PT0-002 Practice Test 14 — 15 Questions

Question 1

A penetration testing firm is scoping a network penetration test for a client. The client has provided a list of IP ranges and subnets. Which TWO of the following should the tester consider when defining the scope?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Identify any third-party hosted services within the provided IP ranges and obtain explicit permission. Scoping must distinguish in-scope vs out-of-scope assets and address third-party services that require permission.

Answer

All IP addresses owned by the client are in scope

Answer

Test all IP addresses regardless of ownership to ensure complete coverage

Answer

Include all subnets that are routable from the internet

Question 2

A penetration tester is writing a report and needs to assign a custom severity rating for a vulnerability that has high business impact but low likelihood of exploitation. Using a custom severity based on business context (impact + likelihood), which rating is most appropriate?

Accepted Answer

Medium. High impact but low likelihood typically results in a medium severity when combining both factors.

Answer

Critical

Answer

High

Answer

Low

Question 3

When writing the executive summary of a penetration test report, which of the following is the most appropriate language to use?

Accepted Answer

Business-oriented language focusing on risk, impact, and high-level recommendations.. The executive summary should be written in business language, avoiding technical jargon, to convey the overall risk and strategic recommendations to non-technical stakeholders.

Answer

A list of all vulnerabilities sorted by CVSS score without context.

Answer

Raw output from scanning tools and network packet captures.

Answer

Detailed technical descriptions of each vulnerability and exploit code used.

Question 4

A penetration tester wants to crack NTLM hashes captured during an internal test. Which hashcat mode should the tester use for NTLM hashes?

Accepted Answer

1000. Hashcat mode 1000 is specifically for NTLM hashes.

Answer

0

Answer

22000

Answer

13100

Question 5

A penetration tester discovers a critical vulnerability on a client's web server and wants to communicate it immediately. Which of the following is the most appropriate action?

Accepted Answer

Notify the client's point of contact immediately.. Immediate notification of critical findings ensures the client can take urgent steps to mitigate risk.

Answer

Include the finding in the report without prior communication.

Answer

Wait until the final report is complete.

Answer

Post the findings on a public forum for disclosure.

Question 6

During a red team engagement, a penetration tester needs to pivot from a compromised internal web server to a database server that is not directly accessible. The web server has two network interfaces: 10.0.1.5 and 192.168.1.5. The database server is at 192.168.1.10. Which technique should the tester use to reach the database?

Accepted Answer

Pivoting through the web server. D is correct because the web server has two network interfaces (10.0.1.5 and 192.168.1.5), making it a dual-homed host that can act as a pivot point. The tester can use the compromised web server as a proxy or relay to route traffic from the attacker's machine (reachable via 10.0.1.5) to the database server at 192.168.1.10, which is on a separate subnet not directly accessible. This technique, known as pivoting, typically involves tools like SSH port forwarding, Metasploit's route add, or a SOCKS proxy to forward traffic through the compromised host.

Answer

ARP spoofing

Answer

DNS tunneling

Answer

Port knocking

Question 7

A penetration tester is writing the technical report for a client. The client's security team needs detailed, step-by-step instructions on how to reproduce each vulnerability found. In which section of the report should this information be placed?

Accepted Answer

Findings and recommendations. The 'Findings and recommendations' section is the correct location for detailed, step-by-step reproduction instructions because it provides the technical depth needed for the client's security team to validate and remediate each vulnerability. This section typically includes exact commands, payloads, and sequences used during testing, aligning with the PT0-002 objective of delivering actionable technical details.

Answer

Executive summary

Answer

Risk rating section

Answer

Appendix

Question 8

A penetration tester is analyzing a Python script that uses the 'subprocess' module to execute shell commands. The tester notices that the script passes user-supplied input directly to the shell without any sanitization or validation. Which vulnerability class is most likely present in this script?

Accepted Answer

Command injection. The script uses the `subprocess` module to execute shell commands with user-supplied input passed directly to the shell without sanitization. This allows an attacker to inject arbitrary shell metacharacters (e.g., `;`, `|`, `&&`) to execute unintended commands, which is the classic definition of command injection. The vulnerability arises because the input is concatenated into a command string rather than passed as a list of arguments, bypassing the shell's argument separation.

Answer

SQL injection

Answer

Path traversal

Answer

Buffer overflow

Question 9

During a penetration test, a tester gains access to a Linux system and runs 'sudo -l', which reveals that the user can run /usr/bin/python with root privileges without a password. Which resource should the tester consult to find a method to escalate privileges using this configuration?

Accepted Answer

GTFOBins. GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions. It provides techniques for privilege escalation using binaries like python. GTFOBins is specifically for Unix privilege escalation.

Answer

PayloadsAllTheThings

Answer

HackTricks

Answer

Exploit-DB

Question 10

A penetration tester has completed the test and is preparing the final report. The client requested a risk rating for each vulnerability. Which of the following frameworks is MOST commonly used to standardize vulnerability severity ratings in penetration testing reports?

Accepted Answer

CVSS. CVSS (Common Vulnerability Scoring System) is the industry-standard framework for assigning numeric severity scores (0-10) to vulnerabilities based on metrics like attack vector, complexity, and impact. Penetration testers use CVSS scores to provide consistent, quantitative risk ratings that clients can compare across findings. OWASP Top 10 is a list of web application risk categories, not a scoring system, and CVE is a vulnerability identifier database, not a rating framework.

Answer

OWASP Top 10

Answer

CVE

Answer

NIST SP 800-115

Question 11

During a Windows privilege escalation attempt, the tester finds that the current user has the SeImpersonatePrivilege enabled. Which tool is commonly used to exploit this privilege to gain SYSTEM?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits SeImpersonatePrivilege to impersonate SYSTEM and spawn a shell.

Answer

SharpUp

Answer

Mimikatz

Answer

PowerUp

Question 12

Which of the following tools is most commonly used for passive reconnaissance by querying certificate transparency logs to discover subdomains?

Accepted Answer

crt.sh. crt.sh is a certificate transparency log search tool that can be used to find subdomains by querying SSL/TLS certificates issued for a domain.

Answer

Censys

Answer

theHarvester

Answer

Shodan

Question 13

A penetration tester has obtained a meterpreter session on a Windows target. The tester wants to escalate privileges to SYSTEM and then dump password hashes. Which two meterpreter commands should the tester use in sequence? (Choose TWO.)

Accepted Answer

getsystem. First, use getsystem to attempt privilege escalation to SYSTEM (via token stealing or other techniques). Then, use hashdump to dump the SAM database hashes. getuid shows current user, sysinfo shows system info.

Answer

getuid

Answer

shell

Answer

sysinfo

Question 14

A penetration tester is using Metasploit to pivot from a compromised host to an internal network. Which THREE Metasploit features can facilitate pivoting?

Accepted Answer

Metasploit route command. The 'route' command adds routes through a session, and Metasploit's socks proxy (auxiliary/server/socks4a) can be used. Autoroute is a post module. Exploit/multi/handler is for reverse shells, not directly for pivoting. Port forwarding via SSH is external to Metasploit.

Answer

Exploit/multi/handler

Answer

SSH local port forwarding

Question 15

A penetration tester is performing active reconnaissance on a target web application. Which TWO tools are specifically designed for directory and file enumeration? (Select TWO.)

Accepted Answer

Feroxbuster. Gobuster and Feroxbuster are both tools specifically designed for directory and file brute-forcing on web servers.

Answer

Wappalyzer

Answer

Nmap

Answer

WhatWeb