PT0-002 Practice Test 17 — 15 Questions

Question 1

A penetration tester wants to enumerate SMB shares, user lists, and operating system information from a Windows target without authenticating. Which of the following tools is BEST suited for this task?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

enum4linux. enum4linux is a Perl wrapper around tools like smbclient, nmblookup, and nbtscan, specifically designed to extract SMB shares, user lists, and OS information from Windows targets without authentication by leveraging null sessions and SMB RPC calls (e.g., via MSRPC over SMB). It automates the enumeration of these details using the Server Message Block (SMB) protocol, making it the best choice for unauthenticated reconnaissance.

Answer

smbclient

Answer

nmblookup

Answer

nbtscan

Question 2

A penetration tester is reviewing a Bash script that contains the following command: 'openssl s_client -connect target:443 -servername target 2>/dev/null | openssl x509 -noout -text'. What is the primary purpose of this command?

Accepted Answer

Extract the SSL certificate in text form.. The command uses `openssl s_client` to establish a TLS connection to `target:443` and then pipes the certificate output to `openssl x509 -noout -text`, which decodes and prints the certificate in human-readable text form. The primary purpose is to retrieve and display the SSL/TLS certificate details (e.g., issuer, subject, validity dates, SANs) for inspection, not to attack or test cipher suites.

Answer

Perform a man-in-the-middle attack.

Answer

Test for weak cipher suites.

Answer

Verify the certificate's revocation status.

Question 3

After completing a penetration test, the client requests a one-page document that highlights the most critical vulnerabilities, overall risk level, and recommended next steps for management. Which deliverable should the penetration tester provide?

Accepted Answer

Executive summary. The executive summary is the correct deliverable because it is specifically designed to provide a high-level overview of the most critical vulnerabilities, overall risk level, and recommended next steps for management. Unlike a technical report, it avoids deep technical jargon and focuses on business impact, aligning with the client's request for a concise one-page document.

Answer

Technical report

Answer

Raw scan data

Answer

Remediation guide

Question 4

A penetration tester wants to discover subdomains of a target domain without sending any packets directly to the target's network. Which resource is most effective for this purpose?

Accepted Answer

Certificate Transparency logs. Certificate Transparency (CT) logs are publicly accessible, append-only ledgers that record every SSL/TLS certificate issued by a Certificate Authority (CA). Since certificates often include Subject Alternative Names (SANs) listing subdomains, querying CT logs (e.g., via crt.sh or tools like `certigo`) reveals subdomains without any direct network probes. This makes CT logs the most effective passive reconnaissance resource, as no packets are sent to the target's infrastructure.

Answer

DNS brute force with a wordlist

Answer

WHOIS lookup

Answer

Traceroute

Question 5

A penetration tester needs to escalate privileges on a Linux target after gaining initial shell access. The /etc/passwd file shows a user 'jake' with UID 0. What does this indicate?

Accepted Answer

The user 'jake' has the same privileges as root. In Linux, a UID (User ID) of 0 is reserved exclusively for the root superuser. When the /etc/passwd file shows a user 'jake' with UID 0, the system treats 'jake' with the same privileges as root, regardless of the username. This is because the kernel checks the UID, not the username, for permission decisions. Therefore, 'jake' has full root-level access, making option C correct.

Answer

The user 'jake' is a normal user with UID misconfiguration

Answer

The user 'jake' is a member of the root group

Answer

There is a duplicate user 'jake' and 'root'

Question 6

During a penetration test, a tester wants to discover all live hosts on a subnet without performing a full port scan. Which Nmap command is most appropriate for this purpose?

Accepted Answer

nmap -sn 192.168.1.0/24. The -sn flag performs a ping sweep (host discovery) without port scanning, which is the standard method to discover live hosts on a subnet efficiently.

Answer

nmap -sS 192.168.1.0/24

Answer

nmap -O 192.168.1.0/24

Answer

nmap -A 192.168.1.0/24

Question 7

A client requests a penetration test that includes testing of both internal network devices and a public-facing web application. The tester is provided with a VPN account for internal access but no credentials for the web application. Which type of penetration test is this?

Accepted Answer

Grey box. Grey box testing involves partial knowledge; the tester has internal network access but not web app credentials.

Answer

White box

Answer

Red team

Answer

Black box

Question 8

After gaining initial access to an internal network, a penetration tester wants to identify live hosts on a subnet without generating excessive traffic. Which Nmap command would be most appropriate for host discovery using ICMP echo requests and TCP SYN to port 80?

Accepted Answer

nmap -sn 192.168.1.0/24. Nmap's -sn flag performs a ping sweep, which by default uses ICMP echo, TCP SYN to port 80, and other probes. The other options are for port scanning or OS detection.

Answer

nmap -A 192.168.1.0/24

Answer

nmap -sS 192.168.1.0/24

Answer

nmap -O 192.168.1.0/24

Question 9

In a red team exercise, the team wants to simulate a realistic adversary. Which TWO of the following are typically included in the scope of a red team engagement compared to a standard penetration test?

Accepted Answer

Physical security testing (e.g., tailgating, lock picking). Red team exercises often include physical and social engineering attacks, and may attempt to remain undetected for longer periods.

Answer

Extensive vulnerability scanning of all in-scope systems

Answer

Comprehensive compliance verification against standards

Answer

Detailed reporting of all vulnerabilities found

Question 10

During a penetration test, the tester discovers evidence of an ongoing ransomware attack on the client's network. Which of the following is the most appropriate action?

Accepted Answer

Notify the client immediately and recommend contacting law enforcement.. Evidence of criminal activity must be reported immediately to the client and may require law enforcement involvement.

Answer

Continue the test as planned and include the finding in the final report.

Answer

Disconnect from the network and destroy all evidence.

Answer

Try to stop the ransomware attack using penetration testing tools.

Question 11

A tester has gained a low-privilege shell on a Windows machine and found that the user has the SeImpersonatePrivilege enabled. Which attack can be used to escalate privileges to SYSTEM?

Accepted Answer

Token impersonation using PrintSpoofer. SeImpersonatePrivilege allows impersonating a client after authentication; tools like PrintSpoofer, RoguePotato exploit this to gain SYSTEM.

Answer

DLL hijacking

Answer

Kerberoasting

Answer

AlwaysInstallElevated

Question 12

During a penetration test, you run the following command on a Linux target: `find / -type f -perm /4000 2>/dev/null`. What are you attempting to identify?

Accepted Answer

SUID binaries. The find command with -perm /4000 searches for files with SUID bit set, which can be exploited for privilege escalation.

Answer

World-writable files

Answer

Files with extended attributes

Answer

SGID binaries

Question 13

A penetration tester discovers evidence of an ongoing criminal activity (e.g., data exfiltration by an insider) during a test. According to best practices and legal considerations, which THREE actions should the tester take?

Accepted Answer

Preserve all evidence and document findings for law enforcement. When discovering criminal activity, the tester should stop testing, notify the client contact, and preserve evidence for investigation.

Answer

Publicly disclose the finding on a vulnerability disclosure platform

Answer

Continue testing to gather more evidence

Question 14

A penetration tester has completed an internal network test. The client's IT manager requests a document that lists each vulnerability with its CVSS score, risk rating, and a brief description of the impact. Which section of the final report should contain this information?

Accepted Answer

Technical Findings. The Technical Findings section is the correct location because it provides a detailed, itemized list of each discovered vulnerability, including its CVSS score, risk rating, and impact description. This section is intended for technical stakeholders who need granular data to prioritize remediation, unlike the Executive Summary which offers high-level business impact and risk overviews.

Answer

Executive Summary

Answer

Methodology

Answer

Remediation Summary

Question 15

A penetration tester is performing passive reconnaissance on a target organization. Which of the following tools is best suited for gathering information from public sources such as search engines, social media, and website scraping?

Accepted Answer

theHarvester. theHarvester is an OSINT tool designed to gather emails, subdomains, IPs, and URLs from public sources like search engines and social media.

Answer

Metasploit

Answer

Nessus

Answer

Nmap