PT0-002 Practice Test 24 — 15 Questions

Question 1

A penetration tester is assessing a custom web application that uses JSON Web Tokens (JWT) for authentication. The tester suspects the token may be using a weak secret. Which tool is best suited to attempt cracking the JWT secret?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Hashcat. Hashcat is a powerful password cracking tool that can crack JWT secrets using dictionary or brute-force attacks. John the Ripper is similar but hashcat is generally faster and more GPU-optimized. DirBuster is for directory discovery, sqlmap for SQL injection, and Burp Suite Intruder can be used but is less efficient for offline cracking.

Answer

DirBuster

Answer

Burp Suite Intruder

Answer

sqlmap

Question 2

A penetration tester needs to automate a series of web application attacks against a login page to identify weak credentials. Which tool is most appropriate?

Accepted Answer

Hydra. Hydra (option B) is the most appropriate tool because it is a dedicated online password-cracking utility that automates credential-guessing attacks against login forms and services, supporting protocols like HTTP-POST and HTTP-GET with configurable username/password lists and threading. For a penetration test targeting weak credentials on a web login page, Hydra's ability to script repeated authentication attempts makes it purpose-built for this task. Nmap (A) is a port scanner and service/version detector, not a credential brute-forcer. Burp Suite (C) is a web proxy and testing platform that can facilitate manual or Intruder-based attacks but is not primarily an automated credential-cracking tool. Wireshark (D) is a packet analyzer used for traffic capture and inspection, not for launching authentication attacks.

Answer

Nmap

Answer

Burp Suite

Answer

Wireshark

Question 3

A penetration tester is conducting a wireless penetration test. The client's rules of engagement state that testing must not disrupt production services. During the test, the tester's de-authentication attack causes the company's guest Wi-Fi to go offline. What should the tester do?

Accepted Answer

Stop testing and follow the emergency stop procedure. According to the RoE, the tester must stop testing if there is an emergency or disruption. The tester should follow the emergency stop procedure and contact the client.

Answer

Ignore the issue and complete the test

Answer

Reduce the intensity of the attack

Answer

Continue testing because guest Wi-Fi is not critical

Question 4

Which THREE of the following are best practices for writing a penetration test report?

Accepted Answer

Organize findings by severity and likelihood. Option A is correct because organizing findings by severity and likelihood (e.g., using a risk matrix combining CVSS base scores with exploitability and business impact) lets stakeholders prioritize remediation of the highest-risk issues first. Option B is correct because a glossary of terms makes the report accessible to non-technical readers such as executives and managers, who often approve budgets and remediation efforts but lack security vocabulary. Option D is correct because each finding should include clear, actionable remediation steps (specific patches, configuration changes, or compensating controls) so the client can actually fix the issue rather than just knowing it exists. Option C is not a best practice because excessive technical jargon obscures meaning and alienates non-technical stakeholders; reports should be precise but audience-appropriate. Option E is not a best practice because including duplicates and false positives dilutes the report, wastes client time, and undermines credibility; findings should be validated and deduplicated before inclusion.

Answer

Use technical jargon to demonstrate expertise

Answer

Include all vulnerabilities discovered even if they are duplicates or false positives

Question 5

A penetration tester is writing the executive summary of a report. Which of the following is MOST important to include?

Accepted Answer

Overall risk rating and strategic recommendations. The executive summary should provide a high-level overview in business language, including the overall risk rating, key findings, and strategic recommendations.

Answer

Step-by-step exploitation commands

Answer

Raw tool output and screenshots

Answer

Detailed CVSS scores for every vulnerability

Question 6

A client asks why a medium-severity finding should be remediated before a high-severity finding. The medium finding is internet-facing and actively exploited; the high finding is isolated in a lab subnet. What is the best explanation?

Accepted Answer

Prioritization should account for exposure and active exploitation, not only the scanner severity.. Risk-based prioritization must consider real-world factors like internet exposure and active exploitation, not just the CVSS base score. A medium-severity finding that is internet-facing and actively exploited poses a higher immediate risk to the organization than a high-severity finding isolated in a lab subnet, which has no external attack surface. This aligns with industry frameworks like CVSS environmental metrics and the FIRST CVSS v3.1 specification, which allow adjusting severity based on attack vector, complexity, and environmental context.

Answer

Medium findings must always be fixed before high findings.

Answer

The high finding should be ignored permanently because it is in a lab.

Answer

Only CVSS base score matters for remediation order.

Question 7

A penetration tester needs to perform a Kerberoasting attack against a Windows Active Directory environment. Which tool from the Impacket suite should the tester use to request service tickets and extract TGS hashes for offline cracking?

Accepted Answer

GetUserSPNs.py. GetUserSPNs.py in the Impacket suite is used to find and request service principal names (SPNs) and retrieve TGS hashes for Kerberoasting.

Answer

wmiexec.py

Answer

secretsdump.py

Answer

psexec.py

Question 8

A penetration tester wants to perform a pass-the-hash attack against a Windows system using a captured NTLM hash. Which tool can be used to authenticate and execute commands remotely?

Accepted Answer

pth-winexe. pth-winexe allows pass-the-hash authentication to Windows systems.

Answer

evil-winrm

Answer

Responder

Answer

Hashcat

Question 9

In a Windows domain, you have compromised a user account with SeImpersonatePrivilege enabled. Which tool or technique would best leverage this privilege to escalate to SYSTEM?

Accepted Answer

PrintSpoofer. SeImpersonatePrivilege allows token impersonation; PrintSpoofer exploits it to get SYSTEM.

Answer

AlwaysInstallElevated

Answer

Pass-the-Hash with pth-winexe

Answer

Kerberoasting

Question 10

During a penetration test, the tester discovers evidence that an external attacker is actively exploiting a vulnerability in the client's environment. Which of the following is the MOST appropriate action?

Accepted Answer

Immediately notify the client and stop testing. If there is evidence of a live attack or criminal activity, the tester should stop testing and immediately notify the client so they can take appropriate action.

Answer

Document the evidence and ignore it

Answer

Attempt to block the attacker's activities

Answer

Continue testing and include the finding in the final report

Question 11

A penetration tester is testing a web application and discovers an endpoint that returns XML data. The tester attempts to read /etc/passwd by injecting an external entity. Which type of attack is this?

Accepted Answer

XXE injection. XML External Entity (XXE) injection allows reading files or performing SSRF via XML processing.

Answer

Command injection

Answer

SSRF

Answer

SQL injection

Question 12

During an external penetration test, the tester discovers that a critical web application is hosted on a third-party cloud provider. The SOW did not mention this provider. What should the tester do before proceeding with testing against that provider's infrastructure?

Accepted Answer

Obtain written authorization from the third-party provider. Testing third-party services requires explicit permission from the provider to avoid legal and contractual issues.

Answer

Scan only the IP addresses that resolve to the client's domain

Answer

Continue testing as long as the target is in scope

Answer

Ignore the web application and test only on-premises assets

Question 13

A penetration tester has gained a low-privilege shell on a Windows server and discovers the user has the SeImpersonatePrivilege. Which tool could the tester use to escalate privileges to SYSTEM?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits SeImpersonatePrivilege to escalate privileges on Windows.

Answer

Mimikatz

Answer

SharpHound

Answer

PowerUp

Question 14

Which of the following is the most important factor when determining the scope of a penetration test?

Accepted Answer

Business objectives. The client's business objectives drive the scope to ensure the test addresses what the client needs to protect. Tools, vulnerabilities, and team size are secondary considerations.

Answer

Tester's available tools

Answer

Latest vulnerabilities

Answer

Number of testing team members

Question 15

A company wants to simulate a real-world attack scenario where the penetration tester has no prior knowledge of the environment and must act as an external threat actor. However, the tester is allowed to use social engineering to gain initial access. Which type of engagement is most appropriate?

Accepted Answer

Red team exercise. A red team exercise is a full-scope adversary simulation that can include social engineering and black box testing.

Answer

Network penetration test

Answer

Wireless penetration test

Answer

Web application penetration test