PT0-002 Practice Test 15 — 15 Questions

Question 1

A penetration tester is preparing the executive summary of a report for a client's board of directors. Which of the following metrics would be MOST valuable for this audience to understand the overall security posture?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A heat map showing the number of vulnerabilities by severity (Critical, High, Medium, Low). The board of directors needs a high-level, risk-based overview of the security posture, not technical details. A heat map with vulnerability counts by severity (Critical, High, Medium, Low) provides an immediate visual representation of risk distribution, enabling strategic decisions without requiring technical expertise. This aligns with the PT0-002 objective of tailoring reporting to the audience.

Answer

The exact CVSS score for each vulnerability found

Answer

A detailed list of commands used during exploitation

Answer

The names of the operating systems and applications that were tested

Question 2

Which section of a penetration testing report should include screenshots, affected systems, and remediation steps?

Accepted Answer

Technical findings. Technical findings contain detailed information for each vulnerability.

Answer

Scope and methodology

Answer

Appendices

Answer

Executive summary

Question 3

A penetration testing firm is contracted to test a multi-tenant SaaS application. During scoping, the client needs to ensure that testing does not affect other tenants' data. Which scoping control is most important to implement?

Accepted Answer

Isolated testing environment. An isolated testing environment is the most important scoping control because it ensures that the penetration testing activities, including any potentially disruptive scans or exploits, are contained within a dedicated instance of the SaaS application. This prevents any cross-tenant data leakage or service degradation, as the tester's actions are restricted to a logically or physically separate environment that does not share databases or compute resources with production tenants. Without isolation, even read-only testing could inadvertently access or modify data belonging to other tenants due to shared multi-tenant architecture.

Answer

Data anonymization

Answer

Signed waiver from all tenants

Answer

Limit test to read-only operations

Question 4

A penetration tester is analyzing a Python script that uses the requests library to automate web vulnerability scanning. The script sends POST requests with payloads but receives 403 Forbidden responses for many requests, even though manual testing with the same payloads works. Which is the most likely cause?

Accepted Answer

Missing User-Agent header. Many web servers and WAFs (Web Application Firewalls) block requests that lack a User-Agent header or use a default one like 'python-requests/2.x.x'. Manual testing typically uses a browser, which sends a legitimate User-Agent, while the script's default header triggers the 403 Forbidden response. Setting a realistic User-Agent header in the script mimics browser behavior and bypasses this common filter.

Answer

Incorrect Content-Type header

Answer

Script is sending too many requests too fast

Answer

Payloads are URL-encoded incorrectly

Question 5

Which tool is used for security auditing of AWS environments and can enumerate misconfigurations in IAM, S3, and other services?

Accepted Answer

Pacu. Pacu is an open-source AWS security testing framework designed for offensive security audits. It includes modules that enumerate and exploit misconfigurations in IAM policies, S3 bucket permissions, and other AWS services, making it the correct tool for this specific purpose.

Answer

CrackMapExec

Answer

Prowler

Answer

ScoutSuite

Question 6

After a penetration test, the client requests a document that includes the methodology used, a list of all vulnerabilities found along with their CVSS scores, and detailed steps for remediation. Which type of report section is this?

Accepted Answer

Technical report. The client's request for methodology, vulnerability list with CVSS scores, and remediation steps describes the detailed, technical findings of the penetration test. This content is characteristic of the Technical Report section, which provides in-depth analysis and actionable data for technical stakeholders, as opposed to high-level summaries or contractual documents.

Answer

Executive summary

Answer

Rules of engagement

Answer

Scope of work

Question 7

During a reconnaissance phase, a penetration tester is using a tool to enumerate NetBIOS names on a target internal network. The tester issues the command 'nbtstat -A 192.168.1.100' on a Windows machine. What type of information is the tester most likely trying to obtain?

Accepted Answer

The NetBIOS name table including computer name, logged-in users, and domain. The `nbtstat -A` command queries the NetBIOS name table of a remote system using its IP address. This table contains the computer name, logged-in users, and domain/workgroup information, which are critical for identifying targets and potential trust relationships during internal reconnaissance.

Answer

The operating system version and patch level

Answer

A list of currently open TCP ports on the remote system

Answer

The MAC address of the remote network interface

Question 8

A penetration tester gains a foothold on a Linux system with ASLR and NX enabled. The tester identifies a stack buffer overflow in a SUID binary. The binary has no PIE (Position Independent Executable) and is compiled without stack canaries. The tester wants to execute a shell. Which technique should be used?

Accepted Answer

ROP chain. Since the binary has no PIE and lacks stack canaries, the attacker can predict the address of the return address on the stack. However, with ASLR and NX enabled, the stack is non-executable and system library addresses are randomized. A ROP chain allows the tester to bypass both protections by chaining small instruction sequences (gadgets) already present in the binary or loaded libraries to achieve arbitrary code execution, such as calling execve to spawn a shell.

Answer

Return-to-libc attack

Answer

Heap spraying

Answer

Buffer overflow with NOP sled

Question 9

A penetration testing firm is scoping a test for a client that has a hybrid infrastructure with on-premises servers and cloud-based virtual machines. The client insists on testing only the on-premises systems due to budget constraints. Which of the following should the penetration tester emphasize during the scoping discussion?

Accepted Answer

Limiting the scope to on-premises may result in an incomplete risk picture because cloud systems are part of the attack surface.. The client's hybrid infrastructure means that cloud-based virtual machines are part of the overall attack surface, and limiting the scope to on-premises systems ignores potential attack vectors such as misconfigured cloud APIs, insecure inter-VPC routing, or compromised cloud credentials that could lead to lateral movement into on-premises systems. A penetration test must assess all components that can be exploited to provide a complete risk picture, as cloud systems often serve as entry points or pivot points into the on-premises environment.

Answer

The on-premises systems are more critical, so testing them is sufficient.

Answer

Cloud systems are generally more secure and do not require testing.

Answer

Testing cloud systems would violate the shared responsibility model.

Question 10

A penetration tester needs to provide a metric that communicates the financial risk of the identified vulnerabilities to the client's CFO. Which metric is most appropriate?

Accepted Answer

Annual Loss Expectancy (ALE).. Annual Loss Expectancy (ALE) is the most appropriate metric for communicating financial risk to a CFO because it quantifies the expected monetary loss per year from a vulnerability, calculated as ALE = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO). This directly translates technical risk into financial terms, enabling informed budget decisions for remediation. CVSS base scores and critical finding counts lack a financial dimension, making them unsuitable for executive-level risk communication.

Answer

CVSS base score.

Answer

Number of critical findings.

Answer

Technical difficulty of exploitation.

Question 11

During a penetration test, a penetration tester discovers a critical vulnerability that allows unauthenticated remote code execution on a public-facing web server. According to best practices for communication during a penetration test, what should the tester do next?

Accepted Answer

Immediately notify the client of the critical finding and provide initial remediation steps.. Critical findings should be communicated to the client immediately to allow them to take urgent action, even before the formal report is delivered.

Answer

Document the finding and inform the client only after verifying with a second tester.

Answer

Wait until the end of the test to include it in the final report.

Answer

Exploit the vulnerability to demonstrate the full impact before notifying the client.

Question 12

During a penetration test for a financial institution, the tester discovers that a third-party vendor's system is vulnerable and could expose customer PII. The tester is unsure if the vendor is within scope. How should the tester proceed?

Accepted Answer

Communicate with the client to clarify whether the vendor is in scope. The tester should communicate with the client to clarify the scope before taking any further action. Testing a vendor system that may be out of scope could violate the terms of the engagement and cause legal or contractual issues. Option A is premature and could lead to unauthorized testing. Option B ignores a potential risk that the client may want to know about. Option C would report a finding that might be out of scope, which could breach the scope boundaries. Therefore, the appropriate first step is to clarify with the client.

Answer

Perform additional testing on the vendor system to confirm the vulnerability

Answer

Ignore the finding since it is out of scope

Answer

Include the vulnerability in the final report as a high-risk finding

Question 13

A penetration tester is preparing the final report. The client's CEO wants a high-level overview of the test results, including the overall security posture and business risk, without technical details. Which section of the report should the tester emphasize for the CEO?

Accepted Answer

Executive summary. The executive summary is the section of a penetration testing report that provides a high-level overview of the test results, focusing on the overall security posture and business risk without technical details. It is specifically designed for non-technical stakeholders like the CEO, who need to understand the impact on the organization without delving into specific vulnerabilities or exploitation steps.

Answer

Technical findings and recommendations

Answer

Methodology

Answer

Appendices

Question 14

A client wants to test a web application that uses a third-party payment gateway. The client explicitly wants the payment gateway to be excluded from the test to avoid service disruption. Where should this exclusion be formally documented?

Accepted Answer

Rules of Engagement (ROE). The Rules of Engagement (ROE) document is the correct place to formally exclude the third-party payment gateway from testing. The ROE defines the scope, boundaries, and constraints of the penetration test, including specific systems or services that must not be targeted. This ensures the client's requirement to avoid service disruption to the payment gateway is legally and operationally enforced.

Answer

Non-Disclosure Agreement (NDA)

Answer

Statement of Work (SOW)

Answer

Penetration Test Plan

Question 15

A penetration tester needs to enumerate Active Directory users and groups from a Windows domain. Which PowerShell tool is specifically designed for AD enumeration and is commonly used in post-exploitation?

Accepted Answer

PowerView. PowerView (option D) is a PowerShell tool specifically designed for Active Directory enumeration, providing functions to query users, groups, computers, and permissions via LDAP. It is widely used in post-exploitation because it runs in-memory, avoids writing to disk, and integrates seamlessly with PowerShell's pipeline for stealthy reconnaissance.

Answer

Invoke-Mimikatz

Answer

Nmap

Answer

CrackMapExec