PT0-002 Practice Test 3 — 10 Questions

Question 1

A penetration tester is using Nmap to perform host discovery on a target network 192.168.1.0/24. The tester wants to identify live hosts without scanning ports. Which Nmap command should be used?

Accepted Answer

nmap -sn 192.168.1.0/24. The `-sn` flag in Nmap performs a ping sweep (host discovery) without scanning any ports. It sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default to determine which hosts are alive on the 192.168.1.0/24 network, making it the ideal choice for identifying live hosts without port scanning.

Answer

nmap -A 192.168.1.0/24

Answer

nmap -sS 192.168.1.0/24

Answer

nmap -sV 192.168.1.0/24

Question 2

Which TWO of the following are components of the DREAD model for risk assessment? (Select TWO.)

Accepted Answer

Reproducibility. DREAD stands for Damage, Reproducibility, Exploitability, Affected users, Discoverability.

Answer

Likelihood

Answer

Severity

Answer

Impact

Question 3

A tester is performing a web application test and discovers a parameter that seems to reflect input in the response. The tester attempts a reflected XSS payload but the application filters script tags. Which XSS variant should the tester try next?

Accepted Answer

Reflected XSS with event handlers. If script tags are filtered, HTML event handlers like onerror can still execute JavaScript.

Answer

Blind XSS

Answer

DOM-based XSS

Answer

Stored XSS

Question 4

While analyzing a malicious document, a tester extracts a VBA macro. Which tool can help decode the macro for analysis?

Accepted Answer

oledump. Oledump extracts and analyzes OLE objects, including VBA macros. Option B is wrong because pdf-parser is for PDF analysis. Option C is wrong because Wireshark is for network traffic. Option D is wrong because Nmap is for network scanning.

Answer

pdf-parser

Answer

Nmap

Answer

Wireshark

Question 5

A penetration tester needs to communicate the financial impact of a critical vulnerability to the board of directors. Which metric is most appropriate for this audience?

Accepted Answer

Annualized loss expectancy (ALE).. The board of directors is concerned with financial risk and business impact, not technical severity. Annualized loss expectancy (ALE) quantifies the expected monetary loss per year from a vulnerability, making it directly relevant for executive decision-making. CVSS scores and risk ratings are technical metrics that do not translate to financial terms.

Answer

CVSS base score (e.g., 9.8 out of 10).

Answer

Risk rating (High, Medium, Low).

Answer

Number of affected systems.

Question 6

A penetration tester is writing the executive summary for the final report. The CEO needs to understand the overall risk level and the business impact of the findings. Which of the following should be included in the executive summary?

Accepted Answer

A high-level overview of the most critical vulnerabilities and their potential business impact.. The executive summary is intended for non-technical stakeholders like the CEO, who need to grasp the overall risk posture and business implications without technical jargon. Option A provides a high-level overview of critical vulnerabilities and their potential business impact, directly addressing the CEO's need to understand risk level and business impact, which aligns with the PT0-002 objective for effective reporting and communication.

Answer

Detailed exploit steps with screenshots.

Answer

A list of all CVSS scores without context.

Answer

The exact commands used during testing.

Question 7

A penetration tester is attempting to exploit a server-side request forgery (SSRF) vulnerability in a cloud-hosted web application to access the cloud metadata service. Which IP address should the tester target?

Accepted Answer

169.254.169.254. The cloud metadata service for most cloud providers (AWS, GCP, Azure) is accessible via 169.254.169.254.

Answer

192.168.1.1

Answer

127.0.0.1

Answer

10.0.0.1

Question 8

A penetration tester is preparing for a web application penetration test. The client application is hosted on a cloud platform that serves multiple tenants. Which THREE of the following are critical legal and scoping considerations?

Accepted Answer

Understand how the client's data privacy policies affect handling of any discovered data. Legal considerations include authorization from the cloud provider, handling sensitive data, and defining permissible testing methods.

Answer

Include a clause in the SOW that the tester is not liable for any data exposure

Answer

Test all tenant data to ensure comprehensive coverage

Question 9

Which of the following is the primary purpose of a get-out-of-jail letter?

Accepted Answer

To provide legal authorization for the tester to perform the test. A get-out-of-jail letter provides authorization and protects the tester from legal liability when performing authorized tests.

Answer

To outline the deliverables

Answer

To establish a communication plan

Answer

To define the rules of engagement

Question 10

A penetration tester gains a low-privilege shell on a Linux server. The command 'sudo -l' reveals that the user can run /usr/bin/less as root without a password. Which tool would the tester likely use to escalate privileges?

Accepted Answer

GTFOBins. GTFOBins documents that less can be used to escalate privileges via the ! command when run with sudo.

Answer

Metasploit

Answer

Hashcat

Answer

Chisel