PT0-002 Practice Test 4 — 25 Questions

Question 1

A penetration tester discovers that a web application uses a vulnerable Java deserialization endpoint. The classpath includes the Apache Commons Collections library. Which attack technique is most likely to achieve remote code execution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Java deserialization of untrusted data (RCE via Commons Collections).. The presence of the Apache Commons Collections library in the classpath, combined with a vulnerable Java deserialization endpoint, enables the classic 'gadget chain' attack. Attackers craft a malicious serialized object that, when deserialized, invokes methods in Commons Collections (e.g., InvokerTransformer) to execute arbitrary system commands, achieving remote code execution (RCE). This is a well-documented exploit chain (e.g., CVE-2015-7501) that directly leverages the library's reflection-based classes.

Answer

SQL injection.

Answer

Cross-site scripting.

Answer

Command injection.

Question 2

During a penetration test, the tester identifies a low-risk information disclosure vulnerability in a public-facing web server. The tester includes this finding in the final report. Which component of the risk rating should the tester use to justify the low severity?

Accepted Answer

CVSS base score. The CVSS base score is the correct component to justify the low severity because it represents the intrinsic and fundamental characteristics of a vulnerability that are constant over time and across user environments. In this case, the information disclosure vulnerability has a low base score due to factors such as low attack complexity and low impact on confidentiality, which are captured in the base metrics. The base score is the standard starting point for communicating severity, making it the appropriate justification for the low-risk rating in the report.

Answer

Exploitability metrics

Answer

Impact metrics

Answer

Temporal score

Question 3

A penetration testing firm is contracted to test a cloud-based infrastructure. The client uses a shared responsibility model. Which of the following should be clarified in the rules of engagement to avoid legal issues?

Accepted Answer

Whether the tester needs authorization from the cloud provider. In a shared responsibility model, the cloud provider is responsible for the security of the cloud, while the customer is responsible for security in the cloud. However, penetration testing activities may violate the cloud provider's terms of service or acceptable use policy, potentially triggering legal action. Therefore, obtaining explicit authorization from the cloud provider is critical to ensure the tester's actions are legally permitted and to avoid liability for unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA).

Answer

Who is responsible for patching the operating system

Answer

The encryption method for data at rest

Answer

The backup strategy for logs

Question 4

A client wants to test a web application that uses multiple third-party APIs for payment processing, shipping, and customer relationship management. The client states that the APIs are critical for operations but cannot be taken offline. Which scoping consideration is most important to include in the rules of engagement?

Accepted Answer

The tester must use only non-intrusive scanning techniques on the APIs.. The client explicitly stated that the APIs are critical for operations and cannot be taken offline. Non-intrusive scanning techniques, such as passive traffic analysis or read-only API calls with safe HTTP methods (GET, HEAD), minimize the risk of service disruption, data corruption, or rate-limit triggering. This aligns with the scoping requirement to maintain availability while still allowing security testing of the API layer.

Answer

The tester must exclude all API endpoints from testing.

Answer

The tester must coordinate testing schedules with the API vendors.

Answer

The tester must provide a list of all API calls to be made prior to testing.

Question 5

A penetration tester is conducting passive reconnaissance on a target organization. The tester wants to identify the technologies and frameworks used by the target's web application without making any requests to the target's servers. Which resource is BEST suited for this task?

Accepted Answer

BuiltWith.com. BuiltWith.com is a passive reconnaissance resource that profiles web application technologies by analyzing publicly available data, such as JavaScript libraries, web frameworks, and analytics tools, without sending any requests to the target's servers. It aggregates information from various public sources and historical data, making it ideal for identifying technologies without direct interaction.

Answer

Nmap service scan with -sV

Answer

Shodan.io

Answer

Wappalyzer browser extension

Question 6

A client requests a penetration test of their web application, but they want to exclude all third-party APIs from the scope. Where should this exclusion be documented?

Accepted Answer

Rules of Engagement. The Rules of Engagement (ROE) document is the authoritative source for defining the scope, boundaries, and constraints of a penetration test, including explicit exclusions such as third-party APIs. This document is established during the planning and scoping phase to ensure both the client and the testing team agree on what is and is not in scope, preventing legal or operational issues. Without documenting the exclusion in the ROE, the tester might inadvertently interact with the third-party APIs, violating the agreement and potentially causing service disruptions or legal liabilities.

Answer

Executive Summary

Answer

Findings Report

Answer

Remediation Plan

Question 7

During a penetration test, you want to perform a stealthy port scan that minimizes the chance of being logged by the target. Which Nmap option should you use?

Accepted Answer

-sS. SYN scan (-sS) is considered stealthy because it does not complete the TCP handshake, reducing the likelihood of being logged compared to a full connect scan.

Answer

-sU

Answer

-sV

Answer

-sT

Question 8

During a penetration test, you want to discover API endpoints and hidden parameters in a web application. Which tool combination is most effective for this task?

Accepted Answer

Arjun and ffuf. Arjun is specifically designed for parameter discovery, while ffuf can be used to bruteforce both directories and parameters. Together they effectively find API endpoints and parameters. gobuster is for directory/file enumeration, not specifically for parameters.

Answer

Wappalyzer and curl

Answer

WhatWeb and theHarvester

Answer

Gobuster and Nikto

Question 9

A penetration tester is performing passive reconnaissance on a target organization. The tester wants to gather information about the target's technology stack, including web server software and frameworks, without directly interacting with the target systems. Which technique is most effective?

Accepted Answer

Querying public records with BuiltWith. BuiltWith is a passive reconnaissance tool that queries public web data and DNS records to identify a target's technology stack, such as web server software (e.g., Apache, Nginx) and frameworks (e.g., React, Django), without sending any packets to the target's systems. This makes it ideal for passive information gathering, as it relies on third-party databases and cached information rather than direct interaction.

Answer

Running Nmap with the -A flag against the target's public IP range

Answer

Using theHarvester to search for email addresses and subdomains

Answer

Performing a DNS zone transfer

Question 10

During a penetration test of a large e-commerce platform, the client requests additional testing on a newly discovered microservice mid-engagement. The scope defined in the rules of engagement (ROE) explicitly lists all target systems. What should the penetration tester do FIRST?

Accepted Answer

Inform the client that a scope amendment is needed and pause testing on the microservice until it is approved. The rules of engagement (ROE) are a legally binding document that defines the scope of testing. Adding a new microservice mid-engagement without an approved scope amendment violates the ROE and could lead to legal or contractual issues. The penetration tester must first pause testing on the microservice and formally request a scope amendment to ensure all activities remain authorized.

Answer

Add the microservice to the test and include it in the final report as an unadvertised finding

Answer

Decline the request because the microservice was not part of the original scope

Answer

Test the microservice only if it is using the same technology stack as other targets

Question 11

A penetration tester is analyzing a Python script that uses the 'requests' library to send HTTP POST requests to a target URL with different payloads. The script also implements a retry mechanism with exponential backoff. What is the most likely purpose of this script?

Accepted Answer

Password spraying. The script sends HTTP POST requests with different payloads and implements a retry mechanism with exponential backoff. This behavior is characteristic of password spraying, where an attacker attempts a small number of common passwords against many usernames to avoid account lockouts. The exponential backoff helps evade rate-limiting and intrusion detection systems by gradually increasing delays between attempts.

Answer

Directory brute-forcing

Answer

SQL injection testing

Answer

Session hijacking

Question 12

A penetration tester gained low-privileged access to a Linux server and found that the user can run a custom script located at /opt/tool/backup.sh with setuid root. The script begins with a hashbang #!/bin/bash and uses an internal variable defined as BASEDIR=$(dirname $0) to determine paths. Which technique is most likely to allow privilege escalation?

Accepted Answer

Create a malicious executable named 'dirname' in a directory earlier in the PATH. The script uses `BASEDIR=$(dirname $0)` to resolve paths. If the user can place a malicious executable named `dirname` earlier in the PATH than the legitimate `/usr/bin/dirname`, then when the script runs with setuid root, the shell will execute the attacker's `dirname` binary instead, allowing arbitrary code execution as root.

Answer

Modify the $0 variable during execution

Answer

Overwrite /opt/tool/backup.sh with a reverse shell

Answer

Exploit a buffer overflow in the Bash interpreter

Question 13

A penetration testing firm is scoping a test for a financial institution. The client insists that the test only be performed on systems located in the corporate headquarters, excluding cloud-based infrastructure and remote branch offices. Which of the following should the penetration tester emphasize during the scoping discussion?

Accepted Answer

The exclusion of cloud infrastructure may leave critical assets untested. The client's exclusion of cloud-based infrastructure and remote branch offices creates a significant gap in the test scope. A penetration test that ignores cloud assets (e.g., AWS, Azure, or SaaS applications) may miss critical vulnerabilities in systems that process or store sensitive financial data, as these are often part of the institution's attack surface. The tester must emphasize that such exclusions can lead to a false sense of security, as attackers frequently target cloud and remote assets due to their accessibility and potential misconfigurations.

Answer

The test will include social engineering of remote employees

Answer

The test can only be performed during off-hours

Answer

The tester will require VPN access to the corporate network

Question 14

A penetration tester is using a vulnerability scanner to assess an internal network. The scanner reports a critical vulnerability in a custom web application, but manual verification shows the application is not vulnerable. Which of the following is the MOST likely cause of this false positive?

Accepted Answer

The scanner detected a vulnerable library used by the application, but the application's implementation does not expose the vulnerable code path. Vulnerability scanners often identify libraries or components with known CVEs, but they cannot determine whether the application's code actually invokes the vulnerable functions. In this case, the scanner flagged a library with a known vulnerability, but the custom web application's implementation does not expose the vulnerable code path, resulting in a false positive. This is a common limitation of static or version-based detection versus dynamic, context-aware analysis.

Answer

The scanner used an outdated vulnerability database that does not match the application's patches

Answer

The scanner identified the application version from the HTTP response header, but the vulnerability was already patched in that version

Answer

The scanner performed an exploit attempt that succeeded on a different service on the same host

Question 15

A penetration tester has compromised a Linux server and wants to move laterally to a Windows server. The Linux server has network access to the Windows server on port 445. The tester has a captured NTLM hash of a domain administrator account. Which technique is most likely to allow the tester to authenticate and execute commands on the Windows server?

Accepted Answer

Pass-the-hash using Impacket's psexec. The tester has a captured NTLM hash of a domain administrator account and network access to the Windows server on port 445 (SMB). Pass-the-hash (PtH) allows authentication using the NTLM hash directly without needing the plaintext password. Impacket's psexec uses the SMB protocol to authenticate with the hash and execute commands remotely, making it the most direct and effective technique for lateral movement in this scenario.

Answer

Kerberos Golden Ticket attack

Answer

SMB relay attack using the hash

Answer

Brute-force password cracking of the hash

Question 16

A penetration tester is preparing a report for a client who has both a technical security team and a non-technical executive team. The tester wants to ensure that each audience receives the appropriate level of detail. Which of the following is the most effective approach?

Accepted Answer

Create a single report that includes an executive summary at the beginning and a detailed technical section later.. It provides a single report with an executive summary for non-technical stakeholders and a detailed technical section for the security team, satisfying both audiences' needs without duplication or omission. This approach aligns with industry best practices for penetration testing reporting, as outlined in standards like PTES and NIST SP 800-115, ensuring clear communication of risks and technical findings.

Answer

Provide the same comprehensive report to both audiences, assuming the security team will interpret it for executives.

Answer

Write two separate reports: one for executives with only business impact and another for technical staff with all details.

Answer

Present only the executive summary and invite the technical team to ask questions orally.

Question 17

A vulnerability scanner reports a reflected XSS vulnerability in a web application. Manual testing confirms that the application HTML-encodes all user input in the response. Which scanner misconfiguration is MOST likely causing this false positive?

Accepted Answer

The scanner's payload triggered a server error that echoed back the input without encoding. A server error that echoes back the unencoded input bypasses the application's normal HTML-encoding logic. In this scenario, the vulnerability scanner detects the reflected payload in the error response, which is not subject to the same encoding as the application's standard output. This creates a false positive because the reflected XSS is not exploitable through the normal application flow, but only through an error condition that the scanner inadvertently triggered.

Answer

The scanner used a POST request instead of a GET request for the payload

Answer

The scanner's payload was reflected in a different context not subject to HTML encoding

Answer

The scanner used a payload with special characters that were truncated by the server

Question 18

A penetration tester is using Burp Suite to intercept and modify HTTP traffic. When browsing to an HTTPS site, the tester observes that the requests are encrypted and not being intercepted by Burp. Which configuration step is most likely missing?

Accepted Answer

The Burp CA certificate has not been installed in the browser's trust store. Burp Suite intercepts HTTPS traffic by acting as a man-in-the-middle, which requires the browser to trust Burp's self-signed CA certificate. Without installing the Burp CA certificate in the browser's trust store, the browser will refuse to establish a TLS connection through the proxy, leaving requests encrypted end-to-end and invisible to Burp.

Answer

The proxy listener is not configured to listen on the correct port

Answer

The browser's proxy settings are not configured to use Burp

Answer

The target site is not in Burp's scope

Question 19

A penetration tester has completed the technical portion of a test and is now writing the executive summary. Which of the following is most important to include in this section to effectively communicate with senior management?

Accepted Answer

The total number of vulnerabilities found and their risk ratings, with a focus on business impact. The executive summary is intended for senior management, who need to understand the business impact of findings rather than technical details. Option B focuses on the total number of vulnerabilities, their risk ratings, and business impact, which directly aligns with management's decision-making needs. This ensures the report communicates risk in terms of potential financial or operational consequences, not just technical severity.

Answer

A detailed list of all tools and commands used during the test

Answer

Step-by-step instructions on how to reproduce the most critical vulnerability

Answer

The names of the penetration testers and their certifications

Question 20

A client requests a penetration test that simulates an external attacker with no prior knowledge of the internal network. The tester is not provided with any credentials, network diagrams, or source code. Which type of test does this describe?

Accepted Answer

Black-box test. This is a black-box test because the tester simulates an external attacker with no prior knowledge of the internal network, no credentials, no network diagrams, and no source code. In black-box testing, the tester must discover all vulnerabilities from an outsider's perspective, relying solely on publicly available information and active reconnaissance techniques such as port scanning, service enumeration, and vulnerability scanning. This approach aligns with the client's requirement to mimic a real-world attacker who has zero insider knowledge.

Answer

White-box test

Answer

Gray-box test

Answer

Covert test