PT0-002 Practice Exam 2 — 20 Questions

Question 1

A client wants to test a web application that uses a third-party payment gateway. The client explicitly wants the payment gateway to be excluded from the test to avoid service disruption. Where should this exclusion be formally documented?

Accepted Answer

Rules of Engagement (ROE). The Rules of Engagement (ROE) document is the correct place to formally exclude the third-party payment gateway from testing. The ROE defines the scope, boundaries, and constraints of the penetration test, including specific systems or services that must not be targeted. This ensures the client's requirement to avoid service disruption to the payment gateway is legally and operationally enforced.

Answer

Non-Disclosure Agreement (NDA)

Answer

Statement of Work (SOW)

Answer

Penetration Test Plan

Question 2

A penetration tester has completed an internal network test. The client's IT manager requests a document that lists each vulnerability with its CVSS score, risk rating, and a brief description of the impact. Which section of the final report should contain this information?

Accepted Answer

Technical Findings. The Technical Findings section is the correct location because it provides a detailed, itemized list of each discovered vulnerability, including its CVSS score, risk rating, and impact description. This section is intended for technical stakeholders who need granular data to prioritize remediation, unlike the Executive Summary which offers high-level business impact and risk overviews.

Answer

Executive Summary

Answer

Methodology

Answer

Remediation Summary

Question 3

A penetration tester has identified a critical misconfiguration in a cloud storage bucket that exposes sensitive customer data. The client's technical team has already applied a fix, but the tester wants to ensure the report accurately reflects the risk and the remediation. Which section of the report should include the steps to reproduce the vulnerability?

Accepted Answer

Technical details and proof of concept. The technical details and proof of concept (POC) section is the correct place to include step-by-step reproduction steps because it provides the client's technical team with the exact commands, API calls, or configuration checks needed to verify the vulnerability and the fix. This section is distinct from the executive summary (which targets non-technical stakeholders) and the findings and risk rating (which focuses on impact and severity). By including reproduction steps here, the tester ensures the remediation can be validated without ambiguity.

Answer

Executive summary

Answer

Findings and risk rating

Answer

Remediation recommendations

Question 4

A client wants to conduct a penetration test of their web application, but they are concerned about potential service disruption. They request that the tester avoid using any techniques that could cause the application to crash or become unresponsive. Which of the following should the tester include in the rules of engagement to address this requirement?

Accepted Answer

Include a clause that prohibits denial-of-service attacks and rate-limits all automated tools.. Option B is correct because it directly addresses the client's concern by prohibiting denial-of-service attacks and implementing rate-limiting on automated tools. Rate-limiting prevents overwhelming the web application with requests, which could cause resource exhaustion or unresponsiveness, while the prohibition on DoS ensures no intentional disruption occurs. This aligns with the rules of engagement (RoE) requirement to scope the test safely.

Answer

Specify that the tester will only use ACK scans and never send data payloads.

Answer

State that the tester will not use any automated tools and will perform only manual testing.

Answer

Do not include any specific limitation; the tester assumes responsibility for any outages.

Question 5

A penetration tester wants to perform DNS brute-force enumeration to discover subdomains of a target domain. Which tool is specifically designed for this purpose?

Accepted Answer

dnsrecon. B is correct because dnsrecon is a specialized DNS enumeration tool that includes a brute-force mode for discovering subdomains. It uses a wordlist to query DNS servers for common subdomain names, leveraging the DNS protocol's inherent structure to map out a target's domain hierarchy without relying on zone transfers.

Answer

nmap

Answer

Wireshark

Answer

Hydra

Question 6

A client is subject to PCI DSS compliance and requests a penetration test. The client's network has a mix of in-scope systems (cardholder data environment) and out-of-scope systems. During scoping, the tester recommends a specific approach to ensure accurate segmentation testing. Which of the following is the most important consideration for the rules of engagement?

Accepted Answer

The tester must be provided with a diagram of the network segmentation. For accurate segmentation testing under PCI DSS, the tester must verify that the segmentation controls (e.g., firewalls, VLANs, ACLs) effectively isolate the cardholder data environment (CDE) from out-of-scope systems. A network diagram is essential because it documents the expected segmentation boundaries, IP ranges, and traffic flows, allowing the tester to design targeted tests (e.g., using traceroute, nm scans, or firewall rule validation) to confirm that no unauthorized paths exist between segments. Without this diagram, the tester cannot determine which systems should be reachable and which should be blocked, making segmentation validation unreliable.

Answer

The tester must have network access to both in-scope and out-of-scope systems

Answer

The tester must agree not to scan any out-of-scope IP addresses

Answer

The tester must obtain written authorization from the client's security team

Question 7

A penetration tester discovers that a web application uses a vulnerable Java deserialization endpoint. The classpath includes the Apache Commons Collections library. Which attack technique is most likely to achieve remote code execution?

Accepted Answer

Java deserialization of untrusted data (RCE via Commons Collections).. The correct answer is A because the presence of the Apache Commons Collections library in the classpath, combined with a vulnerable Java deserialization endpoint, enables the classic 'gadget chain' attack. Attackers craft a malicious serialized object that, when deserialized, invokes methods in Commons Collections (e.g., InvokerTransformer) to execute arbitrary system commands, achieving remote code execution (RCE). This is a well-documented exploit chain (e.g., CVE-2015-7501) that directly leverages the library's reflection-based classes.

Answer

SQL injection.

Answer

Cross-site scripting.

Answer

Command injection.

Question 8

A penetration tester has compromised a Linux server and gained a low-privilege shell. The tester discovers that the /etc/shadow file is readable by the tester's user. Which attack is most directly enabled by this finding?

Accepted Answer

Password cracking offline. The /etc/shadow file contains the hashed passwords for all users on the system. If a low-privilege user can read this file, they can copy the password hashes and attempt to crack them offline using tools like John the Ripper or Hashcat. This directly enables an offline password cracking attack, as the tester can brute-force or use dictionary attacks against the hashes without needing to interact with the live system.

Answer

Pass-the-hash

Answer

LLMNR poisoning

Answer

Kerberoasting

Question 9

A penetration tester discovers a web application that uses client-side JavaScript to validate user input before form submission. The input is then sent to the server and used directly in a SQL query without server-side validation. Which attack would most effectively exploit this vulnerability?

Accepted Answer

SQL injection. The correct answer is A because the vulnerability described—client-side JavaScript validation with no server-side sanitization, followed by direct use of input in a SQL query—is the classic precondition for SQL injection. An attacker can bypass client-side controls (e.g., by disabling JavaScript or using a proxy like Burp Suite) and submit crafted SQL syntax (e.g., `' OR 1=1 --`) to manipulate the query, extract data, or execute arbitrary SQL commands on the database server.

Answer

Cross-site scripting (XSS)

Answer

Command injection

Answer

Parameter pollution

Question 10

A penetration tester has discovered a local file inclusion (LFI) vulnerability in a PHP web application. The vulnerable code uses the following pattern: include($_GET['page']);. The application runs on a Linux server with Apache and PHP. The tester wants to achieve remote code execution (RCE). Which technique is most likely to succeed given this LFI?

Accepted Answer

Use the php://input wrapper and send PHP code in the POST body.. The correct technique is to use the php://input wrapper because it allows the attacker to pass arbitrary PHP code in the HTTP POST body, which the include() function will execute as PHP. Since the vulnerable code directly includes user input without sanitization, the php://input stream reads the raw POST data and processes it as a PHP script, achieving remote code execution.

Answer

Use the file:// wrapper to read sensitive files like /etc/passwd.

Answer

Use the data:// wrapper with a base64-encoded PHP payload.

Answer

Set allow_url_include to On in php.ini via the LFI.

Question 11

A penetration tester wants to discover all subdomains of a target domain without directly querying the target's DNS servers to avoid detection. Which technique is most appropriate?

Accepted Answer

Passive DNS enumeration using public data sources. Passive DNS enumeration leverages public data sources such as certificate transparency logs, search engine caches, and passive DNS databases (e.g., VirusTotal, SecurityTrails) to discover subdomains without sending any queries to the target's authoritative DNS servers. This approach avoids generating DNS traffic that could be logged or detected by the target's monitoring systems, making it ideal for stealthy reconnaissance.

Answer

DNS zone transfer

Answer

Brute-force subdomain enumeration using a wordlist

Answer

SNMP community string enumeration

Question 12

A penetration testing firm is scoping a test for a client that has a hybrid infrastructure with on-premises servers and cloud-based virtual machines. The client insists on testing only the on-premises systems due to budget constraints. Which of the following should the penetration tester emphasize during the scoping discussion?

Accepted Answer

Limiting the scope to on-premises may result in an incomplete risk picture because cloud systems are part of the attack surface.. Option C is correct because the client's hybrid infrastructure means that cloud-based virtual machines are part of the overall attack surface, and limiting the scope to on-premises systems ignores potential attack vectors such as misconfigured cloud APIs, insecure inter-VPC routing, or compromised cloud credentials that could lead to lateral movement into on-premises systems. A penetration test must assess all components that can be exploited to provide a complete risk picture, as cloud systems often serve as entry points or pivot points into the on-premises environment.

Answer

The on-premises systems are more critical, so testing them is sufficient.

Answer

Cloud systems are generally more secure and do not require testing.

Answer

Testing cloud systems would violate the shared responsibility model.

Question 13

During a penetration test, a tester gains access to a Linux server as a low-privileged user. The server has a cron job that executes a script owned by root but writable by the tester's group. Which privilege escalation technique should the tester use?

Accepted Answer

Cron job exploitation via script modification. The cron job executes a script owned by root but writable by the tester's group. This means the tester can modify the script's contents. When the cron job runs (as root), the modified script executes with root privileges, allowing the tester to gain a root shell or execute arbitrary commands as root. This is a classic cron job exploitation via script modification.

Answer

Kernel exploit

Answer

Misconfigured sudo permissions

Answer

Path hijacking in the cron job

Question 14

A penetration tester is attempting a pass-the-hash (PtH) attack against a Windows domain-joined machine. The tester has obtained the NTLM hash of a local administrator account. Which tool can be used directly to authenticate using the hash to gain remote command execution?

Accepted Answer

Metasploit's psexec module. Metasploit's psexec module (exploit/windows/smb/psexec) directly accepts an NTLM hash via the 'SMBPass' option and uses it to authenticate over SMB, then creates a service on the target to execute commands. This is a classic pass-the-hash technique against Windows systems, as the module leverages the SMB protocol and Windows service control manager without needing the plaintext password.

Answer

John the Ripper

Answer

Mimikatz

Answer

Nmap

Question 15

A penetration tester is performing active reconnaissance on a target network. The tester sends TCP SYN packets to a range of ports on a target host. Only a few ports respond with SYN-ACK packets. What does this indicate?

Accepted Answer

The ports that responded with SYN-ACK are open.. The TCP three-way handshake begins with a SYN packet; a SYN-ACK response indicates that the target port received the SYN and is willing to establish a connection, meaning the port is open and listening. Only ports that respond with SYN-ACK are confirmed open, while others may be closed or filtered, but the presence of any SYN-ACK replies directly indicates open ports.

Answer

The host is protected by a firewall that drops all packets.

Answer

The host is running a stealthy IDS.

Answer

The network is using IPv6.

Question 16

A penetration tester is conducting passive reconnaissance on a target organization. The tester wants to identify all publicly accessible cloud storage buckets that might belong to the target without directly interacting with the target's infrastructure. Which of the following techniques would be most effective for this purpose?

Accepted Answer

Search for exposed cloud storage buckets using search engine dorks (e.g., 'site:s3.amazonaws.com target-company'). Option B is correct because search engine dorks allow a penetration tester to query publicly indexed content on cloud storage platforms like AWS S3 without sending any traffic to the target's infrastructure. By using a dork such as 'site:s3.amazonaws.com target-company', the tester leverages the search engine's pre-cached index to identify buckets that may be misconfigured or publicly accessible, which aligns perfectly with passive reconnaissance requirements.

Answer

Perform DNS enumeration using tools like `dnsrecon` to discover subdomains pointing to cloud storage services

Answer

Query certificate transparency logs to find SSL certificates issued to the target's cloud storage endpoints

Answer

Perform a WHOIS lookup to find IP ranges owned by the target and then scan those ranges for open storage services

Question 17

A penetration tester is testing a web application that uses JSON Web Tokens (JWTs) for authentication. The tester discovers that the server does not verify the JWT signature properly. The tester crafts a JWT with an arbitrary payload and sets the algorithm to 'none'. Which attack does this enable?

Accepted Answer

Authentication bypass. Option C is correct because setting the JWT algorithm to 'none' removes all cryptographic verification. If the server does not validate the signature, it will accept a token with an arbitrary payload, allowing the attacker to impersonate any user without knowing the secret key. This directly results in an authentication bypass, as the server trusts the forged token.

Answer

SQL injection

Answer

Server-side request forgery

Answer

Cross-site request forgery

Question 18

A penetration tester is using Burp Suite to test a web application. The tester notices that the application relies on client-side JavaScript validation to restrict input. To bypass this validation and test for server-side vulnerabilities, which Burp Suite feature is MOST useful for automatically modifying requests before they are sent to the server?

Accepted Answer

Proxy (with Match and Replace rules). The Proxy's Match and Replace rules allow the tester to automatically modify HTTP requests in transit, such as stripping or altering client-side validation parameters (e.g., maxlength, pattern attributes) before they reach the server. This bypasses client-side JavaScript restrictions because the modifications occur after the browser's validation but before the request is forwarded to the server, enabling direct testing of server-side input handling.

Answer

Intruder

Answer

Repeater

Answer

Decoder

Question 19

A penetration tester is writing a Bash script to enumerate users from the /etc/passwd file on a compromised Linux system. Which command will efficiently print only the usernames?

Accepted Answer

cut -d: -f1 /etc/passwd. Option A is correct because the `cut` command with `-d:` sets the field delimiter to colon (the separator in /etc/passwd) and `-f1` extracts the first field, which is the username. This is the most efficient and straightforward method for this specific task, as it directly isolates the username column without pattern matching or processing overhead.

Answer

awk -F: '{print $1}' /etc/passwd

Answer

grep -o '^[^:]*' /etc/passwd

Answer

sed 's/:.*//' /etc/passwd

Question 20

A penetration tester is performing a vulnerability scan on a web server that uses HTTPS. The tester wants to identify the server's SSL/TLS configuration weaknesses without overwhelming the server. Which Nmap command is most appropriate?

Accepted Answer

nmap -sV --script ssl-enum-ciphers -p 443 target. Option A is correct because the `ssl-enum-ciphers` NSE script enumerates all supported SSL/TLS ciphers and protocols on the target, providing a detailed assessment of cryptographic weaknesses (e.g., weak ciphers, outdated TLS versions). The `-sV` flag enables version detection, and `-p 443` targets the HTTPS port, while the script itself is designed to be lightweight and not overwhelm the server, making it ideal for a non-intrusive vulnerability scan.

Answer

nmap -sT -A -T4 -p 443 target

Answer

nmap -sU -p 443 target

Answer

nmap -sC -p 443 target