PT0-002 Practice Test 2 — 30 Questions

Question 1

A penetration tester gains access to a web application that uses a MongoDB backend. The tester discovers that the search functionality directly interpolates user input into a NoSQL query without sanitization. Which technique should the tester use to extract data from the database?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NoSQL injection. The application uses MongoDB, a NoSQL database, and the search functionality directly interpolates user input into a NoSQL query without sanitization. This allows the tester to inject MongoDB operators (e.g., $ne, $regex, $gt) to manipulate the query logic and extract data, which is the core of NoSQL injection. Unlike SQL injection, this technique targets MongoDB's query syntax, such as JSON-based operators, to bypass authentication or retrieve records.

Answer

SQL injection

Answer

LDAP injection

Answer

Command injection

Question 2

During code review, a penetration tester identifies the following line in a PHP web application: $sql = "SELECT * FROM users WHERE username='" . $_GET['user'] . "'"; Which type of vulnerability is most likely present?

Accepted Answer

SQL injection. Direct concatenation of user input into an SQL query without sanitization results in SQL injection vulnerability.

Answer

Insecure deserialization

Answer

Command injection

Answer

Cross-site scripting (XSS)

Question 3

After completing a penetration test, the tester must deliver a report. According to standard practices, which of the following is a required component of the deliverables?

Accepted Answer

Executive summary, technical findings, and remediation guidance. A typical penetration test report includes an executive summary, technical findings, and remediation guidance.

Answer

Remediation guidance and a list of all tested IPs

Answer

Only technical findings and proof-of-concept code

Answer

Executive summary and raw data logs

Question 4

During a red team exercise, the tester successfully gains access to an internal server and finds evidence of ongoing criminal activity unrelated to the client. According to best practices for handling discovered criminal activity, what should the tester do first?

Accepted Answer

Contact the client's emergency contact as defined in the RoE. The tester should follow the incident response plan and contact emergency contacts; the RoE should specify procedures.

Answer

Immediately inform law enforcement

Answer

Cease all testing and delete the evidence

Answer

Continue testing and document the evidence for the final report

Question 5

A penetration tester wants to identify the operating system of a remote host without sending any traffic to the target network. Which of the following techniques is most effective for this purpose?

Accepted Answer

Use Shodan to search for the host's IP address and examine the service banners.. Shodan is a search engine that indexes service banners and metadata from internet-connected devices. By querying Shodan for the target's IP address, the tester can retrieve previously collected OS information without sending any packets to the target, satisfying the 'no traffic' constraint.

Answer

Perform an nmap OS fingerprint scan on the host.

Answer

Send a ping sweep to the host's network segment.

Answer

Use ARP scanning to discover the host's MAC address and look up the vendor.

Question 6

During a penetration test, a tester successfully exploits a web application and gains a foothold. The tester needs to pivot to an internal network segment that is not directly accessible. Which THREE tools can the tester use to create a SOCKS proxy or tunnel for pivoting?

Accepted Answer

Chisel. SSH dynamic port forwarding (-D), chisel, and ligolo-ng are all tools for creating SOCKS proxies or tunnels for pivoting.

Answer

Netcat

Answer

Nmap

Question 7

During a web application test, a tester discovers an endpoint that fetches a URL from user input without validation. They attempt to access the AWS metadata endpoint. Which IP address is commonly used for the cloud metadata service?

Accepted Answer

169.254.169.254. AWS metadata is accessible at 169.254.169.254, a link-local address.

Answer

10.0.0.1

Answer

127.0.0.1

Answer

192.168.1.1

Question 8

During a web application test, you find a feature that allows users to export data as PDF. The PDF generation uses user input without sanitization. You inject an XML external entity that reads /etc/passwd and the content appears in the PDF. Which vulnerability is present?

Accepted Answer

XML External Entity (XXE). XXE (XML External Entity) allows reading files via XML entities when the parser is vulnerable.

Answer

Server-Side Request Forgery (SSRF)

Answer

Command injection

Answer

Cross-Site Scripting (XSS)

Question 9

During a web application penetration test, a tester identifies a SQL injection vulnerability. Which TWO techniques could be used to extract data from the database? (Select TWO.)

Accepted Answer

Blind time-based SQL injection. UNION-based and blind time-based are common SQL injection techniques for data extraction.

Answer

Command injection

Answer

XXE injection

Answer

Reflected XSS

Question 10

During a Windows privilege escalation attempt, a tester finds that the current user has the SeImpersonatePrivilege enabled. Which tool can be used to exploit this privilege to gain SYSTEM access?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits SeImpersonatePrivilege to escalate to SYSTEM.

Answer

PowerUp

Answer

CrackMapExec

Answer

Mimikatz

Question 11

A penetration tester has obtained a set of NTLM password hashes from a Windows domain controller. The tester wants to perform an offline cracking attack using GPU acceleration. Which tool is best suited for this purpose?

Accepted Answer

Hashcat. Hashcat is a powerful password cracker that supports GPU acceleration and can crack NTLM hashes efficiently.

Answer

CrackMapExec

Answer

John the Ripper

Answer

Hydra

Question 12

A penetration tester has exploited a web application and found that the server has an outbound firewall that restricts all outbound traffic except for DNS queries (UDP 53). The tester has a reverse shell payload that connects back on TCP 443. Which technique can the tester use to exfiltrate data or establish a channel?

Accepted Answer

Use dnscat2 or other DNS tunneling tool. DNS tunneling tools like dnscat2 encode data within DNS queries and responses, allowing the tester to bypass outbound firewall restrictions that only permit UDP 53 traffic. Since the reverse shell payload uses TCP 443, which is blocked, DNS tunneling provides an alternative covert channel that encapsulates the communication within legitimate DNS lookups, effectively exfiltrating data or establishing a command-and-control channel over the allowed protocol.

Answer

Use netcat to send data over TCP 53

Answer

Use an SSH tunnel over UDP 53

Answer

Use a bind shell listening on TCP 443 internally

Question 13

A penetration tester is analyzing a Python script that performs a buffer overflow attack. The script imports the struct module and the socket module. It constructs a payload by packing a pattern of characters, then overwriting a return address with a specific offset. Which of the following is the most critical piece of information the tester must determine before running this script against the target?

Accepted Answer

The exact location of a JMP ESP instruction in memory. The script performs a buffer overflow attack by overwriting a return address. To redirect execution to attacker-controlled shellcode, the tester must overwrite the return address with the address of a JMP ESP instruction (or equivalent) that is reliably located in memory. Without this address, the overwritten return pointer will cause a crash or unpredictable behavior, making exploitation impossible.

Answer

The IP address and port of the target service

Answer

The version of the operating system running on the target

Answer

The username and password for the target service

Question 14

A client is planning a penetration test of their AWS cloud environment. They will provide the tester with an IAM user account with limited permissions. Which of the following scoping restrictions is most important to include in the rules of engagement to avoid unexpected costs?

Accepted Answer

The tester must not create any new AWS resources that incur costs.. Creating new AWS resources (e.g., EC2 instances, RDS databases, Lambda functions) can incur direct costs under the tester's IAM user account, even with limited permissions. The rules of engagement must explicitly prohibit resource creation to prevent unexpected billing, as AWS charges for resources provisioned regardless of the test's purpose. This scoping restriction aligns with the principle of cost containment in penetration testing engagements.

Answer

The tester must use only premium AWS services for testing.

Answer

The tester must request permission from AWS Support before each test.

Answer

The tester must avoid testing in the us-east-1 region due to higher costs.

Question 15

A penetration tester is performing passive reconnaissance on a target organization. Which of the following tools would be BEST suited to gather information about the organization's domain names, email addresses, and subdomains from publicly available sources without directly interacting with the target's systems?

Accepted Answer

theHarvester. theHarvester is designed for passive OSINT gathering of emails, subdomains, IPs, etc. Maltego is also OSINT but more graph-oriented; theHarvester is specifically for email/subdomain enumeration.

Answer

Nmap

Answer

Nessus

Answer

Metasploit

Question 16

A penetration tester is analyzing a PowerShell script that uses Invoke-WebRequest and Invoke-RestMethod to interact with a target web service. The script parses JSON responses to extract session tokens and then uses those tokens in subsequent requests. Which attack technique is this script most likely performing?

Accepted Answer

Exploiting an API by manipulating request parameters and observing responses.. The script uses Invoke-WebRequest and Invoke-RestMethod to interact with a web service, parsing JSON responses to extract session tokens and reusing them in subsequent requests. This pattern is characteristic of API manipulation, where an attacker modifies request parameters (e.g., headers, query strings, or payload) and observes how the API responds to infer vulnerabilities or escalate privileges, rather than directly attacking authentication or injecting SQL.

Answer

Brute-forcing web application login credentials.

Answer

Performing a SQL injection attack on a web form.

Answer

Conducting a directory traversal attack to read arbitrary files.

Question 17

A penetration tester is using theHarvester tool to gather information about a target domain. The tester wants to collect email addresses and subdomains from public search engines and PGP key servers. Which source is theHarvester commonly configured to use for this passive reconnaissance?

Accepted Answer

Google and Bing search engines. TheHarvester is specifically designed to perform passive reconnaissance by querying public search engines (like Google and Bing) and PGP key servers to collect email addresses, subdomains, and other open-source intelligence (OSINT). It does not initiate direct connections to the target's infrastructure, making it a passive tool. The default configuration often includes Google and Bing as primary sources for this data.

Answer

Direct DNS zone transfer

Answer

Shodan

Answer

Baidu

Question 18

A penetration tester is performing active reconnaissance on a target network. The tester wants to identify all live hosts in the 192.168.1.0/24 subnet and determine which ones have port 80 open. Which technique is most efficient for this task?

Accepted Answer

Use a ping sweep to identify live hosts, then run a SYN scan on port 80 for those hosts.. It combines two efficient steps: first, a ping sweep (ICMP Echo Request or ARP scan) identifies live hosts in the 192.168.1.0/24 subnet, reducing the number of targets; second, a SYN scan on port 80 for only those live hosts is faster and less intrusive than scanning all ports or all IPs without prior host discovery. This approach minimizes network traffic and scan time while accurately identifying hosts with HTTP services.

Answer

Perform a full TCP connect scan on all 65535 ports for each IP address.

Answer

Run a SYN scan on port 80 for every IP in the subnet without ping probing.

Answer

Use ARP requests to map the subnet and then check for port 80 on each host.

Question 19

During a penetration test, a tester gains access to a Linux server as a low-privileged user. The server has a cron job that executes a script owned by root but writable by the tester's group. Which privilege escalation technique should the tester use?

Accepted Answer

Cron job exploitation via script modification. The cron job executes a script owned by root but writable by the tester's group. This means the tester can modify the script's contents. When the cron job runs (as root), the modified script executes with root privileges, allowing the tester to gain a root shell or execute arbitrary commands as root. This is a classic cron job exploitation via script modification.

Answer

Kernel exploit

Answer

Misconfigured sudo permissions

Answer

Path hijacking in the cron job

Question 20

A client requests a penetration test of their internal network. During scoping, the tester learns that the client uses a managed security service provider (MSSP) that monitors all network traffic. The client does not want the MSSP to be informed about the test. What is the most appropriate action for the tester to take?

Accepted Answer

Advise the client to inform the MSSP about the scheduled test and coordinate a maintenance window or exclusion list. Failing to inform the MSSP could trigger automated incident response actions (e.g., IPS blocking, SIEM alerting, or even network isolation) that disrupt the test and potentially cause false-positive security incidents. Coordinating a maintenance window or exclusion list ensures the MSSP's monitoring tools (like Snort, Suricata, or proprietary NDR) do not interfere with legitimate test traffic, preserving both test integrity and the client's operational security.

Answer

Proceed with the test without informing the MSSP, as the client has requested confidentiality

Answer

Include a clause in the rules of engagement that holds the tester harmless for any disruptions caused by the MSSP's monitoring

Answer

Perform the test only after hours to minimize the chance of the MSSP detecting the test activity