PT0-002 Practice Test 18 — 15 Questions

Question 1

A client requests a penetration test of their production environment that includes critical financial transaction systems. The client is concerned about potential service disruptions. Which of the following should the tester include in the Rules of Engagement to address this concern?

Accepted Answer

A 'stop loss' condition that requires immediate termination of testing if system metrics exceed defined thresholds. Option B is correct because a 'stop loss' condition is a standard mechanism in Rules of Engagement (RoE) that defines specific system metrics (e.g., CPU utilization > 90%, memory usage > 80%, or transaction latency > 500ms) which, when exceeded, require immediate termination of testing. This directly addresses the client's concern about service disruptions in the production environment by providing a safety threshold that prevents the penetration test from causing performance degradation or outages in critical financial transaction systems.

Answer

The tester will only use passive reconnaissance techniques

Answer

Exclude all financial transaction systems from the scope of testing

Answer

The client must provide a service level agreement (SLA) to the tester

Question 2

A client wants to conduct a penetration test of their e-commerce website. They are concerned about impacting live transactions. Which clause should be included in the Rules of Engagement to address this?

Accepted Answer

Exclusion of network stress testing and availability testing.. Option A is correct because the client's primary concern is avoiding disruption to live transactions. A clause excluding network stress testing and availability testing (e.g., DoS attacks, resource exhaustion, or high-volume scanning) directly addresses this by prohibiting any action that could degrade performance or cause downtime. This is a standard Rules of Engagement (RoE) safeguard for production e-commerce environments where transaction integrity and uptime are critical.

Answer

Out-of-scope systems list.

Answer

In-scope IP addresses.

Answer

Authorization for testing.

Question 3

A client wants a penetration test that simulates a disgruntled employee with access to the internal network but no administrative privileges. The client provides a standard user account on the domain. The tester discovers that the account has local administrator rights on a critical file server. Which step should the tester take according to typical Rules of Engagement?

Accepted Answer

Pause testing and inform the client of the unexpected privilege level for guidance. Option C is correct because the Rules of Engagement (RoE) require the tester to operate within the agreed scope and privilege level. Discovering that the provided standard user account has unexpected local administrator rights on a critical file server represents a scope change that could invalidate the test's assumptions and potentially cause unintended damage. The tester must pause and inform the client to obtain explicit guidance before proceeding with elevated privileges.

Answer

Continue testing with the elevated privileges because they were provided

Answer

Use the privileges to escalate to domain admin and test further

Answer

Revert to a lower-privileged account provided by the client

Question 4

A client wants a penetration test that simulates an external threat actor with no prior access. The client provides a list of public IP ranges and domain names. Which type of test is this?

Accepted Answer

External black-box test.. This is an external black-box test because the client provides only public IP ranges and domain names, simulating an external threat actor with no prior access. The tester has no internal knowledge or credentials, which defines a black-box approach, and the scope is limited to external-facing assets, making it external.

Answer

Internal white-box test.

Answer

Gray-box test.

Answer

Red team exercise.

Question 5

A penetration tester analyzes a PowerShell script that uses the 'Invoke-Command' cmdlet to run a command on multiple remote Windows systems. The script checks if the local Administrator account is using a default password. Which phase of the penetration test is this script most directly supporting?

Accepted Answer

Enumeration of misconfigurations. The script uses Invoke-Command to check if the local Administrator account on multiple remote Windows systems uses a default password. This directly supports the enumeration of misconfigurations phase, as it identifies a common security weakness (default credentials) that could be exploited. It does not involve moving between systems (lateral movement) or extracting stored credentials (credential dumping).

Answer

Lateral movement

Answer

Credential dumping

Answer

Privilege escalation

Question 6

A client requests a penetration test that includes an API endpoint hosted by a third-party vendor. The client does not have a signed agreement with the vendor for testing. What is the most appropriate action for the tester?

Accepted Answer

Exclude the API endpoint from scope until the client obtains written permission from the vendor. The tester must exclude the API endpoint from scope until the client obtains written permission from the vendor because testing a third-party API without explicit authorization violates legal boundaries and could constitute unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA). Even though the client requests the test, the tester has no contractual or legal relationship with the vendor, making any testing activity potentially illegal. This aligns with the PT0-002 objective of ensuring proper scoping and authorization before any testing begins.

Answer

Proceed with testing the API endpoint as requested by the client

Answer

Test the API endpoint using only non-intrusive methods

Answer

Include a disclaimer in the report that the tester is not liable for any damages

Question 7

A penetration tester has completed a test and is finalizing the report. The client's security team needs to know the exact commands and steps to reproduce a critical remote code execution vulnerability. In which section of the report should this information be primarily documented?

Accepted Answer

Findings and Remediation. The Findings and Remediation section is the correct place to document the exact commands and steps to reproduce a critical remote code execution vulnerability. This section provides detailed technical evidence, including proof-of-concept (PoC) code, command syntax, and step-by-step reproduction steps, enabling the client's security team to validate and remediate the issue. The Executive Summary is too high-level for such technical details, and the Methodology section describes the overall testing approach, not specific exploit commands.

Answer

Executive Summary

Answer

Methodology

Answer

Appendix

Question 8

A penetration tester has compromised a Windows domain-joined workstation and needs to identify all domain controllers and their IP addresses without triggering detection mechanisms. Which technique is most likely to avoid raising alerts?

Accepted Answer

Perform an LDAP query using ADSI to enumerate domain controllers. Performing an LDAP query using ADSI to enumerate domain controllers is stealthy because it uses standard, authenticated Windows API calls that blend into normal domain traffic. This technique queries the directory service for the 'domainController' object class, which returns the DNS hostnames and IP addresses without generating suspicious network scans or DNS anomalies.

Answer

Attempt a DNS zone transfer from the internal DNS server

Answer

Perform an ARP scan of the subnet to identify active IP addresses

Answer

Use Nmap to perform a SYN scan of the entire subnet looking for Kerberos service ports

Question 9

A penetration tester has compromised a Linux server and wants to move laterally to a Windows server. The Linux server has network access to the Windows server on port 445. The tester has a captured NTLM hash of a domain administrator account. Which technique is most likely to allow the tester to authenticate and execute commands on the Windows server?

Accepted Answer

Pass-the-hash using Impacket's psexec. Option A is correct because the tester has a captured NTLM hash of a domain administrator account and network access to the Windows server on port 445 (SMB). Pass-the-hash (PtH) allows authentication using the NTLM hash directly without needing the plaintext password. Impacket's psexec uses the SMB protocol to authenticate with the hash and execute commands remotely, making it the most direct and effective technique for lateral movement in this scenario.

Answer

Kerberos Golden Ticket attack

Answer

SMB relay attack using the hash

Answer

Brute-force password cracking of the hash

Question 10

A penetration test is being conducted for a healthcare organization subject to HIPAA. The tester is given access to a production system that contains electronic protected health information (ePHI). Which of the following should be included in the rules of engagement to ensure compliance?

Accepted Answer

A detailed data handling and destruction procedure within the rules of engagement.. Option C is correct because HIPAA requires covered entities to ensure the confidentiality, integrity, and availability of ePHI, which includes proper disposal of data after testing. A detailed data handling and destruction procedure within the rules of engagement (RoE) ensures that test data containing ePHI is securely wiped or destroyed in compliance with 45 CFR § 164.310(d)(2)(i) and NIST SP 800-88 guidelines. Without this clause, the tester might leave residual ePHI on production systems, violating HIPAA's security rule.

Answer

A clause requiring encryption of all test data at rest and in transit.

Answer

A business associate agreement (BAA) signed between the client and the testing firm.

Answer

A restriction to only test in non-production environments.

Question 11

A penetration tester gains access to a web application that uses a MongoDB backend. The tester discovers that the search functionality directly interpolates user input into a NoSQL query without sanitization. Which technique should the tester use to extract data from the database?

Accepted Answer

NoSQL injection. Option B is correct because the application uses MongoDB, a NoSQL database, and the search functionality directly interpolates user input into a NoSQL query without sanitization. This allows the tester to inject MongoDB operators (e.g., $ne, $regex, $gt) to manipulate the query logic and extract data, which is the core of NoSQL injection. Unlike SQL injection, this technique targets MongoDB's query syntax, such as JSON-based operators, to bypass authentication or retrieve records.

Answer

SQL injection

Answer

LDAP injection

Answer

Command injection

Question 12

A penetration tester has completed the test and is writing the final report. The client's VP of Security requests a single-page summary that highlights the most critical risks and their business impact. Which section of the report should be expanded to satisfy this request while maintaining the integrity of the full report?

Accepted Answer

Executive Summary – should include high-level findings and risk ratings. The VP of Security needs a concise, business-focused overview of critical risks and their impact. The Executive Summary is the appropriate section to expand because it is designed to present high-level findings, risk ratings, and business context for non-technical stakeholders, preserving the full report's integrity by keeping detailed technical data in other sections.

Answer

Technical Findings – should include a risk matrix

Answer

Appendices – should include a condensed risk report

Answer

Methodology – should include a summary of attack paths

Question 13

A penetration tester is analyzing a Bash script that automates a password spraying attack. The script contains the following loop: 'for user in $(cat users.txt); do for pass in $(cat passwords.txt); do curl -s -o /dev/null -w "%{http_code}" --data "user=$user&pass=$pass" http://target/login; done; done'. The script runs but the output is a continuous stream of HTTP status codes that are hard to interpret. Which improvement would most effectively help the tester identify a successful login?

Accepted Answer

Add a conditional statement that checks if the HTTP status code is 302 (redirect) or 200, and if so, prints the successful credentials.. Option C is correct because the script currently outputs a raw stream of HTTP status codes with no context. Adding a conditional to check for 302 (redirect, often indicating a successful login) or 200 (OK) and printing the corresponding credentials allows the tester to immediately identify which user/password pair succeeded, turning an unreadable output into actionable intelligence.

Answer

Add a delay with 'sleep 1' between requests to avoid rate limiting.

Answer

Pipe the output to 'grep -v 200' to exclude any responses that are not 200 OK.

Answer

Use 'curl -v' to see the full response headers.

Question 14

A penetration tester has gained a low-privileged command shell on a Windows 10 system. The tester suspects there is a vulnerable service with an unquoted service path that can be exploited for privilege escalation. Which command should the tester use to identify all services with this vulnerability?

Accepted Answer

reg query HKLM\SYSTEM\CurrentControlSet\Services\ /s /v ImagePath. Option B is correct because the `reg query` command with the `/s` switch recursively searches the registry key `HKLM\SYSTEM\CurrentControlSet\Services` for the `ImagePath` value of each service. An unquoted service path vulnerability occurs when the `ImagePath` contains spaces and is not enclosed in quotes, allowing an attacker to execute arbitrary code by placing a malicious executable in a path that Windows interprets as a command with arguments. This command directly retrieves the raw path strings from the registry, making it the most reliable method to identify unquoted paths.

Answer

Get-Service | Format-List Name,PathName

Answer

sc query type= all state= all | findstr "SERVICE_NAME"

Answer

net start

Question 15

A penetration tester is analyzing a Python script that imports the 'scapy' library. The script defines a function that sends a series of TCP SYN packets to a target IP and port range, and then waits for SYN-ACK responses. Which attack is the script performing?

Accepted Answer

Port scanning. The script sends TCP SYN packets to a range of ports and waits for SYN-ACK responses. This is the classic behavior of a SYN scan, a type of port scanning that identifies open ports by observing which ports respond with a SYN-ACK. The use of Scapy to craft and send these packets confirms the script is performing port scanning, not a denial-of-service attack.

Answer

TCP SYN flood

Answer

ARP poisoning

Answer

DNS spoofing