PT0-002 Practice Test 13 — 15 Questions

Question 1

A penetration tester has gained a low-privileged shell on a Linux server. During enumeration, the tester discovers a binary with the SUID bit set that belongs to root and is known to have a buffer overflow vulnerability. What is the MOST effective next step to escalate privileges?

Accepted Answer

Develop and execute a buffer overflow exploit against the binary to gain a root shell. The SUID binary owned by root and vulnerable to a buffer overflow allows a low-privileged user to execute it with root privileges. Developing and executing a buffer overflow exploit against the binary will overwrite the return address or function pointer to spawn a root shell, directly escalating privileges to root. This is the most effective method because it leverages the existing vulnerability to gain full control without relying on other misconfigurations.

Answer

Use the binary to execute a command that changes the root password

Answer

Modify the binary's permissions to allow execution by any user

Answer

Use sudo to run the binary as root

Question 2

A penetration tester is writing the executive summary of a penetration test report. Which of the following elements is MOST important to include for a non-technical audience?

Accepted Answer

A high-level summary of the overall risk and key findings. C is correct because the executive summary is intended for a non-technical audience, such as senior management or stakeholders, who need a concise overview of the organization's security posture. A high-level summary of the overall risk and key findings communicates the business impact and strategic priorities without overwhelming them with technical details. This aligns with the PT0-002 objective of tailoring communication to the audience, ensuring the report drives decision-making rather than technical analysis.

Answer

Detailed list of all ports and services found

Answer

CVSS scores for every vulnerability

Answer

Raw tool output from vulnerability scans

Question 3

A penetration tester has obtained a TGT from a domain controller by cracking the krbtgt hash. Which attack can the tester now perform to gain persistent administrative access to any resource in the domain?

Accepted Answer

Golden Ticket. A Golden Ticket attack is the correct answer because the tester has cracked the krbtgt hash, which is the key used by the Key Distribution Center (KDC) to sign all Ticket Granting Tickets (TGTs). With this hash, the tester can forge a TGT for any user (including a domain admin) with an arbitrary long validity period, granting persistent administrative access to any resource in the domain without needing to interact with the domain controller again.

Answer

Pass-the-Hash

Answer

Silver Ticket

Answer

DCSync

Question 4

A penetration tester is writing the executive summary for the final report. The CEO needs to understand the overall risk level and the business impact of the findings. Which of the following should be included in the executive summary?

Accepted Answer

A high-level overview of the most critical vulnerabilities and their potential business impact.. The executive summary is intended for non-technical stakeholders like the CEO, who need to grasp the overall risk posture and business implications without technical jargon. Option A provides a high-level overview of critical vulnerabilities and their potential business impact, directly addressing the CEO's need to understand risk level and business impact, which aligns with the PT0-002 objective for effective reporting and communication.

Answer

Detailed exploit steps with screenshots.

Answer

A list of all CVSS scores without context.

Answer

The exact commands used during testing.

Question 5

A penetration tester is writing the executive summary of a report for a client. The client's executive team needs to understand the overall risk posture. Which of the following should be included in the executive summary?

Accepted Answer

A high-level overview of the test's objectives, scope, and key findings with business impact. The executive summary is intended for non-technical leadership who need to grasp the overall risk posture quickly. Option C provides a high-level overview of objectives, scope, and key findings with business impact, which aligns with the PT0-002 objective of tailoring communication to the audience. Detailed technical data like replication steps or raw CVSS scores belong in the technical report, not the executive summary.

Answer

Detailed step-by-step replication steps for each vulnerability

Answer

A list of all CVSS scores for each finding

Answer

Raw scan output from vulnerability scanners

Question 6

A penetration tester has exploited a web application and found that the server has an outbound firewall that restricts all outbound traffic except for DNS queries (UDP 53). The tester has a reverse shell payload that connects back on TCP 443. Which technique can the tester use to exfiltrate data or establish a channel?

Accepted Answer

Use dnscat2 or other DNS tunneling tool. Option C is correct because DNS tunneling tools like dnscat2 encode data within DNS queries and responses, allowing the tester to bypass outbound firewall restrictions that only permit UDP 53 traffic. Since the reverse shell payload uses TCP 443, which is blocked, DNS tunneling provides an alternative covert channel that encapsulates the communication within legitimate DNS lookups, effectively exfiltrating data or establishing a command-and-control channel over the allowed protocol.

Answer

Use netcat to send data over TCP 53

Answer

Use an SSH tunnel over UDP 53

Answer

Use a bind shell listening on TCP 443 internally

Question 7

A penetration tester has completed the test and is preparing the final report. The client requested a risk rating for each vulnerability. Which of the following frameworks is MOST commonly used to standardize vulnerability severity ratings in penetration testing reports?

Accepted Answer

CVSS. CVSS (Common Vulnerability Scoring System) is the industry-standard framework for assigning numeric severity scores (0-10) to vulnerabilities based on metrics like attack vector, complexity, and impact. Penetration testers use CVSS scores to provide consistent, quantitative risk ratings that clients can compare across findings. OWASP Top 10 is a list of web application risk categories, not a scoring system, and CVE is a vulnerability identifier database, not a rating framework.

Answer

OWASP Top 10

Answer

CVE

Answer

NIST SP 800-115

Question 8

A penetration tester is analyzing a Bash script that performs network scanning. The script contains the following command: 'for ip in $(seq 1 254); do hping3 -S -p 22 -c 1 $TARGET_SUBNET.$ip 2>/dev/null | grep -q "flags=SA" && echo "$TARGET_SUBNET.$ip: open"; done'. What is the primary purpose of this script?

Accepted Answer

Conduct a TCP SYN scan to identify hosts with port 22 open. The script uses hping3 with the -S flag (SYN) and -p 22 (port 22) to send TCP SYN packets to each IP in the target subnet. The grep -q 'flags=SA' checks for a SYN-ACK response, which indicates the port is open and listening. This is the classic behavior of a TCP SYN scan (half-open scan) to identify hosts with port 22 open.

Answer

Perform a vulnerability assessment against SSH services

Answer

Execute an ICMP ping sweep to discover live hosts

Answer

Complete a full TCP three-way handshake and log successful connections

Question 9

A penetration tester is analyzing a Python script that uses the 'socket' library. The script creates a socket, connects to a target IP and port, sends a payload, and then receives a response. The script is most likely designed for which type of attack?

Accepted Answer

Buffer overflow exploit. The script uses the 'socket' library to create a raw TCP connection, send a payload, and receive a response. This pattern is characteristic of a buffer overflow exploit, where a crafted payload is sent to trigger a memory corruption vulnerability, often followed by receiving a shell or error response. The direct send-and-receive cycle with a specific payload aligns with exploitation, not reconnaissance or authentication testing.

Answer

Port scanning

Answer

Brute-force attack

Answer

SQL injection

Question 10

A company wants to test the security of their internet-facing web application without impacting production servers or user data. The tester must be authorized to attempt authentication bypass and SQL injection. Which item is most critical to include in the scope definition to ensure the test is focused and lawful?

Accepted Answer

A list of target URLs and IP addresses of the web application. Option B is correct because the scope definition must explicitly list target URLs and IP addresses to establish legal authorization boundaries and prevent unintended access to production systems. Without precise targets, the tester could inadvertently impact non-authorized systems, violating the rules of engagement and potentially causing data breaches or service disruption.

Answer

A list of user accounts with credentials for authenticated testing

Answer

A detailed testing schedule and hours of operation

Answer

The testing methodology and tools to be used

Question 11

A penetration tester is analyzing a PowerShell script used for post-exploitation on a Windows domain. The script contains the following line: Invoke-Command -ComputerName $target -ScriptBlock { get-process -Name "explorer" }. What is the primary purpose of this command?

Accepted Answer

To check if a user is logged in on the remote system. The `Get-Process -Name 'explorer'` command retrieves the Explorer process, which runs only when a user is interactively logged into the Windows desktop. If the command returns a process object, it confirms a user session is active on the remote system. This is a common post-exploitation technique to verify user presence before executing further actions like keylogging or token theft.

Answer

To start the Explorer process on a remote system

Answer

To enumerate running processes on the remote system

Answer

To execute a script block locally on the remote system

Question 12

A client wants to test a web application that uses multiple third-party APIs for payment processing, shipping, and customer relationship management. The client states that the APIs are critical for operations but cannot be taken offline. Which scoping consideration is most important to include in the rules of engagement?

Accepted Answer

The tester must use only non-intrusive scanning techniques on the APIs.. Option A is correct because the client explicitly stated that the APIs are critical for operations and cannot be taken offline. Non-intrusive scanning techniques, such as passive traffic analysis or read-only API calls with safe HTTP methods (GET, HEAD), minimize the risk of service disruption, data corruption, or rate-limit triggering. This aligns with the scoping requirement to maintain availability while still allowing security testing of the API layer.

Answer

The tester must exclude all API endpoints from testing.

Answer

The tester must coordinate testing schedules with the API vendors.

Answer

The tester must provide a list of all API calls to be made prior to testing.

Question 13

A penetration tester gained low-privileged access to a Linux server and found that the user can run a custom script located at /opt/tool/backup.sh with setuid root. The script begins with a hashbang #!/bin/bash and uses an internal variable defined as BASEDIR=$(dirname $0) to determine paths. Which technique is most likely to allow privilege escalation?

Accepted Answer

Create a malicious executable named 'dirname' in a directory earlier in the PATH. Option B is correct because the script uses `BASEDIR=$(dirname $0)` to resolve paths. If the user can place a malicious executable named `dirname` earlier in the PATH than the legitimate `/usr/bin/dirname`, then when the script runs with setuid root, the shell will execute the attacker's `dirname` binary instead, allowing arbitrary code execution as root.

Answer

Modify the $0 variable during execution

Answer

Overwrite /opt/tool/backup.sh with a reverse shell

Answer

Exploit a buffer overflow in the Bash interpreter

Question 14

A client with a hybrid on-premises and cloud infrastructure requests a penetration test. The client uses an IaaS provider for some servers. Which of the following is the MOST important aspect to clarify in the rules of engagement regarding the cloud environment?

Accepted Answer

The authorization from the cloud provider for testing. The most critical aspect to clarify in the rules of engagement for a cloud environment is obtaining explicit authorization from the IaaS provider. Without this authorization, the penetration test may violate the provider's acceptable use policy or terms of service, potentially leading to legal action or service termination. This is a foundational scoping requirement because the client does not own the underlying infrastructure; the cloud provider retains control over the network and hypervisor layers.

Answer

The list of operating systems used in the cloud

Answer

The public IP addresses of the cloud servers

Answer

The budget allocated for cloud testing

Question 15

A penetration tester has gained low-privilege shell access on a Linux server. The tester runs `sudo -l` and sees the following entry: `(root) NOPASSWD: /usr/bin/python3 /opt/scripts/*.py` The `/opt/scripts/` directory is owned by the tester's current user. Which technique is most effective for escalating privileges to root?

Accepted Answer

Write a malicious Python script to /opt/scripts/ that spawns a root shell. Option B is correct because the tester's user owns `/opt/scripts/` and can write arbitrary files there. The sudo rule allows executing any `.py` file in that directory as root without a password. By writing a Python script that calls `os.setuid(0); os.system('/bin/bash')` or similar, the tester can spawn a root shell, directly leveraging the misconfigured sudoers entry.

Answer

Create a symbolic link from a Python script to a system file like /etc/shadow

Answer

Exploit a kernel vulnerability to overwrite the sudo binary

Answer

Overwrite an existing Python script in /usr/bin/ with a malicious payload