PT0-002 Practice Test 3 — 30 Questions

Question 1

During a vulnerability scan of a web application, a tester receives an HTTP response with a '405 Method Not Allowed' error when trying to use a PUT request. What does this indicate about the web server's configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The server blocks the PUT method for that specific URI.. A 405 Method Not Allowed error indicates that the server recognized the PUT method as valid but has explicitly disallowed it for the requested URI. This is a server-level access control configuration, often enforced via web server directives (e.g., Apache's `<LimitExcept>` or IIS's request filtering) or application-level routing rules. The tester's PUT request reached the server and was processed, but the server's configuration prevented it from being fulfilled for that specific endpoint.

Answer

The PUT method is allowed but the resource does not exist.

Answer

The server does not support the PUT method.

Answer

The request was malformed and rejected.

Question 2

A penetration tester is conducting information gathering on a target organization. The tester discovers a public code repository that contains configuration files with embedded credentials. Which of the following is the BEST next step?

Accepted Answer

Notify the organization's security team of the exposed credentials.. The tester has discovered exposed credentials in a public code repository, which is a critical security finding that requires immediate disclosure to the organization's security team. Ethical penetration testing mandates that any discovered vulnerabilities, especially those involving credential exposure, be reported promptly to prevent unauthorized access and potential data breaches. Proceeding with further exploitation without authorization violates the rules of engagement and could cause legal or operational harm.

Answer

Attempt to crack the passwords to gain further access.

Answer

Document the findings and proceed with passive reconnaissance.

Answer

Use the credentials to log into the target system immediately.

Question 3

A penetration tester runs the following command: nmap -sS -p 1-65535 -T4 -A -O --reason target. What is the primary purpose of the -A option in this command?

Accepted Answer

Enables OS detection, version detection, script scanning, and traceroute.. The -A option in nmap is a composite flag that enables OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (--traceroute) in a single switch. This is explicitly documented in nmap's man page and is designed to provide comprehensive reconnaissance in one command, making option A correct.

Answer

Sets the timing template to aggressive (level 4).

Answer

Enables aggressive scanning that is more likely to be detected by the target.

Answer

Performs a SYN (half-open) scan.

Question 4

A penetration tester is tasked with performing passive reconnaissance against a client without triggering any alerts. Which of the following techniques would be MOST appropriate?

Accepted Answer

Shodan search. Shodan is a search engine that indexes banners from internet-facing devices, allowing a penetration tester to gather information about a client's exposed services (e.g., open ports, software versions) without sending any packets to the target. This makes it a purely passive technique that will not trigger any alerts on the client's network or intrusion detection systems.

Answer

Nmap SYN scan

Answer

Brute-force login

Answer

Netcat banner grab

Question 5

A penetration tester needs to escalate privileges on a Linux system and finds that the user can run a script with sudo that has a vulnerable argument. Which resource should the tester consult to find exploitation techniques for common sudo misconfigurations?

Accepted Answer

GTFOBins. GTFOBins is a curated list of Unix binaries that can be exploited to bypass local security restrictions, including sudo misconfigurations.

Answer

Exploit-DB

Answer

Metasploit

Answer

CVE Details

Question 6

Refer to the exhibit. A penetration tester sends the request and receives the response shown. Which vulnerability is confirmed?

Accepted Answer

Reflected cross-site scripting. The response includes the parameter value 'John' reflected directly in the HTML body without sanitization or encoding, and the request uses an HTTP GET method. This confirms a reflected cross-site scripting (XSS) vulnerability, as the tester can inject arbitrary JavaScript by modifying the 'name' parameter, which will execute in the victim's browser.

Answer

Server-side request forgery

Answer

Cross-site request forgery

Answer

SQL injection

Question 7

During a penetration test, a tester needs to perform a man-in-the-middle attack on a network that uses WPA2-Enterprise with PEAP. Which tool is most appropriate for capturing the authentication handshake to attempt offline cracking?

Accepted Answer

hostapd-wpe. hostapd-wpe (Wireless Pwnage Edition) is specifically designed to set up a rogue access point that impersonates a legitimate WPA2-Enterprise network. It captures the MSCHAPv2 challenge-response from the PEAP authentication handshake, which can then be used for offline dictionary or brute-force attacks against the user's credentials. Unlike other tools, hostapd-wpe handles the full EAP/PEAP exchange required for this attack.

Answer

Wireshark

Answer

aircrack-ng

Answer

Ettercap

Question 8

A penetration tester is performing a password attack on a Windows domain and has captured NTLM hashes. Which tool can be used to perform a pass-the-hash attack to gain remote code execution on a target system?

Accepted Answer

pth-winexe. pth-winexe is a tool specifically designed for pass-the-hash attacks to execute commands on remote Windows systems.

Answer

Hashcat

Answer

Responder

Answer

John the Ripper

Question 9

Which of the following tools would a penetration tester most likely use to perform passive reconnaissance on a target domain?

Accepted Answer

theHarvester. theHarvester is a passive reconnaissance tool that gathers information from public sources such as search engines, PGP key servers, and the Shodan API without directly interacting with the target domain. It collects email addresses, subdomains, IPs, and employee names using OSINT (Open Source Intelligence) techniques, making it ideal for passive information gathering.

Answer

Wireshark

Answer

Nmap

Answer

Metasploit

Question 10

A penetration tester is conducting passive reconnaissance on a target organization. Which technique can be used to discover subdomains of the target's domain without sending any packets to the target's network?

Accepted Answer

Using the 'site:' operator in a search engine query. Using the 'site:' operator in a search engine query (e.g., 'site:example.com') retrieves indexed subdomains from the search engine's cache without sending any packets to the target's network. This is a purely passive technique that leverages publicly available data, aligning with the definition of passive reconnaissance.

Answer

Performing a DNS brute-force attack against the target's domain

Answer

Sending ICMP echo requests to potential subdomain IP addresses

Answer

Querying WHOIS databases for domain registration information

Question 11

A penetration tester wants to perform a slow and stealthy port scan to avoid intrusion detection systems. Which Nmap option should be used?

Accepted Answer

-T0. The -T0 option sets the timing template to Paranoid, which is extremely slow and avoids IDS detection. -O is for OS detection, -sV for version detection, and -A for aggressive scan.

Answer

-O

Answer

-A

Answer

-sV

Question 12

A penetration tester is presenting findings to a group of executives. Which of the following is the most effective way to communicate a critical vulnerability?

Accepted Answer

Describe the vulnerability in terms of potential financial and reputational damage.. Executives need to understand business impact, not technical details. Use business language and focus on risk.

Answer

Recommend specific code changes without context.

Answer

Explain the technical exploit steps in detail.

Answer

Show raw network captures as evidence.

Question 13

A penetration tester is preparing a report for a client that includes both a technical security team and an executive leadership team. The executive team needs to understand the overall risk posture, while the technical team requires detailed reproduction steps. Which reporting structure best serves both audiences?

Accepted Answer

A single report with an executive summary and technical appendices. A single report with an executive summary and technical appendices is the correct structure because it satisfies both audiences: the executive summary provides a high-level risk posture overview (e.g., CVSS scores, business impact), while the technical appendices contain detailed reproduction steps (e.g., exact commands, payloads, and packet captures) for the technical team. This approach aligns with the PT0-002 objective of tailoring communication to stakeholders without losing technical rigor.

Answer

Two completely separate reports: one for executives and one for technical staff

Answer

Only an executive summary, omitting technical details

Answer

Only a technical report with all details

Question 14

A penetration tester is performing a cloud security audit of an AWS environment. Which tool is specifically designed for AWS exploitation and post-exploitation, including privilege escalation and persistence?

Accepted Answer

Pacu. Pacu is an AWS exploitation framework that provides modules for enumeration, privilege escalation, and persistence.

Answer

CrackMapExec

Answer

ScoutSuite

Answer

Prowler

Question 15

Which legal framework in the United States prohibits unauthorized access to computer systems and is commonly referenced in penetration testing authorization documents?

Accepted Answer

CFAA. The Computer Fraud and Abuse Act (CFAA) is the primary U.S. law against unauthorized computer access.

Answer

HIPAA

Answer

GLBA

Answer

SOX

Question 16

A penetration tester is contracted to perform a grey box test of a company's internal network. The client provides a VPN account for remote access but does not disclose that the account has been used by a former employee. The tester connects and is immediately locked out. Which pre-engagement document should have addressed this scenario?

Accepted Answer

Rules of Engagement (RoE). The rules of engagement (RoE) should specify the accounts and credentials provided, including any limitations or known issues.

Answer

Emergency contact list

Answer

Data handling agreement

Answer

Statement of Work (SOW)

Question 17

A penetration tester is tasked with performing active reconnaissance on an internal network. The tester wants to identify live hosts and their open ports efficiently while minimizing noise. Which Nmap scan type should be used first to quickly discover which hosts are online?

Accepted Answer

nmap -sn 192.168.1.0/24. The `-sn` flag (ping scan) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default to determine if hosts are online without performing port scans. This minimizes network noise and quickly identifies live hosts on the subnet, which is the first step in active reconnaissance before deeper scanning.

Answer

nmap -sS -sV 192.168.1.0/24

Answer

nmap -A 192.168.1.0/24

Answer

nmap -sT 192.168.1.0/24

Question 18

A penetration tester is examining a compiled binary obtained during an engagement. The tester wants to identify potential buffer overflow vulnerabilities and understand the control flow. Which TWO tools would be most appropriate for this task?

Accepted Answer

OllyDbg. OllyDbg is a debugger that allows dynamic analysis to identify overflow vulnerabilities by examining memory and registers. Ghidra is a disassembler and decompiler that provides static analysis of control flow and potential vulnerabilities. Nmap is a network scanner, Wireshark is a packet analyzer, and Burp Suite is a web proxy, none of which are suitable for binary analysis.

Answer

Wireshark

Answer

Nmap

Answer

Burp Suite

Question 19

A penetration tester is performing a full-scope engagement and needs to identify potential privilege escalation vectors on a Windows system. Which TWO of the following are valid Windows privilege escalation techniques?

Accepted Answer

Unquoted service path exploitation. Unquoted service paths and AlwaysInstallElevated are both valid Windows privilege escalation techniques. Kerberoasting and pass-the-hash are for credential access, not local escalation; SUID/SGID is Linux.

Answer

Pass-the-hash

Answer

Kerberoasting

Answer

SUID/SGID binary exploitation

Question 20

A penetration tester is using Hashcat to crack NTLM hashes obtained from a Windows system. The tester wants to use a rule-based attack to maximize cracking success. Which Hashcat mode should be used for NTLM hashes?

Accepted Answer

-m 1000. Hashcat mode -m 1000 is specifically designated for NTLM hashes, which are the Windows NT LAN Manager hash format stored in the SAM database. A rule-based attack with this mode applies transformation rules to wordlists to generate candidate passwords, maximizing cracking success by leveraging common password patterns and mutations.

Answer

-m 1100

Answer

-m 3000

Answer

-m 5500