PT0-002 Practice Test 29 — 15 Questions

Question 1

A penetration tester is conducting an external network assessment for a client. During the reconnaissance phase, the tester identifies an IP address range that is not listed in the rules of engagement (ROE). The client had initially provided a list of authorized target IPs. What should the tester do next?

Accepted Answer

Stop testing and notify the client to update the ROE.. Testing outside the defined scope is unauthorized and could breach contract or legal boundaries. The correct course is to pause and seek clarification, updating the ROE before proceeding.

Answer

Include the new IPs in the test scope and proceed.

Answer

Perform a quick scan of the new IPs to gather more information.

Answer

Ignore the new IPs and only test the provided range.

Question 2

A penetration tester is scoping a test for a client that uses a hybrid identity system. The client wants to ensure that the test does not affect production authentication. Which TWO actions should the tester recommend?

Accepted Answer

Test using non-production accounts. Using non-production accounts and a separate test domain isolate the test from production identity systems. Password spraying against all users could disrupt accounts, and disabling MFA may weaken security. Off-peak scheduling reduces impact but does not prevent direct interaction with production systems.

Answer

Conduct testing during off-peak hours

Answer

Perform password spraying against all users

Answer

Disable MFA for test accounts

Question 3

A client has limited budget for a penetration test covering critical assets. Which scoping decision best balances coverage and cost?

Accepted Answer

Perform full-scope test of a representative subset. Option C is correct because testing a representative subset of critical systems is efficient. Option A is wrong because it only tests perimeter. Option B is wrong because it is too limited. Option D is wrong because it is not comprehensive.

Answer

Test only the external perimeter

Answer

Focus on physical security assessments

Answer

Conduct only automated scans

Question 4

A client requests a penetration test for a new e-commerce application. The application uses a microservices architecture with RESTful APIs and a React frontend. The tester recommends including both a vulnerability assessment and manual penetration testing. However, the client has a tight budget and asks to skip the vulnerability assessment to save costs. Which response best aligns with best practices?

Accepted Answer

Conduct a vulnerability assessment first and then manually validate findings.. Best practices recommend a vulnerability assessment to identify potential weaknesses, followed by manual validation to reduce false positives and exploit critical issues. Skipping the assessment may leave critical vulnerabilities undetected.

Answer

Perform only a vulnerability assessment because it covers more vulnerabilities.

Answer

Use automated scanning tools during the manual penetration test to compensate.

Answer

Agree to skip the vulnerability assessment and focus only on manual penetration testing.

Question 5

Based on the exhibit, which host or network can SSH to 10.0.1.10?

Accepted Answer

None. The first rule drops all traffic from any source to the 10.0.1.0/24 network. Since 10.0.1.10 falls within that subnet, all traffic to it is dropped before subsequent rules are evaluated, including the SSH allow rule. Therefore, no host can SSH to 10.0.1.10.

Answer

192.168.1.0/24

Answer

10.0.1.0/24

Answer

0.0.0.0/0

Question 6

A wireless network test must not disrupt the network. How can the tester crack WPA2 passwords without disruption?

Accepted Answer

Use passive sniffing to capture traffic and crack offline. Option D is correct because passive sniffing captures the handshake without sending packets. Option A is wrong because deauth is active. Option B is wrong because brute-force is active. Option C is wrong because it doesn't test password strength.

Answer

Scan for rogue access points

Answer

Perform a deauthentication attack

Answer

Attempt a brute-force attack against the Wi-Fi password

Question 7

During the scoping phase of a penetration test, the tester and client must define the rules of engagement (ROE). Which THREE of the following should be included in the ROE? (Select THREE.)

Accepted Answer

Contact information for the client to report issues during the test.. The ROE should cover attack types, communication protocols, and scope boundaries. Specific vulnerabilities are unknown beforehand, and remediation is part of the post-test phase.

Answer

Specific vulnerabilities that will be exploited.

Answer

Post-test remediation steps.

Question 8

Refer to the exhibit. During scoping, what risk does this policy pose?

Accepted Answer

Public read access to all objects. The policy allows any principal (Principal: *) to perform the GetObject action on all objects in the company-data bucket, meaning public read access. Unauthorized deletion is not allowed (only GetObject). SSL configuration and encryption are not addressed in this policy.

Answer

Insecure SSL configuration

Answer

Lack of encryption

Answer

Unauthorized deletion of objects

Question 9

A 'no-fail' clause prohibits service outages. How should the tester address high-risk tests like SQL injection?

Accepted Answer

Require a staging environment for testing. Option B is correct because testing in a staging environment prevents real outages. Option A is wrong because it removes important tests. Option C is wrong because it does not prevent outages. Option D is wrong because it is irresponsible.

Answer

Remove all high-risk tests from the scope

Answer

Include a clause that the tester is not liable

Answer

Proceed with testing and hope no outages occur

Question 10

Refer to the exhibit. A penetration tester is scoping a test and needs to reach a host at 10.0.1.50. Through which interface will traffic be routed?

Accepted Answer

eth2. The most specific route matches the destination. 10.0.1.50 falls within the 10.0.1.0/24 network (Genmask 255.255.255.0), which is routed via eth2. The default route via eth0 and the broader 10.0.0.0/8 route via eth1 are less specific.

Answer

The route is ambiguous

Answer

eth0

Answer

eth1

Question 11

A tester is planning a physical security assessment. Which TWO should be included in the scope? (Choose two.)

Accepted Answer

Testing the ability to tailgate through secured entrances. Options A and C are correct because tailgating and dumpster diving are common physical assessment tests. Option B is too specialized and may need specific approval. Options D and E are network-based, not physical.

Answer

Running vulnerability scans on internal servers

Answer

Performing a man-in-the-middle attack on the Wi-Fi

Answer

Attempting to bypass biometric locks using fake fingerprints

Question 12

A company needs to test the security of its web application without causing any service disruption. Which testing methodology is most appropriate to include in the scope?

Accepted Answer

White-box code review and static analysis. Option A is correct because white-box code review and static analysis do not interact with the live environment, minimizing disruption. Option B is wrong because black-box testing may involve active scanning that could cause performance issues. Option C is wrong because gray-box testing still involves active testing. Option D is wrong because high-intensity scanning can cause denial of service.

Answer

Automated vulnerability scanning with a high intensity profile

Answer

Black-box penetration testing against the production environment

Answer

Gray-box penetration testing with a read-only account

Question 13

A web application test must cover OWASP Top 10. Which THREE should be explicitly included? (Choose three.)

Accepted Answer

SQL injection testing. Options A, B, and D are correct because XSS, SQL injection, and broken authentication are consistently in the OWASP Top 10. Option C is not typically a web vulnerability. Option E is sometimes considered but not always as a separate category.

Answer

Directory traversal testing

Answer

Buffer overflow testing

Question 14

During scoping, a client asks the tester to avoid a specific IP range containing legacy systems. The tester discovers these systems are vulnerable but out of scope. What should the tester do?

Accepted Answer

Notify the client and request a scope change. Option C is correct because the tester should notify the client and request a scope change before testing out-of-scope systems. Option A is wrong because it violates the agreed scope. Option B is wrong because ignoring a critical vulnerability is not best practice. Option D is wrong because passive monitoring may still be considered testing.

Answer

Passively monitor traffic without active exploitation

Answer

Ignore the legacy systems and continue as agreed

Answer

Exploit the legacy systems and include them in the report

Question 15

An internal test prohibits buffer overflow exploits. Which TWO techniques are appropriate to test privilege escalation without violating the rule? (Choose two.)

Accepted Answer

Abuse misconfigured service permissions to run as SYSTEM. Options C and E are correct because pass-the-hash and abusing service permissions do not involve memory corruption. Option A may use exploits, option B is a buffer overflow, option D is a heap overflow.

Answer

Use a kernel exploit that involves a heap overflow

Answer

Exploit EternalBlue (MS17-010)

Answer

Use Metasploit's meterpreter to run getsystem