PT0-002 Practice Test 15 — 15 Questions

Question 1

A penetration testing firm is hired to assess the security of a small business's web application. The client has explicitly stated that they do not want any testing that could cause a denial of service. Which section of the rules of engagement should specify this restriction?

Accepted Answer

Limitations. The restriction against denial of service testing is a limitation on the types of activities permitted during the engagement. In the rules of engagement (RoE), the Limitations section explicitly defines what is prohibited, such as specific attack vectors, tools, or impacts like DoS, to ensure testing stays within agreed boundaries. This is distinct from the Scope, which defines what is tested (e.g., IP ranges, URLs), not what is forbidden.

Answer

Scope

Answer

Scheduling

Answer

Legal

Question 2

A penetration tester is using a vulnerability scanner on a web application and notices that many findings are false positives caused by the scanner sending oversized payloads that the application truncates or rejects. Which scanner configuration change would MOST effectively reduce false positives in this scenario?

Accepted Answer

Enable safe checks or anti-false positive mode. Enabling safe checks or anti-false positive mode configures the scanner to send payloads that conform to expected application input constraints (e.g., length limits, character sets) rather than oversized or malformed payloads. This reduces false positives by ensuring that the scanner only reports vulnerabilities that are actually reachable and exploitable under normal application behavior, rather than triggering truncation or rejection logic that is not a security flaw.

Answer

Increase the scan intensity to send more payloads

Answer

Increase the HTTP request timeout

Answer

Disable vulnerability detection for certain plugins

Question 3

A penetration tester is asked to perform a test that focuses on identifying vulnerabilities in a company's external web application without providing any internal credentials. The tester has been given a signed agreement that lists the IP range and URLs. Which of the following scoping considerations is MOST directly addressed by the agreement?

Accepted Answer

Type of testing (black box vs white box). The signed agreement explicitly defines the IP range and URLs for testing, which directly informs the type of testing. Since no internal credentials are provided, this is a black box test, where the tester has no prior knowledge of the internal system. The agreement's scope (IPs and URLs) is the primary factor that determines the testing approach, making 'Type of testing (black box vs white box)' the most directly addressed scoping consideration.

Answer

Time constraints for the test

Answer

Rules of engagement regarding social engineering

Answer

Data handling procedures

Question 4

A penetration tester is finalizing a report for a client. The client's technical team needs a concise list of each vulnerability with its risk rating, CVSS score, and recommended remediation steps. In which section of the report should this information be placed?

Accepted Answer

Findings and technical details. The Findings and technical details section is the correct placement because it is specifically designed to provide a detailed, itemized list of vulnerabilities, including risk ratings, CVSS scores, and remediation steps, which the client's technical team needs for action. This section goes beyond high-level summaries to deliver the granular data required for patching and mitigation, aligning with the PT0-002 objective of structuring reports for different audiences.

Answer

Executive summary

Answer

Scope and methodology

Answer

Appendix

Question 5

A penetration tester is writing the findings section of a report. The tester discovered a cross-site scripting vulnerability that allows session hijacking. The technical team wants to understand exactly how to reproduce it, while the business owner wants to know the risk it poses to customer data. Which approach best addresses both audiences?

Accepted Answer

Write two separate sections: one for technical details and one for risk analysis. Option B is correct because it separates the technical reproduction steps (for the technical team) from the business impact analysis (for the business owner), ensuring each audience receives the information in the format they need. This aligns with the PT0-002 objective of tailoring communication to different stakeholders, avoiding confusion or information overload. A single combined description (Option A) would likely be too technical for the business owner or too vague for the technical team.

Answer

Include a single detailed description with both technical and business impact

Answer

Place technical details in an appendix and include only risk ratings in the main body

Answer

Provide a video demonstration separately from the written report

Question 6

A penetration tester has gained initial access to a Linux server through a vulnerable web application. The server has a restrictive outbound firewall that only allows traffic on ports 80, 443, and 53. The tester wants to establish a reverse shell that is likely to bypass the firewall. Which of the following techniques would be most effective?

Accepted Answer

Use a reverse shell over DNS by encoding commands in DNS queries. Option C is correct because DNS traffic on port 53 is typically allowed through restrictive outbound firewalls, and encoding reverse shell commands within DNS queries allows the tester to tunnel traffic over DNS, bypassing the firewall's port restrictions. Tools like dnscat2 or iodine can encapsulate TCP data in DNS requests, making the reverse shell appear as legitimate DNS traffic.

Answer

Use a reverse shell listener on TCP port 3389 and connect from the target

Answer

Use a bind shell on the target's port 4444 and connect directly

Answer

Use a reverse shell on TCP port 8080 and hope it is not blocked

Question 7

A penetration tester is analyzing a Python script that uses the 'scapy' library to craft custom network packets. The relevant code is: ```python from scapy.all import * packet = IP(dst="192.168.1.1")/TCP(dport=80, flags="S") response = sr1(packet, timeout=2) if response.haslayer(TCP): print(response.getlayer(TCP).flags) ``` What is the primary goal of this script?

Accepted Answer

To perform a SYN scan and determine if port 80 is open. The script uses Scapy to craft a TCP SYN packet (flags='S') to port 80 and sends it with sr1(), which waits for a single response. If a TCP layer is present in the reply, it prints the flags. This is the classic behavior of a SYN scan (half-open scan): it sends a SYN and analyzes the response to determine if the port is open (SYN-ACK) or closed (RST), without completing the handshake. Option B correctly identifies this as a SYN scan to check if port 80 is open.

Answer

To perform a TCP connect scan by completing the three-way handshake

Answer

To send an HTTP GET request and capture the web page

Answer

To perform a UDP scan on port 80

Question 8

A penetration tester has gained low-privilege access on a Windows 10 machine. The tester discovers that a service runs with SYSTEM privileges and has the following binary path: C:\Program Files\MyApp\service.exe. The path is unquoted. Which exploitation technique is most likely to allow the tester to escalate privileges?

Accepted Answer

Create a malicious executable named 'MyApp.exe' and place it in C:\Program Files\.. The unquoted service binary path 'C:\Program Files\MyApp\service.exe' allows Windows to interpret spaces as separators, so it will attempt to execute 'C:\Program.exe' first, then 'C:\Program Files\MyApp.exe', and finally the intended path. By placing a malicious 'MyApp.exe' in 'C:\Program Files\', the tester exploits the space in 'Program Files' to hijack execution before the legitimate service.exe runs, achieving privilege escalation to SYSTEM.

Answer

Create a malicious executable named 'C:\Program.exe' and place it in the root of C:.

Answer

Modify the service's binary path in the registry to point to a malicious executable.

Answer

Use SeImpersonatePrivilege to impersonate the SYSTEM account and directly modify the service.

Question 9

A penetration tester has obtained the NTLM hash of a service account during an internal test. The tester wants to gain access to a specific SQL server that uses Kerberos authentication. The tester does not know the plaintext password. Which attack is MOST appropriate to forge a service ticket for the SQL server?

Accepted Answer

Silver Ticket attack. A Silver Ticket attack is the most appropriate because it forges a service ticket (TGS) for a specific service, such as the SQL server, using the NTLM hash of the service account. Since the tester has the NTLM hash but not the plaintext password, they can craft a valid Kerberos service ticket without needing to authenticate to the domain controller, directly granting access to the SQL server.

Answer

Golden Ticket attack

Answer

Pass-the-hash attack

Answer

SMB relay attack

Question 10

A penetration tester is conducting an internal network scan and wants to minimize the chance of detection by the target's intrusion detection system (IDS). Which Nmap timing template is the MOST appropriate for this goal?

Accepted Answer

T0 (Paranoid). The T0 (Paranoid) timing template is the most appropriate because it introduces an extremely slow scan rate, sending packets at a rate of no more than one packet every 5 minutes (300 seconds). This slow pace is designed to evade threshold-based intrusion detection systems (IDS) that trigger alerts when they detect a high volume of traffic from a single source within a short time window, making it ideal for stealthy internal reconnaissance.

Answer

T1 (Sneaky)

Answer

T3 (Normal)

Answer

T5 (Insane)

Question 11

A penetration tester is using Burp Suite to intercept and modify HTTP traffic. When browsing to an HTTPS site, the tester observes that the requests are encrypted and not being intercepted by Burp. Which configuration step is most likely missing?

Accepted Answer

The Burp CA certificate has not been installed in the browser's trust store. Burp Suite intercepts HTTPS traffic by acting as a man-in-the-middle, which requires the browser to trust Burp's self-signed CA certificate. Without installing the Burp CA certificate in the browser's trust store, the browser will refuse to establish a TLS connection through the proxy, leaving requests encrypted end-to-end and invisible to Burp.

Answer

The proxy listener is not configured to listen on the correct port

Answer

The browser's proxy settings are not configured to use Burp

Answer

The target site is not in Burp's scope

Question 12

A penetration tester needs to communicate the financial impact of a critical vulnerability to the board of directors. Which metric is most appropriate for this audience?

Accepted Answer

Annualized loss expectancy (ALE).. The board of directors is concerned with financial risk and business impact, not technical severity. Annualized loss expectancy (ALE) quantifies the expected monetary loss per year from a vulnerability, making it directly relevant for executive decision-making. CVSS scores and risk ratings are technical metrics that do not translate to financial terms.

Answer

CVSS base score (e.g., 9.8 out of 10).

Answer

Risk rating (High, Medium, Low).

Answer

Number of affected systems.

Question 13

A penetration tester is preparing the executive summary of a report for a client's board of directors. Which of the following metrics would be MOST valuable for this audience to understand the overall security posture?

Accepted Answer

A heat map showing the number of vulnerabilities by severity (Critical, High, Medium, Low). The board of directors needs a high-level, risk-based overview of the security posture, not technical details. A heat map with vulnerability counts by severity (Critical, High, Medium, Low) provides an immediate visual representation of risk distribution, enabling strategic decisions without requiring technical expertise. This aligns with the PT0-002 objective of tailoring reporting to the audience.

Answer

The exact CVSS score for each vulnerability found

Answer

A detailed list of commands used during exploitation

Answer

The names of the operating systems and applications that were tested

Question 14

A penetration tester is hired to assess a web application that integrates with a third-party payment API. The client wants the API included in the test but does not have a signed agreement with the vendor. What is the most appropriate action for the tester?

Accepted Answer

Ask the client to obtain a written authorization from the third-party vendor before testing the API.. Option A is correct because testing a third-party API without explicit written authorization from the vendor violates legal and contractual boundaries, potentially constituting unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA). The penetration tester must obtain signed authorization to ensure the test is legally defensible and within scope, as the client cannot grant permission for assets they do not own.

Answer

Proceed with testing the API using anonymous techniques to avoid detection.

Answer

Test only the client's application logic but not the actual API endpoint.

Answer

Include the API in the test because the client owns the integration.

Question 15

After a penetration test, the client's development team requests that the report include specific, actionable remediation steps for each vulnerability. Where in the report should this information be placed?

Accepted Answer

Within the technical report section, under each vulnerability finding. The correct placement for specific, actionable remediation steps is within the technical report section under each vulnerability finding. This aligns with industry best practices (e.g., PTES, OWASP) where each finding includes a description, risk rating, and a dedicated remediation subsection, ensuring developers have immediate context and clear steps without cross-referencing other sections.

Answer

In the executive summary to emphasize the need for fixing vulnerabilities

Answer

In the appendix as a separate remediation checklist

Answer

In a separate document attached to the report to avoid cluttering the main report