PT0-002 Practice Test 25 — 15 Questions

Question 1

A penetration tester is preparing a proposal for a client. The client wants a test that includes a detailed technical report with remediation steps and an executive summary for management. Which standard or framework is most commonly used to structure the testing process from pre-engagement through post-engagement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

PTES. The Penetration Testing Execution Standard (PTES) provides a comprehensive framework covering all phases from pre-engagement to post-engagement.

Answer

OWASP Testing Guide

Answer

OSSTMM

Answer

NIST SP 800-115

Question 2

During a penetration test, a tester discovers evidence of an ongoing live exploitation by an unknown third party. Which of the following should the tester do first?

Accepted Answer

Immediately inform the client's point of contact.. If there is evidence of criminal activity or live exploitation, the tester should inform the client immediately so they can take appropriate action.

Answer

Attempt to stop the exploitation on their own.

Answer

Continue the test and document the evidence.

Answer

Ignore the finding as it is out of scope.

Question 3

A penetration tester is performing a password cracking task against a dump of NTLM hashes obtained from a Windows domain controller. Which tool would be the most efficient for this task?

Accepted Answer

Hashcat. Hashcat is a GPU-accelerated password cracker that can crack NTLM hashes quickly, especially with a good wordlist and rules.

Answer

Hydra

Answer

John the Ripper

Answer

CrackMapExec

Question 4

A penetration tester has discovered a web application that appears to be built with WordPress. The tester wants to identify installed plugins, themes, and potential vulnerabilities without triggering intrusion detection systems. Which tool is BEST suited for this task?

Accepted Answer

WPScan. WPScan is a dedicated WordPress vulnerability scanner that can enumerate plugins, themes, users, and known vulnerabilities. It can be configured to use passive methods or throttle requests to avoid detection.

Answer

OpenVAS

Answer

Nikto

Answer

Gobuster

Question 5

Which section of a penetration testing report should provide a high-level overview of the test results using business language and strategic recommendations?

Accepted Answer

Executive summary. The executive summary is designed for non-technical stakeholders to understand the overall risk and key actions.

Answer

Technical findings section

Answer

Remediation recommendations

Answer

Appendices

Question 6

A penetration tester is finalizing a report and needs to ensure that sensitive data discovered during the test (e.g., password hashes, PII) is handled appropriately. Which of the following is the BEST practice?

Accepted Answer

Sanitize the data by redacting or replacing with placeholders.. Option A is correct because sanitizing sensitive findings by redacting or replacing them with placeholders (e.g., masking password hashes or PII) preserves the evidentiary value of the report while preventing unnecessary exposure of the actual secrets to readers. This aligns with penetration testing reporting best practices and data-handling standards such as those in PTES and OWASP, which call for minimizing sensitive data in deliverables. Option B is wrong because destroying all copies and omitting the data removes the evidence needed to validate and remediate the findings. Option C is wrong because an oral-only debrief provides no durable, auditable record for remediation or compliance. Option D is wrong because including raw password hashes or PII, even encrypted, unnecessarily expands the exposure surface and violates the principle of least data in reports.

Answer

Destroy all copies of sensitive data after the test and do not include any.

Answer

Present the data only in the oral debrief, not in written form.

Answer

Include the raw data in an encrypted appendix for the technical team.

Question 7

A penetration testing company is contracted to perform a social engineering engagement. The client requests that only employees in the finance department be targeted. Which scoping consideration is most relevant?

Accepted Answer

Personnel scope. Personnel scope defines which individuals or groups are in-scope for social engineering testing.

Answer

Rules of engagement

Answer

Production vs. staging environments

Answer

Third-party services

Question 8

A penetration tester is performing passive reconnaissance and wants to find historical versions of the target website, including old pages that may contain sensitive information. Which resource should the tester use?

Accepted Answer

Wayback Machine. The Wayback Machine (archive.org) archives historical snapshots of websites. Pastebin is for pasted text, Google dorks are for search queries, and Shodan is for device discovery.

Answer

Pastebin

Answer

Shodan

Answer

Google dorks

Question 9

During a penetration test, the tester discovers a JWT token that uses the 'alg:none' header. Which attack does this vulnerability enable?

Accepted Answer

Signature bypass using alg:none. JWT with 'alg:none' allows an attacker to forge tokens without any signature, bypassing verification.

Answer

Key confusion attack

Answer

Algorithm substitution attack

Answer

Timing attack

Question 10

During a web application penetration test, the tester discovers a JWT token in the Authorization header. The token uses the 'none' algorithm. What attack should the tester attempt?

Accepted Answer

JWT algorithm confusion attack (alg:none). If the server accepts the 'none' algorithm, the tester can forge tokens by setting the algorithm to 'none' and removing the signature.

Answer

JWT timing attack

Answer

JWT kid injection

Answer

JWT brute-force of the secret

Question 11

During a penetration test, the tester discovers evidence of an ongoing data breach that appears to involve criminal activity unrelated to the test scope. What is the tester's primary responsibility regarding this discovery?

Accepted Answer

Notify the client's emergency contact and follow the agreed-upon incident response procedures. The tester should follow the incident response plan and notify the client immediately, as handling criminal activity is a legal and ethical obligation.

Answer

Continue the test as planned and include the findings in the final report

Answer

Document the evidence and destroy it after the engagement to protect the client

Answer

Immediately stop testing and notify law enforcement without client approval

Question 12

Which section of a penetration test report contains detailed technical information such as the vulnerability description, evidence, affected systems, and remediation steps?

Accepted Answer

Technical findings section. The technical findings section provides in-depth details for technical teams to understand and remediate vulnerabilities.

Answer

Appendices

Answer

Executive summary

Answer

Methodology section

Question 13

During a social engineering engagement, a tester is authorized to target employees via email phishing. However, the tester accidentally sends a phishing email to a contractor who is not listed in the personnel scope. The contractor reports the email to the client's security team, causing an internal investigation. Which of the following best describes the tester's mistake?

Accepted Answer

Failure to follow the Rules of Engagement. Personnel scope must be clearly defined; the tester failed to adhere to the scoping requirements for social engineering.

Answer

Breach of the Non-Disclosure Agreement

Answer

Mishandling of discovered criminal activity

Answer

Violation of the Computer Fraud and Abuse Act (CFAA)

Question 14

A penetration tester is engaged to test a web application that uses a third-party payment gateway. The client has not obtained permission from the payment gateway provider. Which of the following is the best course of action?

Accepted Answer

Exclude the payment gateway from scope and notify the client that permission is required. Third-party services require explicit permission from the provider; testing without it could violate terms or laws. The tester should add the service as out-of-scope until permission is obtained.

Answer

Proceed with testing but use only passive techniques on the gateway

Answer

Test the gateway without informing the client to avoid delays

Answer

Include the payment gateway in scope because it is part of the application

Question 15

A tester is performing a Kerberoasting attack. After requesting TGS tickets for accounts with SPNs, what is the next step to obtain plaintext credentials?

Accepted Answer

Crack the TGS tickets using Hashcat or John the Ripper. Kerberoasting involves cracking the TGS tickets offline to recover the service account password.

Answer

Pass-the-ticket to access services

Answer

Relay the TGS tickets to another server

Answer

Use the TGS tickets for silver ticket attacks