PT0-002 Practice Test 14 — 15 Questions

Question 1

A penetration tester has been given access to a network tap on a client's internal network. The tester wants to perform initial reconnaissance by identifying all live hosts and their operating systems without sending any packets that could be detected. Which technique is most appropriate?

Accepted Answer

Run Wireshark to capture traffic and analyze source IP addresses and TCP/IP stack signatures.. Option B is correct because capturing traffic with Wireshark from a network tap is entirely passive—it never injects packets into the network. By analyzing source IP addresses and TCP/IP stack signatures (e.g., TTL values, window sizes, and IP ID patterns), the tester can identify live hosts and infer their operating systems without sending any detectable traffic. This aligns perfectly with the requirement to avoid sending any packets.

Answer

Perform an ARP scan using arp-scan from a connected workstation.

Answer

Use Nmap with the -sn flag to perform a ping sweep of the subnet.

Answer

Initiate a DNS zone transfer request to the internal DNS servers.

Question 2

A penetration tester has gained a low-privileged shell on a Linux server. During enumeration, the tester finds a cron job that runs a script as root every five minutes. The script is located in /opt/backup.sh and is world-writable. Which technique should the tester use to escalate privileges?

Accepted Answer

Cron job script manipulation. Option C is correct because the cron job runs as root and the script /opt/backup.sh is world-writable, meaning any user can modify it. By injecting a reverse shell or privilege escalation command into the script, the tester can execute arbitrary code with root privileges when the cron job triggers. This is a classic cron job script manipulation attack, leveraging the scheduled task's root execution context.

Answer

Kernel exploit

Answer

SUID binary exploitation

Answer

Password cracking

Question 3

A penetration tester has obtained a dump of NTLM password hashes from a Windows Domain Controller. The tester wants to crack these hashes as quickly as possible using GPU acceleration. Which tool is the BEST choice for this task?

Accepted Answer

Hashcat. Hashcat (Option B) is the best choice because it is specifically designed for GPU-accelerated password cracking, supporting NTLM hashes with the -m 1000 mode. It leverages OpenCL or CUDA to parallelize cracking across thousands of GPU cores, making it significantly faster than CPU-based tools for large hash dumps. John the Ripper can use GPUs but requires additional configuration and is generally slower for NTLM hashes, while Ophcrack is limited to LM hashes and cannot handle NTLM hashes at all.

Answer

John the Ripper

Answer

Ophcrack

Answer

THC-Hydra

Question 4

A client wants to test a mobile app that uses certificate pinning. The penetration tester needs to perform dynamic analysis of the app's network traffic. Which of the following should be included in the rules of engagement to enable this testing?

Accepted Answer

Include a provision to install a custom CA certificate on a rooted/jailbroken device.. Certificate pinning in mobile apps rejects any proxy or interception certificate that is not the expected pinned certificate. Installing a custom CA certificate on a rooted/jailbroken device allows the tester to bypass the pinning by injecting a trusted root CA that the proxy (e.g., Burp Suite) uses to sign its certificates, enabling decryption of HTTPS traffic for dynamic analysis.

Answer

Request the app's source code for static analysis instead of dynamic analysis.

Answer

Use a proxy tool like Burp Suite without any modification to the device.

Answer

Obtain a list of API endpoints from the developer and test them manually.

Question 5

A penetration tester has gained a low-privileged shell on a Linux server and discovers a binary with the SUID bit set owned by root. The binary executes a system command using a relative path without sanitizing user input. Which of the following techniques would the tester MOST likely use to escalate privileges?

Accepted Answer

Modify the PATH environment variable to point to a malicious script with the same name as the command called by the binary. Option B is correct because the SUID binary executes a system command using a relative path without sanitizing user input. By modifying the PATH environment variable to include a directory containing a malicious script with the same name as the command, the tester can cause the binary to execute the attacker-controlled script instead of the intended system command, thereby escalating privileges to root when the SUID binary runs.

Answer

Exploit a kernel vulnerability to gain root

Answer

Impersonate the root user using sudo

Answer

Preload a shared library using LD_PRELOAD

Question 6

A client asks a penetration tester to perform a test on an e-commerce website. The website experiences high traffic during weekdays and major sales events. To minimize business disruption, when should the tester schedule the active scanning and exploitation activities?

Accepted Answer

During weekends outside of any special promotions. Option C is correct because scheduling active scanning and exploitation during weekends outside of special promotions aligns with the requirement to minimize business disruption. High-traffic periods like weekdays and major sales events increase the risk of performance degradation or service interruption from scanning tools, which could impact revenue and user experience. By choosing low-traffic windows, the tester reduces the likelihood of overwhelming the web server or triggering rate-limiting mechanisms.

Answer

During peak business hours on weekdays

Answer

During a major holiday sale event

Answer

Anytime, as long as the tester does not perform denial-of-service attacks

Question 7

A client wants a penetration test of their internal network. They are concerned about causing any disruption to the production systems. The tester should include which of the following in the rules of engagement to address this concern?

Accepted Answer

A clear definition of the testing window and contact information for emergency stop. Option B is correct because a clearly defined testing window with emergency stop contact information directly addresses the client's concern about production disruption. This ensures the tester can immediately halt activities if any instability is detected, aligning with the principle of minimizing operational impact during a penetration test.

Answer

A list of all tools that will be used during the test

Answer

A requirement for the client to disable their antivirus software

Answer

A statement that the tester will not be liable for any damages

Question 8

A penetration tester is performing reconnaissance on a target domain. The tester queries the public DNS records and finds an SPF record that includes an 'include' mechanism pointing to a third-party email service. Which technique can the tester use to potentially discover more subdomains or internal infrastructure?

Accepted Answer

Query the TXT records of the third-party domain. The SPF record's 'include' mechanism points to a third-party email service, which itself may have SPF or other TXT records that reveal additional domains or subdomains used for email infrastructure. By querying the TXT records of the third-party domain, the tester can discover these included domains, potentially expanding the attack surface. This technique leverages the recursive nature of SPF includes to map out related infrastructure.

Answer

Perform a DNS zone transfer

Answer

Enumerate MX records for the third-party

Answer

Use Google dorks to find exposed email addresses

Question 9

A penetration tester is analyzing a Bash script that contains the following line: 'for ip in $(cat ip_list.txt); do nc -zv $ip 22; done'. What is the primary purpose of this script?

Accepted Answer

To test if port 22 is open on each IP in the list. The script uses `nc -zv $ip 22` which performs a TCP connection test to port 22 on each IP from the list. The `-z` flag tells netcat to scan without sending any data, and `-v` enables verbose output, so it only reports whether the connection succeeded (port open) or failed (port closed or filtered). This is a classic port connectivity check, not a full banner grab or shell establishment.

Answer

To perform a banner grab on port 22 for each IP

Answer

To establish a remote shell connection to each IP on port 22

Answer

To scan all 65535 ports on each IP in the list

Question 10

A penetration tester is performing internal reconnaissance from a compromised host and wants to map the local network without sending any packets. Which technique is most suitable?

Accepted Answer

Use tcpdump to passively capture and analyze broadcast traffic.. Option A is correct because tcpdump can passively capture broadcast traffic (e.g., ARP, NetBIOS, mDNS) without sending any packets. This allows the tester to map active hosts and services on the local network by listening to existing network chatter, fulfilling the 'no packets sent' constraint.

Answer

Send ARP requests to all possible IP addresses using a ping sweep.

Answer

Query the local DNS server for all host records in the domain.

Answer

Use traceroute to discover network paths.

Question 11

A penetration tester discovers a remote command injection vulnerability in a Java-based web application on a Windows server. The tester wants to execute a PowerShell reverse shell. Which encoding technique is most effective to avoid filter restrictions on special characters?

Accepted Answer

Base64 encoding. Base64 encoding is the most effective technique because it allows the tester to encode the entire PowerShell command, including special characters like semicolons, pipes, and quotes, into a safe ASCII string that bypasses filter restrictions. PowerShell natively supports the `-EncodedCommand` parameter, which decodes Base64 input directly, making it ideal for remote command injection scenarios where character filtering is strict.

Answer

URL encoding

Answer

Unicode encoding

Answer

Hex encoding

Question 12

A client wants a penetration test of their cloud infrastructure hosted on AWS. The client states that they want to test the security of their EC2 instances, S3 buckets, and IAM configurations. The client's security team is concerned about potential service disruption due to testing. Which of the following should be included in the rules of engagement to address this concern?

Accepted Answer

A clear definition of what constitutes a denial-of-service condition and a requirement to stop testing immediately if such a condition is detected.. Option B is correct because it directly addresses the client's concern about service disruption by establishing a clear threshold for denial-of-service (DoS) conditions and a mandatory stop action. In AWS, automated scanning or aggressive testing can inadvertently trigger Auto Scaling events, exhaust burst credits on EC2 instances, or saturate S3 request limits, leading to degraded performance. Defining what constitutes a DoS condition (e.g., CPU > 90%, network packet loss > 5%) ensures the tester can halt immediately, protecting the client's cloud infrastructure while still allowing effective security testing.

Answer

A clause that the tester will avoid using any automated scanning tools.

Answer

A requirement that the tester only performs manual testing and no tools.

Answer

A clause that the tester will test only during business hours.

Question 13

A penetration tester has completed testing and identified several vulnerabilities: a critical SQL injection (CVSS 9.8), a medium stored XSS (CVSS 6.1), and a low self-signed certificate (CVSS 3.7). The client's security manager asks for a simplified way to prioritize remediation. Which of the following is the most effective approach for the tester to present the findings?

Accepted Answer

Provide a risk matrix that maps likelihood and impact for each finding.. Option B is correct because a risk matrix that maps likelihood and impact for each finding provides a more nuanced prioritization than raw CVSS scores alone. CVSS scores reflect intrinsic severity but do not account for the client's specific threat environment, asset criticality, or compensating controls. By presenting a risk matrix, the tester enables the security manager to make informed decisions based on the actual risk to the organization, which is the core goal of the reporting and communication domain in PT0-002.

Answer

List all vulnerabilities in descending order of CVSS score only.

Answer

Present only the critical SQL injection finding because it overshadows the others.

Answer

Calculate a single overall risk score for the entire engagement by averaging all CVSS scores.

Question 14

A penetration tester has gained administrative access to a Windows system and wants to extract NTLM password hashes from the memory of the Local Security Authority Subsystem Service (LSASS). Which tool is most commonly used for this purpose?

Accepted Answer

Mimikatz. Mimikatz is the most commonly used tool for extracting NTLM password hashes from LSASS memory on a Windows system. It leverages the `sekurlsa::logonpasswords` module to read the LSASS process memory and decrypt stored credentials, including NTLM hashes, without requiring a separate brute-force or dictionary attack.

Answer

John the Ripper

Answer

Hashcat

Answer

Netcat

Question 15

A penetration tester has gained access to a Windows workstation and extracted NTLM password hashes. The tester wants to move laterally to a server that authenticates using NTLM. The tester does not have the plaintext passwords. Which technique is MOST appropriate to authenticate to the server using the captured hashes?

Accepted Answer

Pass-the-hash. Pass-the-hash (PtH) is the correct technique because it allows the tester to authenticate to the remote server using the captured NTLM hash directly, without needing the plaintext password. NTLM authentication uses a challenge-response protocol where the hash itself is the secret; by presenting the hash in the response, the tester can impersonate the user. This is a well-known lateral movement technique in Windows environments, often executed with tools like Mimikatz (sekurlsa::pth) or Impacket's wmiexec.py.

Answer

Brute force

Answer

Rainbow tables

Answer

Keylogging