PT0-002 Practice Test 20 — 15 Questions

Question 1

A penetration tester is handling a client's pushback on a finding. Which THREE approaches are appropriate? (Select THREE.)

Accepted Answer

Re-evaluate the finding and adjust if new information is available. When handling pushback, the tester should listen, provide evidence, and possibly adjust the report if valid points are made.

Answer

Immediately lower the severity to satisfy the client

Answer

Refuse to change the report under any circumstances

Question 2

A penetration tester is targeting a web application that uses parameterized queries for all database interactions. Which attack vector is most likely to succeed?

Accepted Answer

Business logic flaws. Parameterized queries prevent SQL injection by separating SQL code from user input, making option B ineffective. Business logic flaws (D) are vulnerabilities in the application's design or workflow that are not mitigated by secure coding practices like parameterized queries, so they remain exploitable. This attack vector targets the intended functionality of the application, such as manipulating pricing or bypassing authentication steps, which parameterized queries do not protect against.

Answer

Cross-site request forgery

Answer

SQL injection

Answer

Cross-site scripting

Question 3

A penetration tester has gained administrative access to a Windows system and wants to extract NTLM password hashes from the memory of the Local Security Authority Subsystem Service (LSASS). Which tool is most commonly used for this purpose?

Accepted Answer

Mimikatz. Mimikatz is the most commonly used tool for extracting NTLM password hashes from LSASS memory on a Windows system. It leverages the `sekurlsa::logonpasswords` module to read the LSASS process memory and decrypt stored credentials, including NTLM hashes, without requiring a separate brute-force or dictionary attack.

Answer

John the Ripper

Answer

Hashcat

Answer

Netcat

Question 4

You are testing a web application and notice that it uses JSON Web Tokens (JWT) for authentication. You change the algorithm to 'none' and remove the signature, and the token is accepted. Which JWT vulnerability did you exploit?

Accepted Answer

Algorithm none attack. Alg:none attack exploits weak validation that accepts unsigned tokens.

Answer

KID injection

Answer

Weak secret brute-force

Answer

Token replay

Question 5

In a penetration test report, which section should contain detailed technical information such as affected systems, proof-of-concept code, and remediation steps?

Accepted Answer

Technical findings. The technical findings section is where detailed vulnerability descriptions, evidence, and remediation steps are documented.

Answer

Appendices

Answer

Executive summary

Answer

Methodology

Question 6

You have obtained a NTLM hash of a domain admin account and want to authenticate to a remote server without cracking the password. Which technique enables you to authenticate using the hash?

Accepted Answer

Pass-the-Hash. Pass-the-hash uses the NTLM hash directly to authenticate without needing the plaintext password. Tools like pth-winexe or CrackMapExec can perform this.

Answer

AS-REP roasting

Answer

Pass-the-Ticket

Answer

Kerberoasting

Question 7

A tester is performing a privilege escalation on a Windows system and finds that the user has SeImpersonatePrivilege enabled. Which tool could be used to escalate to SYSTEM?

Accepted Answer

PrintSpoofer. SeImpersonatePrivilege can be exploited using tools like PrintSpoofer or Potato attacks to impersonate SYSTEM tokens.

Answer

PsExec

Answer

evil-winrm

Answer

pth-winexe

Question 8

A tester is performing a web application test and finds an endpoint that accepts XML input. The tester sends a payload that includes an external entity referencing a local file. Which vulnerability is being tested?

Accepted Answer

XXE. XXE (XML External Entity) injection allows reading local files or performing SSRF via XML parsers.

Answer

IDOR

Answer

SSRF

Answer

Command injection

Question 9

Which Metasploit command is used to display information about the current meterpreter session, including the target OS and user?

Accepted Answer

sysinfo. The 'sysinfo' meterpreter command displays system information such as OS, architecture, and sometimes user context.

Answer

hashdump

Answer

getuid

Answer

getsystem

Question 10

A penetration tester is performing reconnaissance on a target organization and uses Shodan to find internet-facing devices. Which of the following is the BEST use case for Shodan in this context?

Accepted Answer

Discovering open ports and services on public IP ranges. Shodan is a search engine for internet-connected devices that scans public IP ranges and indexes the banners returned by services. Its primary use in reconnaissance is to discover open ports and running services on target IP ranges, revealing attack surface such as exposed databases, web servers, or industrial control systems. This aligns directly with the information-gathering phase of a penetration test.

Answer

Identifying subdomains through DNS brute-forcing

Answer

Enumerating email addresses from corporate websites

Answer

Extracting metadata from documents found on the target's website

Question 11

Which of the following penetration testing standards includes detailed guidelines for pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting?

Accepted Answer

PTES. PTES (Penetration Testing Execution Standard) covers the entire testing lifecycle from pre-engagement to reporting.

Answer

OSSTMM

Answer

OWASP Testing Guide

Answer

NIST SP 800-115

Question 12

During a penetration test, the tester discovers a critical SQL injection vulnerability. The client cannot deploy the full fix (parameterized queries) immediately due to legacy code. Which THREE actions should the tester recommend as compensating controls? (Choose three.)

Accepted Answer

Restrict the database account used by the application to least privilege. Compensating controls reduce risk while the full fix is pending. WAF rules, input validation, and restricted DB privileges are appropriate. Disabling error messages is not a direct compensating control, and patching the DBMS may not address the injection.

Answer

Disable detailed error messages to prevent information disclosure

Answer

Patch the database management system to the latest version

Question 13

A penetration tester is performing active reconnaissance on a web application and wants to discover hidden API endpoints. Which TWO tools are BEST suited for this task? (Select TWO.)

Accepted Answer

Feroxbuster. Gobuster can be used to bruteforce directories and files, including API paths. Feroxbuster is a similar tool written in Rust that is faster and supports recursion. Both are effective for API endpoint discovery.

Answer

Wappalyzer

Answer

Nikto

Answer

theHarvester

Question 14

During an internal penetration test, a tester captures a NetNTLMv2 hash via an SMB relay attack. The target network does not enforce SMB signing. What is the most effective next step to gain access to a remote server?

Accepted Answer

Relay the captured hash to authenticate to another server.. Since SMB signing is not enforced, the tester can relay the captured NetNTLMv2 hash directly to another server without needing to crack it. This works because the relay attack forwards the authentication challenge-response to a target server, allowing the tester to authenticate as the victim user without knowing the plaintext password. This is the most effective step because it provides immediate access without the time and resource cost of offline cracking.

Answer

Crack the hash offline using a dictionary attack.

Answer

Perform a pass-the-hash attack using the captured hash.

Answer

Use the hash to perform an LLMNR poisoning attack.

Question 15

A penetration tester wants to identify live hosts on a large internal network. Which Nmap option would be the FASTEST for initial host discovery?

Accepted Answer

-sn (Ping sweep). The -sn option performs a ping sweep, sending ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default. It does not perform port scanning, making it the fastest method for initial host discovery on a large internal network because it only checks for host availability without enumerating services.

Answer

-sV (Version detection)

Answer

-sS (SYN stealth scan)

Answer

-A (Aggressive scan)