states that testing is only allowed between 8 PM and 6 AM. At 7:30 PM, the tester begins active scanning. At 8:15 PM, a client employee calls emergency contact to report suspicious activity. According to the RoE, which of the following is the most likely reason for the call?

Accepted Answer

The tester started testing outside the agreed time window. The tester started active scanning before the allowed window (8 PM), which violated the RoE and triggered an incident.

Answer

The tester used an unauthorized tool

Answer

The tester targeted an out-of-scope access point

Answer

The tester exceeded the allowed signal strength

Question 14

After completing a penetration test, the tester is writing the report. The client's Chief Information Security Officer (CISO) is the primary audience and wants to understand the overall security posture and the most critical risks to the business. Which section of the report should the tester most heavily focus on for this audience?

Accepted Answer

Executive Summary. The Executive Summary is the section of a penetration test report that provides a high-level overview of the security posture, focusing on business risks and strategic recommendations. For a CISO, who needs to understand the most critical risks to the business without delving into technical details, this section is the most relevant. It translates technical vulnerabilities into business impact, aligning with the CISO's role in risk management and decision-making.

Answer

Technical Findings

Answer

Appendix - Vulnerability Details

Answer

Methodology

Question 15

A penetration tester is planning a social engineering campaign against a corporation. The goal is to trick the CEO into revealing sensitive information. Which type of attack should the tester use?

Accepted Answer

Whaling. Whaling is a targeted form of phishing that specifically focuses on high-profile individuals, such as the CEO. In this scenario, the goal is to trick the CEO into revealing sensitive information, making whaling the correct choice because it is designed to impersonate trusted entities or create urgent scenarios to deceive senior executives.

Answer

Vishing

Answer

Spear phishing

Answer

Pharming