PT0-002 Practice Test 22 — 15 Questions

Question 1

A tester is performing a Kerberoasting attack. After requesting TGS tickets, which hashcat mode should be used to crack them?

Accepted Answer

-m 13100. Kerberoast tickets are TGS-REP hashes, mode 13100.

Answer

-m 1000

Answer

-m 18200

Answer

-m 5500

Question 2

A tester wants to crack NTLM hashes captured from a Windows domain. Which hashcat mode should be used for NTLM hashes?

Accepted Answer

-m 1000. Hashcat mode 1000 corresponds to NTLM hashes.

Answer

-m 13100

Answer

-m 0

Answer

-m 22000

Question 3

During a penetration test, a tester discovers a web application that uses JavaScript to load API endpoints dynamically. Which technique would be most effective for discovering hidden API endpoints?

Accepted Answer

Analyzing JavaScript files for API endpoints. JavaScript analysis involves inspecting JavaScript files for hardcoded API endpoints, secrets, and other useful information, making it effective for discovering hidden API endpoints.

Answer

Performing a DNS zone transfer

Answer

Running a Nikto scan

Answer

Using Nmap to scan for open ports and services

Question 4

During an internal penetration test, you need to perform lateral movement to a Windows target. You have a plaintext password for a domain user account. Which tool would be most appropriate to authenticate to the target using WMI?

Accepted Answer

wmiexec. wmiexec (part of Impacket) allows execution of commands on a Windows host via WMI using valid credentials, suitable for lateral movement.

Answer

CrackMapExec

Answer

evil-winrm

Answer

psexec

Question 5

During a penetration test, the tester runs an Nmap scan with the -sV option and gets a result showing 'Apache httpd 2.4.49'. This version is known to be vulnerable to a path traversal attack. Which of the following best describes the next step the tester should take?

Accepted Answer

Attempt to exploit the vulnerability using a known exploit.. After identifying a potentially vulnerable service, the tester should verify the vulnerability by attempting exploitation in a controlled manner to avoid false positives.

Answer

Ignore it because Nmap version detection is unreliable.

Answer

Report the vulnerability immediately.

Answer

Move on to other targets since the vulnerability is well-known.

Question 6

A penetration tester wants to perform a directory brute-force attack against a web server to discover hidden files and directories. Which tool is best suited for this task?

Accepted Answer

Gobuster. Gobuster is a popular tool for directory and file brute-forcing using wordlists, making it ideal for discovering hidden resources on web servers.

Answer

WPScan

Answer

Nikto

Answer

Nmap

Question 7

While performing vulnerability scanning, a penetration tester runs a Nessus scan against a web server. The report shows a 'critical' finding, but after manual verification, the tester determines the service is not actually vulnerable. This scenario best describes:

Accepted Answer

A false positive. A false positive is when a scanner reports a vulnerability that does not actually exist. Penetration testers must verify scanner findings to avoid reporting false positives.

Answer

A false negative

Answer

A configuration error

Answer

A true positive

Question 8

During a penetration test, a tester uses the Wayback Machine to review historical versions of the target's website. What is the primary benefit of this activity?

Accepted Answer

It reveals old web pages that may contain sensitive information or forgotten endpoints. The Wayback Machine archives historical snapshots of web pages, which can reveal old files, endpoints, or sensitive information that may have been removed but are still accessible on the live site.

Answer

It bypasses the target's WAF

Answer

It provides real-time vulnerability data

Answer

It performs a live vulnerability scan

Question 9

A penetration tester wants to perform a pass-the-hash attack against a Windows system. Which tool can be used to authenticate using the NTLM hash instead of a password?

Accepted Answer

CrackMapExec. CrackMapExec supports pass-the-hash authentication with NTLM hashes.

Answer

Responder

Answer

Hashcat

Answer

John the Ripper

Question 10

After completing a penetration test, you present the findings to the client's technical team. During the debrief meeting, the technical lead argues that one of the identified vulnerabilities is not exploitable in their environment and should be removed from the report. The evidence you have shows it is exploitable. What is the BEST response?

Accepted Answer

Document the disagreement and include both perspectives in the report. A penetration tester's report must remain factually accurate while also capturing the client's risk context, so documenting the disagreement and presenting both the tester's evidence and the client's position preserves integrity and gives decision-makers full information. Since the evidence shows the vulnerability is exploitable, removing it (A) would falsify the assessment, and merely insisting it stays (B) ignores legitimate environmental context the client may have. Option D, offering a live demonstration, can be useful for validation but is not the best primary response because it does not itself resolve how the finding and the dispute are recorded in the final deliverable.

Answer

Immediately remove the finding to maintain good client relations

Answer

Challenge the technical lead and insist it stays

Answer

Offer to demonstrate the exploit to confirm

Question 11

A penetration tester gains access to a web application that uses a MongoDB backend. The tester discovers that the search functionality directly interpolates user input into a NoSQL query without sanitization. Which technique should the tester use to extract data from the database?

Accepted Answer

NoSQL injection. The application uses MongoDB, a NoSQL database, and the search functionality directly interpolates user input into a NoSQL query without sanitization. This allows the tester to inject MongoDB operators (e.g., $ne, $regex, $gt) to manipulate the query logic and extract data, which is the core of NoSQL injection. Unlike SQL injection, this technique targets MongoDB's query syntax, such as JSON-based operators, to bypass authentication or retrieve records.

Answer

SQL injection

Answer

LDAP injection

Answer

Command injection

Question 12

You are performing a network scan and need to identify live hosts on a subnet without triggering firewalls that block ICMP. Which technique should you use?

Accepted Answer

ARP scan with arp-scan. Using ARP scan (arp-scan) works on local networks and does not rely on ICMP, making it effective even when ICMP is blocked. It sends ARP requests and listens for replies.

Answer

Ping sweep with nmap -sn

Answer

TCP SYN ping with nmap -PS

Answer

UDP scan with nmap -sU

Question 13

A penetration tester is conducting an internal network assessment and wants to capture NTLMv2 hashes from Windows hosts without sending any authentication traffic. Which tool and attack technique should the tester use?

Accepted Answer

Responder with LLMNR/NBT-NS/mDNS poisoning. Responder poisons LLMNR/NBT-NS/mDNS to trick hosts into sending NTLM hashes to the attacker, capturing them without the attacker needing to authenticate.

Answer

Metasploit's hashdump module

Answer

Hashcat with a wordlist attack

Answer

Bettercap with ARP spoofing

Question 14

A penetration tester needs to enumerate active hosts and open ports on a network segment with minimal network traffic. Which tool should the tester use?

Accepted Answer

Nmap. Nmap with -sn (ping scan) is designed for host discovery using minimal network traffic. Hydra is for password cracking, Metasploit is an exploitation framework, and Nikto is a web server scanner.

Answer

Metasploit

Answer

Nikto

Answer

Hydra

Question 15

A penetration tester is assessing a web application and wants to identify hidden parameters that the application accepts. Which tool is specifically designed for parameter discovery?

Accepted Answer

Arjun. Arjun is a tool for discovering HTTP parameters by brute-forcing common parameter names and analyzing responses for changes, making it suitable for parameter discovery.

Answer

WPScan

Answer

Nikto

Answer

Gobuster