PT0-002 Practice Test 27 — 15 Questions

Question 1

During a web application penetration test, the tester wants to discover hidden directories and files on the target web server. Which tool is best suited for this task, and what technique does it use?

Accepted Answer

Gobuster - directory brute forcing. Directory enumeration tools like gobuster, dirbuster, and dirsearch use wordlist-based brute force to discover hidden directories and files. Gobuster is a common choice. Wappalyzer is for technology fingerprinting, whatweb is for web server identification, and curl is for HTTP requests but lacks directory brute force functionality.

Answer

Curl - manual HTTP requests

Answer

Whatweb - web server identification

Answer

Wappalyzer - technology fingerprinting

Question 2

During a pre-engagement meeting, the client states that no testing is allowed on the wireless network or on any cloud-based services hosted by third parties. Which part of the engagement documentation would specify these restrictions?

Accepted Answer

Rules of engagement (RoE). The rules of engagement (RoE) define the scope, including what is allowed and not allowed, such as restrictions on wireless and cloud services.

Answer

Get-out-of-jail letter

Answer

Statement of work (SOW)

Answer

Non-disclosure agreement (NDA)

Question 3

During a reverse engineering task on a .NET binary, which tool would allow you to decompile the code into readable C# source code?

Accepted Answer

dnSpy. dnSpy is a .NET decompiler that can produce high-level source code from .NET assemblies.

Answer

IDA Pro Free

Answer

Ghidra

Answer

jadx

Question 4

A tester needs to brute-force SSH credentials on a target. Which tool is most appropriate for this task?

Accepted Answer

Hydra. Hydra is a versatile online brute-force tool supporting many protocols including SSH.

Answer

Aircrack-ng

Answer

Hashcat

Answer

John the Ripper

Question 5

During a web application test, the tester uses sqlmap and identifies a time-based blind SQL injection. Which technique is sqlmap using to extract data?

Accepted Answer

Time-based blind SQL injection. Time-based blind SQL injection uses conditional delays to infer the truth of queries based on response time.

Answer

Error-based SQL injection

Answer

Boolean-based blind SQL injection

Answer

UNION-based SQL injection

Question 6

You are performing a vulnerability scan on a web application and notice that the scanner reports a high-severity SQL injection vulnerability. However, manual testing confirms that the input is properly sanitized. Which term best describes this situation?

Accepted Answer

False positive. A false positive occurs when a scanner incorrectly identifies a vulnerability that does not exist. This is common in automated vulnerability scanning and requires manual verification.

Answer

False negative

Answer

True positive

Answer

Inconclusive

Question 7

During a penetration test, a client asks the tester to clarify the scope of the test. Which of the following is the best approach for the tester?

Accepted Answer

Clarify with the client via email or documented communication.. Clarifying scope questions helps ensure the test stays within agreed boundaries and avoids misunderstandings.

Answer

Make a decision based on previous tests.

Answer

Include the scope in the report after testing.

Answer

Ignore the question and continue testing.

Question 8

A penetration tester needs to perform Kerberoasting against an Active Directory domain. Which step is required after requesting TGS tickets?

Accepted Answer

Crack the TGS hashes offline. After requesting TGS tickets for service accounts, the tester must crack the hashes offline using a tool like Hashcat.

Answer

Perform SMB relay

Answer

Request TGT ticket

Answer

Extract NTLM hashes from LSASS

Question 9

During a penetration test, a tester discovers evidence of an ongoing data exfiltration attack by an unknown third party. Which of the following should the tester do first?

Accepted Answer

Immediately notify the client point of contact. Evidence of criminal activity should be reported immediately to the client, who can then involve law enforcement if needed. The tester should not interfere directly.

Answer

Contact law enforcement directly

Answer

Document the evidence and include it in the final report

Answer

Attempt to block the exfiltration to protect the client

Question 10

A penetration tester is documenting evidence for a finding. Which of the following is the least appropriate type of evidence to include?

Accepted Answer

Proof-of-concept code that deletes user data to prove impact. Proof-of-concept code should demonstrate exploitability without causing harm. Including a fully functional exploit that could cause harm is irresponsible.

Answer

Screenshot of the vulnerability with timestamp

Answer

Network capture showing the exploit traffic

Answer

Output from the vulnerability scanner

Question 11

You are performing a penetration test and capture a Kerberos TGS ticket for a service account. What kind of attack can you perform offline to crack the service account password?

Accepted Answer

Kerberoasting. Kerberoasting involves requesting TGS tickets and cracking them offline to recover service account passwords.

Answer

AS-REP roasting

Answer

LLMNR poisoning

Answer

Pass-the-Ticket

Question 12

A penetration tester is presenting findings to a mixed audience of executives and technical staff. For the executives, the tester should focus on:

Accepted Answer

Risk ratings, business impact, and high-level remediation strategy. Executives are interested in business risk, impact, and strategic recommendations, not technical details.

Answer

Raw tool output and log files

Answer

Detailed exploit code and proof-of-concept

Answer

Step-by-step remediation commands

Question 13

A tester needs to perform an online brute-force attack against an SSH service. Which tool is most suitable?

Accepted Answer

Hydra. Hydra is a fast online brute-force tool that supports many protocols including SSH.

Answer

Hashcat

Answer

John the Ripper

Answer

Aircrack-ng

Question 14

A penetration tester is using OpenVAS to perform an authenticated vulnerability scan of a Linux server. The tester has provided valid SSH credentials. Which of the following is a primary benefit of performing an authenticated scan over an unauthenticated scan?

Accepted Answer

Ability to detect vulnerabilities that require local access. Authenticated scans have deeper access to the system, allowing the scanner to check configuration files, patch levels, and local vulnerabilities that are not visible externally.

Answer

Reduced network bandwidth usage

Answer

Faster scan completion time

Answer

Elimination of all false positives

Question 15

A penetration tester is preparing to perform an authenticated vulnerability scan of a network. Which THREE of the following are important considerations before starting the scan? (Select THREE.)

Accepted Answer

Configuring the scanner to use the appropriate credentials. Authenticated scans require valid credentials to log into systems for deeper assessment. It's important to understand the risk of service disruption, ensure credentials have appropriate privileges, and obtain written authorization to avoid legal issues.

Answer

Using default community strings for SNMP

Answer

Selecting a random scan time to avoid detection