PT0-002 Practice Exam 2 — 20 Questions

Question 1

A penetration tester is using Nmap to perform host discovery on a target network 192.168.1.0/24. The tester wants to identify live hosts without scanning ports. Which Nmap command should be used?

Accepted Answer

nmap -sn 192.168.1.0/24. The `-sn` flag in Nmap performs a ping sweep (host discovery) without scanning any ports. It sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default to determine which hosts are alive on the 192.168.1.0/24 network, making it the ideal choice for identifying live hosts without port scanning.

Answer

nmap -A 192.168.1.0/24

Answer

nmap -sS 192.168.1.0/24

Answer

nmap -sV 192.168.1.0/24

Question 2

Which TWO of the following are components of the DREAD model for risk assessment? (Select TWO.)

Accepted Answer

Reproducibility. DREAD stands for Damage, Reproducibility, Exploitability, Affected users, Discoverability.

Answer

Likelihood

Answer

Severity

Answer

Impact

Question 3

A tester is performing a web application test and discovers a parameter that seems to reflect input in the response. The tester attempts a reflected XSS payload but the application filters script tags. Which XSS variant should the tester try next?

Accepted Answer

Reflected XSS with event handlers. If script tags are filtered, HTML event handlers like onerror can still execute JavaScript.

Answer

Blind XSS

Answer

DOM-based XSS

Answer

Stored XSS

Question 4

While analyzing a malicious document, a tester extracts a VBA macro. Which tool can help decode the macro for analysis?

Accepted Answer

oledump. Oledump extracts and analyzes OLE objects, including VBA macros. Option B is wrong because pdf-parser is for PDF analysis. Option C is wrong because Wireshark is for network traffic. Option D is wrong because Nmap is for network scanning.

Answer

pdf-parser

Answer

Nmap

Answer

Wireshark

Question 5

A penetration tester needs to communicate the financial impact of a critical vulnerability to the board of directors. Which metric is most appropriate for this audience?

Accepted Answer

Annualized loss expectancy (ALE).. The board of directors is concerned with financial risk and business impact, not technical severity. Annualized loss expectancy (ALE) quantifies the expected monetary loss per year from a vulnerability, making it directly relevant for executive decision-making. CVSS scores and risk ratings are technical metrics that do not translate to financial terms.

Answer

CVSS base score (e.g., 9.8 out of 10).

Answer

Risk rating (High, Medium, Low).

Answer

Number of affected systems.

Question 6

A penetration tester is writing the executive summary for the final report. The CEO needs to understand the overall risk level and the business impact of the findings. Which of the following should be included in the executive summary?

Accepted Answer

A high-level overview of the most critical vulnerabilities and their potential business impact.. The executive summary is intended for non-technical stakeholders like the CEO, who need to grasp the overall risk posture and business implications without technical jargon. Option A provides a high-level overview of critical vulnerabilities and their potential business impact, directly addressing the CEO's need to understand risk level and business impact, which aligns with the PT0-002 objective for effective reporting and communication.

Answer

Detailed exploit steps with screenshots.

Answer

A list of all CVSS scores without context.

Answer

The exact commands used during testing.

Question 7

A penetration tester is attempting to exploit a server-side request forgery (SSRF) vulnerability in a cloud-hosted web application to access the cloud metadata service. Which IP address should the tester target?

Accepted Answer

169.254.169.254. The cloud metadata service for most cloud providers (AWS, GCP, Azure) is accessible via 169.254.169.254.

Answer

192.168.1.1

Answer

127.0.0.1

Answer

10.0.0.1

Question 8

A penetration tester is preparing for a web application penetration test. The client application is hosted on a cloud platform that serves multiple tenants. Which THREE of the following are critical legal and scoping considerations?

Accepted Answer

Understand how the client's data privacy policies affect handling of any discovered data. Legal considerations include authorization from the cloud provider, handling sensitive data, and defining permissible testing methods.

Answer

Include a clause in the SOW that the tester is not liable for any data exposure

Answer

Test all tenant data to ensure comprehensive coverage

Question 9

Which of the following is the primary purpose of a get-out-of-jail letter?

Accepted Answer

To provide legal authorization for the tester to perform the test. A get-out-of-jail letter provides authorization and protects the tester from legal liability when performing authorized tests.

Answer

To outline the deliverables

Answer

To establish a communication plan

Answer

To define the rules of engagement

Question 10

A penetration tester gains a low-privilege shell on a Linux server. The command 'sudo -l' reveals that the user can run /usr/bin/less as root without a password. Which tool would the tester likely use to escalate privileges?

Accepted Answer

GTFOBins. GTFOBins documents that less can be used to escalate privileges via the ! command when run with sudo.

Answer

Metasploit

Answer

Hashcat

Answer

Chisel

Question 11

You are attacking a web application and notice that it makes requests to internal services. You attempt to access the cloud metadata endpoint at http://169.254.169.254/. Which vulnerability are you most likely exploiting?

Accepted Answer

SSRF (Server-Side Request Forgery). SSRF (Server-Side Request Forgery) allows an attacker to make requests from the server to internal resources, including cloud metadata endpoints.

Answer

XXE (XML External Entity)

Answer

Command injection

Answer

CSRF (Cross-Site Request Forgery)

Question 12

A penetration tester is writing a report and needs to assign a severity rating to a vulnerability that has a CVSS base score of 7.5. According to CVSS v3.1, which severity level does this score correspond to?

Accepted Answer

High. CVSS v3.1 defines scores from 0.0 to 10.0: 0.0 = None, 0.1-3.9 = Low, 4.0-6.9 = Medium, 7.0-8.9 = High, 9.0-10.0 = Critical.

Answer

Critical

Answer

Low

Answer

Medium

Question 13

A penetration tester is presenting findings to a technical audience. Which THREE practices are MOST appropriate for this setting? (Select THREE.)

Accepted Answer

Demonstrate the exploit steps. Technical audiences benefit from details about exploitation, technical steps, and evidence.

Answer

Use high-level business language only

Answer

Focus on strategic recommendations

Question 14

A 'no-fail' clause prohibits service outages. How should the tester address high-risk tests like SQL injection?

Accepted Answer

Require a staging environment for testing. Testing in a staging environment prevents real outages. Option A is wrong because it removes important tests. Option C is wrong because it does not prevent outages. Option D is wrong because it is irresponsible.

Answer

Remove all high-risk tests from the scope

Answer

Include a clause that the tester is not liable

Answer

Proceed with testing and hope no outages occur

Question 15

During the information gathering phase, a penetration tester uses Google dorks to find exposed documents on a target's website. Which Google dork would be most appropriate to find PDF files containing sensitive information?

Accepted Answer

filetype:pdf. The filetype:pdf dork restricts results to PDF files. Other dorks target different file types or content.

Answer

inurl:admin

Answer

site:target.com password

Answer

intitle:index.of

Question 16

A penetration tester is conducting passive reconnaissance using OSINT techniques. Which TWO of the following are examples of passive OSINT sources?

Accepted Answer

Certificate transparency logs (crt.sh). Certificate transparency logs (crt.sh) (B) are a passive OSINT source because they are public, third-party repositories of issued TLS certificates that a tester can query without sending any traffic to the target's infrastructure, revealing subdomains and hostnames. WHOIS databases (D) are also passive OSINT, as registration records for domains and IP ranges are queried from registry/RIR servers rather than the target itself, exposing registrant, contact, and nameserver data. By contrast, social engineering (A) is an active engagement technique that involves direct interaction with people, not passive collection. snmpwalk (C) actively sends SNMP queries to a device, and an Nmap SYN scan (E) actively probes target ports with TCP SYN packets, so both generate traffic toward the target and are not passive.

Answer

Social engineering

Answer

snmpwalk

Answer

Nmap SYN scan

Question 17

A penetration tester is performing a vulnerability scan on a web server using Nikto. After the scan, the tester notices several findings related to outdated software versions and missing security headers. What should the tester do to validate the findings and reduce false positives?

Accepted Answer

Manually verify a subset of the findings. Manually verifying findings is the best practice to confirm if they are real vulnerabilities or false positives. Relying on scanner output alone is insufficient.

Answer

Ignore findings related to missing headers as low priority

Answer

Increase the scan intensity to get more details

Answer

Accept all findings as true since Nikto is a reliable tool

Question 18

A penetration tester is analyzing a web application and wants to discover hidden API endpoints by brute-forcing common paths. Which tool is best suited for this task?

Accepted Answer

Feroxbuster. Feroxbuster is a fast, recursive content discovery tool that supports wordlist-based brute-forcing of directories, files, and API endpoints, with automatic recursion.

Answer

WPScan

Answer

theHarvester

Answer

Nikto

Question 19

During a source code review of a PHP application, the tester finds the following line: $query = "SELECT * FROM users WHERE username = '" . $_POST['username'] . "'"; Which vulnerability is present?

Accepted Answer

SQL injection. Concatenating user input directly into an SQL query without sanitization leads to SQL injection.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Command injection

Question 20

A penetration tester is using Shodan to identify internet-facing devices associated with a target organization. Which of the following is Shodan's primary function in the context of passive reconnaissance?

Accepted Answer

Searching for devices and services exposed to the internet. Shodan is a search engine for internet-connected devices, providing information about services and banners. It does not perform active scans itself; it indexes data from active scanning.

Answer

Analyzing malware samples

Answer

Exploiting vulnerabilities in IoT devices

Answer

Performing live port scans on target IPs