PT0-002 Practice Test 5 — 25 Questions

Question 1

A penetration tester has compromised a Windows workstation and obtained a low-privileged domain user account. The tester discovers that this user belongs to a group that has the 'GenericWrite' privilege over a computer object in Active Directory. Which attack is most directly enabled by this misconfiguration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Shadow Credentials. The 'GenericWrite' privilege over a computer object allows the attacker to write to the msDS-KeyCredentialLink attribute of that object. By adding a rogue key credential, the attacker can trigger the Key Distribution Center (KDC) to accept a certificate-based authentication, enabling the Shadow Credentials attack to obtain a TGT for the computer account and escalate privileges.

Answer

Kerberoasting

Answer

AS-REP Roasting

Answer

DCSync Attack

Question 2

A penetration tester has submitted the final report to the client. The client's legal team requests a separate document that describes the methodology used, but does not include any actual findings or sensitive data. Which type of document should the tester provide?

Accepted Answer

A document describing the testing methodology and scope. The client's legal team specifically requested a document describing the methodology used without any actual findings or sensitive data. Option C, a document describing the testing methodology and scope, directly fulfills this requirement by providing a high-level overview of the penetration testing approach, tools, and boundaries, while excluding all findings, evidence, and sensitive client data. This type of document is often called a 'Methodology Statement' or 'Scope of Work' and is commonly used for legal or compliance purposes to demonstrate due diligence without exposing risk details.

Answer

A new executive summary that omits the findings

Answer

A copy of the technical findings with redacted details

Answer

The remediation plan without the exploit steps

Question 3

A penetration tester has captured NTLM hashes from a compromised machine and wants to move laterally to a server that requires NTLM authentication. The tester does not have the plaintext password. Which attack technique is MOST appropriate for authenticating using the captured hashes?

Accepted Answer

Pass-the-hash. Pass-the-hash (PtH) is the most appropriate technique because it allows the tester to authenticate to the target server using the captured NTLM hash directly, without needing the plaintext password. NTLM authentication uses the hash as a secret, so the hash can be passed to the server in the challenge-response handshake. This is a well-known lateral movement technique in Windows environments.

Answer

Brute force the password from the hash

Answer

NTLM relay

Answer

Kerberoasting

Question 4

During a penetration test, a tester identifies a buffer overflow vulnerability in a Linux binary that has both ASLR and NX (Non-Executable) enabled. The tester discovers a ROP gadget at a fixed address in a library that is not affected by ASLR. Which technique can be used to exploit this vulnerability and achieve code execution?

Accepted Answer

Return-oriented programming (ROP) using the fixed gadgets. Return-oriented programming (ROP) is the correct technique because ASLR and NX are both enabled, preventing direct shellcode execution and making memory addresses unpredictable. However, the tester found a ROP gadget at a fixed address in a library not affected by ASLR, allowing the construction of a chain of gadgets to achieve arbitrary code execution without needing to inject or execute shellcode on the stack.

Answer

Heap spraying to predict memory layout and inject shellcode

Answer

Stack canary bypass using information leak

Answer

Format string attack to overwrite GOT entries

Question 5

A penetration tester is performing a web application test and identifies a potential SQL injection vulnerability. Which TWO methods can the tester use to confirm the vulnerability and extract data?

Accepted Answer

Blind time-based SQL injection. UNION-based and blind time-based are classic SQL injection techniques. XSS and command injection are different attacks. XXE is also different.

Answer

XXE injection

Answer

Command injection

Answer

XSS injection

Question 6

A penetration tester is writing a Python script to send a crafted TCP packet to a target. Which Python library should the tester use for low-level packet crafting and injection?

Accepted Answer

scapy. Scapy is the correct choice because it is a powerful Python library specifically designed for low-level packet crafting, manipulation, and injection. It allows the tester to construct arbitrary TCP packets at the raw socket level, control individual flags, sequence numbers, and payloads, and send them directly over the wire using Layer 2 or Layer 3 sockets. This makes it ideal for tasks like SYN flooding, TCP handshake manipulation, or custom protocol fuzzing.

Answer

requests

Answer

impacket

Answer

socket

Question 7

A client has a critical web application that cannot be tested in the production environment due to availability requirements. A staging environment exists that exactly mirrors production, but it uses different IP addresses, domain names, and a subset of data. The staging environment is isolated from production networks. Which scoping element is most important to include in the rules of engagement to ensure a valid test?

Accepted Answer

Explicitly define the staging environment as the target scope. The staging environment is an exact mirror of production but uses different IP addresses, domain names, and a subset of data. Explicitly defining the staging environment as the target scope ensures the tester focuses all activities on the authorized systems, preventing any accidental impact on production. This scoping element is critical for a valid test because it aligns the test with the client's availability requirements while still allowing comprehensive security testing on a representative environment.

Answer

Require the tester to use non-disruptive testing techniques only

Answer

Include the production IP ranges in the scope 'just in case'

Answer

Specify that the test must be performed from the internet only

Question 8

Which type of penetration test provides the tester with full knowledge of the target environment, including network diagrams, source code, and administrative credentials?

Accepted Answer

White box. A white box test gives the tester complete information about the target, allowing for a comprehensive assessment.

Answer

Grey box

Answer

Black box

Answer

Red team

Question 9

A penetration tester is analyzing a Python script used during a test. The script contains the following code: 'import requests; r = requests.get('http://target', headers={'User-Agent': 'Mozilla/5.0'}); print(r.text)'. What is the primary purpose of setting the User-Agent header in this script?

Accepted Answer

To mimic a legitimate browser to evade detection by web application firewalls.. Setting the User-Agent header to 'Mozilla/5.0' makes the HTTP request appear to originate from a standard web browser rather than a Python script. This helps evade detection by web application firewalls (WAFs) and other security controls that may block or flag requests with non-browser User-Agent strings, which are common indicators of automated or malicious traffic.

Answer

To bypass IP-based rate limiting.

Answer

To authenticate to the web server.

Answer

To enable SSL/TLS encryption.

Question 10

During a web application test, a penetration tester suspects an LDAP injection vulnerability. The application uses user input to dynamically construct an LDAP query. The tester submits the following payload in the username field: 'admin)(&)'. The application returns a list of all users instead of the expected single user. Which of the following best describes the reason this payload was effective?

Accepted Answer

The payload closes the original filter and appends a tautology that returns all objects.. The payload 'admin)(&)' closes the original LDAP filter after 'admin' and appends '(&)' which is a tautology (always true). This causes the LDAP query to match all directory objects, returning the full user list instead of a single user. The attack exploits the way LDAP filters are parsed: injecting a closing parenthesis and a new filter that evaluates to true for every entry.

Answer

The payload causes an LDAP error that triggers a fallback to list all users.

Answer

The payload modifies the base DN to search the entire directory.

Answer

The payload introduces a logical OR that negates the original condition.

Question 11

A penetration tester wants to perform a network scan that minimizes the chance of detection by an intrusion detection system (IDS). Which Nmap timing template is MOST appropriate?

Accepted Answer

-T0. The -T0 (Paranoid) timing template is the most appropriate for minimizing detection by an IDS because it introduces extreme delays between packet transmissions (up to 5 minutes between probes) and uses a very slow scan rate. This makes the scan traffic blend into normal network noise, reducing the likelihood of triggering signature-based or anomaly-based IDS alerts that rely on detecting rapid, sequential connection attempts.

Answer

-T3

Answer

-T5

Answer

-T2

Question 12

A penetration testing firm is hired to assess a client's web application that integrates with a third-party payment processor's API. The client wants to include the payment processor's API in the test scope. Which action should the tester take FIRST?

Accepted Answer

Request written permission from the payment processor. The correct first action is to request written permission from the payment processor because the API is owned and operated by a third party, not the client. Testing a third-party API without explicit authorization could violate the Computer Fraud and Abuse Act (CFAA) and the payment processor's terms of service, potentially leading to legal liability for both the tester and the client. The scope of a penetration test must be legally defined and agreed upon by all parties whose systems are being tested.

Answer

Begin testing the API because it is part of the client's environment

Answer

Only test the client's internal systems, excluding the API

Answer

Use the payment processor's sandbox environment without notifying them

Question 13

A penetration tester is writing the findings section of a report. The tester discovered a cross-site scripting vulnerability that allows session hijacking. The technical team wants to understand exactly how to reproduce it, while the business owner wants to know the risk it poses to customer data. Which approach best addresses both audiences?

Accepted Answer

Write two separate sections: one for technical details and one for risk analysis. It separates the technical reproduction steps (for the technical team) from the business impact analysis (for the business owner), ensuring each audience receives the information in the format they need. This aligns with the PT0-002 objective of tailoring communication to different stakeholders, avoiding confusion or information overload. A single combined description (Option A) would likely be too technical for the business owner or too vague for the technical team.

Answer

Include a single detailed description with both technical and business impact

Answer

Place technical details in an appendix and include only risk ratings in the main body

Answer

Provide a video demonstration separately from the written report

Question 14

Which tool is specifically designed for scanning WordPress websites to detect vulnerabilities, such as outdated plugins, themes, and weak passwords?

Accepted Answer

WPScan. WPScan is a dedicated WordPress security scanner that enumerates WordPress-specific vulnerabilities, including outdated plugins, themes, and weak passwords via XML-RPC brute-force testing. It uses the WordPress vulnerability database (wpvulndb.com) to match installed versions against known CVEs, making it the correct tool for this targeted task.

Answer

OpenVAS

Answer

Nikto

Answer

Nessus

Question 15

A penetration tester with a low-privileged domain user account performs a Kerberoasting attack. What is the primary goal of this attack?

Accepted Answer

Obtain the plaintext password of a user account with a Service Principal Name (SPN).. Kerberoasting targets service accounts that have a Service Principal Name (SPN) registered in Active Directory. The attacker requests a Kerberos service ticket (TGS) for the SPN, which is encrypted with the service account's NTLM hash. The attacker then cracks this hash offline to recover the plaintext password, enabling lateral movement or privilege escalation.

Answer

Obtain the NTLM hash of the krbtgt account.

Answer

Obtain a list of all domain users.

Answer

Obtain a Kerberos ticket that can be used to impersonate a domain admin.

Question 16

A client with a hybrid on-premises and cloud infrastructure requests a penetration test. The client uses an IaaS provider for some servers. Which of the following is the MOST important aspect to clarify in the rules of engagement regarding the cloud environment?

Accepted Answer

The authorization from the cloud provider for testing. The most critical aspect to clarify in the rules of engagement for a cloud environment is obtaining explicit authorization from the IaaS provider. Without this authorization, the penetration test may violate the provider's acceptable use policy or terms of service, potentially leading to legal action or service termination. This is a foundational scoping requirement because the client does not own the underlying infrastructure; the cloud provider retains control over the network and hypervisor layers.

Answer

The list of operating systems used in the cloud

Answer

The public IP addresses of the cloud servers

Answer

The budget allocated for cloud testing

Question 17

A penetration tester is conducting a vulnerability scan of a web application that uses a custom API framework. The scanner reports several potential SQL injection vulnerabilities, but manual testing confirms they are false positives. The tester suspects the scanner is misinterpreting input validation. Which of the following is the most likely reason for these false positives?

Accepted Answer

The application reflects the injected payload in error messages or response content, causing the scanner to think the injection succeeded. The scanner likely detected the injected payload reflected in the application's response (e.g., in an error message or echoed input), which it interpreted as successful SQL execution. In custom API frameworks, input validation may reject the payload but still reflect it back in the response, causing the scanner to flag a false positive. Manual testing confirms the injection fails, so the reflection is merely a side effect of the API's error handling, not a sign of database interaction.

Answer

The scanner used a payload that was blocked by a Web Application Firewall (WAF) before reaching the application

Answer

The scanner used outdated signatures that do not match the custom API's input validation logic

Answer

The application returns a generic 'Invalid input' message for all types of invalid input, confusing the scanner

Question 18

A client wants a penetration test that simulates an external threat actor with no prior access. The client provides a list of public IP ranges and domain names. Which type of test is this?

Accepted Answer

External black-box test.. This is an external black-box test because the client provides only public IP ranges and domain names, simulating an external threat actor with no prior access. The tester has no internal knowledge or credentials, which defines a black-box approach, and the scope is limited to external-facing assets, making it external.

Answer

Internal white-box test.

Answer

Gray-box test.

Answer

Red team exercise.

Question 19

A client engages a penetration testing firm to evaluate the security of their internal network. During the scoping meeting, the client states that they use a network access control (NAC) solution that might block the tester's machine if it is connected to the internal network without prior authorization. Which of the following should be included in the rules of engagement to address this potential issue?

Accepted Answer

Add a clause requiring the client to whitelist the tester's MAC address in the NAC policy before testing.. Whitelisting the tester's MAC address in the NAC policy allows the tester's machine to connect to the internal network without being blocked, while keeping the NAC solution active for other devices. This approach preserves the real-world security posture of the client's environment and ensures the tester can perform internal network assessments as scoped. It is a standard practice in penetration testing to request MAC address whitelisting to avoid false positives from NAC enforcement.

Answer

Include a requirement that the client disables NAC during the testing window.

Answer

State that the tester will not connect to the internal network and will only test externally.

Answer

Specify that the tester will bypass NAC as part of the test objectives.

Question 20

A penetration tester is analyzing a Bash script that performs network scanning. The script contains the following command: 'for ip in $(seq 1 254); do hping3 -S -p 22 -c 1 $TARGET_SUBNET.$ip 2>/dev/null | grep -q "flags=SA" && echo "$TARGET_SUBNET.$ip: open"; done'. What is the primary purpose of this script?

Accepted Answer

Conduct a TCP SYN scan to identify hosts with port 22 open. The script uses hping3 with the -S flag (SYN) and -p 22 (port 22) to send TCP SYN packets to each IP in the target subnet. The grep -q 'flags=SA' checks for a SYN-ACK response, which indicates the port is open and listening. This is the classic behavior of a TCP SYN scan (half-open scan) to identify hosts with port 22 open.

Answer

Perform a vulnerability assessment against SSH services

Answer

Execute an ICMP ping sweep to discover live hosts

Answer

Complete a full TCP three-way handshake and log successful connections