PT0-002 Practice Test 21 — 15 Questions

Question 1

A penetration tester is scoping a test for a multinational company that must comply with GDPR. The tester wants to ensure that any personal data captured during the test is handled appropriately. Which document should be reviewed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data processing agreement. A data processing agreement (DPA) outlines how personal data is processed and protected, which is essential for GDPR compliance. An NDA covers confidentiality but not data processing specifics. An authorization letter grants permission, and a test plan is technical.

Answer

Test plan

Answer

Authorization letter

Answer

Non-disclosure agreement

Question 2

A penetration tester is reverse-engineering a .NET binary to understand its authentication logic. Which three tools are suitable for decompiling .NET assemblies? (Choose THREE.)

Accepted Answer

dotPeek. dnSpy, ILSpy, and JetBrains dotPeek are decompilers for .NET. Ghidra is for native code, jadx for Android APK.

Answer

jadx

Answer

Ghidra

Question 3

A penetration tester has successfully exploited a buffer overflow vulnerability in a Linux binary. However, the binary has Data Execution Prevention (DEP) enabled and Address Space Layout Randomization (ASLR) disabled. Which exploitation technique is MOST appropriate to achieve code execution in this environment?

Accepted Answer

Return-oriented programming (ROP) to bypass DEP. Return-oriented programming (ROP) is the most appropriate technique because DEP marks the stack and heap as non-executable, preventing direct shellcode injection. With ASLR disabled, the attacker can reliably locate and chain small instruction sequences (gadgets) from the binary or loaded libraries to achieve arbitrary code execution without needing executable memory regions.

Answer

Simple shellcode injection on the stack

Answer

ASLR bypass techniques

Answer

Heap spraying

Question 4

During a web application test, a tester discovers that the application uses JSON Web Tokens (JWT) for authentication. The tester intercepts a JWT and changes the algorithm header to 'none' with an empty signature. Which attack is being attempted?

Accepted Answer

JWT alg:none attack. Setting algorithm to 'none' is a JWT algorithm confusion attack where the server accepts unsigned tokens.

Answer

SQL injection

Answer

SSRF

Answer

IDOR

Question 5

You are tasked with identifying the technologies used by a web application (e.g., web server, frameworks, libraries) during the reconnaissance phase. Which tool would you use?

Accepted Answer

WhatWeb. WhatWeb is a tool for fingerprinting web technologies. It identifies software, frameworks, and other components by analyzing HTTP responses and page content. Wappalyzer is a browser extension but WhatWeb is command-line and scriptable.

Answer

Gobuster

Answer

theHarvester

Answer

Nmap

Question 6

A penetration tester is performing a wireless assessment and wants to set up an evil twin attack. Which of the following steps are necessary? (Choose THREE.)

Accepted Answer

Create a rogue access point with the same SSID as the target network. An evil twin attack involves creating a rogue access point with the same SSID as a legitimate network, deauthenticating clients, and capturing the handshake.

Answer

Configure WPA3 encryption on the rogue AP

Answer

Use Wireshark to decrypt the traffic

Question 7

A penetration tester is hired to perform a test with no prior knowledge of the target environment. The tester is given only the company name and must gather all necessary information from public sources. Which type of penetration test is this?

Accepted Answer

Black box. In a black box test, the tester has no prior knowledge or credentials, simulating an external attacker.

Answer

Grey box

Answer

Red team

Answer

White box

Question 8

After completing a penetration test, the tester prepares the final report. According to best practices, which of the following should be included in the executive summary?

Accepted Answer

High-level findings, risk ratings, and strategic recommendations. The executive summary should provide high-level findings, risk ratings, and strategic recommendations. Option A is wrong because detailed vulnerability lists belong in the technical section. Option B is wrong because exploitation procedures are too detailed. Option C is wrong because personal opinions are unprofessional and subjective.

Answer

Detailed list of vulnerabilities and CVSS scores

Answer

Step-by-step exploitation procedures

Answer

The tester's personal opinions about the security posture

Question 9

A penetration tester has completed a network penetration test for a large financial institution. The client has requested a report that includes details for both technical staff and executive management. The tester has written a single report with a technical focus, including raw CLI outputs and exploit code. During the review, the chief information security officer (CISO) expresses confusion about the overall risk posture and wants a concise summary. Which action should the tester take to best address the CISO's concerns?

Accepted Answer

Add an executive summary at the beginning that highlights critical risks and business impact.. Adding an executive summary directly in the report provides a concise, business-oriented overview that addresses the CISO's needs while retaining technical details for staff.

Answer

Schedule a meeting to walk through the technical details.

Answer

Remove all technical details and replace them with high-level statements.

Answer

Provide a separate document with only the executive summary.

Question 10

A tester is attempting to crack WPA2 handshakes captured from a wireless network. Which hashcat mode should be used?

Accepted Answer

-m 22000. Hashcat mode 22000 is used for WPA-PBKDF2-PMKID+EAPOL (WPA/WPA2) handshakes.

Answer

-m 13100

Answer

-m 1000

Answer

-m 0

Question 11

A penetration tester uses Shodan to find internet-facing devices belonging to a target company. Which of the following Shodan search filters would most effectively identify devices with a specific organization name?

Accepted Answer

org:CompanyName. The 'org' filter in Shodan allows searching by organization name, which is the most direct way to find devices associated with a company.

Answer

hostname:company.com

Answer

ssl:company.com

Answer

net:192.168.0.0/16

Question 12

A penetration tester is evaluating the security of a WordPress site. Which tool is specifically designed to scan WordPress installations for vulnerabilities?

Accepted Answer

WPScan. WPScan is a dedicated WordPress vulnerability scanner that checks for known vulnerabilities in WordPress core, plugins, and themes.

Answer

Nessus

Answer

OpenVAS

Answer

Nikto

Question 13

A penetration tester is preparing the final report. The client's legal team requests a document that outlines the scope, limitations, and any data handling procedures to comply with regulatory requirements. Which section of the report should include this information?

Accepted Answer

Scope and Rules of Engagement. The Scope and Rules of Engagement section is the correct location for documenting the scope, limitations, and data handling procedures because it formally defines the boundaries of the penetration test, including authorized targets, testing windows, and legal constraints. This section ensures compliance with regulatory requirements by specifying how data is collected, stored, and disposed of, which is critical for audits and legal review.

Answer

Executive Summary

Answer

Methodology

Answer

Technical Findings

Question 14

During the pre-engagement phase, which document defines the IP ranges, test windows, and emergency stop criteria for a penetration test?

Accepted Answer

Rules of Engagement (RoE). The Rules of Engagement (RoE) document specifies technical constraints like IP ranges, timing, and stop conditions.

Answer

Get-out-of-jail letter

Answer

Non-Disclosure Agreement (NDA)

Answer

Statement of Work (SOW)

Question 15

A penetration tester is tasked with performing an authenticated vulnerability scan of a Windows network. The tester has domain admin credentials. Which tool is most appropriate for this task?

Accepted Answer

Nessus. Nessus supports authenticated scanning using credentials (e.g., domain admin) to perform deep vulnerability assessment of Windows systems, including missing patches and insecure configurations.

Answer

Nikto

Answer

Nmap

Answer

theHarvester