PT0-002 Practice Test 13 — 15 Questions

Question 1

During a penetration test, a tester identifies that the target's network uses Private VLANs to isolate hosts. Which technique can be used to bypass this isolation and perform ARP spoofing?

Accepted Answer

VLAN hopping. Private VLANs isolate hosts within the same VLAN by restricting traffic at the switch level. VLAN hopping (option D) allows an attacker to bypass this isolation by exploiting the switch's trunking protocol (e.g., DTP) to negotiate a trunk link, enabling the attacker to send and receive frames on multiple VLANs, including the target's community or isolated VLAN, thus facilitating ARP spoofing across the Private VLAN boundaries.

Answer

ARP cache poisoning from the switch

Answer

MAC flooding

Answer

Double tagging

Question 2

A penetration testing firm is scoping a test for a client that uses a hybrid infrastructure with both on-premises servers and cloud-based services (IaaS). The client specifies that only the cloud environment should be tested this year. Which concept is MOST important for the tester to discuss during the scoping meeting to avoid testing out-of-scope assets?

Accepted Answer

The shared responsibility model between the client and the cloud provider. The shared responsibility model defines which security controls and operational tasks are managed by the cloud provider versus the client. In a scoping meeting, understanding this model is critical because the penetration tester must only target the client's side of the responsibility boundary (e.g., guest OS, applications, and IaaS configurations) and avoid testing the provider's underlying infrastructure, which is out-of-scope. Without this discussion, the tester could inadvertently probe the provider's hypervisor or physical network, violating the scope agreement and potentially causing legal or contractual issues.

Answer

The need to test on-premises systems as well to get a complete picture

Answer

The potential for false positives in cloud vulnerability scanners

Answer

The cost of third-party cloud penetration testing tools

Question 3

A penetration tester is analyzing a PowerShell script that uses the 'Invoke-Command' cmdlet to execute commands on remote machines, and 'Set-Service' to change service startup types. What attack is this script most likely performing?

Accepted Answer

Remote service modification for persistence.. The script uses Invoke-Command to execute commands on remote machines and Set-Service to change service startup types. This combination is commonly used to modify a service to start automatically or to create a new service that runs malicious code, establishing persistence on a remote system. The attack does not involve lateral movement via PsExec (which uses SMB and service control manager differently) nor credential dumping (which requires tools like Mimikatz or direct memory access).

Answer

Lateral movement via PsExec.

Answer

Credential dumping.

Answer

Data exfiltration.

Question 4

A penetration tester has completed testing and identified several vulnerabilities: a critical SQL injection (CVSS 9.8), a medium stored XSS (CVSS 6.1), and a low self-signed certificate (CVSS 3.7). The client's security manager asks for a simplified way to prioritize remediation. Which of the following is the most effective approach for the tester to present the findings?

Accepted Answer

Provide a risk matrix that maps likelihood and impact for each finding.. A risk matrix that maps likelihood and impact for each finding provides a more nuanced prioritization than raw CVSS scores alone. CVSS scores reflect intrinsic severity but do not account for the client's specific threat environment, asset criticality, or compensating controls. By presenting a risk matrix, the tester enables the security manager to make informed decisions based on the actual risk to the organization, which is the core goal of the reporting and communication domain in PT0-002.

Answer

List all vulnerabilities in descending order of CVSS score only.

Answer

Present only the critical SQL injection finding because it overshadows the others.

Answer

Calculate a single overall risk score for the entire engagement by averaging all CVSS scores.

Question 5

A penetration testing firm is hired to assess a client's hybrid infrastructure with on-premises and cloud servers in multiple regions. The client specifies testing only the on-premises systems due to budget and compliance. Which of the following should the tester emphasize in the rules of engagement (ROE)?

Accepted Answer

Explicit exclusion of all cloud-based assets. The client explicitly restricted testing to on-premises systems due to budget and compliance. The rules of engagement (ROE) must clearly define the authorized scope to prevent accidental testing of cloud assets, which could violate the contract and potentially breach the cloud provider's terms of service. Option B is correct because explicitly excluding all cloud-based assets ensures the tester does not touch any cloud resources, aligning with the client's constraints.

Answer

Detailed network diagrams of the cloud environment

Answer

Approval from the cloud service provider

Answer

A list of all cloud API endpoints

Question 6

A penetration tester is analyzing a Python script that uses the 'requests' library to send HTTP requests with a custom header that mimics a mobile device. The script also uses 'beautifulsoup4' to parse the response and extract specific data. Which task is this script most likely performing?

Accepted Answer

Web scraping to gather publicly available information.. The script uses the 'requests' library to send HTTP requests with a custom header mimicking a mobile device, and 'beautifulsoup4' to parse the HTML response and extract data. This combination is specifically designed for web scraping, where the custom header helps avoid bot detection by making the request appear to come from a mobile browser, and BeautifulSoup extracts targeted information from the page structure.

Answer

Fuzzing for SQL injection.

Answer

Performing a brute-force attack on a login form.

Answer

Testing for directory traversal vulnerabilities.

Question 7

A penetration tester is performing internal reconnaissance on a Windows Active Directory environment. The tester has a low-privileged domain user account. Which of the following techniques is most likely to help identify all domain controllers and their IP addresses without generating excessive network traffic or alerts?

Accepted Answer

Query the DNS service for SRV records of _ldap._tcp.dc._msdcs.domain.local. Querying DNS for SRV records of _ldap._tcp.dc._msdcs.domain.local is a standard, low-noise method to discover all domain controllers in an Active Directory environment. This query leverages the automatic registration of LDAP service records by domain controllers, requiring only a single DNS lookup rather than sweeping the network, thus avoiding excessive traffic and typical security alerts.

Answer

Perform a full subnet ping sweep using Nmap

Answer

Use NetBIOS name resolution by sending broadcasts

Answer

Enumerate SMB shares on all IP addresses in the subnet

Question 8

A penetration tester wants to identify all subdomains for a target domain using only public records. Which technique is most effective for this purpose?

Accepted Answer

Searching crt.sh (Certificate Transparency logs).. Certificate Transparency logs, accessible via crt.sh, are a public record of all SSL/TLS certificates issued for a domain. Since certificates often include Subject Alternative Names (SANs) listing subdomains, querying crt.sh reveals subdomains without any interaction with the target's infrastructure. This technique is passive, requires no authorization, and leverages mandatory logging per RFC 6962, making it highly effective for enumeration from public records.

Answer

DNS zone transfer.

Answer

Using Nmap to brute-force subdomains.

Answer

Querying the domain's MX records.

Question 9

A penetration tester has gained initial access to a Linux server through a vulnerable web application. The server has a restrictive outbound firewall that only allows traffic on ports 80, 443, and 53. The tester wants to establish a reverse shell that is likely to bypass the firewall. Which of the following techniques would be most effective?

Accepted Answer

Use a reverse shell over DNS by encoding commands in DNS queries. DNS traffic on port 53 is typically allowed through restrictive outbound firewalls, and encoding reverse shell commands within DNS queries allows the tester to tunnel traffic over DNS, bypassing the firewall's port restrictions. Tools like dnscat2 or iodine can encapsulate TCP data in DNS requests, making the reverse shell appear as legitimate DNS traffic.

Answer

Use a reverse shell listener on TCP port 3389 and connect from the target

Answer

Use a bind shell on the target's port 4444 and connect directly

Answer

Use a reverse shell on TCP port 8080 and hope it is not blocked

Question 10

A penetration tester has gained a foothold on a Linux server through a vulnerable web application. The server has an outbound firewall that blocks all traffic except DNS queries (UDP 53). The tester needs to establish a reverse shell to maintain access. Which technique is most likely to succeed?

Accepted Answer

Encode the payload in Base64 and use DNS tunneling to execute commands. DNS tunneling encapsulates non-DNS traffic (e.g., command output) within DNS query and response packets, which are allowed through the firewall on UDP port 53. This technique bypasses the outbound firewall restriction by making the malicious traffic appear as legitimate DNS queries, enabling the tester to execute commands and exfiltrate data without triggering network-level blocks.

Answer

Use a bind shell on a high TCP port and connect from the tester's machine

Answer

Attempt a reverse shell over HTTP using TCP port 80

Answer

Use SSH reverse port forwarding to the tester's server on port 443

Question 11

A client requests a penetration test of their production environment that includes critical financial transaction systems. The client is concerned about potential service disruptions. Which of the following should the tester include in the Rules of Engagement to address this concern?

Accepted Answer

A 'stop loss' condition that requires immediate termination of testing if system metrics exceed defined thresholds. A 'stop loss' condition is a standard mechanism in Rules of Engagement (RoE) that defines specific system metrics (e.g., CPU utilization > 90%, memory usage > 80%, or transaction latency > 500ms) which, when exceeded, require immediate termination of testing. This directly addresses the client's concern about service disruptions in the production environment by providing a safety threshold that prevents the penetration test from causing performance degradation or outages in critical financial transaction systems.

Answer

The tester will only use passive reconnaissance techniques

Answer

Exclude all financial transaction systems from the scope of testing

Answer

The client must provide a service level agreement (SLA) to the tester

Question 12

In a web application test, you find a parameter that directly references internal object IDs (e.g., user_id=123) and changing the ID allows access to another user's data. This vulnerability is known as:

Accepted Answer

Insecure Direct Object Reference (IDOR). IDOR (Insecure Direct Object Reference) occurs when an application exposes internal object references without proper access control checks.

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

Cross-site request forgery (CSRF)

Question 13

A client wants a penetration test that simulates a disgruntled employee with access to the internal network but no administrative privileges. The client provides a standard user account on the domain. The tester discovers that the account has local administrator rights on a critical file server. Which step should the tester take according to typical Rules of Engagement?

Accepted Answer

Pause testing and inform the client of the unexpected privilege level for guidance. The Rules of Engagement (RoE) require the tester to operate within the agreed scope and privilege level. Discovering that the provided standard user account has unexpected local administrator rights on a critical file server represents a scope change that could invalidate the test's assumptions and potentially cause unintended damage. The tester must pause and inform the client to obtain explicit guidance before proceeding with elevated privileges.

Answer

Continue testing with the elevated privileges because they were provided

Answer

Use the privileges to escalate to domain admin and test further

Answer

Revert to a lower-privileged account provided by the client

Question 14

During a Windows privilege escalation attempt, the tester finds that the current user has the SeImpersonatePrivilege enabled. Which tool is commonly used to exploit this privilege to gain SYSTEM?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits SeImpersonatePrivilege to impersonate SYSTEM and spawn a shell.

Answer

SharpUp

Answer

Mimikatz

Answer

PowerUp

Question 15

A penetration test is being conducted for a healthcare organization subject to HIPAA. The tester is given access to a production system that contains electronic protected health information (ePHI). Which of the following should be included in the rules of engagement to ensure compliance?

Accepted Answer

A detailed data handling and destruction procedure within the rules of engagement.. HIPAA requires covered entities to ensure the confidentiality, integrity, and availability of ePHI, which includes proper disposal of data after testing. A detailed data handling and destruction procedure within the rules of engagement (RoE) ensures that test data containing ePHI is securely wiped or destroyed in compliance with 45 CFR § 164.310(d)(2)(i) and NIST SP 800-88 guidelines. Without this clause, the tester might leave residual ePHI on production systems, violating HIPAA's security rule.

Answer

A clause requiring encryption of all test data at rest and in transit.

Answer

A business associate agreement (BAA) signed between the client and the testing firm.

Answer

A restriction to only test in non-production environments.