PT0-002 Practice Exam 3 — 20 Questions

Question 1

During a web application test, the tester discovers a parameter that reflects user input in the response without proper encoding. The tester crafts a payload that executes JavaScript when another user views the page. Which type of XSS is this, and what is a primary risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reflected XSS; risk of session hijacking. Reflected XSS executes in the victim's browser when the malicious link is clicked, allowing session hijacking.

Answer

Stored XSS; risk of data theft from database

Answer

Blind XSS; risk of internal network scanning

Answer

DOM-based XSS; risk of client-side logic bypass

Question 2

A penetration testing firm is hired to assess a healthcare organization's network. The client has strict regulatory requirements (HIPAA) and wants to ensure that all patient data is protected during testing. Which scoping document should specify the data handling procedures and the destruction of any collected sensitive information?

Accepted Answer

Data Protection Addendum. A Data Protection Addendum (DPA) or equivalent data handling agreement is the appropriate document to define how sensitive data will be handled, stored, and destroyed. The Rules of Engagement cover authorization and constraints, but specific data protection clauses are often in a separate addendum or included in the contract. The Methodology and Scope of Work do not typically detail data destruction procedures.

Answer

Rules of Engagement

Answer

Testing Methodology

Answer

Scope of Work

Question 3

Which TWO of the following are typical deliverables of a penetration test?

Accepted Answer

Technical findings and remediation guidance. Standard deliverables include an executive summary for management and technical findings for remediation.

Answer

User credentials for all accounts

Answer

Source code of the tested application

Answer

Video recording of the testing process

Question 4

Which Nmap scan type sends SYN packets to determine open ports without completing the TCP three-way handshake?

Accepted Answer

-sS. The SYN scan (-sS) sends a SYN packet and if a SYN/ACK is received, the port is considered open; it does not complete the handshake, making it stealthier than a full connect scan.

Answer

-sU

Answer

-sT

Answer

-sN

Question 5

A penetration tester has gained a low-privileged command shell on a Windows 10 system. The tester suspects there is a vulnerable service with an unquoted service path that can be exploited for privilege escalation. Which command should the tester use to identify all services with this vulnerability?

Accepted Answer

reg query HKLM\SYSTEM\CurrentControlSet\Services\ /s /v ImagePath. The `reg query` command with the `/s` switch recursively searches the registry key `HKLM\SYSTEM\CurrentControlSet\Services` for the `ImagePath` value of each service. An unquoted service path vulnerability occurs when the `ImagePath` contains spaces and is not enclosed in quotes, allowing an attacker to execute arbitrary code by placing a malicious executable in a path that Windows interprets as a command with arguments. This command directly retrieves the raw path strings from the registry, making it the most reliable method to identify unquoted paths.

Answer

Get-Service | Format-List Name,PathName

Answer

sc query type= all state= all | findstr "SERVICE_NAME"

Answer

net start

Question 6

During a post-exploitation phase, a tester needs to establish persistence on a Windows target. Which THREE methods are commonly used for persistence on Windows?

Accepted Answer

Registry Run keys. Scheduled tasks, registry Run keys, and WMI subscriptions are common persistence mechanisms. Pass-the-hash is lateral movement, and cron jobs are Linux-specific.

Answer

Pass-the-hash

Answer

Cron jobs

Question 7

You are conducting passive reconnaissance on a target organization. Which of the following are examples of passive reconnaissance techniques? (Select TWO.)

Accepted Answer

Querying certificate transparency logs. Passive reconnaissance involves collecting information without directly interacting with the target's systems. WHOIS lookups and certificate transparency logs are passive. DNS zone transfer and port scanning are active. Social engineering is active.

Answer

DNS zone transfer

Answer

Scanning ports with Nmap

Answer

Sending phishing emails

Question 8

A penetration tester identifies a Linux binary with the SUID bit set. Which command can find all SUID binaries on a Linux system?

Accepted Answer

find / -perm /4000. The find command with -perm /4000 lists files with SUID set.

Answer

ps aux

Answer

ls -la

Answer

chmod u+s

Question 9

A small business hires a penetration tester to assess the security of their network. The owner is concerned about employee data breaches and wants to ensure compliance with industry regulations. Which of the following is the MOST critical document to establish before the test begins?

Accepted Answer

Rules of engagement. The Rules of Engagement (RoE) is the most critical document because it defines the legal boundaries, scope, and authorization for the penetration test. Without a signed RoE, the tester has no legal protection and the test could be considered unauthorized access, violating laws like the Computer Fraud and Abuse Act (CFAA). It also specifies key constraints such as testing times, target IP ranges, and prohibited actions, ensuring compliance with industry regulations like PCI DSS or HIPAA.

Answer

Vulnerability scan report

Answer

Penetration test report

Answer

Risk assessment matrix

Question 10

A penetration tester is tasked with exploiting a web application that uses an insecure deserialization vulnerability. Which type of attack should the tester primarily use to execute arbitrary code on the server?

Accepted Answer

Malicious object deserialization. Insecure deserialization vulnerabilities occur when an application deserializes untrusted data without proper validation, allowing an attacker to manipulate serialized objects. By crafting a malicious object (e.g., a PHP gadget chain or a Java serialized object with a custom readObject() method), the tester can trigger arbitrary code execution on the server during the deserialization process. This directly aligns with option C, as the attack vector is the deserialization of a malicious object.

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

Cross-site request forgery (CSRF)

Question 11

An organization has a web application that stores session tokens in a cookie named 'auth_token'. The token is a base64-encoded JSON object containing the username, role, and expiration timestamp. Which attack is most likely to succeed if the encryption is not used?

Accepted Answer

Cookie tampering. The session token is a base64-encoded JSON object without encryption, making it trivially easy to decode, modify (e.g., change the role to 'admin' or extend the expiration timestamp), re-encode, and send back to the server. This is a classic cookie tampering attack, as the server trusts the client-provided data without integrity verification.

Answer

Session replay

Answer

Cross-site request forgery

Answer

Session hijacking

Question 12

A penetration tester wants to quickly identify known vulnerabilities in a web application without triggering many alarms. Which tool should the tester use?

Accepted Answer

Nikto. Nikto is a web server scanner that performs checks for known vulnerabilities with minimal noise. SQLmap is for SQL injection only, OpenVAS is a comprehensive vulnerability scanner that may be noisy, and Metasploit is for exploitation.

Answer

SQLmap

Answer

Metasploit

Answer

OpenVAS

Question 13

During a web application penetration test, a tester identifies a potential SQL injection vulnerability in a search field. The tester wants to extract data from the database without generating error messages that could trigger an alert. Which technique is most appropriate?

Accepted Answer

Blind SQL injection (time-based). Blind SQL injection (time-based) allows data extraction without generating visible error messages or database output. By using conditional time delays (e.g., IF condition THEN WAITFOR DELAY '0:0:5' in SQL Server or SLEEP(5) in MySQL), the tester can infer true/false conditions based on response timing, avoiding any error-based alerts that might be monitored by a WAF or IDS.

Answer

In-band SQL injection

Answer

Error-based SQL injection

Answer

Union-based SQL injection

Question 14

Which TWO of the following are types of penetration testing based on the level of knowledge provided to the tester? (Select TWO.)

Accepted Answer

Black box. Black box and white box are two common types based on knowledge level; grey box is the third.

Answer

Social engineering

Answer

Network penetration test

Answer

Red team

Question 15

A penetration tester is exploiting a web application that stores session tokens in HTTP cookies without the HttpOnly flag. Which attack is most likely to succeed?

Accepted Answer

Session hijacking through cross-site scripting. The absence of the HttpOnly flag on session cookies allows client-side scripts (e.g., JavaScript) to access the cookie. An attacker can exploit a cross-site scripting (XSS) vulnerability to execute arbitrary JavaScript in the victim's browser, which then reads the session cookie and sends it to the attacker. This enables session hijacking without needing to guess or brute-force the token.

Answer

SQL injection

Answer

Cross-site request forgery

Answer

Server-side request forgery

Question 16

While performing a password audit, a tester finds that the hash of 'Password123' is stored in the LAN Manager (LM) hash format. What is the primary security weakness of LM hashes?

Accepted Answer

The password is split into two 7-character halves. The primary security weakness of LAN Manager (LM) hashes is that the password is converted to uppercase, padded or truncated to 14 characters, and then split into two 7-character halves. Each half is hashed independently using DES as the key for a known constant, which means an attacker can brute-force each 7-character half separately, drastically reducing the keyspace from 14 characters to two sets of 7 characters. This makes LM hashes extremely vulnerable to offline cracking, especially with modern tools like John the Ripper or Hashcat.

Answer

The hash is case-sensitive

Answer

The hash is salted with a weak random value

Answer

The hash uses the MD4 hashing algorithm

Question 17

A penetration tester needs to describe a stored XSS vulnerability to a web developer who will fix it. Which level of detail is most appropriate for this audience?

Accepted Answer

Include the specific vulnerable URL, the request parameters, the payload used, and a code snippet for proper output encoding.. A web developer needs precise, actionable technical details to remediate the vulnerability: the exact URL, request parameters, the payload that triggered the stored XSS, and a code snippet showing proper output encoding (e.g., using OWASP ESAPI or context-specific escaping). This level of detail enables the developer to locate the vulnerable code, understand the injection point, and apply the correct fix without ambiguity.

Answer

Provide the CVSS score and risk rating.

Answer

Describe the business impact and potential regulatory fines.

Answer

Use a graph showing the number of vulnerabilities by severity across the application.

Question 18

A penetration tester discovers that a previously reported vulnerability from a prior test has not been remediated. How should this be communicated in the current report?

Accepted Answer

Include it as a recurring finding and note the lack of remediation.. Penetration testing standards (e.g., PTES, OWASP) require that previously identified vulnerabilities that remain unpatched be documented as recurring findings with explicit reference to the prior report. This ensures the client understands the risk persists and can track remediation progress over time. Including the finding with a note on lack of remediation maintains the integrity of the current risk assessment and supports compliance with reporting frameworks like NIST SP 800-115.

Answer

Only mention it in the executive summary, referencing the past report.

Answer

Omit the finding to avoid repetition.

Answer

Reduce the severity rating because it was already reported.

Question 19

Which of the following tools is primarily used for enumerating subdomains via search engine queries?

Accepted Answer

theHarvester. theHarvester is specifically designed to gather emails, subdomains, IPs, and URLs from public sources, including search engines like Google, Bing, and Yahoo. It leverages search engine APIs and scraping techniques to enumerate subdomains without directly interacting with the target infrastructure, making it the correct tool for this task.

Answer

Metasploit

Answer

Netcat

Answer

Nmap

Question 20

During a penetration test, a tester discovers a web application that reflects user input in the HTTP response without sanitization. Which attack is most likely to be successful?

Accepted Answer

Reflected cross-site scripting. Reflected cross-site scripting (XSS) is the correct answer because the vulnerability described—user input reflected in the HTTP response without sanitization—directly enables an attacker to inject malicious scripts (e.g., JavaScript) that execute in the victim's browser. This occurs when the application fails to validate or encode the input before including it in the response, allowing the attacker to craft a URL with a script payload that, when visited, runs in the context of the vulnerable web application's origin.

Answer

Server-side request forgery

Answer

SQL injection

Answer

Cross-site request forgery