PT0-002 Practice Test 4 — 25 Questions

Question 1

A penetration tester is contracted to perform a grey box test of a company's internal network. The client provides a VPN account for remote access but does not disclose that the account has been used by a former employee. The tester connects and is immediately locked out. Which pre-engagement document should have addressed this scenario?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Rules of Engagement (RoE). The rules of engagement (RoE) should specify the accounts and credentials provided, including any limitations or known issues.

Answer

Emergency contact list

Answer

Data handling agreement

Answer

Statement of Work (SOW)

Question 2

A penetration tester is tasked with performing active reconnaissance on an internal network. The tester wants to identify live hosts and their open ports efficiently while minimizing noise. Which Nmap scan type should be used first to quickly discover which hosts are online?

Accepted Answer

nmap -sn 192.168.1.0/24. The `-sn` flag (ping scan) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default to determine if hosts are online without performing port scans. This minimizes network noise and quickly identifies live hosts on the subnet, which is the first step in active reconnaissance before deeper scanning.

Answer

nmap -sS -sV 192.168.1.0/24

Answer

nmap -A 192.168.1.0/24

Answer

nmap -sT 192.168.1.0/24

Question 3

A penetration tester is examining a compiled binary obtained during an engagement. The tester wants to identify potential buffer overflow vulnerabilities and understand the control flow. Which TWO tools would be most appropriate for this task?

Accepted Answer

OllyDbg. OllyDbg is a debugger that allows dynamic analysis to identify overflow vulnerabilities by examining memory and registers. Ghidra is a disassembler and decompiler that provides static analysis of control flow and potential vulnerabilities. Nmap is a network scanner, Wireshark is a packet analyzer, and Burp Suite is a web proxy, none of which are suitable for binary analysis.

Answer

Wireshark

Answer

Nmap

Answer

Burp Suite

Question 4

A penetration tester is performing a full-scope engagement and needs to identify potential privilege escalation vectors on a Windows system. Which TWO of the following are valid Windows privilege escalation techniques?

Accepted Answer

Unquoted service path exploitation. Unquoted service paths and AlwaysInstallElevated are both valid Windows privilege escalation techniques. Kerberoasting and pass-the-hash are for credential access, not local escalation; SUID/SGID is Linux.

Answer

Pass-the-hash

Answer

Kerberoasting

Answer

SUID/SGID binary exploitation

Question 5

A penetration tester is using Hashcat to crack NTLM hashes obtained from a Windows system. The tester wants to use a rule-based attack to maximize cracking success. Which Hashcat mode should be used for NTLM hashes?

Accepted Answer

-m 1000. Hashcat mode -m 1000 is specifically designated for NTLM hashes, which are the Windows NT LAN Manager hash format stored in the SAM database. A rule-based attack with this mode applies transformation rules to wordlists to generate candidate passwords, maximizing cracking success by leveraging common password patterns and mutations.

Answer

-m 1100

Answer

-m 3000

Answer

-m 5500

Question 6

A penetration tester is reviewing a Python script that attempts to exploit a command injection vulnerability. The script uses the 'subprocess' module with the 'shell=True' argument. Which of the following code changes would be MOST effective to reduce the risk of unintended consequences when executing system commands?

Accepted Answer

Avoid using shell=True and pass the command as a list of arguments. Setting `shell=True` in Python's `subprocess` module causes the command string to be interpreted by the system shell, which introduces command injection risks if any part of the string is user-controlled. By passing the command as a list of arguments (e.g., `['ls', '-l', filename]`) and omitting `shell=True`, the subprocess module directly executes the binary without shell interpretation, eliminating shell metacharacter injection. This is the most effective mitigation as it avoids shell parsing entirely, which is the root cause of the vulnerability.

Answer

Replace subprocess with os.system()

Answer

Use the 'shlex.quote()' function to sanitize user input before passing to subprocess

Answer

Use the 'exec()' function to run the command

Question 7

A tester is performing a post-exploitation phase on a compromised Linux server and wants to establish persistence. Which THREE of the following methods are commonly used for Linux persistence? (Choose THREE.)

Accepted Answer

Adding an SSH public key to ~/.ssh/authorized_keys. Common Linux persistence methods include adding cron jobs (crontab), creating a systemd service that starts on boot, and adding SSH authorized keys for backdoor access. Scheduled tasks are Windows-specific; Registry Run keys are also Windows-only.

Answer

Adding a registry Run key

Answer

Creating a scheduled task using schtasks

Question 8

A penetration tester is attempting to exploit a buffer overflow vulnerability in a Linux binary. The binary has Data Execution Prevention (DEP) enabled but Address Space Layout Randomization (ASLR) is disabled. Which exploitation technique would be the MOST effective to achieve code execution?

Accepted Answer

Perform a return-to-libc attack to call system("/bin/sh"). With DEP enabled, the stack is non-executable, so injecting shellcode directly into the buffer (Option A) would fail. Since ASLR is disabled, library addresses are fixed, making a return-to-libc attack viable. Option C exploits this by overwriting the return address with the address of system() and placing the string "/bin/sh" in memory, achieving code execution without needing an executable stack.

Answer

Inject shellcode into the buffer and redirect execution to it

Answer

Use a ROP chain to call mprotect() to make the stack executable, then jump to shellcode

Answer

Use a heap spray to place shellcode at a known address and then trigger the overflow

Question 9

A penetration tester has discovered a critical SQL injection vulnerability in a web application. The developer team will fix the issue. Which level of detail is most appropriate for this audience?

Accepted Answer

Include the full proof-of-concept code and the exact HTTP requests used.. The developer team needs the exact technical details to reproduce and fix the vulnerability. Providing the full proof-of-concept code and exact HTTP requests allows developers to understand the injection point, the payload structure, and the vulnerable parameter, enabling them to implement a precise fix such as parameterized queries or input validation.

Answer

Provide the CVSS score and a brief description.

Answer

Describe the business impact in financial terms.

Answer

List all findings in a bullet-point summary without additional context.

Question 10

A penetration tester is performing an NTLM relay attack against a Windows network. The tester uses ntlmrelayx to relay captured NTLM authentication attempts to a target server. What must be true for this attack to succeed?

Accepted Answer

SMB signing must be disabled or not enforced. SMB signing must be disabled or not enforced on the target server, otherwise the relayed authentication will be rejected.

Answer

LLMNR must be enabled

Answer

The relayed hash must be crackable

Answer

The target server must have SMB signing enabled

Question 11

Which of the following is an example of a custom severity rating based on business context?

Accepted Answer

Risk rating of 'Critical' based on high business impact and likelihood. Custom severity often uses impact and likelihood to determine risk, as not all vulnerabilities affect the business equally.

Answer

DREAD score of 7

Answer

High/Medium/Low based on CVSS

Answer

CVSS score of 9.0

Question 12

A penetration tester is preparing a remediation recommendation for a SQL injection vulnerability found in a legacy application. The development team cannot immediately update the framework due to compatibility issues. What should the tester recommend as a compensating control?

Accepted Answer

Implement a web application firewall (WAF) with rules to block SQL injection attempts.. When a full fix is not immediately possible, compensating controls such as a WAF can provide temporary protection.

Answer

Disable the affected functionality until the framework can be updated.

Answer

Conduct manual code reviews to identify and fix the vulnerability immediately.

Answer

Upgrade the database to a newer version to prevent SQL injection.

Question 13

A client hires a penetration testing firm to assess a web application. The client uses a third-party content delivery network (CDN) for static assets and explicitly wants to exclude the CDN infrastructure from testing. In which document should this restriction be formally documented?

Accepted Answer

Rules of Engagement (ROE). The Rules of Engagement (ROE) document is the correct place to formally document restrictions such as excluding the CDN infrastructure from testing. The ROE defines the scope, boundaries, and specific constraints for the penetration test, including which IP ranges, domains, or systems are off-limits. This ensures the testing team does not inadvertently target the third-party CDN, which could violate contractual agreements or cause unintended disruptions.

Answer

Statement of Work (SOW)

Answer

Non-Disclosure Agreement (NDA)

Answer

Master Services Agreement (MSA)

Question 14

A tester is exploiting a SQL injection vulnerability in a login form. The application returns different responses for valid and invalid queries. However, the tester cannot see the database output. Which type of SQL injection is most likely?

Accepted Answer

Blind SQL injection. Blind SQL injection occurs when query results are not directly reflected, but the application behavior changes based on truth values.

Answer

Out-of-band SQL injection

Answer

UNION-based SQL injection

Answer

Error-based SQL injection

Question 15

In a penetration test report, the tester includes a screenshot of a successful exploit. What metadata should the screenshot include to ensure proper evidence documentation?

Accepted Answer

A timestamp and the IP address or hostname of the affected system.. Screenshots should include timestamps and relevant context such as the affected system to provide clear evidence.

Answer

Only the exploit output without any timestamps or identifiers.

Answer

A diagram of the network architecture instead of the exploit screenshot.

Answer

The tester's name and the date of the test, but not the system details.

Question 16

A penetration tester is writing a report and needs to assign a severity rating to a vulnerability. Which of the following scoring systems is specifically designed to consider Damage, Reproducibility, Exploitability, Affected users, and Discoverability?

Accepted Answer

DREAD. The DREAD model is a risk assessment model that uses these five categories.

Answer

STRIDE

Answer

OWASP Risk Rating

Answer

CVSS

Question 17

A penetration tester is analyzing a Python script that uses the 'paramiko' library. The script reads a list of IP addresses from a file and attempts to connect to each host using the same username and a list of common passwords. Which attack technique is the script most likely performing?

Accepted Answer

Brute-force attack against SSH credentials. The script uses the 'paramiko' library, which is a Python implementation of the SSHv2 protocol. By reading a list of IP addresses and attempting connections with the same username and a list of common passwords, it is performing a brute-force attack against SSH credentials. This technique systematically tries multiple password guesses to gain unauthorized access to SSH services.

Answer

SQL injection attack against a database

Answer

Cross-site scripting (XSS) attack against a web application

Answer

ARP spoofing attack to intercept network traffic

Question 18

A penetration tester is using Hashcat to crack NTLM hashes obtained from a Windows domain controller. Which hash mode should the tester specify for NTLM hashes?

Accepted Answer

-m 1000. Hashcat uses mode -m 1000 for NTLM hashes. Mode 0 is for MD5, mode 13100 is for Kerberoast, and mode 22000 is for WPA2.

Answer

-m 22000

Answer

-m 0

Answer

-m 13100

Question 19

A penetration tester is exploiting a web application and discovers an XML External Entity (XXE) vulnerability. Which TWO attacks can be performed using XXE?

Accepted Answer

Server-Side Request Forgery (SSRF). XXE can be used to read local files via external entities and also to perform SSRF by making the server request internal resources.

Answer

Remote code execution

Answer

Cross-Site Scripting (XSS)

Answer

SQL injection

Question 20

A penetration tester is using Nmap to perform an aggressive scan of a target. Which command combines OS detection, version detection, script scanning, and traceroute?

Accepted Answer

nmap -A target. The -A flag enables aggressive scanning which includes OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (--traceroute).

Answer

nmap -sV -O target

Answer

nmap -sC -O target

Answer

nmap -T4 -sV target