PT0-002 Practice Test 2 — 10 Questions

Question 1

A penetration tester is reviewing source code and wants to identify common hardcoded credentials and input validation gaps. Which three checks should the tester perform? (Choose THREE.)

Accepted Answer

Identify usage of eval, exec, or system with user input. Hardcoded credentials, concatenated SQL queries, and dangerous functions like eval/exec/system are common vulnerabilities.

Answer

Verify the use of HTTPS

Answer

Check for proper session timeout implementation

Question 2

During a penetration test, a tester captures NTLMv2 hashes by spoofing LLMNR responses. Which tool is most commonly used for this purpose?

Accepted Answer

Responder. Responder is the standard tool for LLMNR/NBT-NS/mDNS poisoning to capture NTLM hashes.

Answer

John the Ripper

Answer

Bettercap

Answer

Hashcat

Question 3

During a penetration test, the tester gains access to a domain-joined Windows machine and wants to perform Kerberoasting. Which THREE conditions are necessary for a successful Kerberoasting attack?

Accepted Answer

Ability to request TGS-REP tickets. The user must have domain credentials, there must be service accounts with SPNs, and the attacker must be able to request TGS tickets. Plaintext passwords are not required, and local admin is not needed.

Answer

Local administrator privileges on the target

Answer

Plaintext password of the service account

Question 4

A penetration tester is conducting passive reconnaissance and wants to gather information about a target organization's employees, email addresses, and internal structure. Which TWO tools are best suited for this purpose? (Select TWO.)

Accepted Answer

Maltego. Maltego is a data mining tool that visualizes relationships and can collect info from social media, DNS, and other sources. theHarvester gathers emails, subdomains, and names from public sources. LinkedIn is also used for organizational chart mapping, but the question asks for tools specifically.

Answer

Gobuster

Answer

Nmap

Answer

Nikto

Question 5

During post-engagement, a penetration tester needs to ensure proper data handling. Which THREE actions should the tester take?

Accepted Answer

Securely destroy test artifacts after the client accepts the report. After the engagement, test artifacts should be securely destroyed, data should be purged from test systems, and confidential information must be handled per agreement.

Answer

Retain all test data indefinitely for future reference

Answer

Share findings with other clients to demonstrate expertise

Question 6

During an internal penetration test, the tester wants to relay captured NTLM authentication to a server to gain access. Which tool from the Impacket suite is specifically designed for NTLM relay attacks?

Accepted Answer

ntlmrelayx. ntlmrelayx is the Impacket tool for relaying NTLM authentication.

Answer

CrackMapExec

Answer

Metasploit

Answer

Responder

Question 7

A penetration tester discovers evidence of ongoing criminal activity, such as a data breach by an internal employee, during a white box penetration test. The client's legal team has not provided specific instructions on handling such discoveries. According to best practices and legal considerations, what should the tester do first?

Accepted Answer

Stop testing and contact the client's emergency contact. The tester should immediately stop testing and inform the client's emergency contact to handle the criminal activity appropriately.

Answer

Notify law enforcement directly

Answer

Continue testing and document the evidence for later reporting

Answer

Ignore the activity and proceed as planned

Question 8

A penetration tester is using a vulnerability scanner on a web application and notices that many findings are false positives caused by the scanner sending oversized payloads that the application truncates or rejects. Which scanner configuration change would MOST effectively reduce false positives in this scenario?

Accepted Answer

Enable safe checks or anti-false positive mode. Enabling safe checks or anti-false positive mode configures the scanner to send payloads that conform to expected application input constraints (e.g., length limits, character sets) rather than oversized or malformed payloads. This reduces false positives by ensuring that the scanner only reports vulnerabilities that are actually reachable and exploitable under normal application behavior, rather than triggering truncation or rejection logic that is not a security flaw.

Answer

Increase the scan intensity to send more payloads

Answer

Increase the HTTP request timeout

Answer

Disable vulnerability detection for certain plugins

Question 9

When a client disagrees with a finding's severity rating, what is the best approach for the penetration tester?

Accepted Answer

Discuss the rationale and adjust if valid business context is provided. The tester should listen to the client's perspective and discuss the risk assessment, providing rationale to explain the rating.

Answer

Escalate to the tester's manager

Answer

Insist on the original rating and refuse to change it

Answer

Lower the rating to satisfy the client

Question 10

You are performing reconnaissance on a target's web application. Which of the following techniques can be used to discover hidden directories and files? (Select THREE.)

Accepted Answer

Using feroxbuster. Directory bruteforce tools like dirsearch, gobuster, and feroxbuster are designed to discover hidden directories and files by using wordlists. Nikto is a vulnerability scanner, not primarily for directory discovery. theHarvester is for email/subdomain harvesting.

Answer

Running Nikto with default options

Answer

Querying theHarvester