PT0-002 Practice Test 25 — 15 Questions

Question 1

A penetration testing firm is contracted to test a cloud-based infrastructure. The client uses a shared responsibility model. Which of the following should be clarified in the rules of engagement to avoid legal issues?

Accepted Answer

Whether the tester needs authorization from the cloud provider. In a shared responsibility model, the cloud provider is responsible for the security of the cloud, while the customer is responsible for security in the cloud. However, penetration testing activities may violate the cloud provider's terms of service or acceptable use policy, potentially triggering legal action. Therefore, obtaining explicit authorization from the cloud provider is critical to ensure the tester's actions are legally permitted and to avoid liability for unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA).

Answer

Who is responsible for patching the operating system

Answer

The encryption method for data at rest

Answer

The backup strategy for logs

Question 2

A client requests a penetration test of their network and provides a list of IP addresses. During scoping, the tester notices that several IP addresses belong to a major cloud service provider. What should the tester do FIRST before including those IP addresses in the test?

Accepted Answer

Ask the client to verify ownership and obtain written authorization from the cloud provider if needed. Option B is correct because testing cloud provider IP addresses without explicit authorization violates the cloud provider's terms of service and could be considered unauthorized access, potentially leading to legal action. The tester must first verify that the client actually owns those IPs (e.g., via ARIN WHOIS or cloud provider documentation) and obtain written authorization from the cloud provider, as the provider's shared infrastructure means the tester's traffic could impact other tenants. This aligns with the PT0-002 scoping requirement to confirm all targets are within the authorized boundary.

Answer

Proceed with testing since the client provided the IP addresses

Answer

Exclude the cloud IP addresses from the scope without further discussion

Answer

Perform a quick port scan to determine if the IPs are responsive before deciding

Question 3

A penetration tester is conducting passive reconnaissance on a target organization using Google dorking. The tester wants to find PDF documents that may contain usernames and passwords. Which Google search query is most appropriate for this task?

Accepted Answer

site:target.com filetype:pdf password. Option A is correct because it uses the `filetype:pdf` operator to specifically target PDF documents, combined with the keyword `password` to find files likely containing credentials. Google dorking with `site:target.com` restricts results to the target domain, making this query efficient for passive reconnaissance of exposed sensitive information in PDFs.

Answer

site:target.com username password

Answer

site:target.com filetype:xls password

Answer

site:target.com intitle:'index of' password

Question 4

A client requests a penetration test of their production environment, which includes critical financial transaction systems. The client is concerned about potential service disruptions. Which of the following should the tester include in the Rules of Engagement to address this concern?

Accepted Answer

A scope that limits testing to off-peak hours and includes a rollback plan for any changes. Option C is correct because it directly addresses the client's concern about service disruptions by limiting testing to off-peak hours and including a rollback plan. This ensures that any changes made during the test can be reversed quickly, minimizing the risk to critical financial transaction systems. The Rules of Engagement (RoE) must balance thorough testing with operational stability, and this scope provision achieves that.

Answer

A detailed schedule of every attack method to be used

Answer

A clause stating that testing will stop immediately if any service degradation is detected

Answer

A list of all tools and versions that will be used during the test

Question 5

A penetration tester is using a vulnerability scanner to assess a web application. The scanner reports a 'SQL Injection' finding with a high confidence level. However, manual verification of the same payload does not trigger the vulnerability in a browser. Which of the following is the most likely reason for this discrepancy?

Accepted Answer

The scanner might have generated a false positive due to a misinterpretation of the server's response. The most likely reason is that the scanner generated a false positive due to a misinterpretation of the server's response. Vulnerability scanners often infer SQL injection based on response patterns (e.g., database error messages, timing differences) that may not actually be exploitable. Manual verification in a browser failed because the payload did not produce a true SQL error or data leak, confirming the scanner's alert was incorrect.

Answer

The scanner used a different HTTP method than the one used in manual testing

Answer

The scanner's payloads were URL-encoded differently

Answer

The vulnerability exists only in the scanner's simulated environment

Question 6

A penetration tester has completed an engagement and needs to present findings to a mixed audience of technical engineers and business executives. Which section of the penetration test report is BEST suited for communicating high-level risk ratings and potential business impact to the non-technical stakeholders?

Accepted Answer

Executive Summary. The Executive Summary is the correct section because it is specifically designed to communicate high-level risk ratings, business impact, and strategic recommendations to non-technical stakeholders such as executives. It avoids technical jargon and focuses on the business context, aligning with the PT0-002 objective of tailoring reports to the audience.

Answer

Technical Findings and Vulnerability Details

Answer

Remediation Steps

Answer

Appendix

Question 7

A penetration tester is contracted to perform a test of a company's critical web application that handles financial transactions. The client requires that testing must not degrade the application's performance for live users. Which of the following scoping controls would best address this requirement?

Accepted Answer

Implement rate limiting in the testing tools and schedule the test during a maintenance window with low traffic. Option B is correct because rate limiting and scheduling during a maintenance window directly prevent performance degradation for live users. Rate limiting controls the request rate (e.g., limiting to 10 requests per second) to avoid overwhelming the application, while a maintenance window ensures minimal user impact. This approach balances active testing needs with the client's requirement to preserve live user experience.

Answer

Require the use of only passive reconnaissance techniques and exclude all active scanning

Answer

Include a clause that the client must monitor application performance and halt the test if degradation is observed

Answer

Test only from a single IP address and use low-packet-rate tools to avoid overwhelming the application

Question 8

A penetration tester wrote a Python script to automate HTTP request fuzzing. The script uses the 'requests' library to send payloads and checks for reflected content in the response. The tester wants to analyze the script for potential improvements. Which of the following code changes would MOST directly reduce false positives in detecting reflection?

Accepted Answer

Convert the response to lowercase before checking for reflection. Option A directly reduces false positives by normalizing the case of the response before checking for reflected content. HTTP responses may contain the payload in different cases (e.g., 'Test' vs 'test'), and without case-insensitive matching, the script would miss reflections that differ only in case, incorrectly reporting a false negative. Converting to lowercase ensures that any case variation of the reflected payload is detected, thereby reducing false positives from case-sensitive mismatches.

Answer

Add a random delay between requests

Answer

Remove the User-Agent header from requests

Answer

Use a session object to maintain cookies

Question 9

During passive reconnaissance, a penetration tester wants to compile a list of valid employee email addresses for a target company to be used in a future phishing campaign. Which technique is LEAST likely to be detected by the target or its security controls?

Accepted Answer

Mining GitHub repositories for company email patterns. Option D is correct because mining GitHub repositories for email patterns is a passive reconnaissance technique that relies on publicly accessible code and commit histories. The target company has no visibility into GitHub's public data, and no direct interaction with the target's systems occurs, making it the least likely to trigger alerts or be detected by security controls such as IDS/IPS, email gateways, or network monitoring.

Answer

Using theHarvester to search public sources

Answer

Sending probe emails to validate addresses

Answer

Scraping LinkedIn profiles for email patterns

Question 10

A penetration tester is performing passive reconnaissance to discover email addresses associated with a target domain. The tester wants to avoid sending any packets directly to the target's infrastructure. Which tool is most appropriate for this task?

Accepted Answer

Using theHarvester to search public sources like search engines, PGP key servers, and social media. TheHarvester is designed specifically for passive reconnaissance, gathering email addresses, subdomains, and other data from public sources such as search engines, PGP key servers, and social media without sending any packets directly to the target's infrastructure. This aligns perfectly with the requirement to avoid direct interaction with the target domain.

Answer

Using the whois command to query domain registration details

Answer

Using Shodan to identify email servers and associated addresses

Answer

Using Google dorking with advanced search queries to find email addresses in indexed pages

Question 11

When calculating the risk rating for a vulnerability found during a penetration test, which two factors are most fundamental to the risk calculation?

Accepted Answer

Likelihood and impact. Risk rating in penetration testing is fundamentally derived from the likelihood that a vulnerability will be exploited and the impact if it is exploited. These two factors form the core of any risk assessment framework, including NIST SP 800-30 and ISO 31000, because they directly quantify the probability and consequence of a threat event. Without likelihood and impact, you cannot compute a meaningful risk score, as other factors like CVSS scores or asset counts are secondary inputs that feed into these primary dimensions.

Answer

CVSS base score and temporal score

Answer

Number of affected systems and data classification

Question 12

A penetration tester is planning a social engineering campaign against a corporation. The goal is to trick the CEO into revealing sensitive information. Which type of attack should the tester use?

Accepted Answer

Whaling. Whaling is a targeted form of phishing that specifically focuses on high-profile individuals, such as the CEO. In this scenario, the goal is to trick the CEO into revealing sensitive information, making whaling the correct choice because it is designed to impersonate trusted entities or create urgent scenarios to deceive senior executives.

Answer

Vishing

Answer

Spear phishing

Answer

Pharming

Question 13

Which TWO of the following are indicators that a web application is vulnerable to XML External Entity (XXE) attacks? (Select TWO.)

Accepted Answer

Exfiltration of files via HTTP requests to an attacker-controlled server. Option C is correct because XXE attacks allow an attacker to define an external entity that references a local file (e.g., file:///etc/passwd) and then have that entity's content included in an HTTP request to an attacker-controlled server. This exfiltration via out-of-band HTTP requests is a classic indicator of a successful XXE exploitation, as the attacker can read sensitive files from the server's filesystem.

Answer

Directory traversal in file upload functionality

Answer

Persistent cross-site scripting in user profiles

Answer

Successful UNION-based SQL injection

Question 14

During a penetration test, the tester finds that a web application is vulnerable to server-side template injection (SSTI). Which of the following payloads would be most effective to test for SSTI in an Express-based Node.js application using Handlebars?

Accepted Answer

{{7*7}}. In Handlebars, the expression {{7*7}} evaluates the multiplication directly, returning 49. This confirms SSTI because the server processes the template expression before rendering. Other payloads like {{7*'7'}} may cause type coercion errors or not execute in the same way, making {{7*7}} the most reliable test.

Answer

Answer

<%= 7*7 %>

Answer

${7*7}

Question 15

During a penetration test, a tester identifies that the target's network uses Private VLANs to isolate hosts. Which technique can be used to bypass this isolation and perform ARP spoofing?

Accepted Answer

VLAN hopping. Private VLANs isolate hosts within the same VLAN by restricting traffic at the switch level. VLAN hopping (option D) allows an attacker to bypass this isolation by exploiting the switch's trunking protocol (e.g., DTP) to negotiate a trunk link, enabling the attacker to send and receive frames on multiple VLANs, including the target's community or isolated VLAN, thus facilitating ARP spoofing across the Private VLAN boundaries.

Answer

ARP cache poisoning from the switch

Answer

MAC flooding

Answer

Double tagging