PT0-002 Practice Exam 3 — 20 Questions

Question 1

A penetration tester has obtained a set of NTLM password hashes from a Windows domain controller. The tester wants to perform an offline cracking attack using GPU acceleration. Which tool is best suited for this purpose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Hashcat. Hashcat is a powerful password cracker that supports GPU acceleration and can crack NTLM hashes efficiently.

Answer

CrackMapExec

Answer

John the Ripper

Answer

Hydra

Question 2

A penetration tester has exploited a web application and found that the server has an outbound firewall that restricts all outbound traffic except for DNS queries (UDP 53). The tester has a reverse shell payload that connects back on TCP 443. Which technique can the tester use to exfiltrate data or establish a channel?

Accepted Answer

Use dnscat2 or other DNS tunneling tool. DNS tunneling tools like dnscat2 encode data within DNS queries and responses, allowing the tester to bypass outbound firewall restrictions that only permit UDP 53 traffic. Since the reverse shell payload uses TCP 443, which is blocked, DNS tunneling provides an alternative covert channel that encapsulates the communication within legitimate DNS lookups, effectively exfiltrating data or establishing a command-and-control channel over the allowed protocol.

Answer

Use netcat to send data over TCP 53

Answer

Use an SSH tunnel over UDP 53

Answer

Use a bind shell listening on TCP 443 internally

Question 3

A penetration tester is analyzing a Python script that performs a buffer overflow attack. The script imports the struct module and the socket module. It constructs a payload by packing a pattern of characters, then overwriting a return address with a specific offset. Which of the following is the most critical piece of information the tester must determine before running this script against the target?

Accepted Answer

The exact location of a JMP ESP instruction in memory. The script performs a buffer overflow attack by overwriting a return address. To redirect execution to attacker-controlled shellcode, the tester must overwrite the return address with the address of a JMP ESP instruction (or equivalent) that is reliably located in memory. Without this address, the overwritten return pointer will cause a crash or unpredictable behavior, making exploitation impossible.

Answer

The IP address and port of the target service

Answer

The version of the operating system running on the target

Answer

The username and password for the target service

Question 4

A client is planning a penetration test of their AWS cloud environment. They will provide the tester with an IAM user account with limited permissions. Which of the following scoping restrictions is most important to include in the rules of engagement to avoid unexpected costs?

Accepted Answer

The tester must not create any new AWS resources that incur costs.. Creating new AWS resources (e.g., EC2 instances, RDS databases, Lambda functions) can incur direct costs under the tester's IAM user account, even with limited permissions. The rules of engagement must explicitly prohibit resource creation to prevent unexpected billing, as AWS charges for resources provisioned regardless of the test's purpose. This scoping restriction aligns with the principle of cost containment in penetration testing engagements.

Answer

The tester must use only premium AWS services for testing.

Answer

The tester must request permission from AWS Support before each test.

Answer

The tester must avoid testing in the us-east-1 region due to higher costs.

Question 5

A penetration tester is performing passive reconnaissance on a target organization. Which of the following tools would be BEST suited to gather information about the organization's domain names, email addresses, and subdomains from publicly available sources without directly interacting with the target's systems?

Accepted Answer

theHarvester. theHarvester is designed for passive OSINT gathering of emails, subdomains, IPs, etc. Maltego is also OSINT but more graph-oriented; theHarvester is specifically for email/subdomain enumeration.

Answer

Nmap

Answer

Nessus

Answer

Metasploit

Question 6

A penetration tester is analyzing a PowerShell script that uses Invoke-WebRequest and Invoke-RestMethod to interact with a target web service. The script parses JSON responses to extract session tokens and then uses those tokens in subsequent requests. Which attack technique is this script most likely performing?

Accepted Answer

Exploiting an API by manipulating request parameters and observing responses.. The script uses Invoke-WebRequest and Invoke-RestMethod to interact with a web service, parsing JSON responses to extract session tokens and reusing them in subsequent requests. This pattern is characteristic of API manipulation, where an attacker modifies request parameters (e.g., headers, query strings, or payload) and observes how the API responds to infer vulnerabilities or escalate privileges, rather than directly attacking authentication or injecting SQL.

Answer

Brute-forcing web application login credentials.

Answer

Performing a SQL injection attack on a web form.

Answer

Conducting a directory traversal attack to read arbitrary files.

Question 7

A penetration tester is using theHarvester tool to gather information about a target domain. The tester wants to collect email addresses and subdomains from public search engines and PGP key servers. Which source is theHarvester commonly configured to use for this passive reconnaissance?

Accepted Answer

Google and Bing search engines. TheHarvester is specifically designed to perform passive reconnaissance by querying public search engines (like Google and Bing) and PGP key servers to collect email addresses, subdomains, and other open-source intelligence (OSINT). It does not initiate direct connections to the target's infrastructure, making it a passive tool. The default configuration often includes Google and Bing as primary sources for this data.

Answer

Direct DNS zone transfer

Answer

Shodan

Answer

Baidu

Question 8

A penetration tester is performing active reconnaissance on a target network. The tester wants to identify all live hosts in the 192.168.1.0/24 subnet and determine which ones have port 80 open. Which technique is most efficient for this task?

Accepted Answer

Use a ping sweep to identify live hosts, then run a SYN scan on port 80 for those hosts.. It combines two efficient steps: first, a ping sweep (ICMP Echo Request or ARP scan) identifies live hosts in the 192.168.1.0/24 subnet, reducing the number of targets; second, a SYN scan on port 80 for only those live hosts is faster and less intrusive than scanning all ports or all IPs without prior host discovery. This approach minimizes network traffic and scan time while accurately identifying hosts with HTTP services.

Answer

Perform a full TCP connect scan on all 65535 ports for each IP address.

Answer

Run a SYN scan on port 80 for every IP in the subnet without ping probing.

Answer

Use ARP requests to map the subnet and then check for port 80 on each host.

Question 9

During a penetration test, a tester gains access to a Linux server as a low-privileged user. The server has a cron job that executes a script owned by root but writable by the tester's group. Which privilege escalation technique should the tester use?

Accepted Answer

Cron job exploitation via script modification. The cron job executes a script owned by root but writable by the tester's group. This means the tester can modify the script's contents. When the cron job runs (as root), the modified script executes with root privileges, allowing the tester to gain a root shell or execute arbitrary commands as root. This is a classic cron job exploitation via script modification.

Answer

Kernel exploit

Answer

Misconfigured sudo permissions

Answer

Path hijacking in the cron job

Question 10

A client requests a penetration test of their internal network. During scoping, the tester learns that the client uses a managed security service provider (MSSP) that monitors all network traffic. The client does not want the MSSP to be informed about the test. What is the most appropriate action for the tester to take?

Accepted Answer

Advise the client to inform the MSSP about the scheduled test and coordinate a maintenance window or exclusion list. Failing to inform the MSSP could trigger automated incident response actions (e.g., IPS blocking, SIEM alerting, or even network isolation) that disrupt the test and potentially cause false-positive security incidents. Coordinating a maintenance window or exclusion list ensures the MSSP's monitoring tools (like Snort, Suricata, or proprietary NDR) do not interfere with legitimate test traffic, preserving both test integrity and the client's operational security.

Answer

Proceed with the test without informing the MSSP, as the client has requested confidentiality

Answer

Include a clause in the rules of engagement that holds the tester harmless for any disruptions caused by the MSSP's monitoring

Answer

Perform the test only after hours to minimize the chance of the MSSP detecting the test activity

Question 11

A penetration tester is performing passive reconnaissance to discover email addresses associated with a target domain. The tester wants to avoid sending any packets directly to the target's infrastructure. Which tool is most appropriate for this task?

Accepted Answer

Using theHarvester to search public sources like search engines, PGP key servers, and social media. TheHarvester is designed specifically for passive reconnaissance, gathering email addresses, subdomains, and other data from public sources such as search engines, PGP key servers, and social media without sending any packets directly to the target's infrastructure. This aligns perfectly with the requirement to avoid direct interaction with the target domain.

Answer

Using the whois command to query domain registration details

Answer

Using Shodan to identify email servers and associated addresses

Answer

Using Google dorking with advanced search queries to find email addresses in indexed pages

Question 12

A penetration tester is preparing the executive summary for a report. Which of the following metrics would be MOST valuable to include for non-technical stakeholders to understand the overall security posture?

Accepted Answer

The number of critical and high-risk findings along with the average time to exploit them. Non-technical stakeholders (e.g., executives) need a high-level, risk-focused summary that communicates the severity and urgency of findings. The number of critical/high-risk findings directly indicates the most dangerous exposures, and the average time to exploit them conveys how quickly an attacker could compromise the environment. This metric translates technical risk into business impact, which is the core goal of an executive summary.

Answer

A list of all tools used during the penetration test

Answer

The total number of vulnerabilities discovered and their average CVSS score

Answer

A detailed step-by-step exploitation walkthrough of one critical vulnerability

Question 13

A penetration tester is conducting passive reconnaissance on a target organization using Google dorking. The tester wants to find PDF documents that may contain usernames and passwords. Which Google search query is most appropriate for this task?

Accepted Answer

site:target.com filetype:pdf password. It uses the `filetype:pdf` operator to specifically target PDF documents, combined with the keyword `password` to find files likely containing credentials. Google dorking with `site:target.com` restricts results to the target domain, making this query efficient for passive reconnaissance of exposed sensitive information in PDFs.

Answer

site:target.com username password

Answer

site:target.com filetype:xls password

Answer

site:target.com intitle:'index of' password

Question 14

A penetration tester analyzes a PowerShell script that uses the 'Invoke-Command' cmdlet to run a command on multiple remote Windows systems. The script checks if the local Administrator account is using a default password. Which phase of the penetration test is this script most directly supporting?

Accepted Answer

Enumeration of misconfigurations. The script uses Invoke-Command to check if the local Administrator account on multiple remote Windows systems uses a default password. This directly supports the enumeration of misconfigurations phase, as it identifies a common security weakness (default credentials) that could be exploited. It does not involve moving between systems (lateral movement) or extracting stored credentials (credential dumping).

Answer

Lateral movement

Answer

Credential dumping

Answer

Privilege escalation

Question 15

A client wants to conduct a penetration test of their e-commerce website. They are concerned about impacting live transactions. Which clause should be included in the Rules of Engagement to address this?

Accepted Answer

Exclusion of network stress testing and availability testing.. The client's primary concern is avoiding disruption to live transactions. A clause excluding network stress testing and availability testing (e.g., DoS attacks, resource exhaustion, or high-volume scanning) directly addresses this by prohibiting any action that could degrade performance or cause downtime. This is a standard Rules of Engagement (RoE) safeguard for production e-commerce environments where transaction integrity and uptime are critical.

Answer

Out-of-scope systems list.

Answer

In-scope IP addresses.

Answer

Authorization for testing.

Question 16

A penetration tester wants to perform DNS brute-force enumeration to discover subdomains of a target domain. Which tool is specifically designed for this purpose?

Accepted Answer

dnsrecon. B is correct because dnsrecon is a specialized DNS enumeration tool that includes a brute-force mode for discovering subdomains. It uses a wordlist to query DNS servers for common subdomain names, leveraging the DNS protocol's inherent structure to map out a target's domain hierarchy without relying on zone transfers.

Answer

nmap

Answer

Wireshark

Answer

Hydra

Question 17

A penetration tester is scoping an engagement for a client that hosts a public-facing web application and an internal database server. The client wants to ensure that testing does not cause any disruption to the database server. Which of the following should the tester include in the rules of engagement to address this concern?

Accepted Answer

Define the database server as an out-of-scope target.. Defining the database server as out-of-scope explicitly removes it from all testing activities, ensuring zero disruption as requested. This is the only option that fully prevents any interaction with the database server, including passive reconnaissance or exploitation attempts, which could still cause unintended load or queries.

Answer

Specify that only passive reconnaissance techniques will be used on the database server.

Answer

Include a clause that the tester will not attempt to exploit any vulnerabilities on the database server.

Answer

Require that all testing activities be performed during off-peak hours only.

Question 18

A penetration tester is performing passive reconnaissance on a target organization. The tester wants to identify internal IP address ranges used by the organization without interacting directly with their network. Which of the following techniques would be most effective for this purpose?

Accepted Answer

Querying public BGP route databases and looking up the organization's autonomous system (AS) number. Querying public BGP route databases (e.g., RADB, ARIN) using the organization's AS number allows a tester to retrieve IP prefixes announced by the target. This is passive reconnaissance because it uses publicly available routing data without sending any packets to the target's network, making it ideal for identifying internal IP ranges from an external perspective.

Answer

Performing a DNS zone transfer against the target's authoritative DNS servers

Answer

Using Shodan to search for devices from the target organization

Answer

Sending ARP requests on the local network segment to discover hosts

Question 19

A penetration tester is conducting passive reconnaissance on a target organization. The tester wants to identify all publicly accessible cloud storage buckets that might belong to the target without directly interacting with the target's infrastructure. Which of the following techniques would be most effective for this purpose?

Accepted Answer

Search for exposed cloud storage buckets using search engine dorks (e.g., 'site:s3.amazonaws.com target-company'). Search engine dorks allow a penetration tester to query publicly indexed content on cloud storage platforms like AWS S3 without sending any traffic to the target's infrastructure. By using a dork such as 'site:s3.amazonaws.com target-company', the tester leverages the search engine's pre-cached index to identify buckets that may be misconfigured or publicly accessible, which aligns perfectly with passive reconnaissance requirements.

Answer

Perform DNS enumeration using tools like `dnsrecon` to discover subdomains pointing to cloud storage services

Answer

Query certificate transparency logs to find SSL certificates issued to the target's cloud storage endpoints

Answer

Perform a WHOIS lookup to find IP ranges owned by the target and then scan those ranges for open storage services

Question 20

A penetration tester writes a Python script to test an API for vulnerabilities. The script sends requests with multiple payloads and checks if the response contains an error message indicating a potential injection. Which of the following code snippets would BEST reduce false positives by verifying that the injected parameter is processed?

Accepted Answer

Compare the response of the injected request to the response of a benign request with the same parameter structure. Comparing the response of an injected request to a benign request with the same parameter structure directly confirms that the injected parameter was processed and caused a different application behavior, thereby reducing false positives. This technique, often called differential analysis, isolates the effect of the injection from normal variations in the API response, such as dynamic content or session tokens. It is more reliable than checking for specific error messages or status codes, which may be suppressed or generic.

Answer

Check if the response status code is 500 for each payload

Answer

Compare the response time of the injected request to a baseline without injection

Answer

Check if the response contains a specific error message that is only triggered when the injection is successful