PT0-002 Practice Test 19 — 15 Questions

Question 1

After completing a penetration test, the tester must handle test artifacts appropriately. Which TWO of the following are best practices for data handling and destruction?

Accepted Answer

Securely delete all test data after the engagement is complete. Best practices include securely erasing test data and returning any client data to the client.

Answer

Keep all test data indefinitely for future reference

Answer

Store test data in an unencrypted archive on the tester's laptop

Answer

Share test data with other clients for benchmarking

Question 2

A penetration tester is conducting a web application test and discovers a server-side request forgery (SSRF) vulnerability. The application accepts a URL parameter and fetches the resource. Which TWO of the following are common SSRF exploitation techniques?

Accepted Answer

Accessing the AWS metadata endpoint at 169.254.169.254. SSRF can access internal services like cloud metadata endpoints and perform internal port scans.

Answer

Crafting a JavaScript payload for XSS

Answer

Injecting SQL queries into the URL

Answer

Forcing the server to send a POST request

Question 3

A penetration tester is reviewing a Python script that uses the `requests` library to send HTTP POST requests to a login endpoint. The script attempts to bypass authentication by sending SQL injection payloads in the username field. Which of the following code changes would MOST effectively help the tester identify successful injections by reducing false negatives?

Accepted Answer

Parsing the response for specific error messages such as 'SQL syntax' or 'mysql_fetch_array'. Parsing the HTTP response for database-specific error messages (e.g., 'SQL syntax', 'mysql_fetch_array') directly indicates that the SQL injection payload triggered a detectable database error, confirming a successful injection. This reduces false negatives by catching cases where the login fails but the injection still executes, rather than relying solely on authentication bypass (which may not occur if the injection is blind or the query structure differs).

Answer

Using a `requests.Session` object to maintain cookies across requests

Answer

Implementing a random delay between requests to avoid rate limiting

Answer

Adding a function to automatically resend each payload multiple times

Question 4

A penetration tester runs a SYN scan against a target and receives SYN-ACK responses from several ports. The tester then runs version detection on those ports. What is the primary purpose of version detection?

Accepted Answer

To identify the software and version running on open ports. Version detection (-sV) in Nmap identifies the specific software and version running on open ports, helping assess potential vulnerabilities and plan further exploitation.

Answer

To identify the operating system of the target

Answer

To perform a vulnerability scan

Answer

To determine if the host is online

Question 5

A penetration tester is performing a man-in-the-middle attack on a network using ARP spoofing. What is the primary purpose of ARP spoofing?

Accepted Answer

To associate the attacker's MAC address with the IP address of a legitimate host. ARP spoofing works by sending forged ARP replies to associate the attacker's MAC address with the IP address of a legitimate host (e.g., the default gateway). This causes traffic destined for that IP to be sent to the attacker instead, enabling interception and manipulation of network communications.

Answer

To assign a fake IP address to the attacker's device

Answer

To modify the routing table of the target

Answer

To poison the DNS cache of the target

Question 6

A penetration tester discovers a Java application that deserializes user-controlled data without validation. The tester crafts a malicious serialized object that executes a command upon deserialization. The application runs on a Linux server with a standard Java runtime. Which of the following is the most likely outcome if the malicious object is accepted?

Accepted Answer

The tester will be able to execute arbitrary commands on the server.. Java deserialization of untrusted data allows an attacker to supply a crafted serialized object that, when deserialized, can execute arbitrary code via gadget chains (e.g., CommonsCollections). Since the application runs on a Linux server with a standard Java runtime, the attacker can achieve remote code execution (RCE) with the privileges of the application's user, not necessarily an interactive shell. Option D is correct because the primary impact is arbitrary command execution, which may or may not yield a shell depending on the payload.

Answer

The application will crash immediately due to an exception.

Answer

The application will disclose sensitive information in the response.

Answer

The tester will gain a shell with the privileges of the current user.

Question 7

A penetration tester is analyzing a Bash script used for post-exploitation enumeration. The script contains the line: `cat /etc/shadow | awk -F: '{print $1, $2}'`. What is the primary purpose of this command?

Accepted Answer

Display all usernames and their associated password hashes. The command `cat /etc/shadow | awk -F: '{print $1, $2}'` reads the shadow file, which stores user account information including password hashes. The `-F:` sets the field separator to colon, and `{print $1, $2}` outputs the first field (username) and second field (password hash). This is a common post-exploitation technique to extract password hashes for offline cracking.

Answer

Show the number of users in the system

Answer

Extract the usernames and home directories

Answer

List the account expiration dates

Question 8

Which legal framework in the United States makes it a crime to access a computer system without authorization, and is a key consideration when obtaining permission for penetration testing?

Accepted Answer

CFAA. The Computer Fraud and Abuse Act (CFAA) is the primary US law against unauthorized access.

Answer

SOX

Answer

HIPAA

Answer

GDPR

Question 9

A Python proof-of-concept sends repeated login attempts but does not preserve cookies between requests. The application sets a CSRF token in a session cookie. What change is most likely required for accurate testing?

Accepted Answer

Use a requests.Session object and refresh the CSRF token before each attempt.. The proof-of-concept fails to maintain session state across requests, which is essential for handling CSRF tokens that are typically tied to a session. Using a `requests.Session` object automatically persists cookies (including the session cookie containing the CSRF token) across requests, and refreshing the CSRF token before each attempt ensures the token is valid for each login attempt, mimicking real browser behavior.

Answer

Remove all headers from the requests.

Answer

Increase the payload length only.

Answer

Disable TLS certificate verification as the main fix.

Question 10

A penetration tester is planning a test that involves scanning for vulnerabilities across a large IP range. The client has provided a list of IPs that are in-scope, but the tester notices that some IPs belong to a third-party company hosting a client application. What should the tester do?

Accepted Answer

Exclude the third-party IPs and notify the client. The tester must ensure that all in-scope IPs are authorized. If an IP belongs to a third party, the tester needs written permission from that provider before testing.

Answer

Assume the client has permission and scan all IPs

Answer

Scan the IPs because they are on the client's list

Answer

Scan only the third-party IPs that respond to ping

Question 11

During a penetration test, the tester gains a Meterpreter session on a Windows target and wants to escalate privileges to SYSTEM. The current user has the SeImpersonatePrivilege token. Which tool should the tester use to exploit this privilege?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits the SeImpersonatePrivilege to impersonate SYSTEM tokens.

Answer

Windows-Exploit-Suggester

Answer

whoami /priv

Answer

Mimikatz

Question 12

A penetration tester needs to gather information about a target organization's employees and email addresses from public sources. Which passive reconnaissance tool is BEST suited for this task?

Accepted Answer

Maltego. Maltego is a passive reconnaissance tool that excels at gathering information from public sources, including employee names, email addresses, and organizational relationships, by querying open-source intelligence (OSINT) data such as social media, search engines, and DNS records. It uses transforms to automate data collection and link analysis, making it ideal for this task without directly interacting with the target's systems.

Answer

Nikto

Answer

Nmap

Answer

Wireshark

Question 13

A client asks a penetration tester to perform a test on an e-commerce website. The website experiences high traffic during weekdays and major sales events. To minimize business disruption, when should the tester schedule the active scanning and exploitation activities?

Accepted Answer

During weekends outside of any special promotions. Scheduling active scanning and exploitation during weekends outside of special promotions aligns with the requirement to minimize business disruption. High-traffic periods like weekdays and major sales events increase the risk of performance degradation or service interruption from scanning tools, which could impact revenue and user experience. By choosing low-traffic windows, the tester reduces the likelihood of overwhelming the web server or triggering rate-limiting mechanisms.

Answer

During peak business hours on weekdays

Answer

During a major holiday sale event

Answer

Anytime, as long as the tester does not perform denial-of-service attacks

Question 14

A penetration tester is performing a Kerberoasting attack. Which TWO steps are required for a successful Kerberoasting attack?

Accepted Answer

Request TGS tickets for service accounts. Kerberoasting involves requesting TGS tickets for service accounts and then cracking the tickets offline.

Answer

Enumerate domain admins

Answer

Perform a relay attack

Answer

Capture NTLMv2 hashes using Responder

Question 15

Before starting a penetration test, the tester receives permission to test only two public IP ranges and is told not to perform denial-of-service testing. Which two documents or artefacts are most important to confirm before testing begins? (Choose 2.)

Accepted Answer

Written authorization to test the specified targets.. Written authorization (A) is the foundational legal document that explicitly grants the tester permission to test the specified public IP ranges, protecting against claims of unauthorized access under laws like the Computer Fraud and Abuse Act. The rules of engagement (B) define the scope boundaries, including the prohibition of denial-of-service testing, which is critical to avoid service disruption and legal liability. Without these two documents, the tester lacks both legal authority and operational constraints, making them the most important artefacts before testing begins.

Answer

A list of exploit payloads from a public GitHub repository.

Answer

A screenshot of the company home page.