PT0-002 Practice Test 15 — 15 Questions

Question 1

A penetration tester discovers a web application that deserializes user-controlled data without validation. The application uses Java serialization. The tester creates a malicious serialized object that executes a system command. Which of the following conditions is required for this exploit to succeed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Java runtime must have a gadget chain available in its classpath. Java deserialization exploits rely on the presence of specific classes (gadget chains) in the application's classpath that can be chained together to achieve arbitrary code execution. The attacker crafts a serialized object that, when deserialized, triggers a sequence of method calls (gadget chain) that ultimately executes a system command. Without a suitable gadget chain available in the classpath, the deserialization of a malicious object will not lead to code execution.

Answer

The application must be running with root privileges

Answer

The application must use a custom ClassLoader

Answer

The application must be running on a Windows operating system

Question 2

You are performing a vulnerability scan on an internal network using an authenticated scanner. Which of the following is a primary benefit of authenticated scanning compared to unauthenticated scanning?

Accepted Answer

It provides more accurate identification of vulnerabilities that require credentials. Authenticated scanning provides deeper insight by checking for missing patches, misconfigurations, and vulnerabilities that require valid credentials to detect, such as local privilege escalation issues.

Answer

It eliminates false positives entirely

Answer

It reduces network traffic

Answer

It avoids detection by intrusion detection systems

Question 3

A penetration tester is analyzing a Ruby script that uses the 'metasploit-framework' gem. The script includes a line: `Msf::Simple::Framework.create` and then calls `run_single('use exploit/multi/handler')`. What is the primary purpose of this script?

Accepted Answer

Set up a Metasploit payload handler to catch reverse shells. The script uses `Msf::Simple::Framework.create` to instantiate a Metasploit Framework instance and then calls `run_single('use exploit/multi/handler')` to load the multi/handler module. This module is specifically designed to listen for incoming connections from payloads (e.g., reverse shells) that have been executed on a target, making the script's primary purpose to set up a handler to catch reverse shells.

Answer

Automate a port scan across multiple targets

Answer

Create a Metasploit resource script for automated attacks

Answer

Load and execute a local exploit against a specified target

Question 4

A penetration tester is performing active reconnaissance on a web application and wants to discover hidden directories and files. Which tool would be most effective for brute-forcing directory names based on a wordlist?

Accepted Answer

Gobuster. Gobuster is a tool used for directory/file brute-forcing using wordlists. Dirb is similar but older; gobuster is more modern and flexible.

Answer

Nikto

Answer

theHarvester

Answer

WPScan

Question 5

A penetration tester is performing host discovery on a subnet. Which TWO of the following Nmap options can be used to discover live hosts?

Accepted Answer

-sn. Both -sn (ping sweep) and -sP (older alias for ping sweep) perform host discovery without port scanning. -sS and -sV are for port scanning and version detection respectively, not host discovery.

Answer

-O

Answer

-sV

Answer

-sS

Question 6

During a web application test, a tester discovers that the application uses JSON Web Tokens (JWT) for authentication. The tester attempts to modify the 'alg' header to 'none' and sends the token. The server accepts the forged token. Which vulnerability is being exploited?

Accepted Answer

alg:none attack. The 'alg:none' attack exploits JWT libraries that accept tokens without verifying signatures. This allows an attacker to forge tokens. Weak secret brute-force would crack the signing key; kid injection manipulates the key ID.

Answer

kid injection

Answer

Algorithm confusion

Answer

Weak signing secret

Question 7

A penetration tester is writing a Bash script to enumerate network shares on multiple Windows hosts. The script uses smbclient to list shares. Which command should be used within the script to attempt to connect to a host with a known username and password?

Accepted Answer

smbclient -L //host -U username%password. The `smbclient -L //host` command lists available shares on a remote SMB/CIFS host, and appending `-U username%password` provides the credentials for authentication. This matches the requirement to enumerate network shares on multiple Windows hosts using a known username and password within a Bash script.

Answer

smbclient //host/share -U username%password

Answer

smbmap -H host -u username -p password

Answer

net use \host\share /user:username password

Question 8

During a web application penetration test, a tester wants to identify vulnerabilities that allow unauthorized access to internal resources. Which TWO of the following are commonly exploited to access internal services?

Accepted Answer

Server-side request forgery (SSRF). SSRF can be used to access internal services by making the server request internal IPs. XXE can also be used for SSRF by using external entities to make HTTP requests. XSS is client-side, SQLi is database, command injection is OS commands.

Answer

Cross-site scripting (XSS)

Answer

SQL injection (SQLi)

Answer

Command injection

Question 9

A penetration tester is compiling evidence for a critical-severity SQL injection vulnerability. Which of the following is the most important piece of evidence to include in the report to demonstrate exploitability while remaining responsible?

Accepted Answer

A proof-of-concept script that retrieves the current database user (e.g., 'SELECT user()').. Proof-of-concept code should demonstrate the vulnerability without causing harm or exposing sensitive data.

Answer

A video of the full exploitation process, including data extraction.

Answer

A screenshot of the database table with all user credentials.

Answer

Raw network captures showing SQL injection attempts.

Question 10

A penetration tester is using Nmap to identify the operating system of a target host. Which Nmap option should be used to enable OS detection?

Accepted Answer

-O. The -O option enables OS detection in Nmap.

Answer

-sV

Answer

-sC

Answer

-A

Question 11

A tester finds that a web application is vulnerable to Server-Side Request Forgery (SSRF). The tester wants to access the cloud metadata endpoint to obtain instance credentials. Which IP address is commonly used for the cloud metadata service?

Accepted Answer

169.254.169.254. The cloud metadata endpoint is typically at 169.254.169.254 for AWS, GCP, and Azure.

Answer

127.0.0.1

Answer

10.0.0.1

Answer

192.168.1.1

Question 12

A penetration tester is about to start an engagement. Which document outlines the IP ranges that are in scope, the testing window, and the emergency stop criteria?

Accepted Answer

Rules of Engagement (RoE). The rules of engagement (RoE) specify technical and procedural boundaries for the test.

Answer

Non-Disclosure Agreement (NDA)

Answer

Statement of Work (SOW)

Answer

Get-out-of-jail letter

Question 13

A penetration tester is conducting a wireless security assessment. The target network uses WPA2-PSK. The tester has captured the four-way handshake. Which tool from the Aircrack-ng suite can be used to attempt to recover the pre-shared key by performing a dictionary attack?

Accepted Answer

aircrack-ng. Aircrack-ng is the tool within the suite that performs dictionary or brute-force attacks on captured WPA/WPA2 handshakes to recover the PSK.

Answer

airtun-ng

Answer

airodump-ng

Answer

aireplay-ng

Question 14

A tester wants to identify the technologies used by a web application before conducting a deeper assessment. Which tool would be most appropriate for passive technology fingerprinting?

Accepted Answer

Wappalyzer. Wappalyzer is a browser extension or online tool that identifies web technologies (CMS, frameworks, analytics) by analyzing page content and headers without sending probes.

Answer

Nmap

Answer

OpenVAS

Answer

Nikto

Question 15

Which of the following is the most appropriate evidence to include in a penetration testing report for a SQL injection vulnerability?

Accepted Answer

Screenshots of the successful injection with timestamps. Screenshots with timestamps provide clear visual evidence of the exploitation and help validate the finding.

Answer

A verbal description of the exploit

Answer

A link to a public exploit database

Answer

Raw source code of the application