PT0-002 Practice Test 3 — 25 Questions

Question 1

An organization has a web application that stores session tokens in a cookie named 'auth_token'. The token is a base64-encoded JSON object containing the username, role, and expiration timestamp. Which attack is most likely to succeed if the encryption is not used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cookie tampering. The session token is a base64-encoded JSON object without encryption, making it trivially easy to decode, modify (e.g., change the role to 'admin' or extend the expiration timestamp), re-encode, and send back to the server. This is a classic cookie tampering attack, as the server trusts the client-provided data without integrity verification.

Answer

Session replay

Answer

Cross-site request forgery

Answer

Session hijacking

Question 2

A penetration tester wants to quickly identify known vulnerabilities in a web application without triggering many alarms. Which tool should the tester use?

Accepted Answer

Nikto. Nikto is a web server scanner that performs checks for known vulnerabilities with minimal noise. SQLmap is for SQL injection only, OpenVAS is a comprehensive vulnerability scanner that may be noisy, and Metasploit is for exploitation.

Answer

SQLmap

Answer

Metasploit

Answer

OpenVAS

Question 3

During a web application penetration test, a tester identifies a potential SQL injection vulnerability in a search field. The tester wants to extract data from the database without generating error messages that could trigger an alert. Which technique is most appropriate?

Accepted Answer

Blind SQL injection (time-based). Blind SQL injection (time-based) allows data extraction without generating visible error messages or database output. By using conditional time delays (e.g., IF condition THEN WAITFOR DELAY '0:0:5' in SQL Server or SLEEP(5) in MySQL), the tester can infer true/false conditions based on response timing, avoiding any error-based alerts that might be monitored by a WAF or IDS.

Answer

In-band SQL injection

Answer

Error-based SQL injection

Answer

Union-based SQL injection

Question 4

Which TWO of the following are types of penetration testing based on the level of knowledge provided to the tester? (Select TWO.)

Accepted Answer

Black box. Black box and white box are two common types based on knowledge level; grey box is the third.

Answer

Social engineering

Answer

Network penetration test

Answer

Red team

Question 5

A penetration tester is exploiting a web application that stores session tokens in HTTP cookies without the HttpOnly flag. Which attack is most likely to succeed?

Accepted Answer

Session hijacking through cross-site scripting. The absence of the HttpOnly flag on session cookies allows client-side scripts (e.g., JavaScript) to access the cookie. An attacker can exploit a cross-site scripting (XSS) vulnerability to execute arbitrary JavaScript in the victim's browser, which then reads the session cookie and sends it to the attacker. This enables session hijacking without needing to guess or brute-force the token.

Answer

SQL injection

Answer

Cross-site request forgery

Answer

Server-side request forgery

Question 6

While performing a password audit, a tester finds that the hash of 'Password123' is stored in the LAN Manager (LM) hash format. What is the primary security weakness of LM hashes?

Accepted Answer

The password is split into two 7-character halves. The primary security weakness of LAN Manager (LM) hashes is that the password is converted to uppercase, padded or truncated to 14 characters, and then split into two 7-character halves. Each half is hashed independently using DES as the key for a known constant, which means an attacker can brute-force each 7-character half separately, drastically reducing the keyspace from 14 characters to two sets of 7 characters. This makes LM hashes extremely vulnerable to offline cracking, especially with modern tools like John the Ripper or Hashcat.

Answer

The hash is case-sensitive

Answer

The hash is salted with a weak random value

Answer

The hash uses the MD4 hashing algorithm

Question 7

A penetration tester needs to describe a stored XSS vulnerability to a web developer who will fix it. Which level of detail is most appropriate for this audience?

Accepted Answer

Include the specific vulnerable URL, the request parameters, the payload used, and a code snippet for proper output encoding.. A web developer needs precise, actionable technical details to remediate the vulnerability: the exact URL, request parameters, the payload that triggered the stored XSS, and a code snippet showing proper output encoding (e.g., using OWASP ESAPI or context-specific escaping). This level of detail enables the developer to locate the vulnerable code, understand the injection point, and apply the correct fix without ambiguity.

Answer

Provide the CVSS score and risk rating.

Answer

Describe the business impact and potential regulatory fines.

Answer

Use a graph showing the number of vulnerabilities by severity across the application.

Question 8

A penetration tester discovers that a previously reported vulnerability from a prior test has not been remediated. How should this be communicated in the current report?

Accepted Answer

Include it as a recurring finding and note the lack of remediation.. Penetration testing standards (e.g., PTES, OWASP) require that previously identified vulnerabilities that remain unpatched be documented as recurring findings with explicit reference to the prior report. This ensures the client understands the risk persists and can track remediation progress over time. Including the finding with a note on lack of remediation maintains the integrity of the current risk assessment and supports compliance with reporting frameworks like NIST SP 800-115.

Answer

Only mention it in the executive summary, referencing the past report.

Answer

Omit the finding to avoid repetition.

Answer

Reduce the severity rating because it was already reported.

Question 9

Which of the following tools is primarily used for enumerating subdomains via search engine queries?

Accepted Answer

theHarvester. theHarvester is specifically designed to gather emails, subdomains, IPs, and URLs from public sources, including search engines like Google, Bing, and Yahoo. It leverages search engine APIs and scraping techniques to enumerate subdomains without directly interacting with the target infrastructure, making it the correct tool for this task.

Answer

Metasploit

Answer

Netcat

Answer

Nmap

Question 10

During a penetration test, a tester discovers a web application that reflects user input in the HTTP response without sanitization. Which attack is most likely to be successful?

Accepted Answer

Reflected cross-site scripting. Reflected cross-site scripting (XSS) is the correct answer because the vulnerability described—user input reflected in the HTTP response without sanitization—directly enables an attacker to inject malicious scripts (e.g., JavaScript) that execute in the victim's browser. This occurs when the application fails to validate or encode the input before including it in the response, allowing the attacker to craft a URL with a script payload that, when visited, runs in the context of the vulnerable web application's origin.

Answer

Server-side request forgery

Answer

SQL injection

Answer

Cross-site request forgery

Question 11

During a vulnerability scan of a web application, a tester receives an HTTP response with a '405 Method Not Allowed' error when trying to use a PUT request. What does this indicate about the web server's configuration?

Accepted Answer

The server blocks the PUT method for that specific URI.. A 405 Method Not Allowed error indicates that the server recognized the PUT method as valid but has explicitly disallowed it for the requested URI. This is a server-level access control configuration, often enforced via web server directives (e.g., Apache's `<LimitExcept>` or IIS's request filtering) or application-level routing rules. The tester's PUT request reached the server and was processed, but the server's configuration prevented it from being fulfilled for that specific endpoint.

Answer

The PUT method is allowed but the resource does not exist.

Answer

The server does not support the PUT method.

Answer

The request was malformed and rejected.

Question 12

A penetration tester is conducting information gathering on a target organization. The tester discovers a public code repository that contains configuration files with embedded credentials. Which of the following is the BEST next step?

Accepted Answer

Notify the organization's security team of the exposed credentials.. The tester has discovered exposed credentials in a public code repository, which is a critical security finding that requires immediate disclosure to the organization's security team. Ethical penetration testing mandates that any discovered vulnerabilities, especially those involving credential exposure, be reported promptly to prevent unauthorized access and potential data breaches. Proceeding with further exploitation without authorization violates the rules of engagement and could cause legal or operational harm.

Answer

Attempt to crack the passwords to gain further access.

Answer

Document the findings and proceed with passive reconnaissance.

Answer

Use the credentials to log into the target system immediately.

Question 13

A penetration tester runs the following command: nmap -sS -p 1-65535 -T4 -A -O --reason target. What is the primary purpose of the -A option in this command?

Accepted Answer

Enables OS detection, version detection, script scanning, and traceroute.. The -A option in nmap is a composite flag that enables OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (--traceroute) in a single switch. This is explicitly documented in nmap's man page and is designed to provide comprehensive reconnaissance in one command, making option A correct.

Answer

Sets the timing template to aggressive (level 4).

Answer

Enables aggressive scanning that is more likely to be detected by the target.

Answer

Performs a SYN (half-open) scan.

Question 14

A penetration tester is tasked with performing passive reconnaissance against a client without triggering any alerts. Which of the following techniques would be MOST appropriate?

Accepted Answer

Shodan search. Shodan is a search engine that indexes banners from internet-facing devices, allowing a penetration tester to gather information about a client's exposed services (e.g., open ports, software versions) without sending any packets to the target. This makes it a purely passive technique that will not trigger any alerts on the client's network or intrusion detection systems.

Answer

Nmap SYN scan

Answer

Brute-force login

Answer

Netcat banner grab

Question 15

A penetration tester needs to escalate privileges on a Linux system and finds that the user can run a script with sudo that has a vulnerable argument. Which resource should the tester consult to find exploitation techniques for common sudo misconfigurations?

Accepted Answer

GTFOBins. GTFOBins is a curated list of Unix binaries that can be exploited to bypass local security restrictions, including sudo misconfigurations.

Answer

Exploit-DB

Answer

Metasploit

Answer

CVE Details

Question 16

Refer to the exhibit. A penetration tester sends the request and receives the response shown. Which vulnerability is confirmed?

Accepted Answer

Reflected cross-site scripting. The response includes the parameter value 'John' reflected directly in the HTML body without sanitization or encoding, and the request uses an HTTP GET method. This confirms a reflected cross-site scripting (XSS) vulnerability, as the tester can inject arbitrary JavaScript by modifying the 'name' parameter, which will execute in the victim's browser.

Answer

Server-side request forgery

Answer

Cross-site request forgery

Answer

SQL injection

Question 17

During a penetration test, a tester needs to perform a man-in-the-middle attack on a network that uses WPA2-Enterprise with PEAP. Which tool is most appropriate for capturing the authentication handshake to attempt offline cracking?

Accepted Answer

hostapd-wpe. hostapd-wpe (Wireless Pwnage Edition) is specifically designed to set up a rogue access point that impersonates a legitimate WPA2-Enterprise network. It captures the MSCHAPv2 challenge-response from the PEAP authentication handshake, which can then be used for offline dictionary or brute-force attacks against the user's credentials. Unlike other tools, hostapd-wpe handles the full EAP/PEAP exchange required for this attack.

Answer

Wireshark

Answer

aircrack-ng

Answer

Ettercap

Question 18

A penetration tester is performing a password attack on a Windows domain and has captured NTLM hashes. Which tool can be used to perform a pass-the-hash attack to gain remote code execution on a target system?

Accepted Answer

pth-winexe. pth-winexe is a tool specifically designed for pass-the-hash attacks to execute commands on remote Windows systems.

Answer

Hashcat

Answer

Responder

Answer

John the Ripper

Question 19

Which of the following tools would a penetration tester most likely use to perform passive reconnaissance on a target domain?

Accepted Answer

theHarvester. theHarvester is a passive reconnaissance tool that gathers information from public sources such as search engines, PGP key servers, and the Shodan API without directly interacting with the target domain. It collects email addresses, subdomains, IPs, and employee names using OSINT (Open Source Intelligence) techniques, making it ideal for passive information gathering.

Answer

Wireshark

Answer

Nmap

Answer

Metasploit

Question 20

A penetration tester is conducting passive reconnaissance on a target organization. Which technique can be used to discover subdomains of the target's domain without sending any packets to the target's network?

Accepted Answer

Using the 'site:' operator in a search engine query. Using the 'site:' operator in a search engine query (e.g., 'site:example.com') retrieves indexed subdomains from the search engine's cache without sending any packets to the target's network. This is a purely passive technique that leverages publicly available data, aligning with the definition of passive reconnaissance.

Answer

Performing a DNS brute-force attack against the target's domain

Answer

Sending ICMP echo requests to potential subdomain IP addresses

Answer

Querying WHOIS databases for domain registration information