PT0-002 Practice Test 13 — 15 Questions

Question 1

A penetration tester is performing a vulnerability scan on a target network. The tester uses Nmap with the default NSE scripts against a web server. The scan report shows several 'http-vuln-cve2017-5638' findings. What does this indicate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The target is vulnerable to Apache Struts2 remote code execution. The Nmap script 'http-vuln-cve2017-5638' specifically targets the Apache Struts2 remote code execution vulnerability (CVE-2017-5638). This vulnerability exists in the Jakarta Multipart parser used by Apache Struts2, allowing an attacker to execute arbitrary commands via crafted Content-Type headers. The presence of this finding in the scan report indicates the web server is running a vulnerable version of Apache Struts2.

Answer

The target is vulnerable to the Heartbleed bug in OpenSSL

Answer

The target is vulnerable to the Shellshock Bash vulnerability

Answer

The target has a SQL injection vulnerability

Question 2

A client wants a penetration test of their internal network. They are concerned about causing any disruption to the production systems. The tester should include which of the following in the rules of engagement to address this concern?

Accepted Answer

A clear definition of the testing window and contact information for emergency stop. A clearly defined testing window with emergency stop contact information directly addresses the client's concern about production disruption. This ensures the tester can immediately halt activities if any instability is detected, aligning with the principle of minimizing operational impact during a penetration test.

Answer

A list of all tools that will be used during the test

Answer

A requirement for the client to disable their antivirus software

Answer

A statement that the tester will not be liable for any damages

Question 3

A penetration tester is recommending remediation for a critical vulnerability. Which of the following is the best example of a specific, actionable remediation step?

Accepted Answer

Upgrade Apache from version 2.4.49 to 2.4.51.. Effective remediation should be specific, including exact versions or commands.

Answer

Apply security patches.

Answer

Update the software to the latest version.

Answer

Fix the vulnerability.

Question 4

A penetration tester has completed the test and is writing the findings section. For a critical vulnerability, the tester wants to provide a clear and actionable remediation recommendation. Which of the following is the best practice for writing this recommendation?

Accepted Answer

Provide a step-by-step guide including commands, patches, and configuration changes. A penetration test report must provide actionable remediation that the client can implement immediately. A step-by-step guide with specific commands, patch identifiers, and configuration changes ensures the client can verify and apply the fix without ambiguity, which is critical for a high-severity vulnerability.

Answer

State 'Upgrade the software to the latest version'

Answer

Recommend applying vendor-supplied patches but do not include specific versions

Answer

Suggest hiring a third-party consultant to fix the issue

Question 5

A penetration tester is preparing a deliverable for a client. Which of the following should be included in the final report?

Accepted Answer

Executive summary, technical findings, and remediation guidance. A standard penetration testing report includes an executive summary, technical findings, and remediation guidance.

Answer

The tester's personal notes and observations

Answer

Only the technical findings

Answer

Only the executive summary

Question 6

After gaining initial access to a Windows host, you want to escalate privileges by exploiting a service that runs as SYSTEM but has an unquoted service path. What is the attack vector?

Accepted Answer

Unquoted service path. Unquoted service path vulnerability allows an attacker to place an executable in a path that the service will execute due to ambiguous path parsing.

Answer

Token impersonation

Answer

AlwaysInstallElevated

Answer

DLL hijacking

Question 7

During an internal penetration test, a tester wants to capture NTLMv2 hashes by poisoning LLMNR and NBT-NS traffic. Which tool should the tester use?

Accepted Answer

Responder. Responder is specifically designed to respond to LLMNR and NBT-NS queries and capture NetNTLM hashes.

Answer

ntlmrelayx

Answer

Bettercap

Answer

Hashcat

Question 8

A penetration tester has physical access to a small office. The network switch is in a locked cabinet, but the tester notices the lock is broken. The switch has multiple ports, and the tester wants to connect to the internal network. The tester has a laptop with an Ethernet port. However, the tester suspects that port security is enabled on the switch ports, which would block the connection if the MAC address is not authorized. Which action should the tester take first to gain network access?

Accepted Answer

Connect to the switch's console port and attempt default credentials.. The tester has physical access to the switch and the lock is broken, allowing direct console access. If port security is enabled, plugging into a data port (Option C) would be blocked. The fastest first step is to connect to the console port and try default credentials (e.g., cisco/cisco) to gain administrative control of the switch, which can then be used to disable port security or add the tester's MAC address to the allowed list.

Answer

Perform a MAC flooding attack to fill the switch's MAC table.

Answer

Use a DHCP starvation attack to exhaust IP addresses.

Answer

Plug the laptop into an available switch port.

Question 9

A penetration tester is performing active reconnaissance on a target network and wants to enumerate SNMP devices to gather system information. The tester uses snmpwalk with a common community string. Which community string is most likely to provide read-write access if misconfigured?

Accepted Answer

private. SNMP community strings are like passwords. 'public' is the default read-only community string, 'private' is the default read-write community string. 'internal' and 'manager' are less common defaults. The tester should try 'private' for potential read-write access.

Answer

public

Answer

internal

Answer

manager

Question 10

A client wants to conduct a penetration test of their web application, but they are concerned about potential service disruption. They request that the tester avoid using any techniques that could cause the application to crash or become unresponsive. Which of the following should the tester include in the rules of engagement to address this requirement?

Accepted Answer

Include a clause that prohibits denial-of-service attacks and rate-limits all automated tools.. It directly addresses the client's concern by prohibiting denial-of-service attacks and implementing rate-limiting on automated tools. Rate-limiting prevents overwhelming the web application with requests, which could cause resource exhaustion or unresponsiveness, while the prohibition on DoS ensures no intentional disruption occurs. This aligns with the rules of engagement (RoE) requirement to scope the test safely.

Answer

Specify that the tester will only use ACK scans and never send data payloads.

Answer

State that the tester will not use any automated tools and will perform only manual testing.

Answer

Do not include any specific limitation; the tester assumes responsibility for any outages.

Question 11

During a penetration test, the tester performs a SYN scan with Nmap on a target network. The results show that port 443 is open on a web server. The tester then runs a service version detection scan and discovers the server is running Apache 2.4.41. Which Nmap flags were used in sequence?

Accepted Answer

nmap -sS then nmap -sV. The tester first performed a SYN scan with -sS to identify open ports, then used -sV for service version detection. -sC runs default scripts, -O is for OS detection, and -A enables aggressive scanning (includes OS detection, version detection, script scanning, and traceroute).

Answer

nmap -A then nmap -O

Answer

nmap -sV then nmap -sS

Answer

nmap -sS then nmap -sC

Question 12

After a penetration test, the client's development team requests that the report include specific, actionable remediation steps for each vulnerability. Where in the report should this information be placed?

Accepted Answer

Within the technical report section, under each vulnerability finding. The correct placement for specific, actionable remediation steps is within the technical report section under each vulnerability finding. This aligns with industry best practices (e.g., PTES, OWASP) where each finding includes a description, risk rating, and a dedicated remediation subsection, ensuring developers have immediate context and clear steps without cross-referencing other sections.

Answer

In the executive summary to emphasize the need for fixing vulnerabilities

Answer

In the appendix as a separate remediation checklist

Answer

In a separate document attached to the report to avoid cluttering the main report

Question 13

Which of the following is the primary audience for the executive summary of a penetration test report?

Accepted Answer

Executives and management. The executive summary is written for non-technical stakeholders such as executives and managers, using business language and focusing on risk and strategic recommendations.

Answer

Developers

Answer

External auditors

Answer

System administrators

Question 14

Which THREE of the following are important elements to include in the remediation section of a penetration test report? (Select THREE.)

Accepted Answer

Priority levels (e.g., Critical, High, Medium) based on risk.. Options A, C, and D are correct. Remediation should include specific steps, reference to industry standards, and priority based on risk. Option B is not a standard part of remediation; it's for methodology. Option E is about disclosure, not remediation.

Answer

A list of all external parties notified about the vulnerabilities.

Answer

Detailed timeline of when each finding was discovered.

Question 15

A penetration tester has obtained the NTLM hash of a service account during an internal test. The tester wants to gain access to a specific SQL server that uses Kerberos authentication. The tester does not know the plaintext password. Which attack is MOST appropriate to forge a service ticket for the SQL server?

Accepted Answer

Silver Ticket attack. A Silver Ticket attack is the most appropriate because it forges a service ticket (TGS) for a specific service, such as the SQL server, using the NTLM hash of the service account. Since the tester has the NTLM hash but not the plaintext password, they can craft a valid Kerberos service ticket without needing to authenticate to the domain controller, directly granting access to the SQL server.

Answer

Golden Ticket attack

Answer

Pass-the-hash attack

Answer

SMB relay attack