PT0-002 Practice Test 18 — 15 Questions

Question 1

A penetration tester is conducting a post-exploitation phase on a Windows target and wants to dump credentials. Which of the following tools can be used? (Choose TWO.)

Accepted Answer

secretsdump.py. Mimikatz is a well-known credential dumping tool, and secretsdump.py from Impacket can dump hashes remotely.

Answer

Nmap

Answer

Hydra

Answer

Wireshark

Question 2

In Metasploit, after searching for an exploit, you select it with 'use exploit/...' and set required options. What is the final command to execute the exploit against the target?

Accepted Answer

run. The 'run' or 'exploit' command launches the exploit.

Answer

execute

Answer

launch

Answer

start

Question 3

After a penetration test, the client's technical team wants to understand the exact steps required to reproduce a cross-site scripting vulnerability found in the web application. In which section of the standard penetration testing report should this information be included?

Accepted Answer

Technical Findings and Recommendations. The Technical Findings and Recommendations section is the correct place for step-by-step reproduction steps because it provides detailed, actionable technical information for the client's technical team. This section typically includes specific payloads, HTTP request/response details, and the exact sequence of user interactions needed to trigger the XSS vulnerability, enabling the team to verify and remediate the issue.

Answer

Executive Summary

Answer

Methodology

Answer

Appendices

Question 4

A penetration tester wants to quickly capture and analyze network packets during an internal test to identify unencrypted protocols. Which command-line tool is commonly used for packet capture on Linux?

Accepted Answer

tcpdump. tcpdump is the standard command-line packet capture tool on Linux, allowing the tester to capture raw network packets and filter them by protocol (e.g., HTTP, FTP, Telnet) to identify unencrypted traffic. It uses libpcap to capture packets at the network interface level, making it ideal for quickly analyzing plaintext protocols during an internal penetration test.

Answer

nslookup

Answer

nmap

Answer

netcat

Question 5

A penetration tester is using theHarvester tool to gather email addresses and subdomains for a target domain. Which source is theHarvester commonly configured to use for passive reconnaissance?

Accepted Answer

Google search. TheHarvester is a passive reconnaissance tool that collects emails, subdomains, and other data from public sources without directly interacting with the target. Google search is a primary source because theHarvester uses Google's search engine via its API or scraping to find indexed pages containing email addresses and subdomains, leveraging Google's dorking capabilities for passive data gathering.

Answer

Shodan

Answer

DNS zone transfer

Answer

Social media APIs

Question 6

A penetration tester is reviewing a Java application for insecure deserialization vulnerabilities. Which of the following should the tester look for? (Choose TWO.)

Accepted Answer

Accepting serialized objects from user input without sanitization. Insecure deserialization vulnerabilities often arise from using ObjectInputStream without filtering and from accepting serialized data from untrusted sources.

Answer

Use of eval() functions

Answer

Hardcoded credentials in configuration files

Answer

Use of prepared statements for SQL queries

Question 7

A penetration tester is performing initial reconnaissance on a target domain. Which THREE sources can provide historical data about the target? (Select THREE.)

Accepted Answer

Wayback Machine. The Wayback Machine archives web pages, Pastebin may contain leaked historical data, and certificate transparency logs (crt.sh) provide historical certificate issuance data.

Answer

Shodan

Answer

Nmap

Question 8

After exploiting a Linux server, you need to pivot to a restricted network subnet. You have SSH access to the compromised server. Which command would create a SOCKS proxy on the server to route traffic through it?

Accepted Answer

ssh -D 1080 user@server. SSH -D creates a SOCKS tunnel for dynamic port forwarding, allowing pivoting.

Answer

ssh -L 1080:server:80 user@server

Answer

ssh -R 1080:server:80 user@server

Answer

ssh -J user@server:1080

Question 9

During a web application test, a penetration tester discovers that the server returns verbose error messages containing full file paths. Which type of attack is directly facilitated by this information disclosure?

Accepted Answer

Path traversal. Verbose error messages revealing file paths can enable path traversal attacks, as the attacker learns the directory structure. SQL injection may be facilitated by database error messages, but file paths are specific to path traversal.

Answer

SQL injection

Answer

CSRF

Answer

Cross-site scripting

Question 10

During a Windows privilege escalation attempt, the tester finds that the current user has SeImpersonatePrivilege enabled. Which THREE tools or techniques can be used to exploit this privilege?

Accepted Answer

JuicyPotato. PrintSpoofer, RoguePotato, and JuicyPotato exploit SeImpersonatePrivilege to gain SYSTEM. Mimikatz is for credential dumping, and PowerUp is a PowerShell script for privilege escalation but not specific to this privilege.

Answer

Mimikatz

Answer

PowerUp

Question 11

During a web application test, you discover an endpoint that accepts a URL parameter and fetches the content. You try `http://169.254.169.254/latest/meta-data/` and receive a response. Which vulnerability is this?

Accepted Answer

Server-Side Request Forgery (SSRF). The IP 169.254.169.254 is the cloud metadata endpoint; accessing it indicates SSRF.

Answer

Cross-Site Request Forgery (CSRF)

Answer

Local File Inclusion (LFI)

Answer

XML External Entity (XXE)

Question 12

A penetration tester is reviewing a Python script that uses the 'mitmproxy' library. The script sets up a proxy and captures HTTP traffic, then modifies certain requests in real time. Which of the following is the most likely purpose of this script?

Accepted Answer

To intercept and manipulate API requests for security testing. The mitmproxy library is specifically designed for man-in-the-middle interception and modification of HTTP/HTTPS traffic. By setting up a proxy and modifying requests in real time, the script's most likely purpose is to intercept and manipulate API requests for security testing, such as fuzzing parameters, injecting payloads, or bypassing client-side controls.

Answer

To perform passive network mapping and port scanning

Answer

To capture raw network packets for offline analysis

Answer

To automatically detect SQL injection vulnerabilities

Question 13

During a code review of a PHP web application, you encounter the following code: $result = mysql_query("SELECT * FROM users WHERE username='" . $_GET['user'] . "'");. Which vulnerability does this represent?

Accepted Answer

SQL injection. Direct concatenation of user input into SQL query without sanitization or parameterization is classic SQL injection.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Command injection

Question 14

A penetration tester is performing web application reconnaissance and wants to discover API endpoints and hidden parameters that may not be linked from the main application. Which technique would be most effective for this purpose?

Accepted Answer

JavaScript analysis for endpoint discovery. JavaScript analysis often reveals AJAX API endpoints, keys, and parameters that are not visible in HTML. Directory bruteforcing may find endpoints but JS analysis is more targeted for hidden APIs.

Answer

Running Nikto for web server vulnerabilities

Answer

Directory bruteforcing with gobuster

Answer

Using Wappalyzer to fingerprint technologies

Question 15

A penetration testing firm is hired to assess the security of a small business's web application. The client has explicitly stated that they do not want any testing that could cause a denial of service. Which section of the rules of engagement should specify this restriction?

Accepted Answer

Limitations. The restriction against denial of service testing is a limitation on the types of activities permitted during the engagement. In the rules of engagement (RoE), the Limitations section explicitly defines what is prohibited, such as specific attack vectors, tools, or impacts like DoS, to ensure testing stays within agreed boundaries. This is distinct from the Scope, which defines what is tested (e.g., IP ranges, URLs), not what is forbidden.

Answer

Scope

Answer

Scheduling

Answer

Legal