PT0-002 Practice Test 16 — 15 Questions

Question 1

A penetration tester has successfully exploited a web application and gained a reverse shell as the www-data user on a Linux server. The tester wants to escalate privileges to root. The server is running a vulnerable version of polkit's pkexec (CVE-2021-4034). Which action should the tester take to exploit this vulnerability?

Accepted Answer

Run the 'pkexec' binary with crafted environment variables. Option B is correct because CVE-2021-4034 (PwnKit) is a memory corruption vulnerability in polkit's pkexec that allows an unprivileged user to escalate privileges to root by running the pkexec binary with crafted environment variables. Specifically, by setting the PATH and other environment variables to trigger an out-of-bounds write, the attacker can execute arbitrary code as root without authentication.

Answer

Execute the 'sudo -u root' command

Answer

Modify the PATH environment variable to include a malicious executable

Answer

Use a generic kernel exploit for privilege escalation

Question 2

During reconnaissance, a penetration tester discovers a public GitHub repository belonging to the target organization. The repository contains internal project names, server IP addresses, and code comments with database credentials. Which reconnaissance technique does this represent?

Accepted Answer

OSINT (Open-Source Intelligence). The discovery of a public GitHub repository containing internal project names, server IP addresses, and database credentials is a classic example of OSINT (Open-Source Intelligence). OSINT involves collecting and analyzing publicly available information from sources like code repositories, social media, and websites to gain insights about a target without direct interaction. This technique leverages the fact that sensitive data is often inadvertently exposed in public repositories, making it a passive reconnaissance method.

Answer

DNS enumeration

Answer

Port scanning

Answer

Social engineering

Question 3

A penetration tester is performing active reconnaissance on a target network. The tester wants to identify all live hosts in the 192.168.1.0/24 subnet and determine which ones have port 80 open. Which technique is most efficient for this task?

Accepted Answer

Use a ping sweep to identify live hosts, then run a SYN scan on port 80 for those hosts.. Option B is correct because it combines two efficient steps: first, a ping sweep (ICMP Echo Request or ARP scan) identifies live hosts in the 192.168.1.0/24 subnet, reducing the number of targets; second, a SYN scan on port 80 for only those live hosts is faster and less intrusive than scanning all ports or all IPs without prior host discovery. This approach minimizes network traffic and scan time while accurately identifying hosts with HTTP services.

Answer

Perform a full TCP connect scan on all 65535 ports for each IP address.

Answer

Run a SYN scan on port 80 for every IP in the subnet without ping probing.

Answer

Use ARP requests to map the subnet and then check for port 80 on each host.

Question 4

A penetration tester is writing a Bash script to automate the extraction of password hashes from a Windows system after gaining SYSTEM-level access. The script uses 'reg.exe' to save the SAM and SYSTEM hives. Which command should the tester include in the script to export the SAM hive to a file?

Accepted Answer

reg save HKLM\SAM sam.hive. The correct command is 'reg save HKLM\SAM sam.hive' because 'reg save' creates a binary copy of the specified registry hive, which is necessary for offline extraction of password hashes. The SAM hive contains the hashed credentials, and saving it as a file allows tools like 'samdump2' or 'secretsdump.py' to parse the hashes. The other options either export in a non-binary format or use a non-existent command.

Answer

reg export HKLM\SAM sam.hive

Answer

reg backup HKLM\SAM sam.hive

Answer

reg copy HKLM\SAM sam.hive

Question 5

A penetration tester is reviewing a Bash script that contains the following command: 'openssl s_client -connect target:443 -servername target 2>/dev/null | openssl x509 -noout -text'. What is the primary purpose of this command?

Accepted Answer

Extract the SSL certificate in text form.. The command uses `openssl s_client` to establish a TLS connection to `target:443` and then pipes the certificate output to `openssl x509 -noout -text`, which decodes and prints the certificate in human-readable text form. The primary purpose is to retrieve and display the SSL/TLS certificate details (e.g., issuer, subject, validity dates, SANs) for inspection, not to attack or test cipher suites.

Answer

Perform a man-in-the-middle attack.

Answer

Test for weak cipher suites.

Answer

Verify the certificate's revocation status.

Question 6

A penetration tester is using Hashcat to crack NTLM hashes obtained from a Windows system. The tester wants to use a rule-based attack to maximize cracking success. Which Hashcat mode should be used for NTLM hashes?

Accepted Answer

-m 1000. Hashcat mode -m 1000 is specifically designated for NTLM hashes, which are the Windows NT LAN Manager hash format stored in the SAM database. A rule-based attack with this mode applies transformation rules to wordlists to generate candidate passwords, maximizing cracking success by leveraging common password patterns and mutations.

Answer

-m 1100

Answer

-m 3000

Answer

-m 5500

Question 7

A penetration tester wants to identify the web server software and version used by a target organization without sending any packets to the target's infrastructure. Which of the following techniques is most effective for this purpose?

Accepted Answer

Use Shodan to search for the target's IP address or domain and review the gathered banners.. Shodan is a search engine that continuously scans the internet and stores service banners from various ports. By querying the target's IP address or domain, the penetration tester can retrieve previously collected HTTP headers and other service banners without sending any packets to the target, thus achieving passive reconnaissance.

Answer

Perform a DNS zone transfer to obtain internal server information.

Answer

Use netcat to connect to port 80 and read the HTTP banner.

Answer

Use nmap -sV with a delayed scan to avoid detection.

Question 8

A penetration tester is performing a client-side attack against a user. The tester sends an email with a malicious attachment that, when opened, executes a macro that downloads a payload. Which type of attack is this?

Accepted Answer

Spear phishing. Spear phishing is a targeted phishing attack where the attacker crafts a personalized email to a specific individual or organization, often including a malicious attachment. In this scenario, the email with a macro-enabled attachment that downloads a payload is a classic spear phishing technique, as it exploits human trust and social engineering to deliver malware. This contrasts with generic phishing, which casts a wide net, and the client-side attack vector relies on the user executing the macro.

Answer

Vishing

Answer

Smishing

Answer

Watering hole

Question 9

During a penetration test, a tester identifies a buffer overflow vulnerability in a Linux binary that has both ASLR and NX (Non-Executable) enabled. The tester discovers a ROP gadget at a fixed address in a library that is not affected by ASLR. Which technique can be used to exploit this vulnerability and achieve code execution?

Accepted Answer

Return-oriented programming (ROP) using the fixed gadgets. Return-oriented programming (ROP) is the correct technique because ASLR and NX are both enabled, preventing direct shellcode execution and making memory addresses unpredictable. However, the tester found a ROP gadget at a fixed address in a library not affected by ASLR, allowing the construction of a chain of gadgets to achieve arbitrary code execution without needing to inject or execute shellcode on the stack.

Answer

Heap spraying to predict memory layout and inject shellcode

Answer

Stack canary bypass using information leak

Answer

Format string attack to overwrite GOT entries

Question 10

After completing a penetration test, the client's technical team requests a document that provides step-by-step reproduction instructions for each vulnerability, including exact payloads, tools used, and screenshots. Which deliverable BEST satisfies this requirement?

Accepted Answer

Technical Findings Report. The Technical Findings Report (Option B) is the correct deliverable because it is specifically designed to provide granular, step-by-step reproduction steps, exact payloads, tool commands, and screenshots for each vulnerability. This level of detail is essential for the client's technical team to validate and remediate the findings, aligning with the PT0-002 objective of producing a comprehensive technical report that supports evidence-based remediation.

Answer

Executive Summary

Answer

Remediation Guide

Answer

Vulnerability Scanner Output

Question 11

A penetration tester is preparing a report for a client that includes both a technical security team and an executive leadership team. The executive team needs to understand the overall risk posture, while the technical team requires detailed reproduction steps. Which reporting structure best serves both audiences?

Accepted Answer

A single report with an executive summary and technical appendices. A single report with an executive summary and technical appendices is the correct structure because it satisfies both audiences: the executive summary provides a high-level risk posture overview (e.g., CVSS scores, business impact), while the technical appendices contain detailed reproduction steps (e.g., exact commands, payloads, and packet captures) for the technical team. This approach aligns with the PT0-002 objective of tailoring communication to stakeholders without losing technical rigor.

Answer

Two completely separate reports: one for executives and one for technical staff

Answer

Only an executive summary, omitting technical details

Answer

Only a technical report with all details

Question 12

Before starting a penetration test, the tester receives permission to test only two public IP ranges and is told not to perform denial-of-service testing. Which two documents or artefacts are most important to confirm before testing begins? (Choose 2.)

Accepted Answer

Written authorization to test the specified targets.. Written authorization (A) is the foundational legal document that explicitly grants the tester permission to test the specified public IP ranges, protecting against claims of unauthorized access under laws like the Computer Fraud and Abuse Act. The rules of engagement (B) define the scope boundaries, including the prohibition of denial-of-service testing, which is critical to avoid service disruption and legal liability. Without these two documents, the tester lacks both legal authority and operational constraints, making them the most important artefacts before testing begins.

Answer

A list of exploit payloads from a public GitHub repository.

Answer

A screenshot of the company home page.

Question 13

A penetration tester is attempting to exploit a buffer overflow vulnerability in a Linux binary. The binary has Data Execution Prevention (DEP) enabled but Address Space Layout Randomization (ASLR) is disabled. Which exploitation technique would be the MOST effective to achieve code execution?

Accepted Answer

Perform a return-to-libc attack to call system("/bin/sh"). With DEP enabled, the stack is non-executable, so injecting shellcode directly into the buffer (Option A) would fail. Since ASLR is disabled, library addresses are fixed, making a return-to-libc attack viable. Option C exploits this by overwriting the return address with the address of system() and placing the string "/bin/sh" in memory, achieving code execution without needing an executable stack.

Answer

Inject shellcode into the buffer and redirect execution to it

Answer

Use a ROP chain to call mprotect() to make the stack executable, then jump to shellcode

Answer

Use a heap spray to place shellcode at a known address and then trigger the overflow

Question 14

A penetration tester is reviewing a Python script that uses the 'mitmproxy' library. The script sets up a proxy and captures HTTP traffic, then modifies certain requests in real time. Which of the following is the most likely purpose of this script?

Accepted Answer

To intercept and manipulate API requests for security testing. The mitmproxy library is specifically designed for man-in-the-middle interception and modification of HTTP/HTTPS traffic. By setting up a proxy and modifying requests in real time, the script's most likely purpose is to intercept and manipulate API requests for security testing, such as fuzzing parameters, injecting payloads, or bypassing client-side controls.

Answer

To perform passive network mapping and port scanning

Answer

To capture raw network packets for offline analysis

Answer

To automatically detect SQL injection vulnerabilities

Question 15

A penetration tester wants to identify hosts on a network that are running web servers on any TCP port, including non-standard ports. Which Nmap command is most efficient for this task?

Accepted Answer

nmap -sV -p- target. Option A is correct because `-sV` enables version detection to identify web server software, and `-p-` scans all 65535 TCP ports, including non-standard ones. This combination efficiently discovers web servers on any port without unnecessary overhead like OS detection or default script scanning.

Answer

nmap -sC -p 80,443 target

Answer

nmap -O -p- target

Answer

nmap -sT -p 8000,8080 target