PT0-002 Practice Test 16 — 15 Questions

Question 1

A penetration tester is preparing the final report. The client's IT director wants a high-level overview of the test results, including the number of findings and the overall risk rating. Which section of the report should the tester point to?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Executive summary. The executive summary is specifically designed to provide a high-level overview for management and non-technical stakeholders, such as the IT director. It summarizes the number of findings, overall risk rating, and key business impacts without delving into technical details, making it the correct section for this request.

Answer

Technical findings

Answer

Methodology

Answer

Recommendations

Question 2

A penetration tester is reviewing a Bash script that uses 'nmap' with the '-sC' and '-sV' flags. The script runs the scan and saves the output to a text file. Later, the tester uses 'grep' to extract lines containing 'open'. What is the primary purpose of this script?

Accepted Answer

Identify all open ports and services running on them. The '-sC' flag runs default NSE scripts (which perform service enumeration and basic checks), and '-sV' enables version detection. Together, they identify open ports and the services/versions running on them. The subsequent 'grep' for 'open' extracts lines showing open ports, confirming the primary purpose is to enumerate open ports and their associated services.

Answer

Perform a vulnerability scan using NSE scripts

Answer

Detect the operating system of the target

Answer

Perform a stealthy SYN scan

Question 3

A penetration tester discovers a critical vulnerability that cannot be fully remediated immediately. The client asks for recommendations. Which THREE of the following should the tester include?

Accepted Answer

Implement compensating controls to reduce risk.. When full remediation is not possible, recommend compensating controls, prioritize critical fixes, and offer retesting.

Answer

Delete the finding from the report.

Answer

Ignore the vulnerability until the next test.

Question 4

During a penetration test, the tester wants to discover publicly exposed IoT devices related to the target organization. Which OSINT tool is specifically designed for searching devices connected to the internet?

Accepted Answer

Shodan. Shodan is a search engine that indexes banners from internet-connected devices, including IoT, webcams, routers, and industrial control systems.

Answer

Censys

Answer

Maltego

Answer

theHarvester

Question 5

A penetration tester is writing remediation recommendations. Which THREE practices should the tester follow? (Select THREE.)

Accepted Answer

Recommend updates with specific version numbers. Good remediation recommendations are specific, prioritized, and offer alternatives if full fixes are impossible.

Answer

Recommend only one fix for each vulnerability

Answer

Avoid mentioning retesting to reduce client concern

Question 6

During a web application test, a tester discovers a parameter that appears to be vulnerable to SQL injection. They want to extract data from a database using a technique that does not rely on visible output. Which type of SQL injection is most appropriate?

Accepted Answer

Blind time-based SQL injection. Blind SQL injection, specifically time-based, is used when no error or data is returned, allowing inference via time delays.

Answer

UNION-based SQL injection

Answer

Out-of-band SQL injection

Answer

Error-based SQL injection

Question 7

A penetration tester is analyzing a Bash script that uses 'curl' to send HTTP requests with payloads and checks for a specific string in the response. The script contains: 'if echo $response | grep -q "root:x:0:0"'. Which vulnerability is the script most likely testing for?

Accepted Answer

Local file inclusion. The script checks for the string 'root:x:0:0' in the HTTP response, which is the standard format of the root user entry in the /etc/passwd file on Unix-like systems. This indicates the script is testing whether the server is returning the contents of a local file (e.g., /etc/passwd) via a path traversal or file inclusion vulnerability, making Local File Inclusion (LFI) the correct answer.

Answer

SQL injection

Answer

Cross-site scripting

Answer

Remote code execution

Question 8

A PenTest team is planning to perform a physical social engineering engagement to gather information from a client's facility. Which of the following reconnaissance techniques would be LEAST likely to be detected?

Accepted Answer

Dumpster diving. Dumpster diving (D) is the least likely to be detected because it occurs off-site against discarded materials, typically outside business hours, and leaves no interaction with employees or network systems that could trigger alerts. In contrast, shoulder surfing (A) requires close physical proximity to a victim viewing a screen or keypad, making the attacker observable, and tailgating (C) involves physically following an employee through a controlled access point, which risks challenge by staff or CCTV monitoring. Email phishing (B) is also easily detected because it traverses mail gateways and can be flagged by spam filters, link scanners, or user reporting. Thus, dumpster diving presents the lowest detection risk for a physical social engineering engagement.

Answer

Shoulder surfing

Answer

Email phishing

Answer

Tailgating

Question 9

A penetration tester has gained a low-privileged shell on a Linux server. During enumeration, the tester discovers a binary with the SUID bit set that belongs to root and is known to have a buffer overflow vulnerability. What is the MOST effective next step to escalate privileges?

Accepted Answer

Develop and execute a buffer overflow exploit against the binary to gain a root shell. The SUID binary owned by root and vulnerable to a buffer overflow allows a low-privileged user to execute it with root privileges. Developing and executing a buffer overflow exploit against the binary will overwrite the return address or function pointer to spawn a root shell, directly escalating privileges to root. This is the most effective method because it leverages the existing vulnerability to gain full control without relying on other misconfigurations.

Answer

Use the binary to execute a command that changes the root password

Answer

Modify the binary's permissions to allow execution by any user

Answer

Use sudo to run the binary as root

Question 10

A penetration tester is performing lateral movement in a Windows domain after compromising a workstation. Which THREE techniques can be used to move to another machine?

Accepted Answer

Evil-WinRM. PsExec, WMIExec, and Evil-WinRM are common tools for lateral movement in Windows environments.

Answer

ARP spoofing

Answer

SSH with captured credentials

Question 11

Which penetration testing standard provides a methodology that includes pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting?

Accepted Answer

PTES. The Penetration Testing Execution Standard (PTES) is the only standard among the options that explicitly defines a full penetration testing methodology with the phases listed: pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting. PTES provides a structured, seven-phase framework designed specifically for penetration testers, making it the correct choice for this question.

Answer

OSSTMM

Answer

NIST SP 800-115

Answer

OWASP Testing Guide

Question 12

During a Linux privilege escalation attempt, a tester checks for misconfigurations that could allow running commands as root. Which of the following are potential vectors? (Select THREE.)

Accepted Answer

Sudo misconfigurations. SUID/SGID binaries, sudo misconfigurations, and writable cron scripts are common escalation vectors.

Answer

Unquoted service paths

Answer

DLL hijacking

Question 13

A client hires a penetration testing firm to assess a web application that integrates with a third-party API for payment processing. The client wants to include the API endpoint in the test scope. What should the penetration tester do FIRST to ensure the test is conducted ethically and legally?

Accepted Answer

Obtain written authorization from the third-party API provider. The penetration tester must obtain explicit written authorization from the third-party API provider before testing. Without this, testing the API endpoint could violate the Computer Fraud and Abuse Act (CFAA) or similar laws, as the tester would be accessing a system they do not own or have contractual permission to test. The client's scope inclusion does not grant legal access to the third-party's infrastructure.

Answer

Assume the client has already obtained permission from the API provider

Answer

Rely on the client's statement that the API is within scope

Answer

Test only the client's application code and ignore the API

Question 14

A penetration tester is presenting findings to a group of IT administrators. One administrator questions the validity of a finding, claiming it is not exploitable. How should the tester respond?

Accepted Answer

Present the proof-of-concept code and screenshots that demonstrate the exploit.. The tester should provide evidence to support the finding rather than being defensive or dismissive.

Answer

Insist that the finding is valid based on the tester's experience.

Answer

Escalate the issue to the project manager.

Answer

Agree to remove the finding from the report.

Question 15

A penetration testing company is planning a social engineering engagement for a client. The engagement includes phishing and physical tailgating. Which THREE of the following should be clearly defined in the Rules of Engagement? (Select THREE.)

Accepted Answer

The conditions under which the test must be stopped immediately. RoE should address personnel scope, emergency stop conditions, and specific techniques allowed; vulnerabilities and deliverables are part of SOW.

Answer

The format of the final report

Answer

The specific vulnerabilities to be exploited