PT0-002 Practice Test 20 — 15 Questions

Question 1

A penetration tester is performing internal reconnaissance on a Windows Active Directory environment. The tester has a low-privileged domain user account. Which of the following techniques is most likely to help identify all domain controllers and their IP addresses without generating excessive network traffic or alerts?

Accepted Answer

Query the DNS service for SRV records of _ldap._tcp.dc._msdcs.domain.local. Option B is correct because querying DNS for SRV records of _ldap._tcp.dc._msdcs.domain.local is a standard, low-noise method to discover all domain controllers in an Active Directory environment. This query leverages the automatic registration of LDAP service records by domain controllers, requiring only a single DNS lookup rather than sweeping the network, thus avoiding excessive traffic and typical security alerts.

Answer

Perform a full subnet ping sweep using Nmap

Answer

Use NetBIOS name resolution by sending broadcasts

Answer

Enumerate SMB shares on all IP addresses in the subnet

Question 2

A penetration tester is preparing the final report. The client's IT director wants a high-level overview of the test results, including the number of findings and the overall risk rating. Which section of the report should the tester point to?

Accepted Answer

Executive summary. The executive summary is specifically designed to provide a high-level overview for management and non-technical stakeholders, such as the IT director. It summarizes the number of findings, overall risk rating, and key business impacts without delving into technical details, making it the correct section for this request.

Answer

Technical findings

Answer

Methodology

Answer

Recommendations

Question 3

A penetration tester is performing reconnaissance on a target organization and uses Shodan to find internet-facing devices. Which of the following is the BEST use case for Shodan in this context?

Accepted Answer

Discovering open ports and services on public IP ranges. Shodan is a search engine for internet-connected devices that scans public IP ranges and indexes the banners returned by services. Its primary use in reconnaissance is to discover open ports and running services on target IP ranges, revealing attack surface such as exposed databases, web servers, or industrial control systems. This aligns directly with the information-gathering phase of a penetration test.

Answer

Identifying subdomains through DNS brute-forcing

Answer

Enumerating email addresses from corporate websites

Answer

Extracting metadata from documents found on the target's website

Question 4

A penetration tester is reviewing a Python script that automates a common network attack. The script imports the 'ftplib' and 'telnetlib' libraries. It reads a list of IP addresses from a file and, for each host, attempts to connect using a predefined username and password. If the connection succeeds, it logs the success. Which attack is the script most likely performing?

Accepted Answer

Brute-force attack against FTP and Telnet services. The script uses 'ftplib' and 'telnetlib' to attempt connections with a predefined username and password against multiple IP addresses. This is characteristic of a brute-force attack, where the attacker tries a single credential pair against many hosts to gain unauthorized access to FTP and Telnet services.

Answer

Vulnerability scanning for open ports

Answer

Password spraying attack against web applications

Answer

Service enumeration using banner grabbing

Question 5

A penetration tester is using theHarvester tool to gather information about a target domain. The tester wants to collect email addresses and subdomains from public search engines and PGP key servers. Which source is theHarvester commonly configured to use for this passive reconnaissance?

Accepted Answer

Google and Bing search engines. Option D is correct because theHarvester is specifically designed to perform passive reconnaissance by querying public search engines (like Google and Bing) and PGP key servers to collect email addresses, subdomains, and other open-source intelligence (OSINT). It does not initiate direct connections to the target's infrastructure, making it a passive tool. The default configuration often includes Google and Bing as primary sources for this data.

Answer

Direct DNS zone transfer

Answer

Shodan

Answer

Baidu

Question 6

A penetration tester runs a vulnerability scanner against a web server and receives a high-confidence alert that the server is vulnerable to Heartbleed (CVE-2014-0160). The tester manually verifies using an OpenSSL command and finds that the server is patched. Which of the following is the most likely cause of this false positive?

Accepted Answer

The scanner's vulnerability signatures are outdated and still flagging the old behavior. Option A is correct because outdated vulnerability signatures are the most common cause of false positives in vulnerability scanning. The scanner's signature database likely still contains the original detection logic for Heartbleed (e.g., checking for a specific TLS heartbeat response length or pattern), which the patched server no longer exhibits. When the tester manually verified with an OpenSSL command (e.g., `openssl s_client -connect target:443 -tlsextdebug`), the patched server correctly handled the heartbeat request, confirming the scanner's alert was based on stale signatures.

Answer

The scanner's plugin for Heartbleed was misconfigured and sent malformed packets

Answer

The server returned a generic error message that the scanner misinterpreted as a sign of the vulnerability

Answer

The scanner's network connection was intermittent, causing incomplete responses that were incorrectly flagged

Question 7

A penetration tester is writing a Bash script to enumerate network shares on multiple Windows hosts. The script uses smbclient to list shares. Which command should be used within the script to attempt to connect to a host with a known username and password?

Accepted Answer

smbclient -L //host -U username%password. Option A is correct because the `smbclient -L //host` command lists available shares on a remote SMB/CIFS host, and appending `-U username%password` provides the credentials for authentication. This matches the requirement to enumerate network shares on multiple Windows hosts using a known username and password within a Bash script.

Answer

smbclient //host/share -U username%password

Answer

smbmap -H host -u username -p password

Answer

net use \host\share /user:username password

Question 8

A penetration tester is tasked with performing vulnerability scanning on a target organization that uses a web application firewall (WAF) and an intrusion prevention system (IPS). The tester wants to avoid being blocked while still gathering comprehensive data. Which scanning approach is most effective?

Accepted Answer

Use a slow, distributed scan from multiple IP addresses with random delays. A slow, distributed scan from multiple IP addresses with random delays is most effective because it evades rate-based detection mechanisms in WAFs and IPSs. By spreading the scan across many sources and introducing jitter, the traffic appears as normal user activity rather than a coordinated attack, allowing comprehensive data collection without triggering blocks.

Answer

Perform an aggressive scan with a high thread count to complete before the WAF adapts

Answer

Only perform passive reconnaissance and avoid active scanning

Answer

Use known WAF bypass techniques for each request

Question 9

A penetration tester is writing the findings section of a report. The tester identified a critical SQL injection vulnerability that allows extraction of the entire customer database. The client's technical team has already remediated the issue. How should the tester present this finding to ensure clarity and usefulness?

Accepted Answer

Document the vulnerability in full, including reproduction steps, impact, and evidence, and note the remediation status. Option C is correct because penetration testing standards (e.g., PTES, OWASP) require full documentation of all findings regardless of remediation status. Including reproduction steps, impact analysis, and evidence ensures the report serves as a permanent record for compliance, audit, and future reference. Noting the remediation status provides clear context that the issue has been resolved, which is critical for stakeholders who need to verify the fix.

Answer

Include the vulnerability with the risk rating, a brief description, and a note that it was remediated during the test

Answer

Exclude the vulnerability from the report because it has already been fixed

Answer

Reduce the risk rating of the vulnerability because it has been fixed, and include it in an appendix

Question 10

A penetration tester is using an Nmap NSE script to enumerate SMB shares on a target Windows server. The script runs without errors but returns no shares, even though the server has shares configured. Which is the MOST likely cause?

Accepted Answer

The script requires administrative credentials. The Nmap SMB enumeration scripts (e.g., smb-enum-shares.nse) by default attempt to connect as a guest or anonymous user. On modern Windows servers, especially those with default security configurations, anonymous access to SMB shares is disabled. The script requires valid administrative credentials to list all shares, as the SMB protocol restricts share enumeration to authenticated users with appropriate privileges.

Answer

The target is running Windows 10 with SMB signing enabled

Answer

The script is not being run with the correct arguments

Answer

The target is blocking ICMP traffic

Question 11

A penetration tester wants to identify all subdomains for a target domain using only public records. Which technique is most effective for this purpose?

Accepted Answer

Searching crt.sh (Certificate Transparency logs).. Certificate Transparency logs, accessible via crt.sh, are a public record of all SSL/TLS certificates issued for a domain. Since certificates often include Subject Alternative Names (SANs) listing subdomains, querying crt.sh reveals subdomains without any interaction with the target's infrastructure. This technique is passive, requires no authorization, and leverages mandatory logging per RFC 6962, making it highly effective for enumeration from public records.

Answer

DNS zone transfer.

Answer

Using Nmap to brute-force subdomains.

Answer

Querying the domain's MX records.

Question 12

A penetration tester wants to passively gather information about a target's technology stack, including web server software and frameworks. Which resource is best suited for this task without sending any packets to the target?

Accepted Answer

BuiltWith. BuiltWith is a web-based reconnaissance tool that analyzes a target website's technology stack by examining publicly available data, such as HTTP headers, HTML source code, and JavaScript files, without sending any packets from the tester's machine. It passively gathers information about web server software, frameworks, analytics tools, and more, making it ideal for passive information gathering.

Answer

Shodan

Answer

Nmap with -sT scan

Answer

Wappalyzer browser extension

Question 13

A penetration tester wants to discover email addresses associated with a target domain (example.com) without sending any network packets to the target's systems. Which technique is BEST suited for this?

Accepted Answer

Google dorking. Google dorking uses advanced search operators (e.g., site:example.com intext:@example.com) to index publicly available information from Google's cached pages, allowing discovery of email addresses without sending any packets to the target's infrastructure. This passive reconnaissance technique relies solely on pre-existing search engine data, making it ideal for avoiding direct interaction with the target.

Answer

DNS brute forcing

Answer

WHOIS lookup

Answer

SMB enumeration

Question 14

A penetration tester wants to enumerate user accounts and SMB shares from a Windows machine without authenticating. Which tool is specifically designed for this purpose and is commonly used in Linux penetration testing distributions?

Accepted Answer

enum4linux. enum4linux is specifically designed to enumerate user accounts, SMB shares, and other information from Windows machines via the SMB protocol without requiring authentication. It leverages the SMB null session vulnerability (CVE-1999-0504) to query the remote system for data such as user lists, share lists, and OS details, making it a standard tool in Linux penetration testing distributions like Kali Linux.

Answer

nmap

Answer

smbclient

Answer

hydra

Question 15

A penetration tester wants to perform a network scan that minimizes the chance of detection by an intrusion detection system (IDS). Which Nmap timing template is MOST appropriate?

Accepted Answer

-T0. The -T0 (Paranoid) timing template is the most appropriate for minimizing detection by an IDS because it introduces extreme delays between packet transmissions (up to 5 minutes between probes) and uses a very slow scan rate. This makes the scan traffic blend into normal network noise, reducing the likelihood of triggering signature-based or anomaly-based IDS alerts that rely on detecting rapid, sequential connection attempts.

Answer

-T3

Answer

-T5

Answer

-T2