PT0-002 Practice Test 26 — 15 Questions

Question 1

Refer to the exhibit. A penetration tester discovers this IAM policy attached to a public user role. Which attack is most likely to succeed?

Accepted Answer

Data exfiltration and modification. The IAM policy grants `s3:PutObject` and `s3:GetObject` actions on the `arn:aws:s3:::example-bucket/*` resource, allowing a public user to both upload and download objects. This directly enables data exfiltration (via GetObject) and modification (via PutObject overwriting existing objects). The policy does not restrict object listing or require encryption, making D the most likely successful attack.

Answer

Bucket ACL misconfiguration leading to public listing

Answer

Privilege escalation to admin

Answer

Resource exhaustion through large object uploads

Question 2

Which TWO of the following are common techniques used during a pass-the-hash attack? (Select TWO.)

Accepted Answer

Extracting NTLM hashes from LSASS. Option A is correct because in a pass-the-hash attack, the attacker first extracts NTLM hashes from the Local Security Authority Subsystem Service (LSASS) process memory. LSASS stores user credentials, including NTLM hashes, after successful authentication. By dumping LSASS (e.g., using Mimikatz sekurlsa::logonpasswords), the attacker obtains the hash without needing the plaintext password.

Answer

Performing a brute-force attack on the hash

Answer

Using a password spray attack

Answer

Requesting Kerberos TGS tickets

Question 3

An organization has a web application that stores session tokens in a cookie named 'auth_token'. The token is a base64-encoded JSON object containing the username, role, and expiration timestamp. Which attack is most likely to succeed if the encryption is not used?

Accepted Answer

Cookie tampering. Option C is correct because the session token is a base64-encoded JSON object without encryption, making it trivially easy to decode, modify (e.g., change the role to 'admin' or extend the expiration timestamp), re-encode, and send back to the server. This is a classic cookie tampering attack, as the server trusts the client-provided data without integrity verification.

Answer

Session replay

Answer

Cross-site request forgery

Answer

Session hijacking

Question 4

A penetration tester is tasked with exploiting a web application that uses an insecure deserialization vulnerability. Which type of attack should the tester primarily use to execute arbitrary code on the server?

Accepted Answer

Malicious object deserialization. Insecure deserialization vulnerabilities occur when an application deserializes untrusted data without proper validation, allowing an attacker to manipulate serialized objects. By crafting a malicious object (e.g., a PHP gadget chain or a Java serialized object with a custom readObject() method), the tester can trigger arbitrary code execution on the server during the deserialization process. This directly aligns with option C, as the attack vector is the deserialization of a malicious object.

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

Cross-site request forgery (CSRF)

Question 5

Which TWO of the following are common methods used to bypass network access controls during a penetration test? (Choose two.)

Accepted Answer

MAC spoofing. MAC spoofing allows a tester to impersonate an authorized device by changing the MAC address of their network interface to match a whitelisted MAC, thereby bypassing MAC-based access control lists (ACLs) or port security. This is a common bypass because many network access controls rely on MAC addresses as a simple authentication factor, which can be trivially altered using tools like `macchanger` or `ifconfig`.

Answer

SSID broadcasting

Answer

ARP poisoning

Answer

SQL injection

Question 6

A penetration tester is assessing a wireless network's security. The tester wants to capture WPA2 handshakes for offline password cracking. Which two attacks can be used to force a client to re-authenticate and capture the handshake? (Choose TWO.)

Accepted Answer

Disassociation attack. A deauthentication attack (Option E) sends deauth frames from the access point to the client, forcing it to disconnect and reconnect, thereby generating a new WPA2 4-way handshake. A disassociation attack (Option D) similarly sends disassociation frames to break the client's connection, prompting re-authentication. Both attacks exploit management frame vulnerabilities in 802.11 to capture the handshake for offline cracking.

Answer

Rogue DHCP server attack

Answer

ARP poisoning attack

Answer

Evil twin attack

Question 7

A penetration tester is analyzing the results of a vulnerability scan. Which of the following findings indicate that a vulnerability is likely exploitable? (Choose two.)

Accepted Answer

The vulnerability is classified as 'critical' by the scanner. Option A is correct because a 'critical' classification by the scanner typically indicates a high-severity vulnerability with a CVSS base score of 9.0 or higher, which often corresponds to remotely exploitable flaws that can lead to complete compromise. Scanners like Nessus or OpenVAS assign critical severity based on factors such as attack vector, complexity, and impact, making such vulnerabilities highly likely to be exploitable in practice.

Answer

CVSS base score of 4.0

Answer

The vulnerability has been patched by the vendor

Answer

Multiple hosts share the same vulnerability

Question 8

A penetration tester has discovered a vulnerable service running on a Linux server that allows remote code execution. Which of the following is the most appropriate next step to maintain access?

Accepted Answer

Install a backdoor for persistent access. Option B is correct because after gaining initial access, installing a backdoor ensures persistent access. Option A is wrong because erasing logs prematurely could alert defenders. Option C is wrong because privilege escalation may not be necessary if current access is sufficient. Option D is wrong because reporting should occur after the engagement, not during.

Answer

Clear all system logs to avoid detection

Answer

Immediately report the finding to the client

Answer

Escalate privileges to root

Question 9

A tester is performing a vulnerability scan against a critical production server. The client requests minimal impact on system performance. Which scan type should the tester use?

Accepted Answer

Vulnerability scan with low-thread count. Option B is correct because a vulnerability scan with a low-thread count reduces the number of concurrent connections and packets sent to the target, minimizing CPU, memory, and network overhead on the production server. This directly addresses the client's requirement for minimal performance impact while still performing a legitimate security assessment. Unlike aggressive or stealth scans, this approach throttles the scan intensity to avoid service disruption.

Answer

TCP connect scan

Answer

Aggressive Nmap scan

Answer

Stealth SYN scan

Question 10

During a web application penetration test, a tester identifies a potential SQL injection vulnerability in a search field. The tester wants to extract data from the database without generating error messages that could trigger an alert. Which technique is most appropriate?

Accepted Answer

Blind SQL injection (time-based). Option C is correct because blind SQL injection (time-based) allows data extraction without generating visible error messages or database output. By using conditional time delays (e.g., IF condition THEN WAITFOR DELAY '0:0:5' in SQL Server or SLEEP(5) in MySQL), the tester can infer true/false conditions based on response timing, avoiding any error-based alerts that might be monitored by a WAF or IDS.

Answer

In-band SQL injection

Answer

Error-based SQL injection

Answer

Union-based SQL injection

Question 11

A penetration tester is evaluating a cloud environment (AWS) and finds an S3 bucket with public write access. Which attack is most likely to succeed if the tester wants to plant malicious files that will be served to users?

Accepted Answer

Upload a malicious JavaScript file to the bucket. Option B is correct because an S3 bucket with public write access allows anyone to upload objects without authentication. A penetration tester can upload a malicious JavaScript file (e.g., for cross-site scripting or drive-by download) that, when accessed by users via the bucket's public URL, executes in their browsers. This directly exploits the misconfiguration to serve malicious content to end users.

Answer

Exhaust the bucket's storage quota

Answer

Encrypt all objects in the bucket for ransom

Answer

Modify the bucket policy to grant further permissions

Question 12

Refer to the exhibit. A penetration tester sends the request and receives the response shown. Which vulnerability is confirmed?

Accepted Answer

Reflected cross-site scripting. The response includes the parameter value 'John' reflected directly in the HTML body without sanitization or encoding, and the request uses an HTTP GET method. This confirms a reflected cross-site scripting (XSS) vulnerability, as the tester can inject arbitrary JavaScript by modifying the 'name' parameter, which will execute in the victim's browser.

Answer

Server-side request forgery

Answer

Cross-site request forgery

Answer

SQL injection

Question 13

Which TWO of the following are effective methods for bypassing AppLocker during a penetration test? (Choose two.)

Accepted Answer

Use InstallUtil.exe to run a malicious .exe. Option A is correct because regsvr32 can be used to execute code via DLL registration. Option D is correct because InstallUtil is a trusted Microsoft executable that can run arbitrary code. Option B is wrong because PowerShell execution policy is separate from AppLocker. Option C is wrong because WMIC is not typically allowed by AppLocker. Option E is wrong because Cscript is often blocked, but using trusted binaries is the key.

Answer

Execute code via WMIC

Answer

Use PowerShell with Bypass execution policy

Answer

Launch a script with cscript.exe

Question 14

A penetration tester is performing a port scan on a target network and receives no response to SYN packets sent to port 443. However, the service is known to be running. Which scanning technique should the tester use next to confirm the service?

Accepted Answer

TCP connect scan. Option B (TCP connect scan) is correct because when a SYN scan receives no response to port 443, it may indicate that a firewall or packet filter is dropping the SYN packets. A TCP connect scan completes the full three-way handshake (SYN, SYN-ACK, ACK), which can bypass some stateless firewall rules that only block initial SYN packets but allow established connections. This technique confirms the service by successfully establishing a connection, even if SYN packets are filtered.

Answer

SYN scan

Answer

UDP scan

Answer

Idle scan

Question 15

A tester needs to identify all open ports on a target system behind a firewall that is blocking ICMP and dropping unsolicited SYN packets. Which of the following scanning techniques is most likely to succeed?

Accepted Answer

TCP connect scan. A TCP connect scan (option B) completes the full three-way handshake, which is more likely to succeed against a firewall that drops unsolicited SYN packets because the firewall may allow outbound connections initiated from inside the network. Since the tester is behind the firewall, the SYN packet is sent as part of a legitimate connection attempt, and if the port is open, the target responds with SYN-ACK, completing the handshake. This technique bypasses the firewall's rule against unsolicited SYN packets because the connection appears to be initiated from the trusted side.

Answer

Ping sweep

Answer

FIN scan

Answer

UDP scan

PT0-002 Practice Test 26 — 15 Questions

Exhibit

PT0-002 Practice Test 26 — 15 Questions

Exhibit