PT0-002 Practice Test 23 — 15 Questions

Question 1

After compromising a Linux host, you want to escalate privileges by exploiting a cron job that runs a script with root privileges. The script references an executable using a relative path. Which attack technique is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

PATH manipulation. PATH manipulation works by modifying the PATH environment variable so that when the script calls the executable (by name only, no full path), the attacker's malicious version runs with the privileges of the script.

Answer

SUID binary exploitation

Answer

Kernel exploit

Answer

DLL hijacking

Question 2

A penetration tester receives pushback from a client's technical team regarding a finding, claiming it is not exploitable. Which of the following is the best response?

Accepted Answer

Provide additional evidence and offer to demonstrate the exploit in a controlled environment.. Providing evidence and offering to demonstrate helps validate the finding and address concerns professionally.

Answer

Escalate the issue to the executive without further discussion.

Answer

Downgrade the severity to low.

Answer

Remove the finding from the report to avoid conflict.

Question 3

A penetration tester is performing DNS reconnaissance and wants to enumerate all subdomains of a target domain by querying DNS servers in an attempt to transfer the entire zone file. Which technique is the tester using?

Accepted Answer

DNS zone transfer. DNS zone transfer (AXFR) is a mechanism that allows a secondary DNS server to replicate the entire zone file from a primary server. If misconfigured, anyone can request it.

Answer

DNS reverse lookup

Answer

DNS cache snooping

Answer

DNS tunneling

Question 4

During a penetration test, you need to gather information about a target's email addresses and employee names without directly interacting with the target's systems. Which tool is most appropriate for this passive reconnaissance task?

Accepted Answer

theHarvester. theHarvester is an OSINT tool designed to gather emails, subdomains, IPs, and employee names from public sources like search engines and social media. Maltego is more for relationship mapping, Shodan for internet-facing devices, and Censys for certificate and network data.

Answer

Shodan

Answer

Censys

Answer

Maltego

Question 5

A penetration tester discovers a web application that fetches URLs from user input without proper validation. The tester targets the internal cloud metadata endpoint at 169.254.169.254 to retrieve instance credentials. Which type of attack is this?

Accepted Answer

SSRF. SSRF (Server-Side Request Forgery) occurs when the server makes requests to internal resources based on user input, and the cloud metadata endpoint is a common target.

Answer

CSRF

Answer

XXE

Answer

IDOR

Question 6

During a penetration test, a tester runs the Responder tool on the internal network and captures an NTLMv2 hash. Which type of network attack is being performed?

Accepted Answer

LLMNR/NBT-NS poisoning. Responder poisons LLMNR, NBT-NS, and mDNS queries to capture NTLM hashes from systems trying to resolve names.

Answer

ARP spoofing

Answer

Relay attack

Answer

SSL stripping

Question 7

During a penetration test, the tester runs a DNS zone transfer attempt against a target domain. The zone transfer fails. What is the most likely reason?

Accepted Answer

The DNS server is configured to deny zone transfers from unauthorized hosts. DNS zone transfers are typically restricted by default to authorized secondary DNS servers only. Misconfigured DNS servers might allow zone transfers from any host, but it's uncommon. The failure is likely due to security restrictions. The authoritative server is not necessarily offline, and the domain might not exist otherwise.

Answer

The DNS server is offline

Answer

The tester used the wrong tool

Answer

The domain does not exist

Question 8

During a penetration test, a tester captures NTLMv2 hashes by spoofing LLMNR and NBT-NS responses on the internal network. Which tool is most commonly used for this type of attack?

Accepted Answer

Responder. Responder is a widely used tool for LLMNR/NBT-NS/mDNS poisoning to capture NTLM hashes.

Answer

ntlmrelayx

Answer

Bettercap

Answer

Hashcat

Question 9

A penetration tester runs the following command: `hashcat -m 1000 -a 0 hashes.txt rockyou.txt`. What type of attack is being performed?

Accepted Answer

Dictionary attack. The command uses mode 1000 (NTLM) and attack mode 0 (dictionary) with rockyou.txt wordlist. This is a dictionary attack.

Answer

Brute-force attack

Answer

Hybrid attack

Answer

Rule-based attack

Question 10

A penetration tester wants to identify hosts on a network that are running web servers on any TCP port, including non-standard ports. Which Nmap command is most efficient for this task?

Accepted Answer

nmap -sV -p- target. `-sV` enables version detection to identify web server software, and `-p-` scans all 65535 TCP ports, including non-standard ones. This combination efficiently discovers web servers on any port without unnecessary overhead like OS detection or default script scanning.

Answer

nmap -sC -p 80,443 target

Answer

nmap -O -p- target

Answer

nmap -sT -p 8000,8080 target

Question 11

A penetration tester is performing a network attack and wants to intercept traffic between two hosts on the same local network. Which technique should the tester use to redirect traffic through their machine?

Accepted Answer

ARP spoofing. ARP spoofing allows an attacker to associate their MAC address with the IP address of another host, intercepting traffic intended for that host.

Answer

DNS poisoning

Answer

LLMNR poisoning

Answer

SSL stripping

Question 12

A tester wants to exploit a Windows service running with SYSTEM privileges that has an unquoted service path containing spaces. Which technique should be used to escalate privileges?

Accepted Answer

Unquoted service path exploitation. An unquoted service path allows placing an executable with the same name as a folder in the path, which Windows will execute with SYSTEM privileges.

Answer

AlwaysInstallElevated

Answer

Token impersonation

Answer

DLL hijacking

Question 13

Which penetration testing standard provides a step-by-step methodology from pre-engagement through post-engagement activities, including intelligence gathering, vulnerability analysis, and exploitation?

Accepted Answer

PTES. PTES (Penetration Testing Execution Standard) covers the entire lifecycle of a penetration test.

Answer

OSSTMM

Answer

OWASP Testing Guide

Answer

NIST SP 800-115

Question 14

A penetration tester is analyzing a Linux binary and wants to decompile it to understand its logic. Which open-source tool is specifically designed for reverse engineering and can generate C-like pseudocode from compiled binaries?

Accepted Answer

Ghidra. Ghidra, developed by the NSA, is a reverse engineering framework that can decompile binaries into C-like pseudocode.

Answer

IDA Pro Free

Answer

dnSpy

Answer

jadx

Question 15

A penetration tester needs to escalate privileges on a Linux system and finds that the current user can run a specific command with sudo without a password. Which tool should the tester consult to find known exploitation techniques for that command?

Accepted Answer

GTFOBins. GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions.

Answer

Exploit-DB

Answer

HackTricks

Answer

Metasploit