PT0-002 Practice Test 3 — 25 Questions

Question 1

During an internal penetration test, a tester gains access to a domain-joined Windows 10 workstation as a local administrator. The tester wants to escalate privileges to Domain Admin. Which attack involves requesting Kerberos service tickets that can be cracked offline to reveal the plaintext password of a service account?

Accepted Answer

Kerberoasting. Kerberoasting is the correct attack because it involves requesting Kerberos service tickets (TGS-REP) for service accounts registered with Service Principal Names (SPNs) in Active Directory. These tickets are encrypted with the service account's NTLM hash, which can be cracked offline to reveal the plaintext password. Since the tester has local administrator access on a domain-joined workstation, they can use tools like Rubeus or Impacket to request these tickets without needing domain admin privileges initially.

Answer

Pass-the-hash

Answer

Golden ticket

Answer

Silver ticket

Question 2

During an internal penetration test, a tester captures an NTLMv2 hash of a domain admin account using a Responder attack. The organization's password policy requires at least 12 characters with uppercase, lowercase, numbers, and special characters. Which password cracking technique is most likely to succeed first?

Accepted Answer

Hybrid attack combining dictionary words with numbers and special characters. Option C is correct because NTLMv2 hashes are computationally expensive to crack, and a hybrid attack that combines dictionary words with numbers and special characters is the most efficient approach given the 12-character minimum policy. This technique leverages common password patterns (e.g., 'Password123!') that users often create to meet complexity requirements, making it faster than brute-forcing all possible 12-character combinations.

Answer

Dictionary attack with common passwords

Answer

Brute-force attack with all possible 8-character combinations

Answer

Rainbow table attack on the hash

Question 3

During the scoping phase of a penetration test, a client wants to test a third-party API that is integral to their web application. However, they do not have permission from the third-party provider. Which of the following should the tester do first?

Accepted Answer

Exclude the third-party API from the scope and document the limitation. Option B is correct because testing a third-party API without explicit permission from the provider violates legal and ethical boundaries, potentially constituting unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA). The penetration tester must first document this limitation in the scope to ensure the client understands the risk and to maintain the test's legality. Proceeding without permission could lead to liability for both the tester and the client.

Answer

Proceed with testing the API but restrict the test to read-only operations

Answer

Contact the third-party provider directly to obtain permission

Answer

Include the API in the scope and note the legal risks in the report

Question 4

You are performing a vulnerability scan on an internal network using an authenticated scanner. Which of the following is a primary benefit of authenticated scanning compared to unauthenticated scanning?

Accepted Answer

It provides more accurate identification of vulnerabilities that require credentials. Authenticated scanning provides deeper insight by checking for missing patches, misconfigurations, and vulnerabilities that require valid credentials to detect, such as local privilege escalation issues.

Answer

It eliminates false positives entirely

Answer

It reduces network traffic

Answer

It avoids detection by intrusion detection systems

Question 5

A penetration tester is conducting a vulnerability assessment and wants to minimize false positives. Which THREE actions should the tester take? (Select THREE.)

Accepted Answer

Verify findings manually. Option B is correct because manual verification of findings (e.g., confirming a vulnerability by exploiting it or inspecting the service banner) eliminates false positives that automated scanners often report due to signature mismatches or incomplete checks. For example, a scanner might flag a service as vulnerable based on version string alone, but manual testing can confirm whether the actual exploit conditions exist, such as checking for specific configuration flaws or patch levels.

Answer

Run the same scan multiple times

Answer

Ignore all high-severity findings initially

Question 6

A penetration tester wants to use Google dorking to find publicly accessible documents containing sensitive information on a target domain 'example.com'. Which Google dork would be MOST appropriate to locate PDF files with the word 'confidential'?

Accepted Answer

site:example.com filetype:pdf confidential. Option C is correct because the Google dork 'site:example.com filetype:pdf confidential' combines the site restriction to the target domain, the filetype filter for PDFs, and the keyword 'confidential' to search for PDF documents containing that word. This directly matches the requirement to locate publicly accessible PDF files with the word 'confidential' on example.com.

Answer

site:example.com intitle:confidential pdf

Answer

filetype:pdf site:example.com password

Answer

site:example.com inurl:pdf confidential

Question 7

A penetration tester is performing web application reconnaissance. The tester wants to discover hidden directories and files, identify the technologies used, and find API endpoints. Which THREE of the following tools are best suited for these tasks?

Accepted Answer

Gobuster. Gobuster is a tool that performs directory/file brute-forcing using wordlists, making it ideal for discovering hidden directories and files. It can also be used to enumerate DNS subdomains and virtual hosts, directly supporting the task of finding hidden resources on a web server.

Answer

Nikto

Answer

Burp Suite

Question 8

A penetration tester is preparing the executive summary for a report. Which of the following metrics would be MOST valuable to include for non-technical stakeholders to understand the overall security posture?

Accepted Answer

The number of critical and high-risk findings along with the average time to exploit them. Option C is correct because non-technical stakeholders (e.g., executives) need a high-level, risk-focused summary that communicates the severity and urgency of findings. The number of critical/high-risk findings directly indicates the most dangerous exposures, and the average time to exploit them conveys how quickly an attacker could compromise the environment. This metric translates technical risk into business impact, which is the core goal of an executive summary.

Answer

A list of all tools used during the penetration test

Answer

The total number of vulnerabilities discovered and their average CVSS score

Answer

A detailed step-by-step exploitation walkthrough of one critical vulnerability

Question 9

A client requires a penetration test of their web application that uses Single Sign-On (SSO) with a third-party identity provider. The client is concerned that testing could lock out real user accounts and disrupt operations. Which of the following should be included in the rules of engagement to address this concern?

Accepted Answer

Provide test accounts that are excluded from lockout policies. Option B is correct because providing test accounts that are excluded from lockout policies allows the penetration tester to thoroughly assess the SSO authentication mechanism—including the SAML or OIDC flows—without risking the lockout of real user accounts. This directly addresses the client's operational concern while still enabling comprehensive testing of the identity provider integration.

Answer

Prohibit all testing of the authentication mechanism

Answer

Only perform testing during business hours

Answer

Require the tester to use only passive reconnaissance techniques

Question 10

A client asks why a medium-severity finding should be remediated before a high-severity finding. The medium finding is internet-facing and actively exploited; the high finding is isolated in a lab subnet. What is the best explanation?

Accepted Answer

Prioritization should account for exposure and active exploitation, not only the scanner severity.. Option A is correct because risk-based prioritization must consider real-world factors like internet exposure and active exploitation, not just the CVSS base score. A medium-severity finding that is internet-facing and actively exploited poses a higher immediate risk to the organization than a high-severity finding isolated in a lab subnet, which has no external attack surface. This aligns with industry frameworks like CVSS environmental metrics and the FIRST CVSS v3.1 specification, which allow adjusting severity based on attack vector, complexity, and environmental context.

Answer

Medium findings must always be fixed before high findings.

Answer

The high finding should be ignored permanently because it is in a lab.

Answer

Only CVSS base score matters for remediation order.

Question 11

A penetration tester is conducting passive reconnaissance on a target organization. Which of the following techniques would provide the MOST useful information about internal network architecture without directly interacting with the target's systems?

Accepted Answer

Searching for the target's SSL certificates in Certificate Transparency logs. Certificate Transparency (CT) logs are publicly accessible, append-only ledgers of SSL/TLS certificates. By searching CT logs for certificates issued to the target organization, a penetration tester can discover subdomains, hostnames, and even internal-facing server names that are included in Subject Alternative Names (SANs) or Common Names (CNs). This reveals internal network architecture details (e.g., 'mail.internal.example.com') without any direct interaction with the target's systems, making it a purely passive reconnaissance technique.

Answer

Performing a zone transfer against the target's DNS servers

Answer

Using Nmap to scan common ports on the target's public IP range

Answer

Querying the target's WHOIS records for IP addresses

Question 12

A client wants a penetration test that includes social engineering attacks against employees. They request that the testing team not target the executive leadership team. What should be included in the rules of engagement to address this requirement?

Accepted Answer

A list of excluded users or groups, specifically the executive leadership team. Option A is correct because the rules of engagement (RoE) must explicitly define the scope and boundaries of the test. Including a list of excluded users or groups, specifically the executive leadership team, ensures that social engineering attacks are not directed at them, directly addressing the client's requirement. This is a standard scoping practice in penetration testing to prevent unintended consequences and maintain legal and ethical compliance.

Answer

The maximum number of phishing emails that can be sent

Answer

The time window for conducting social engineering activities

Answer

A description of the social engineering techniques that will be used

Question 13

A penetration tester has discovered a critical SQL injection vulnerability in a web application. The developer team will fix the issue. Which level of detail is most appropriate for this audience?

Accepted Answer

Include the full proof-of-concept code and the exact HTTP requests used.. Option B is correct because the developer team needs the exact technical details to reproduce and fix the vulnerability. Providing the full proof-of-concept code and exact HTTP requests allows developers to understand the injection point, the payload structure, and the vulnerable parameter, enabling them to implement a precise fix such as parameterized queries or input validation.

Answer

Provide the CVSS score and a brief description.

Answer

Describe the business impact in financial terms.

Answer

List all findings in a bullet-point summary without additional context.

Question 14

A penetration tester has completed the technical portion of a test and is now writing the executive summary. Which of the following is most important to include in this section to effectively communicate with senior management?

Accepted Answer

The total number of vulnerabilities found and their risk ratings, with a focus on business impact. The executive summary is intended for senior management, who need to understand the business impact of findings rather than technical details. Option B focuses on the total number of vulnerabilities, their risk ratings, and business impact, which directly aligns with management's decision-making needs. This ensures the report communicates risk in terms of potential financial or operational consequences, not just technical severity.

Answer

A detailed list of all tools and commands used during the test

Answer

Step-by-step instructions on how to reproduce the most critical vulnerability

Answer

The names of the penetration testers and their certifications

Question 15

A penetration tester has compromised a Windows workstation and obtained a low-privileged domain user account. The tester discovers that this user belongs to a group that has the 'GenericWrite' privilege over a computer object in Active Directory. Which attack is most directly enabled by this misconfiguration?

Accepted Answer

Shadow Credentials. The 'GenericWrite' privilege over a computer object allows the attacker to write to the msDS-KeyCredentialLink attribute of that object. By adding a rogue key credential, the attacker can trigger the Key Distribution Center (KDC) to accept a certificate-based authentication, enabling the Shadow Credentials attack to obtain a TGT for the computer account and escalate privileges.

Answer

Kerberoasting

Answer

AS-REP Roasting

Answer

DCSync Attack

Question 16

A penetration tester has gained a foothold on a Windows server and wants to move laterally to a domain controller. The tester has access to a service account that is a member of the 'Remote Management Users' group on the domain controller. Which of the following tools would be MOST appropriate for lateral movement in this scenario?

Accepted Answer

WinRM. WinRM (Windows Remote Management) is the most appropriate tool because the tester's service account is a member of the 'Remote Management Users' group on the domain controller, which grants explicit permission to connect via WinRM over HTTP/HTTPS (ports 5985/5986). This allows direct PowerShell remoting or winrs execution for lateral movement without requiring administrative privileges or additional exploits.

Answer

PsExec

Answer

MS16-075 exploit

Answer

BloodHound

Question 17

A penetration tester is analyzing a Bash script that uses 'curl' to send HTTP requests with payloads and checks for a specific string in the response. The script contains: 'if echo $response | grep -q "root:x:0:0"'. Which vulnerability is the script most likely testing for?

Accepted Answer

Local file inclusion. The script checks for the string 'root:x:0:0' in the HTTP response, which is the standard format of the root user entry in the /etc/passwd file on Unix-like systems. This indicates the script is testing whether the server is returning the contents of a local file (e.g., /etc/passwd) via a path traversal or file inclusion vulnerability, making Local File Inclusion (LFI) the correct answer.

Answer

SQL injection

Answer

Cross-site scripting

Answer

Remote code execution

Question 18

A penetration tester has successfully exploited a buffer overflow vulnerability in a Linux binary. However, the binary has Data Execution Prevention (DEP) enabled and Address Space Layout Randomization (ASLR) disabled. Which exploitation technique is MOST appropriate to achieve code execution in this environment?

Accepted Answer

Return-oriented programming (ROP) to bypass DEP. Return-oriented programming (ROP) is the most appropriate technique because DEP marks the stack and heap as non-executable, preventing direct shellcode injection. With ASLR disabled, the attacker can reliably locate and chain small instruction sequences (gadgets) from the binary or loaded libraries to achieve arbitrary code execution without needing executable memory regions.

Answer

Simple shellcode injection on the stack

Answer

ASLR bypass techniques

Answer

Heap spraying

Question 19

A penetration tester is analyzing a PowerShell script used during an internal test. The script contains the following code block: ```powershell $cred = Get-Credential $session = New-PSSession -ComputerName 'Server01' -Credential $cred Invoke-Command -Session $session -ScriptBlock { Get-ChildItem C:\Secrets.txt } Remove-PSSession $session ``` What is the primary purpose of this script?

Accepted Answer

To achieve lateral movement and access a file on a remote server. The script uses Get-Credential to obtain user credentials, creates a remote PowerShell session (PSSession) to Server01 via New-PSSession, and then executes Get-ChildItem C:\Secrets.txt on that remote server using Invoke-Command. This is the classic pattern for lateral movement: authenticating to a remote host and accessing a file stored there, not performing any local privilege escalation or password brute-forcing.

Answer

To perform a local privilege escalation using stored credentials

Answer

To brute-force the password of the user account via 'Get-Credential'

Answer

To execute a script from the remote server using the ScriptBlock

Question 20

A penetration tester is analyzing a Python script that uses the 'scapy' library. The script contains the line: `packet = IP(dst='10.0.0.1')/TCP(dport=80, flags='S')`. The tester then uses `sr1(packet, timeout=2)`. What is the primary purpose of this code?

Accepted Answer

Perform a TCP SYN scan to determine if port 80 is open. The code constructs an IP packet with destination 10.0.0.1 and a TCP segment with destination port 80 and the SYN flag set (flags='S'). The sr1() function sends this packet and waits for a response (up to 2 seconds). This is the classic technique for a TCP SYN scan: if a SYN-ACK is received, the port is open; if an RST is received, the port is closed. The primary purpose is therefore to probe whether port 80 on the target is open.

Answer

Perform a DNS resolution for the target IP

Answer

Send a TCP ACK packet to test firewall rules

Answer

Complete a full TCP three-way handshake