PT0-002 Practice Test 19 — 15 Questions

Question 1

A penetration tester has submitted the final report to the client. The client's legal team requests a separate document that describes the methodology used, but does not include any actual findings or sensitive data. Which type of document should the tester provide?

Accepted Answer

A document describing the testing methodology and scope. The client's legal team specifically requested a document describing the methodology used without any actual findings or sensitive data. Option C, a document describing the testing methodology and scope, directly fulfills this requirement by providing a high-level overview of the penetration testing approach, tools, and boundaries, while excluding all findings, evidence, and sensitive client data. This type of document is often called a 'Methodology Statement' or 'Scope of Work' and is commonly used for legal or compliance purposes to demonstrate due diligence without exposing risk details.

Answer

A new executive summary that omits the findings

Answer

A copy of the technical findings with redacted details

Answer

The remediation plan without the exploit steps

Question 2

A penetration tester has compromised a Linux web server via a remote file inclusion vulnerability. The tester wants to maintain persistent access on the system. Which technique is MOST reliable for persistence on a Linux system?

Accepted Answer

Adding a cron job to run a reverse shell every minute. A cron job is the most reliable persistence mechanism because it operates independently of user login sessions, runs with root privileges if configured in the root crontab, and can execute a reverse shell at a fixed interval (e.g., every minute). Unlike user accounts or sudoers modifications, a cron job does not require the attacker to maintain an active session or rely on system services that may be monitored or disabled.

Answer

Creating a local user account with UID 0

Answer

Modifying the sudoers file to grant the tester sudo access

Answer

Installing a kernel module rootkit

Question 3

A penetration tester has gained a foothold on a Windows server running IIS. The tester wants to perform an SMB relay attack to move laterally within the domain. Which of the following conditions must be met for this attack to succeed?

Accepted Answer

The target server must have SMB signing disabled or not enforced. SMB relay attacks work by intercepting an SMB authentication attempt and forwarding it to a target server. For the relay to succeed, the target server must not require SMB signing, or signing must be disabled, because signing cryptographically binds the authentication to the original session, preventing the relayed credentials from being reused. If SMB signing is enforced, the target server will reject the relayed authentication, as the signature will not match the new session.

Answer

The tester must have local administrator privileges on the IIS server

Answer

The target server must be running SMBv1

Answer

The tester must have a valid domain user account to trigger the relay

Question 4

A penetration tester is analyzing a Python script that uses the Impacket library to perform an SMB relay attack. The script is failing to capture NTLM hashes from target machines. Which part of the script is MOST likely misconfigured?

Accepted Answer

The listener IP address. In an SMB relay attack using Impacket, the listener IP address must be set to the attacker's IP address where the relayed authentication is received. If the listener IP is misconfigured (e.g., set to the target's IP or left as localhost), the relay server will not receive the forwarded NTLM hashes, causing the capture to fail. This is a common configuration error when using Impacket's 'smbrelayx' or similar scripts.

Answer

The target IP address

Answer

The SMB version negotiation

Answer

The authentication method (NTLMv1 vs NTLMv2)

Question 5

A penetration tester is analyzing a Python script that uses the 'scapy' library to craft and send packets. The script contains the following code snippet: 'send(IP(dst=target)/TCP(dport=port, flags='S'))'. The script then listens for responses and looks for packets with flags 'SA'. Which type of scan is this script performing?

Accepted Answer

TCP SYN scan (half-open scan). The script sends a TCP SYN packet (flags='S') and listens for a SYN-ACK response (flags='SA'), which is the defining behavior of a TCP SYN scan (also known as a half-open scan). This scan never completes the three-way handshake, making it stealthier than a full TCP Connect scan. The use of Scapy's `send()` function (Layer 3) rather than `sr()` or a socket-level connect confirms it is crafting raw packets, not relying on the OS's TCP stack.

Answer

TCP Connect scan

Answer

TCP FIN scan

Answer

TCP Xmas scan

Question 6

A penetration tester is analyzing a PowerShell script that uses the 'Invoke-Command' cmdlet to execute commands on remote machines, and 'Set-Service' to change service startup types. What attack is this script most likely performing?

Accepted Answer

Remote service modification for persistence.. The script uses Invoke-Command to execute commands on remote machines and Set-Service to change service startup types. This combination is commonly used to modify a service to start automatically or to create a new service that runs malicious code, establishing persistence on a remote system. The attack does not involve lateral movement via PsExec (which uses SMB and service control manager differently) nor credential dumping (which requires tools like Mimikatz or direct memory access).

Answer

Lateral movement via PsExec.

Answer

Credential dumping.

Answer

Data exfiltration.

Question 7

A penetration tester is analyzing a Python script used for web application testing. The script imports the 'socket' module and uses it to create a raw socket. Which of the following is the most likely purpose of the script?

Accepted Answer

Sending crafted TCP packets to perform a SYN flood. The 'socket' module in Python provides low-level networking interfaces, and creating a raw socket (using `socket.SOCK_RAW`) allows the script to craft and send custom packets at the IP layer. A SYN flood attack involves sending a high volume of TCP SYN packets with spoofed source IP addresses to exhaust a target's resources, which requires raw socket access to manipulate packet headers. Therefore, the most likely purpose of the script is sending crafted TCP packets to perform a SYN flood.

Answer

Creating a reverse shell payload

Answer

Parsing HTTP responses for header injection

Answer

Automating user-agent rotation for web requests

Question 8

A penetration tester is analyzing a PowerShell script that uses Invoke-WebRequest and Invoke-RestMethod to interact with a target web service. The script parses JSON responses to extract session tokens and then uses those tokens in subsequent requests. Which attack technique is this script most likely performing?

Accepted Answer

Exploiting an API by manipulating request parameters and observing responses.. The script uses Invoke-WebRequest and Invoke-RestMethod to interact with a web service, parsing JSON responses to extract session tokens and reusing them in subsequent requests. This pattern is characteristic of API manipulation, where an attacker modifies request parameters (e.g., headers, query strings, or payload) and observes how the API responds to infer vulnerabilities or escalate privileges, rather than directly attacking authentication or injecting SQL.

Answer

Brute-forcing web application login credentials.

Answer

Performing a SQL injection attack on a web form.

Answer

Conducting a directory traversal attack to read arbitrary files.

Question 9

A penetration tester is analyzing a Ruby script that uses the 'metasploit-framework' gem. The script includes a line: `Msf::Simple::Framework.create` and then calls `run_single('use exploit/multi/handler')`. What is the primary purpose of this script?

Accepted Answer

Set up a Metasploit payload handler to catch reverse shells. The script uses `Msf::Simple::Framework.create` to instantiate a Metasploit Framework instance and then calls `run_single('use exploit/multi/handler')` to load the multi/handler module. This module is specifically designed to listen for incoming connections from payloads (e.g., reverse shells) that have been executed on a target, making the script's primary purpose to set up a handler to catch reverse shells.

Answer

Automate a port scan across multiple targets

Answer

Create a Metasploit resource script for automated attacks

Answer

Load and execute a local exploit against a specified target

Question 10

A penetration tester is analyzing a web application's JavaScript files to discover hidden API endpoints and potential client-side vulnerabilities. Which tool is specifically designed to extract URLs and endpoints from JavaScript files?

Accepted Answer

LinkFinder. LinkFinder is a Python-based tool specifically designed to extract URLs and endpoints from JavaScript files by using regular expressions and parsing techniques. It analyzes JS files for patterns like API routes, relative paths, and hardcoded URLs, making it ideal for discovering hidden endpoints during web application penetration testing.

Answer

Wireshark

Answer

Burp Suite's Target scope

Answer

Nmap

Question 11

A penetration tester is conducting passive reconnaissance against a target domain. The tester wants to discover all subdomains associated with the domain without making any direct DNS queries to the target's authoritative servers. Which technique is BEST suited for this purpose?

Accepted Answer

Querying certificate transparency logs using a site like crt.sh. Certificate transparency logs, accessible via sites like crt.sh, provide a historical record of all SSL/TLS certificates issued for a domain, including those for subdomains. Querying these logs allows a tester to discover subdomains without making any direct DNS queries to the target's authoritative servers, thus remaining fully passive and avoiding detection.

Answer

Using the 'nslookup' command to query the domain's DNS server

Answer

Performing a DNS zone transfer

Answer

Using the 'whois' lookup to gather domain registration info

Question 12

A penetration tester is performing internal reconnaissance on a Windows domain. The tester wants to enumerate SMB shares on multiple hosts quickly. Which tool is best suited for this task?

Accepted Answer

enum4linux. B is correct because enum4linux is a dedicated tool that automates the enumeration of SMB shares, users, and other information from Windows and Samba systems using the SMB protocol (primarily over TCP/445 and NetBIOS over TCP/139). It leverages the SMB RPC calls (e.g., NetShareEnum) to quickly list shares across multiple hosts, making it ideal for internal reconnaissance in a Windows domain.

Answer

nmap -sV --script=smb-enum-shares

Answer

nbtscan

Answer

dig

Question 13

A penetration tester is conducting a vulnerability scan of a web application that uses a custom API framework. The scanner reports several potential SQL injection vulnerabilities, but manual testing confirms they are false positives. The tester suspects the scanner is misinterpreting input validation. Which of the following is the most likely reason for these false positives?

Accepted Answer

The application reflects the injected payload in error messages or response content, causing the scanner to think the injection succeeded. Option B is correct because the scanner likely detected the injected payload reflected in the application's response (e.g., in an error message or echoed input), which it interpreted as successful SQL execution. In custom API frameworks, input validation may reject the payload but still reflect it back in the response, causing the scanner to flag a false positive. Manual testing confirms the injection fails, so the reflection is merely a side effect of the API's error handling, not a sign of database interaction.

Answer

The scanner used a payload that was blocked by a Web Application Firewall (WAF) before reaching the application

Answer

The scanner used outdated signatures that do not match the custom API's input validation logic

Answer

The application returns a generic 'Invalid input' message for all types of invalid input, confusing the scanner

Question 14

A penetration tester is finalizing a report. Which section should include a detailed technical explanation of how each vulnerability was exploited?

Accepted Answer

Findings and Recommendations. The Findings and Recommendations section is the correct place for detailed technical explanations of how each vulnerability was exploited because it provides the technical audience (e.g., system administrators, developers) with the step-by-step attack chain, including specific commands, payloads, and tools used. This section bridges the gap between raw scan data and actionable remediation, ensuring that the technical team can reproduce and verify the findings. The Executive Summary is too high-level for this detail, and the Methodology section describes the overall approach, not per-vulnerability exploitation steps.

Answer

Executive Summary

Answer

Methodology

Answer

Appendix

Question 15

A penetration tester is reviewing a Python script that uses the `requests` library to send HTTP POST requests to a login endpoint. The script attempts to bypass authentication by sending SQL injection payloads in the username field. Which of the following code changes would MOST effectively help the tester identify successful injections by reducing false negatives?

Accepted Answer

Parsing the response for specific error messages such as 'SQL syntax' or 'mysql_fetch_array'. Option B is correct because parsing the HTTP response for database-specific error messages (e.g., 'SQL syntax', 'mysql_fetch_array') directly indicates that the SQL injection payload triggered a detectable database error, confirming a successful injection. This reduces false negatives by catching cases where the login fails but the injection still executes, rather than relying solely on authentication bypass (which may not occur if the injection is blind or the query structure differs).

Answer

Using a `requests.Session` object to maintain cookies across requests

Answer

Implementing a random delay between requests to avoid rate limiting

Answer

Adding a function to automatically resend each payload multiple times