PT0-002 Practice Test 26 — 15 Questions

Question 1

During a penetration test, the tester wants to capture network traffic for later analysis. Which tool is most appropriate for capturing packets and saving them to a pcap file?

Accepted Answer

Wireshark. Wireshark is a network protocol analyzer capable of capturing live traffic and saving it to pcap files.

Answer

Metasploit

Answer

Burp Suite

Answer

Nmap

Question 2

After completing a penetration test, the client's technical team requests the detailed raw data (e.g., scan results, exploit logs, packet captures) used to support the findings. According to best practices, which of the following should the penetration tester do?

Accepted Answer

Provide the raw data in a separate, sanitized deliverable with a data handling agreement. Raw data such as scan results, exploit logs, and packet captures often contain sensitive information like IP addresses, credentials, or system details. Best practices (e.g., PTES, NIST SP 800-115) dictate that raw data should be provided in a separate, sanitized deliverable accompanied by a data handling agreement to ensure confidentiality and proper data governance, rather than embedding it directly in the final report.

Answer

Include all raw data in the appendices of the final report

Answer

Refuse to provide raw data to protect the confidentiality of the testing process

Answer

Provide the raw data only if the client signs a non-disclosure agreement

Question 3

A penetration tester is writing the executive summary of a report. Which of the following best describes the appropriate language and content for this section?

Accepted Answer

Business language, overall risk rating, key findings, and strategic recommendations.. The executive summary is for non-technical stakeholders, so it should use business language and focus on overall risk, key findings, and strategic recommendations.

Answer

Detailed technical descriptions of each vulnerability with CVSS scores.

Answer

A list of all tools used during the penetration test.

Answer

Step-by-step exploitation procedures for each finding.

Question 4

A client requests that the penetration test report include raw output from the scanning tools used. Where should this output be placed in the report?

Accepted Answer

In the appendices.. Raw tool output is typically included in appendices to avoid cluttering the main findings.

Answer

As a separate deliverable not included in the report.

Answer

In the executive summary.

Answer

In the technical findings section, alongside each vulnerability.

Question 5

A penetration tester wants to perform a pass-the-hash attack against a Windows target. Which tools can be used to authenticate using an NTLM hash without knowing the plaintext password? (Choose the best option.)

Accepted Answer

CrackMapExec. CrackMapExec is a popular tool for pass-the-hash attacks across many Windows services.

Answer

Nmap

Answer

Responder

Answer

Wireshark

Question 6

A tester is exploiting a Linux system and finds a binary with the SUID bit set owned by root. The binary executes other commands. Which technique would allow privilege escalation to root?

Accepted Answer

PATH manipulation. If a SUID binary executes commands (e.g., via system() or exec()), it may be exploited to run arbitrary commands as root, especially if the path is not absolute.

Answer

DLL hijacking

Answer

Kernel exploit

Answer

Token impersonation

Question 7

A tester is analyzing a piece of malware and needs to identify the original entry point after unpacking. Which technique is most appropriate?

Accepted Answer

Original Entry Point (OEP) finding. Finding the Original Entry Point (OEP) is a standard step after unpacking to resume analysis. Option B is wrong because hash analysis identifies known malware. Option C is wrong because import hash matching identifies library versions. Option D is wrong because code signing verification checks authenticity.

Answer

Hash analysis

Answer

Import hash matching

Answer

Code signing verification

Question 8

A penetration tester needs to perform a dictionary attack against an SSH service. Which of the following tools is best suited for this task?

Accepted Answer

Hydra. Hydra is a versatile online brute-force tool that supports many protocols, including SSH.

Answer

CrackMapExec

Answer

John the Ripper

Answer

Hashcat

Question 9

While performing a web application penetration test, a tester observes that the application reflects user input in the page without proper sanitization. To steal session cookies, the tester crafts a payload like . Which XSS type is this?

Accepted Answer

Reflected XSS. Reflected XSS occurs when the injected script is reflected off the web server immediately.

Answer

Stored XSS

Answer

DOM-based XSS

Answer

SQL injection

Question 10

A penetration tester is conducting active reconnaissance on a target network and wants to perform a SYN scan to identify open ports without completing the full TCP handshake. Which Nmap flag should the tester use?

Accepted Answer

-sS. The -sS flag specifies a SYN scan, which is stealthy and does not complete the three-way handshake.

Answer

-sA

Answer

-sU

Answer

-sT

Question 11

During a web application test, a tester discovers a JWT token with the following header: {'alg':'HS256','typ':'JWT'}. The token payload contains 'admin':false. The tester attempts to change the algorithm to 'none' and removes the signature. Which vulnerability is being exploited?

Accepted Answer

JWT algorithm confusion (alg:none). JWT alg:none attack exploits servers that accept unsigned tokens. Other options are different attack types.

Answer

JWT brute-force

Answer

JWT kid injection

Answer

JWT injection

Question 12

During a web application test, the tester discovers a parameter that reflects user input in the response without sanitization. Which type of vulnerability is most likely present?

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately reflected in the response without proper encoding or sanitization.

Answer

DOM-based XSS

Answer

Stored XSS

Answer

SQL injection

Question 13

A penetration tester is evaluating vulnerabilities using the DREAD model. For a specific vulnerability, the tester assigns the following scores: Damage=8, Reproducibility=7, Exploitability=9, Affected users=6, Discoverability=5. Which of the following is the overall DREAD risk rating?

Accepted Answer

7. DREAD scores are averaged across the five categories. Compute (8+7+9+6+5)/5 = 35/5 = 7.

Answer

9

Answer

8

Answer

6

Question 14

Which section of a penetration testing report should include screenshots, affected systems, and remediation steps?

Accepted Answer

Technical findings. The technical findings section is where the penetration tester documents each discovered vulnerability with supporting evidence — screenshots, affected hostnames/IPs, reproduction steps, and specific remediation guidance. This is the actionable core of the report that the client's engineers use to fix issues.

Answer

Scope and methodology

Answer

Appendices

Answer

Executive summary

Question 15

A penetration tester has gained a low-privilege shell on a Windows server and discovered that the SeImpersonatePrivilege is enabled. Which of the following tools would be most appropriate to escalate privileges to SYSTEM-level access?

Accepted Answer

PrintSpoofer. SeImpersonatePrivilege allows token impersonation. Tools like PrintSpoofer exploit this to gain SYSTEM privileges. Potato attacks (JuicyPotato) also work, but PrintSpoofer is more modern and reliable.

Answer

pth-winexe

Answer

Responder

Answer

CrackMapExec