PT0-002 Practice Test 28 — 15 Questions

Question 1

A tester is targeting a web application that makes server-side requests to internal resources based on user input. The tester attempts to access the AWS metadata endpoint at http://169.254.169.254/latest/meta-data/. The request returns sensitive cloud credentials. Which vulnerability is being exploited?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSRF. SSRF (Server-Side Request Forgery) allows the attacker to make the server send requests to internal resources. The metadata endpoint is a classic SSRF target. XXE can also access files but typically via entity injection, not direct URL.

Answer

IDOR

Answer

XXE

Answer

CSRF

Question 2

You have captured an NTLMv2 hash from a LLMNR poisoning attack using Responder. Which tool and mode would you use to attempt to crack the hash using a dictionary attack?

Accepted Answer

Hashcat -m 5600 -a 0. Hashcat mode 5600 is for NTLMv2 hashes; -a 0 is dictionary attack.

Answer

John the Ripper --format=LM --wordlist

Answer

Hashcat -m 1000 -a 0

Answer

John the Ripper --format=NT --wordlist

Question 3

Which type of penetration test provides the tester with full knowledge of the target environment, including network diagrams, source code, and administrative credentials?

Accepted Answer

White box. A white box penetration test gives the tester full knowledge of the target, including network diagrams, source code, and administrative credentials. This full-disclosure approach lets the tester focus on finding vulnerabilities efficiently rather than spending time on reconnaissance.

Answer

Grey box

Answer

Black box

Answer

Red team

Question 4

During a penetration test, a tester uses Responder to capture NTLM hashes from a Windows network. Which of the following protocols is MOST commonly targeted by Responder for poisoning?

Accepted Answer

LLMNR. Responder poisons LLMNR, NBT-NS, and mDNS to capture NTLM hashes. The other options are not primary targets.

Answer

DNS

Answer

ICMP

Answer

HTTP

Question 5

After compromising a Windows workstation, the tester wants to extract password hashes from the local SAM database. Which Metasploit meterpreter command should be used?

Accepted Answer

hashdump. hashdump dumps the SAM database hashes.

Answer

getsystem

Answer

getuid

Answer

shell

Question 6

A penetration tester is writing a Bash script to automate enumeration of a Linux system after gaining a shell. The script needs to extract user information from the /etc/passwd file. Which command would be most efficient for listing only the usernames?

Accepted Answer

cat /etc/passwd | cut -d: -f1. The `cut` command with `-d: -f1` splits each line of /etc/passwd on the colon delimiter and extracts the first field, which is the username. This is the most efficient and purpose-built approach for parsing colon-delimited files in Linux, avoiding unnecessary overhead from other tools.

Answer

cat /etc/passwd | awk '{print $1}'

Answer

cat /etc/passwd | head

Answer

grep 'user' /etc/passwd

Question 7

A penetration tester needs to identify live hosts and open ports on a target network. Which tool is most appropriate for this task?

Accepted Answer

Nmap. Nmap is the standard tool for network discovery and port scanning.

Answer

Burp Suite

Answer

Metasploit

Answer

Wireshark

Question 8

A penetration tester has gained initial access to a Linux server and wants to establish persistence. Which THREE of the following methods are commonly used for persistence on Linux systems?

Accepted Answer

Installing an SSH authorized_key for the attacker. Cron jobs, SSH authorized_keys, and systemd services are common persistence mechanisms.

Answer

Using schtasks to create a scheduled task

Answer

Modifying the Windows Registry Run key

Question 9

A company is planning a social engineering engagement. Which TWO items should be included in the pre-engagement documentation?

Accepted Answer

Emergency contact list. Pre-engagement documentation should include the rules of engagement (RoE) and emergency contacts to handle incidents during social engineering.

Answer

List of all employee passwords

Answer

Network topology diagrams

Answer

Source code of all applications

Question 10

A penetration tester is testing a web application and wants to exploit an XXE vulnerability to read sensitive files. Which TWO payloads could be used?

Accepted Answer

]>. XXE can be used to read files via file:// or to perform SSRF to internal resources via http://, including cloud metadata.

Answer

Answer

'; DROP TABLE users; --

Answer

../../etc/passwd

Question 11

A penetration tester has exploited a web application and found that the server has an outbound firewall that restricts all outbound traffic except for DNS queries (UDP 53). The tester has a reverse shell payload that connects back on TCP 443. Which technique can the tester use to exfiltrate data or establish a channel?

Accepted Answer

Use dnscat2 or other DNS tunneling tool. DNS tunneling tools like dnscat2 encode data within DNS queries and responses, allowing the tester to bypass outbound firewall restrictions that only permit UDP 53 traffic. Since the reverse shell payload uses TCP 443, which is blocked, DNS tunneling provides an alternative covert channel that encapsulates the communication within legitimate DNS lookups, effectively exfiltrating data or establishing a command-and-control channel over the allowed protocol.

Answer

Use netcat to send data over TCP 53

Answer

Use an SSH tunnel over UDP 53

Answer

Use a bind shell listening on TCP 443 internally

Question 12

A penetration tester is analyzing a Python script that performs a buffer overflow attack. The script imports the struct module and the socket module. It constructs a payload by packing a pattern of characters, then overwriting a return address with a specific offset. Which of the following is the most critical piece of information the tester must determine before running this script against the target?

Accepted Answer

The exact location of a JMP ESP instruction in memory. The script performs a buffer overflow attack by overwriting a return address. To redirect execution to attacker-controlled shellcode, the tester must overwrite the return address with the address of a JMP ESP instruction (or equivalent) that is reliably located in memory. Without this address, the overwritten return pointer will cause a crash or unpredictable behavior, making exploitation impossible.

Answer

The IP address and port of the target service

Answer

The version of the operating system running on the target

Answer

The username and password for the target service

Question 13

A client is planning a penetration test of their AWS cloud environment. They will provide the tester with an IAM user account with limited permissions. Which of the following scoping restrictions is most important to include in the rules of engagement to avoid unexpected costs?

Accepted Answer

The tester must not create any new AWS resources that incur costs.. Creating new AWS resources (e.g., EC2 instances, RDS databases, Lambda functions) can incur direct costs under the tester's IAM user account, even with limited permissions. The rules of engagement must explicitly prohibit resource creation to prevent unexpected billing, as AWS charges for resources provisioned regardless of the test's purpose. This scoping restriction aligns with the principle of cost containment in penetration testing engagements.

Answer

The tester must use only premium AWS services for testing.

Answer

The tester must request permission from AWS Support before each test.

Answer

The tester must avoid testing in the us-east-1 region due to higher costs.

Question 14

A penetration tester is analyzing a PowerShell script that uses Invoke-WebRequest and Invoke-RestMethod to interact with a target web service. The script parses JSON responses to extract session tokens and then uses those tokens in subsequent requests. Which attack technique is this script most likely performing?

Accepted Answer

Exploiting an API by manipulating request parameters and observing responses.. The script uses Invoke-WebRequest and Invoke-RestMethod to interact with a web service, parsing JSON responses to extract session tokens and reusing them in subsequent requests. This pattern is characteristic of API manipulation, where an attacker modifies request parameters (e.g., headers, query strings, or payload) and observes how the API responds to infer vulnerabilities or escalate privileges, rather than directly attacking authentication or injecting SQL.

Answer

Brute-forcing web application login credentials.

Answer

Performing a SQL injection attack on a web form.

Answer

Conducting a directory traversal attack to read arbitrary files.

Question 15

A penetration tester is using theHarvester tool to gather information about a target domain. The tester wants to collect email addresses and subdomains from public search engines and PGP key servers. Which source is theHarvester commonly configured to use for this passive reconnaissance?

Accepted Answer

Google and Bing search engines. TheHarvester is specifically designed to perform passive reconnaissance by querying public search engines (like Google and Bing) and PGP key servers to collect email addresses, subdomains, and other open-source intelligence (OSINT). It does not initiate direct connections to the target's infrastructure, making it a passive tool. The default configuration often includes Google and Bing as primary sources for this data.

Answer

Direct DNS zone transfer

Answer

Shodan

Answer

Baidu