PT0-002 Practice Test 30 — 15 Questions

Question 1

A client requires a penetration test of their web application that uses Single Sign-On (SSO) with a third-party identity provider. The client is concerned that testing could lock out real user accounts and disrupt operations. Which of the following should be included in the rules of engagement to address this concern?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Provide test accounts that are excluded from lockout policies. Providing test accounts that are excluded from lockout policies allows the penetration tester to thoroughly assess the SSO authentication mechanism—including the SAML or OIDC flows—without risking the lockout of real user accounts. This directly addresses the client's operational concern while still enabling comprehensive testing of the identity provider integration.

Answer

Prohibit all testing of the authentication mechanism

Answer

Only perform testing during business hours

Answer

Require the tester to use only passive reconnaissance techniques

Question 2

During a penetration test, a tester finds a custom binary that is vulnerable to a stack-based buffer overflow. The binary has DEP enabled but no ASLR. Which of the following exploitation techniques would be MOST effective to achieve code execution?

Accepted Answer

ret2libc to call system() with a controlled argument. Ret2libc allows the tester to call the system() function from libc with a controlled argument (e.g., "/bin/sh") to spawn a shell, bypassing DEP (which prevents code execution on the stack) without needing to execute shellcode. Since ASLR is disabled, the address of system() and the string "/bin/sh" in libc are predictable, making this technique reliable and effective.

Answer

Return-oriented programming (ROP) to bypass DEP

Answer

Heap spraying to inject shellcode

Answer

Stack pivoting to redirect execution to a known location

Question 3

A penetration tester wants to identify the web server software and version used by a target organization without sending any packets to the target's infrastructure. Which of the following techniques is most effective for this purpose?

Accepted Answer

Use Shodan to search for the target's IP address or domain and review the gathered banners.. Shodan is a search engine that continuously scans the internet and stores service banners from various ports. By querying the target's IP address or domain, the penetration tester can retrieve previously collected HTTP headers and other service banners without sending any packets to the target, thus achieving passive reconnaissance.

Answer

Perform a DNS zone transfer to obtain internal server information.

Answer

Use netcat to connect to port 80 and read the HTTP banner.

Answer

Use nmap -sV with a delayed scan to avoid detection.

Question 4

A penetration tester is analyzing a Python script that uses the 'requests' library. The script sends a GET request to a target URL with a crafted parameter value containing a SQL sleep function, then measures the response time. What attack is the script most likely performing?

Accepted Answer

Blind time-based SQL injection.. The script sends a crafted parameter containing a SQL sleep function (e.g., `' OR SLEEP(5)--`) and measures the response time. If the database executes the sleep, the response is delayed, confirming a SQL injection vulnerability without relying on visible output. This is the hallmark of a blind time-based SQL injection attack using the `requests` library to time the HTTP response.

Answer

Cross-site scripting (XSS) attack.

Answer

Command injection attack.

Answer

Error-based SQL injection.

Question 5

A penetration tester is conducting a web application assessment and discovers that the target uses WordPress. The tester wants to identify installed plugins, themes, and potential vulnerabilities. Which of the following tools is best suited for this task?

Accepted Answer

WPScan. WPScan is a dedicated WordPress security scanner that enumerates installed plugins, themes, and known vulnerabilities by querying the WordPress API and fingerprinting version-specific files. It is purpose-built for WordPress assessments, making it the best choice for this task.

Answer

OpenVAS

Answer

Nikto

Answer

Gobuster

Question 6

A penetration tester is analyzing the results of a vulnerability scan against a web application. The scanner reports a potential SQL injection vulnerability in a login form parameter. However, manual testing with the same payload does not produce any error messages or changes in behavior. Which of the following is the most likely reason for the false positive?

Accepted Answer

The web application is using a parameterized query that sanitizes input. The use of parameterized queries (prepared statements) separates SQL logic from user input, preventing SQL injection even if the input contains malicious payloads. The scanner's payload triggered a false positive because the application's database layer safely handles the input, so no error or behavioral change occurs during manual testing.

Answer

The scanner used a payload that was not URL-encoded

Answer

The scanning engine is outdated and does not support the latest SQL syntax

Answer

The login form is protected by a CAPTCHA that blocks automated scanning

Question 7

A penetration tester has gained access to a Windows workstation and extracted NTLM password hashes. The tester wants to move laterally to a server that authenticates using NTLM. The tester does not have the plaintext passwords. Which technique is MOST appropriate to authenticate to the server using the captured hashes?

Accepted Answer

Pass-the-hash. Pass-the-hash (PtH) is the correct technique because it allows the tester to authenticate to the remote server using the captured NTLM hash directly, without needing the plaintext password. NTLM authentication uses a challenge-response protocol where the hash itself is the secret; by presenting the hash in the response, the tester can impersonate the user. This is a well-known lateral movement technique in Windows environments, often executed with tools like Mimikatz (sekurlsa::pth) or Impacket's wmiexec.py.

Answer

Brute force

Answer

Rainbow tables

Answer

Keylogging

Question 8

While performing vulnerability scanning with Nessus, a penetration tester notices that several high-severity vulnerabilities are reported for a web server, but manual verification shows the server is not vulnerable. What is the MOST likely cause of this discrepancy?

Accepted Answer

The scanner is reporting false positives due to inaccurate version detection. Nessus performs version-based detection by analyzing server banners and HTTP response headers. If the web server's software version string is outdated or misconfigured, the scanner may flag vulnerabilities that do not actually exist in the patched or custom-compiled version. This is a classic false positive scenario where the scanner relies on version matching rather than actual exploit verification.

Answer

The scanner used unauthenticated scans, missing the actual vulnerabilities

Answer

The scanner configuration excluded necessary plugins for accurate testing

Answer

The target server is behind a load balancer that modifies responses

Question 9

A client is planning a penetration test of their internal network but refuses to provide network diagrams or access to a staging environment. The tester is concerned about causing a denial of service (DoS) on critical systems. Which clause should be included in the rules of engagement to mitigate this risk?

Accepted Answer

A rate-limiting clause that restricts scan speed and concurrent connections.. A rate-limiting clause directly addresses the risk of causing a denial of service (DoS) by controlling the speed and concurrency of the penetration test. By restricting scan rates (e.g., using tools like Nmap with `--max-rate` or `--min-hostgroup`) and limiting concurrent connections, the tester can prevent overwhelming critical systems, even without network diagrams or a staging environment. This clause mitigates the risk without requiring the client to provide additional information or shifting liability.

Answer

A clause requiring the client to provide a complete list of in-scope IP addresses.

Answer

A waiver stating that any service disruption is the client's responsibility.

Answer

An exclusion list for systems that should not be tested.

Question 10

During pre-engagement, a client insists that the penetration testers sign a non-disclosure agreement (NDA). However, the client refuses to provide a 'get-out-of-jail' letter. What risk does this pose to the penetration testers?

Accepted Answer

Potential legal liability if the client or third parties perceive the testing as malicious. Without a 'get-out-of-jail' letter (also known as a authorization letter or testing waiver), the penetration testers have no documented legal authorization to perform the agreed-upon attacks. If the client or a third party (e.g., an ISP, law enforcement, or a security monitoring service) detects the test traffic and interprets it as malicious, the testers could face criminal charges or civil lawsuits for unauthorized access, even if the NDA is in place. The NDA only protects confidentiality, not the legality of the actions.

Answer

Increased risk of data breach

Answer

Higher likelihood of false positives

Answer

Inability to use certain tools

Question 11

A penetration tester has compromised a Linux server and gained a low-privilege shell. The tester discovers that the /etc/shadow file is readable by the tester's user. Which attack is most directly enabled by this finding?

Accepted Answer

Password cracking offline. The /etc/shadow file contains the hashed passwords for all users on the system. If a low-privilege user can read this file, they can copy the password hashes and attempt to crack them offline using tools like John the Ripper or Hashcat. This directly enables an offline password cracking attack, as the tester can brute-force or use dictionary attacks against the hashes without needing to interact with the live system.

Answer

Pass-the-hash

Answer

LLMNR poisoning

Answer

Kerberoasting

Question 12

A penetration tester wants to identify all publicly accessible Amazon S3 buckets that belong to a specific organization. Which technique is most effective for passive reconnaissance?

Accepted Answer

Use Google dorks to search for bucket names and URLs.. Google dorks (e.g., site:s3.amazonaws.com "companyname") allow a penetration tester to passively discover publicly accessible S3 bucket names and URLs indexed by search engines without sending any traffic to the target organization. This technique leverages existing search engine caches, making it purely passive and highly effective for identifying misconfigured buckets that have been crawled.

Answer

Send DNS queries for common bucket name prefixes.

Answer

Use nmap to scan all AWS IP ranges for open ports.

Answer

Perform a DNS zone transfer on the target organization's domain.

Question 13

A penetration tester is analyzing the output of a Nessus vulnerability scan and notices a critical vulnerability reported against a web server that is actually a false positive due to outdated plugin data. What is the best course of action for the tester?

Accepted Answer

Manually verify the vulnerability by testing it. A false positive due to outdated plugin data must be manually verified before any action is taken. The tester should use a tool like `curl` or a browser to send the exact request that Nessus simulated (e.g., an HTTP GET to a specific endpoint) and inspect the response headers or body to confirm whether the vulnerability actually exists. Only after manual validation can the tester decide to include, exclude, or note the finding in the report.

Answer

Accept the finding as accurate and include it in the report

Answer

Remove the finding from the report entirely

Answer

Ignore the finding because it's a false positive

Question 14

A penetration tester is exploiting a Linux system that has ASLR enabled but no stack canaries. The vulnerability is a classic stack-based buffer overflow. Which of the following is the most effective method to achieve code execution?

Accepted Answer

Return to the PLT entry for system(). With ASLR enabled, direct shellcode injection fails due to randomized stack addresses, but the PLT entry for system() has a fixed, known address in the binary. Since there are no stack canaries, a simple buffer overflow can overwrite the return address to jump directly to system() in the PLT, passing a pointer to a command string (e.g., "/bin/sh") already in memory, achieving code execution without needing to know runtime addresses.

Answer

Prepend a NOP sled and inject shellcode into the buffer

Answer

Return-to-libc (ret2libc)

Answer

Use a ROP chain to bypass ASLR and execute shellcode

Question 15

A penetration tester has obtained a TGT from a domain controller by cracking the krbtgt hash. Which attack can the tester now perform to gain persistent administrative access to any resource in the domain?

Accepted Answer

Golden Ticket. A Golden Ticket attack is the correct answer because the tester has cracked the krbtgt hash, which is the key used by the Key Distribution Center (KDC) to sign all Ticket Granting Tickets (TGTs). With this hash, the tester can forge a TGT for any user (including a domain admin) with an arbitrary long validity period, granting persistent administrative access to any resource in the domain without needing to interact with the domain controller again.

Answer

Pass-the-Hash

Answer

Silver Ticket

Answer

DCSync