PT0-002 Practice Test 12 — 15 Questions

Question 1

A client requests a penetration test of their network and provides a list of IP addresses. During scoping, the tester notices that several IP addresses belong to a major cloud service provider. What should the tester do FIRST before including those IP addresses in the test?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ask the client to verify ownership and obtain written authorization from the cloud provider if needed. Testing cloud provider IP addresses without explicit authorization violates the cloud provider's terms of service and could be considered unauthorized access, potentially leading to legal action. The tester must first verify that the client actually owns those IPs (e.g., via ARIN WHOIS or cloud provider documentation) and obtain written authorization from the cloud provider, as the provider's shared infrastructure means the tester's traffic could impact other tenants. This aligns with the PT0-002 scoping requirement to confirm all targets are within the authorized boundary.

Answer

Proceed with testing since the client provided the IP addresses

Answer

Exclude the cloud IP addresses from the scope without further discussion

Answer

Perform a quick port scan to determine if the IPs are responsive before deciding

Question 2

A penetration tester is scoping a test for a client that uses a hybrid identity system. The client wants to ensure that the test does not affect production authentication. Which TWO actions should the tester recommend?

Accepted Answer

Test using non-production accounts. Using non-production accounts and a separate test domain isolate the test from production identity systems. Password spraying against all users could disrupt accounts, and disabling MFA may weaken security. Off-peak scheduling reduces impact but does not prevent direct interaction with production systems.

Answer

Conduct testing during off-peak hours

Answer

Perform password spraying against all users

Answer

Disable MFA for test accounts

Question 3

A penetration tester is planning a web application test. The client wants to minimize risk to production data. Which environment should the tester recommend for testing?

Accepted Answer

Staging environment with anonymized data. Testing in a staging environment reduces the risk of impacting live data and systems.

Answer

Development environment with live data

Answer

Production environment with a read-only database

Answer

Production environment with full access

Question 4

After gaining a foothold on a Windows server, a tester wants to laterally move to another machine. The tester has obtained NTLM hashes and wants to execute commands remotely. Which tool is specifically designed for remote command execution using hashes via WMI?

Accepted Answer

wmiexec. wmiexec.py (from Impacket) allows executing commands via WMI using NTLM hashes.

Answer

evil-winrm

Answer

psexec

Answer

CrackMapExec

Question 5

A penetration tester is using theHarvester to gather email addresses associated with a target domain. The tool returns several email addresses. What is the primary limitation of using theHarvester for this purpose?

Accepted Answer

It only finds publicly available email addresses. theHarvester collects data from public sources, so its results are limited to what is publicly available. It may miss internal email addresses and can include outdated information. It does not require authentication, and it is not limited to Google only.

Answer

It requires authentication to the target's mail server

Answer

It only searches Google

Answer

It cannot find subdomains

Question 6

A penetration tester is analyzing a Python script that uses the 'scapy' library to craft custom network packets. The relevant code is: ```python from scapy.all import * packet = IP(dst="192.168.1.1")/TCP(dport=80, flags="S") response = sr1(packet, timeout=2) if response.haslayer(TCP): print(response.getlayer(TCP).flags) ``` What is the primary goal of this script?

Accepted Answer

To perform a SYN scan and determine if port 80 is open. The script uses Scapy to craft a TCP SYN packet (flags='S') to port 80 and sends it with sr1(), which waits for a single response. If a TCP layer is present in the reply, it prints the flags. This is the classic behavior of a SYN scan (half-open scan): it sends a SYN and analyzes the response to determine if the port is open (SYN-ACK) or closed (RST), without completing the handshake. Option B correctly identifies this as a SYN scan to check if port 80 is open.

Answer

To perform a TCP connect scan by completing the three-way handshake

Answer

To send an HTTP GET request and capture the web page

Answer

To perform a UDP scan on port 80

Question 7

A penetration tester has obtained a set of NTLM hashes from a Windows domain. The tester wants to perform lateral movement to other systems. Which TWO tools can be used for this purpose? (Select TWO.)

Accepted Answer

pth-winexe. CrackMapExec and pth-winexe both support pass-the-hash for lateral movement.

Answer

Responder

Answer

Nmap

Answer

Hashcat

Question 8

A penetration tester gains a low-privilege shell on a Linux server. Using 'sudo -l', the tester finds that they can run '/usr/bin/vi' as root without a password. Which technique would the tester MOST likely use to escalate privileges?

Accepted Answer

Use vi to execute a shell as root. GTFOBins lists vi as having a sudo escape, allowing privilege escalation by spawning a root shell. Other options are not directly applicable.

Answer

Exploit a kernel vulnerability

Answer

Modify a cron script

Answer

Perform PATH hijacking

Question 9

A client requests a penetration test but only provides network diagrams and application credentials. Which type of test is being scoped?

Accepted Answer

Grey box. A grey box test provides the tester with limited information such as network diagrams and credentials, which matches the scenario. Black box tests provide no information, white box tests provide full information, and red team engagements are a type of test, not a box color.

Answer

Red team

Answer

Black box

Answer

White box

Question 10

A penetration tester is preparing the final report. The client's CEO needs to understand the overall risk level and the business impact of the findings. Which of the following should be included in the executive summary?

Accepted Answer

A high-level summary of the test's scope, overall risk rating, and business impact. The executive summary is designed for senior management, such as the CEO, who needs a concise overview of the penetration test's scope, overall risk rating, and business impact to make informed decisions. Detailed technical data, such as CVSS scores or exploitation commands, is inappropriate for this audience and belongs in the technical report. Option D directly addresses the requirement for a high-level, business-focused summary.

Answer

A detailed list of all vulnerabilities with CVSS scores

Answer

The exact commands and payloads used during exploitation

Answer

A quantitative risk analysis including annualized loss expectancy

Question 11

A penetration tester is analyzing a Python script used for web application testing. The script imports the 'socket' module and uses it to create a raw socket. Which of the following is the most likely purpose of the script?

Accepted Answer

Sending crafted TCP packets to perform a SYN flood. The 'socket' module in Python provides low-level networking interfaces, and creating a raw socket (using `socket.SOCK_RAW`) allows the script to craft and send custom packets at the IP layer. A SYN flood attack involves sending a high volume of TCP SYN packets with spoofed source IP addresses to exhaust a target's resources, which requires raw socket access to manipulate packet headers. Therefore, the most likely purpose of the script is sending crafted TCP packets to perform a SYN flood.

Answer

Creating a reverse shell payload

Answer

Parsing HTTP responses for header injection

Answer

Automating user-agent rotation for web requests

Question 12

A penetration tester is conducting an internal network assessment. The tester wants to perform a man-in-the-middle attack to capture credentials. Which TWO tools can be used for ARP spoofing?

Accepted Answer

Ettercap. Bettercap and Ettercap are both capable of ARP spoofing.

Answer

Responder

Answer

Nmap

Answer

Hashcat

Question 13

A penetration tester is tasked with performing vulnerability scanning on a target organization that uses a web application firewall (WAF) and an intrusion prevention system (IPS). The tester wants to avoid being blocked while still gathering comprehensive data. Which scanning approach is most effective?

Accepted Answer

Use a slow, distributed scan from multiple IP addresses with random delays. A slow, distributed scan from multiple IP addresses with random delays is most effective because it evades rate-based detection mechanisms in WAFs and IPSs. By spreading the scan across many sources and introducing jitter, the traffic appears as normal user activity rather than a coordinated attack, allowing comprehensive data collection without triggering blocks.

Answer

Perform an aggressive scan with a high thread count to complete before the WAF adapts

Answer

Only perform passive reconnaissance and avoid active scanning

Answer

Use known WAF bypass techniques for each request

Question 14

Refer to the exhibit. A penetration tester is presenting this finding to a non-technical executive. Which improvement should be made to the description?

Accepted Answer

Describe the business impact in plain language. Describing the business impact in plain language helps executives understand the risk without technical jargon.

Answer

Include the CVSS vector

Answer

List the exact database tables affected

Answer

Add a proof-of-concept screenshot

Question 15

A client wants a penetration test that includes testing of their internal network, external perimeter, and wireless. However, they have a very limited budget. Which approach would best meet the client's needs while staying within budget?

Accepted Answer

Conduct a targeted test focusing on high-risk areas identified through threat modeling. Conducting a targeted test focused on high-risk areas identified through threat modeling allows coverage of all three areas with limited depth, maximizing value within budget. Skipping areas or using only automated tools may not meet the client's full requirements.

Answer

Use vulnerability scanners for all three areas

Answer

Only test internal and external

Answer

Only test external and wireless