PT0-002 Practice Test 2 — 25 Questions

Question 1

A penetration tester is writing the technical report for a client. The client's security team needs detailed, step-by-step instructions on how to reproduce each vulnerability found. In which section of the report should this information be placed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Findings and recommendations. The 'Findings and recommendations' section is the correct location for detailed, step-by-step reproduction instructions because it provides the technical depth needed for the client's security team to validate and remediate each vulnerability. This section typically includes exact commands, payloads, and sequences used during testing, aligning with the PT0-002 objective of delivering actionable technical details.

Answer

Executive summary

Answer

Risk rating section

Answer

Appendix

Question 2

A penetration testing firm is engaged to assess a cloud infrastructure hosted in multiple AWS regions. The client specifies that only systems in US-based regions should be tested due to data sovereignty concerns. Which of the following is the MOST critical documentation to include in the rules of engagement (ROE) to ensure compliance?

Accepted Answer

List of allowed AWS regions and associated VPC CIDR ranges. The rules of engagement (ROE) must explicitly define the authorized scope to prevent testing outside US-based regions, which could violate data sovereignty laws. Listing allowed AWS regions and their associated VPC CIDR ranges provides a precise technical boundary for the penetration test, ensuring that only in-scope systems are targeted. Without this, the testing team might inadvertently access resources in non-US regions, leading to legal and compliance breaches.

Answer

Statement of Work (SOW)

Answer

Data Processing Agreement (DPA)

Answer

Penetration testing methodology document

Question 3

A penetration testing firm is hired to perform a test on a multinational company that has offices in Europe and North America. The client wants to test all systems including those in the European office, which is subject to GDPR. Which of the following is the MOST important legal consideration to include in the rules of engagement?

Accepted Answer

Data protection and privacy clauses addressing handling of personal data. The engagement involves testing systems in a European office subject to GDPR, which imposes strict requirements on the processing and protection of personal data. The rules of engagement must include data protection and privacy clauses to define how the penetration tester will handle any personal data encountered during the test, ensuring compliance with GDPR Article 5 (lawfulness, fairness, transparency) and Article 32 (security of processing). Without these clauses, the tester could inadvertently violate GDPR by collecting or storing personal data without a lawful basis, exposing both the client and the testing firm to significant fines.

Answer

A limitation of liability clause

Answer

A non-disclosure agreement

Answer

A schedule of testing hours

Question 4

A penetration tester wants to identify live hosts on a large internal network. Which Nmap option would be the FASTEST for initial host discovery?

Accepted Answer

-sn (Ping sweep). The -sn option performs a ping sweep, sending ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default. It does not perform port scanning, making it the fastest method for initial host discovery on a large internal network because it only checks for host availability without enumerating services.

Answer

-sV (Version detection)

Answer

-sS (SYN stealth scan)

Answer

-A (Aggressive scan)

Question 5

A penetration tester wants to perform a pass-the-hash attack against a Windows system. Which tool can be used to authenticate using the NTLM hash instead of a password?

Accepted Answer

CrackMapExec. CrackMapExec supports pass-the-hash authentication with NTLM hashes.

Answer

Responder

Answer

Hashcat

Answer

John the Ripper

Question 6

A penetration tester gains access to a web application that uses a MongoDB backend. The tester discovers that the search functionality directly interpolates user input into a NoSQL query without sanitization. Which technique should the tester use to extract data from the database?

Accepted Answer

NoSQL injection. The application uses MongoDB, a NoSQL database, and the search functionality directly interpolates user input into a NoSQL query without sanitization. This allows the tester to inject MongoDB operators (e.g., $ne, $regex, $gt) to manipulate the query logic and extract data, which is the core of NoSQL injection. Unlike SQL injection, this technique targets MongoDB's query syntax, such as JSON-based operators, to bypass authentication or retrieve records.

Answer

SQL injection

Answer

LDAP injection

Answer

Command injection

Question 7

During code review, a penetration tester identifies the following line in a PHP web application: $sql = "SELECT * FROM users WHERE username='" . $_GET['user'] . "'"; Which type of vulnerability is most likely present?

Accepted Answer

SQL injection. Direct concatenation of user input into an SQL query without sanitization results in SQL injection vulnerability.

Answer

Insecure deserialization

Answer

Command injection

Answer

Cross-site scripting (XSS)

Question 8

After completing a penetration test, the tester must deliver a report. According to standard practices, which of the following is a required component of the deliverables?

Accepted Answer

Executive summary, technical findings, and remediation guidance. A typical penetration test report includes an executive summary, technical findings, and remediation guidance.

Answer

Remediation guidance and a list of all tested IPs

Answer

Only technical findings and proof-of-concept code

Answer

Executive summary and raw data logs

Question 9

During a red team exercise, the tester successfully gains access to an internal server and finds evidence of ongoing criminal activity unrelated to the client. According to best practices for handling discovered criminal activity, what should the tester do first?

Accepted Answer

Contact the client's emergency contact as defined in the RoE. The tester should follow the incident response plan and contact emergency contacts; the RoE should specify procedures.

Answer

Immediately inform law enforcement

Answer

Cease all testing and delete the evidence

Answer

Continue testing and document the evidence for the final report

Question 10

A penetration tester wants to identify the operating system of a remote host without sending any traffic to the target network. Which of the following techniques is most effective for this purpose?

Accepted Answer

Use Shodan to search for the host's IP address and examine the service banners.. Shodan is a search engine that indexes service banners and metadata from internet-connected devices. By querying Shodan for the target's IP address, the tester can retrieve previously collected OS information without sending any packets to the target, satisfying the 'no traffic' constraint.

Answer

Perform an nmap OS fingerprint scan on the host.

Answer

Send a ping sweep to the host's network segment.

Answer

Use ARP scanning to discover the host's MAC address and look up the vendor.

Question 11

During a penetration test, a tester successfully exploits a web application and gains a foothold. The tester needs to pivot to an internal network segment that is not directly accessible. Which THREE tools can the tester use to create a SOCKS proxy or tunnel for pivoting?

Accepted Answer

Chisel. SSH dynamic port forwarding (-D), chisel, and ligolo-ng are all tools for creating SOCKS proxies or tunnels for pivoting.

Answer

Netcat

Answer

Nmap

Question 12

During a web application test, a tester discovers an endpoint that fetches a URL from user input without validation. They attempt to access the AWS metadata endpoint. Which IP address is commonly used for the cloud metadata service?

Accepted Answer

169.254.169.254. AWS metadata is accessible at 169.254.169.254, a link-local address.

Answer

10.0.0.1

Answer

127.0.0.1

Answer

192.168.1.1

Question 13

During a web application test, you find a feature that allows users to export data as PDF. The PDF generation uses user input without sanitization. You inject an XML external entity that reads /etc/passwd and the content appears in the PDF. Which vulnerability is present?

Accepted Answer

XML External Entity (XXE). XXE (XML External Entity) allows reading files via XML entities when the parser is vulnerable.

Answer

Server-Side Request Forgery (SSRF)

Answer

Command injection

Answer

Cross-Site Scripting (XSS)

Question 14

During a web application penetration test, a tester identifies a SQL injection vulnerability. Which TWO techniques could be used to extract data from the database? (Select TWO.)

Accepted Answer

Blind time-based SQL injection. UNION-based and blind time-based are common SQL injection techniques for data extraction.

Answer

Command injection

Answer

XXE injection

Answer

Reflected XSS

Question 15

During a Windows privilege escalation attempt, a tester finds that the current user has the SeImpersonatePrivilege enabled. Which tool can be used to exploit this privilege to gain SYSTEM access?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits SeImpersonatePrivilege to escalate to SYSTEM.

Answer

PowerUp

Answer

CrackMapExec

Answer

Mimikatz

Question 16

A penetration tester has obtained a set of NTLM password hashes from a Windows domain controller. The tester wants to perform an offline cracking attack using GPU acceleration. Which tool is best suited for this purpose?

Accepted Answer

Hashcat. Hashcat is a powerful password cracker that supports GPU acceleration and can crack NTLM hashes efficiently.

Answer

CrackMapExec

Answer

John the Ripper

Answer

Hydra

Question 17

A penetration tester has exploited a web application and found that the server has an outbound firewall that restricts all outbound traffic except for DNS queries (UDP 53). The tester has a reverse shell payload that connects back on TCP 443. Which technique can the tester use to exfiltrate data or establish a channel?

Accepted Answer

Use dnscat2 or other DNS tunneling tool. DNS tunneling tools like dnscat2 encode data within DNS queries and responses, allowing the tester to bypass outbound firewall restrictions that only permit UDP 53 traffic. Since the reverse shell payload uses TCP 443, which is blocked, DNS tunneling provides an alternative covert channel that encapsulates the communication within legitimate DNS lookups, effectively exfiltrating data or establishing a command-and-control channel over the allowed protocol.

Answer

Use netcat to send data over TCP 53

Answer

Use an SSH tunnel over UDP 53

Answer

Use a bind shell listening on TCP 443 internally

Question 18

A penetration tester is analyzing a Python script that performs a buffer overflow attack. The script imports the struct module and the socket module. It constructs a payload by packing a pattern of characters, then overwriting a return address with a specific offset. Which of the following is the most critical piece of information the tester must determine before running this script against the target?

Accepted Answer

The exact location of a JMP ESP instruction in memory. The script performs a buffer overflow attack by overwriting a return address. To redirect execution to attacker-controlled shellcode, the tester must overwrite the return address with the address of a JMP ESP instruction (or equivalent) that is reliably located in memory. Without this address, the overwritten return pointer will cause a crash or unpredictable behavior, making exploitation impossible.

Answer

The IP address and port of the target service

Answer

The version of the operating system running on the target

Answer

The username and password for the target service

Question 19

A client is planning a penetration test of their AWS cloud environment. They will provide the tester with an IAM user account with limited permissions. Which of the following scoping restrictions is most important to include in the rules of engagement to avoid unexpected costs?

Accepted Answer

The tester must not create any new AWS resources that incur costs.. Creating new AWS resources (e.g., EC2 instances, RDS databases, Lambda functions) can incur direct costs under the tester's IAM user account, even with limited permissions. The rules of engagement must explicitly prohibit resource creation to prevent unexpected billing, as AWS charges for resources provisioned regardless of the test's purpose. This scoping restriction aligns with the principle of cost containment in penetration testing engagements.

Answer

The tester must use only premium AWS services for testing.

Answer

The tester must request permission from AWS Support before each test.

Answer

The tester must avoid testing in the us-east-1 region due to higher costs.

Question 20

A penetration tester is performing passive reconnaissance on a target organization. Which of the following tools would be BEST suited to gather information about the organization's domain names, email addresses, and subdomains from publicly available sources without directly interacting with the target's systems?

Accepted Answer

theHarvester. theHarvester is designed for passive OSINT gathering of emails, subdomains, IPs, etc. Maltego is also OSINT but more graph-oriented; theHarvester is specifically for email/subdomain enumeration.

Answer

Nmap

Answer

Nessus

Answer

Metasploit