PT0-002 Practice Test 22 — 15 Questions

Question 1

During a vulnerability scan, a penetration tester notices that the scanner is repeatedly attempting to exploit a service, causing the service to crash and generating misleading findings. Which of the following scan configurations would BEST help the tester avoid this issue while still identifying potential vulnerabilities?

Accepted Answer

Activate the 'safe checks' option in the scanner. Option C is correct because the 'safe checks' option in vulnerability scanners (such as Nessus or OpenVAS) disables intrusive plug-ins that attempt to exploit services aggressively, which can cause service crashes. This configuration allows the scanner to identify potential vulnerabilities without disrupting the target service, avoiding misleading findings from crashed services.

Answer

Enable SYN scan instead of full TCP connect scan

Answer

Adjust the scan timing template to a slower rate

Answer

Increase the port range to include high ports

Question 2

During the reconnaissance phase, a penetration tester wants to map out the target's DNS infrastructure without directly interacting with the target's servers. Which of the following techniques BEST achieves this?

Accepted Answer

Querying publicly available DNS records. Option B is correct because querying publicly available DNS records (e.g., via passive DNS, WHOIS, or DNS dumpster) allows the tester to gather DNS information without any direct interaction with the target's servers. This technique relies on third-party databases and cached records, avoiding any packets sent to the target, which is essential for stealth during reconnaissance. It aligns with passive information gathering, as defined in the PT0-002 objectives.

Answer

Performing a DNS zone transfer

Answer

Using Nmap to scan for DNS servers

Answer

Sending crafted DNS queries to the target's DNS server

Question 3

During an internal penetration test, a tester discovers a Windows server running a custom service that is vulnerable to a stack-based buffer overflow. The binary has Data Execution Prevention (DEP) enabled but Address Space Layout Randomization (ASLR) is disabled. Which exploitation technique would be MOST effective to achieve code execution?

Accepted Answer

Constructing a ROP chain using gadgets from loaded DLLs to simulate shellcode execution. With DEP enabled, the stack is marked non-executable, so injecting shellcode directly (option A) would fail. ASLR being disabled means the addresses of loaded DLLs are predictable, making it feasible to construct a ROP chain using gadgets from those DLLs to simulate shellcode execution. Option C is correct because ROP chains bypass DEP by reusing existing executable code (gadgets) without needing to execute code on the stack.

Answer

Injecting shellcode directly onto the stack and overwriting the return address to jump to it

Answer

Using a return-to-libc attack to call system() with a command string

Answer

Enabling the execute bit on the stack via a memory corruption primitive

Question 4

A penetration tester writes a Python script to test an API for vulnerabilities. The script sends requests with multiple payloads and checks if the response contains an error message indicating a potential injection. Which of the following code snippets would BEST reduce false positives by verifying that the injected parameter is processed?

Accepted Answer

Compare the response of the injected request to the response of a benign request with the same parameter structure. Option D is correct because comparing the response of an injected request to a benign request with the same parameter structure directly confirms that the injected parameter was processed and caused a different application behavior, thereby reducing false positives. This technique, often called differential analysis, isolates the effect of the injection from normal variations in the API response, such as dynamic content or session tokens. It is more reliable than checking for specific error messages or status codes, which may be suppressed or generic.

Answer

Check if the response status code is 500 for each payload

Answer

Compare the response time of the injected request to a baseline without injection

Answer

Check if the response contains a specific error message that is only triggered when the injection is successful

Question 5

A penetration tester is tasked with discovering all publicly accessible Amazon S3 buckets that belong to a target company. Which technique is MOST effective for this purpose?

Accepted Answer

Querying Google dorks for 'site:s3.amazonaws.com [target_company]'. Option D is correct because Google dorks allow a penetration tester to search for indexed S3 bucket URLs that contain the target company's name, revealing publicly accessible buckets without direct interaction with the target's infrastructure. This technique leverages Google's crawlers to find buckets that may have been inadvertently exposed or misconfigured, making it highly effective for passive reconnaissance.

Answer

Scanning the target's IP ranges for open ports 443

Answer

Using dnsdumpster.com to find subdomains

Answer

Guessing bucket names based on common patterns

Question 6

A penetration testing firm is hired to assess a U.S.-based company that has recently expanded operations to a country with strict data privacy laws (e.g., GDPR-style regulations). Which of the following is the MOST important legal consideration to include in the rules of engagement?

Accepted Answer

Data collected during the test must be stored only within the country of operation and deleted after the engagement. Option B is correct because under strict data privacy laws like GDPR, personal data collected during a penetration test must be stored within the jurisdiction where it was obtained and deleted once the engagement is complete. This ensures compliance with data localization and minimization requirements, which are critical legal considerations in the rules of engagement.

Answer

The client's headquarters location determines which laws apply

Answer

All findings must be reported in the local language of the country of operation

Answer

The penetration testers must be citizens of the country where the systems reside

Question 7

During a reconnaissance phase, a penetration tester is using a tool to enumerate NetBIOS names on a target internal network. The tester issues the command 'nbtstat -A 192.168.1.100' on a Windows machine. What type of information is the tester most likely trying to obtain?

Accepted Answer

The NetBIOS name table including computer name, logged-in users, and domain. The `nbtstat -A` command queries the NetBIOS name table of a remote system using its IP address. This table contains the computer name, logged-in users, and domain/workgroup information, which are critical for identifying targets and potential trust relationships during internal reconnaissance.

Answer

The operating system version and patch level

Answer

A list of currently open TCP ports on the remote system

Answer

The MAC address of the remote network interface

Question 8

A client hires a penetration testing firm to assess a web application. The client uses a third-party content delivery network (CDN) for static assets and explicitly wants to exclude the CDN infrastructure from testing. In which document should this restriction be formally documented?

Accepted Answer

Rules of Engagement (ROE). The Rules of Engagement (ROE) document is the correct place to formally document restrictions such as excluding the CDN infrastructure from testing. The ROE defines the scope, boundaries, and specific constraints for the penetration test, including which IP ranges, domains, or systems are off-limits. This ensures the testing team does not inadvertently target the third-party CDN, which could violate contractual agreements or cause unintended disruptions.

Answer

Statement of Work (SOW)

Answer

Non-Disclosure Agreement (NDA)

Answer

Master Services Agreement (MSA)

Question 9

A penetration tester discovers a Java application that deserializes user-controlled data without validation. The tester crafts a malicious serialized object that executes a command upon deserialization. The application runs on a Linux server with a standard Java runtime. Which of the following is the most likely outcome if the malicious object is accepted?

Accepted Answer

The tester will be able to execute arbitrary commands on the server.. Java deserialization of untrusted data allows an attacker to supply a crafted serialized object that, when deserialized, can execute arbitrary code via gadget chains (e.g., CommonsCollections). Since the application runs on a Linux server with a standard Java runtime, the attacker can achieve remote code execution (RCE) with the privileges of the application's user, not necessarily an interactive shell. Option D is correct because the primary impact is arbitrary command execution, which may or may not yield a shell depending on the payload.

Answer

The application will crash immediately due to an exception.

Answer

The application will disclose sensitive information in the response.

Answer

The tester will gain a shell with the privileges of the current user.

Question 10

During a web application test, a penetration tester suspects an LDAP injection vulnerability. The application uses user input to dynamically construct an LDAP query. The tester submits the following payload in the username field: 'admin)(&)'. The application returns a list of all users instead of the expected single user. Which of the following best describes the reason this payload was effective?

Accepted Answer

The payload closes the original filter and appends a tautology that returns all objects.. Option D is correct because the payload 'admin)(&)' closes the original LDAP filter after 'admin' and appends '(&)' which is a tautology (always true). This causes the LDAP query to match all directory objects, returning the full user list instead of a single user. The attack exploits the way LDAP filters are parsed: injecting a closing parenthesis and a new filter that evaluates to true for every entry.

Answer

The payload causes an LDAP error that triggers a fallback to list all users.

Answer

The payload modifies the base DN to search the entire directory.

Answer

The payload introduces a logical OR that negates the original condition.

Question 11

A penetration tester is using Nmap to scan a target web server. The tester only wants to see which of the top 100 ports are open, but wants to minimize network traffic and time. Which Nmap command is most appropriate?

Accepted Answer

nmap -sV --top-ports 100 target. Option D is correct because `--top-ports 100` instructs Nmap to scan only the 100 most commonly open ports, which minimizes network traffic and time compared to scanning all ports or a large range. The `-sV` flag enables version detection, which is not strictly required but is commonly used in information gathering; however, the key factor for minimizing traffic and time is the `--top-ports` option, which uses a statistically derived list to reduce scan scope.

Answer

nmap -sS -p- target

Answer

nmap -sT -p 1-100 target

Answer

nmap -sC -p 1-1000 target

Question 12

During an internal penetration test, a tester is trying to identify live hosts on a network segment. The tester wants to avoid generating a high volume of traffic or alerts. Which scanning technique is most appropriate for this task?

Accepted Answer

ARP ping scan. An ARP ping scan (option D) is the most appropriate technique because it operates at Layer 2 (Data Link layer) using ARP requests to determine if an IP address is active on the local subnet. Since ARP traffic is confined to the local broadcast domain and does not generate IP-level packets, it produces minimal network traffic and is unlikely to trigger IDS/IPS alerts, making it ideal for stealthy host discovery on a local network segment.

Answer

Full TCP connect scan on common ports

Answer

ICMP echo request sweep

Answer

SYN stealth scan on port 80 and 443

Question 13

During a penetration test, a tester identifies a critical SQL injection vulnerability. The client remediates the issue, but a retest reveals the same vulnerability in a different module of the application. How should the tester present this information in the final report to best communicate recurring risks?

Accepted Answer

Document the recurrence and recommend a root-cause analysis and secure coding training to prevent future regressions.. Option D is correct because it addresses the root cause of the recurrence rather than treating each instance as an isolated event. By recommending a root-cause analysis and secure coding training, the tester helps the client prevent future regressions across the entire codebase, which is the core goal of a penetration test report. This aligns with the PT0-002 objective of providing actionable remediation guidance beyond simply listing vulnerabilities.

Answer

List each instance as a separate finding with its own risk rating.

Answer

Increase the CVSS score of the second finding to reflect the repeated issue.

Answer

Note that the vulnerability was successfully remediated earlier and reappeared, so it is now considered a new finding.

Question 14

During an internal test, a penetration tester discovers a web application that is vulnerable to Server-Side Template Injection (SSTI). The application uses a template engine that does not sandbox user input. Which of the following payloads would be MOST effective to achieve remote code execution on the server?

Accepted Answer

{{config.__class__.__init__.__globals__['os'].popen('id').read()}}. Option D is correct because it exploits Python's object model to access the `os` module via `__class__.__init__.__globals__`, bypassing the template engine's lack of sandboxing. This allows the attacker to execute arbitrary system commands like `id` on the server, achieving remote code execution (RCE). The payload is specific to Jinja2 or similar Python-based template engines that expose built-in objects.

Answer

Answer

Answer

${7*7}

Question 15

Drag and drop the steps to perform a web application fuzzing using Burp Suite Intruder into the correct order.