PT0-002 Practice Test 31 — 15 Questions

Question 1

During a penetration test, a tester has access to a Windows domain-joined machine. The tester finds that the machine is running a service that uses named pipes for interprocess communication. The tester wants to perform a relay attack to capture authentication credentials. Which of the following conditions is necessary for an SMB relay attack to succeed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SMB signing must be disabled or not enforced. SMB relay attacks work by intercepting an authentication attempt and forwarding it to a target server. For the relay to succeed, the target server must not require SMB signing, because signing ensures that the relayed authentication packet is cryptographically bound to the original session, preventing the attacker from replaying it. When SMB signing is disabled or not enforced, the relayed authentication is accepted as valid, allowing credential capture.

Answer

The attacker must be on the same subnet

Answer

The target must have a publicly available SMB share

Answer

The attacker must have admin privileges on the relay machine

Question 2

A penetration tester is performing internal reconnaissance on a network that uses IPv6. The tester wants to discover alive hosts and their IPv6 addresses without sending many packets. Which technique is most effective for this purpose?

Accepted Answer

Ping the IPv6 all-nodes multicast address (ff02::1) and analyze the responses to discover active hosts. Sending a ping to the IPv6 all-nodes multicast address (ff02::1) triggers a response from all active hosts on the local link that have IPv6 enabled, allowing the tester to discover alive hosts and their IPv6 addresses with minimal packets. This technique leverages the inherent multicast behavior of IPv6, where hosts join the all-nodes multicast group by default, making it highly efficient for reconnaissance without scanning each address individually.

Answer

Perform a full TCP SYN scan on the entire /64 subnet using Nmap with IPv6 addressing

Answer

Request the DHCPv6 server log from the network administrator to obtain a list of assigned IPv6 addresses

Answer

Use the `ip neighbor` command on the tester's machine to view the IPv6 neighbor cache after generating traffic

Question 3

A penetration tester is performing reconnaissance on a target domain. The tester queries the public DNS records and finds an SPF record that includes an 'include' mechanism pointing to a third-party email service. Which technique can the tester use to potentially discover more subdomains or internal infrastructure?

Accepted Answer

Query the TXT records of the third-party domain. The SPF record's 'include' mechanism points to a third-party email service, which itself may have SPF or other TXT records that reveal additional domains or subdomains used for email infrastructure. By querying the TXT records of the third-party domain, the tester can discover these included domains, potentially expanding the attack surface. This technique leverages the recursive nature of SPF includes to map out related infrastructure.

Answer

Perform a DNS zone transfer

Answer

Enumerate MX records for the third-party

Answer

Use Google dorks to find exposed email addresses

Question 4

A penetration tester discovers that a web application uses a vulnerable Java deserialization endpoint. The classpath includes the Apache Commons Collections library. Which attack technique is most likely to achieve remote code execution?

Accepted Answer

Java deserialization of untrusted data (RCE via Commons Collections).. The presence of the Apache Commons Collections library in the classpath, combined with a vulnerable Java deserialization endpoint, enables the classic 'gadget chain' attack. Attackers craft a malicious serialized object that, when deserialized, invokes methods in Commons Collections (e.g., InvokerTransformer) to execute arbitrary system commands, achieving remote code execution (RCE). This is a well-documented exploit chain (e.g., CVE-2015-7501) that directly leverages the library's reflection-based classes.

Answer

SQL injection.

Answer

Cross-site scripting.

Answer

Command injection.

Question 5

During a penetration test, the tester identifies a low-risk information disclosure vulnerability in a public-facing web server. The tester includes this finding in the final report. Which component of the risk rating should the tester use to justify the low severity?

Accepted Answer

CVSS base score. The CVSS base score is the correct component to justify the low severity because it represents the intrinsic and fundamental characteristics of a vulnerability that are constant over time and across user environments. In this case, the information disclosure vulnerability has a low base score due to factors such as low attack complexity and low impact on confidentiality, which are captured in the base metrics. The base score is the standard starting point for communicating severity, making it the appropriate justification for the low-risk rating in the report.

Answer

Exploitability metrics

Answer

Impact metrics

Answer

Temporal score

Question 6

A penetration testing firm is contracted to test a cloud-based infrastructure. The client uses a shared responsibility model. Which of the following should be clarified in the rules of engagement to avoid legal issues?

Accepted Answer

Whether the tester needs authorization from the cloud provider. In a shared responsibility model, the cloud provider is responsible for the security of the cloud, while the customer is responsible for security in the cloud. However, penetration testing activities may violate the cloud provider's terms of service or acceptable use policy, potentially triggering legal action. Therefore, obtaining explicit authorization from the cloud provider is critical to ensure the tester's actions are legally permitted and to avoid liability for unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA).

Answer

Who is responsible for patching the operating system

Answer

The encryption method for data at rest

Answer

The backup strategy for logs

Question 7

A client wants to test a web application that uses multiple third-party APIs for payment processing, shipping, and customer relationship management. The client states that the APIs are critical for operations but cannot be taken offline. Which scoping consideration is most important to include in the rules of engagement?

Accepted Answer

The tester must use only non-intrusive scanning techniques on the APIs.. The client explicitly stated that the APIs are critical for operations and cannot be taken offline. Non-intrusive scanning techniques, such as passive traffic analysis or read-only API calls with safe HTTP methods (GET, HEAD), minimize the risk of service disruption, data corruption, or rate-limit triggering. This aligns with the scoping requirement to maintain availability while still allowing security testing of the API layer.

Answer

The tester must exclude all API endpoints from testing.

Answer

The tester must coordinate testing schedules with the API vendors.

Answer

The tester must provide a list of all API calls to be made prior to testing.

Question 8

A penetration tester is conducting passive reconnaissance on a target organization. The tester wants to identify the technologies and frameworks used by the target's web application without making any requests to the target's servers. Which resource is BEST suited for this task?

Accepted Answer

BuiltWith.com. BuiltWith.com is a passive reconnaissance resource that profiles web application technologies by analyzing publicly available data, such as JavaScript libraries, web frameworks, and analytics tools, without sending any requests to the target's servers. It aggregates information from various public sources and historical data, making it ideal for identifying technologies without direct interaction.

Answer

Nmap service scan with -sV

Answer

Shodan.io

Answer

Wappalyzer browser extension

Question 9

A client requests a penetration test of their web application, but they want to exclude all third-party APIs from the scope. Where should this exclusion be documented?

Accepted Answer

Rules of Engagement. The Rules of Engagement (ROE) document is the authoritative source for defining the scope, boundaries, and constraints of a penetration test, including explicit exclusions such as third-party APIs. This document is established during the planning and scoping phase to ensure both the client and the testing team agree on what is and is not in scope, preventing legal or operational issues. Without documenting the exclusion in the ROE, the tester might inadvertently interact with the third-party APIs, violating the agreement and potentially causing service disruptions or legal liabilities.

Answer

Executive Summary

Answer

Findings Report

Answer

Remediation Plan

Question 10

When performing vulnerability scanning, which of the following best describes a false positive?

Accepted Answer

A vulnerability that the scanner reports but does not actually exist.. A false positive in vulnerability scanning occurs when the scanner reports a vulnerability that does not actually exist. This is option C. False positives are caused by factors such as overly aggressive signature matching, misconfigured scan profiles, or incomplete verification of service responses. They waste resources by prompting unnecessary remediation efforts.

Answer

A vulnerability that is correctly identified and verified.

Answer

A vulnerability that is exploited during the test.

Answer

A vulnerability that exists but the scanner fails to detect it.

Question 11

A penetration tester is performing passive reconnaissance on a target organization. The tester wants to gather information about the target's technology stack, including web server software and frameworks, without directly interacting with the target systems. Which technique is most effective?

Accepted Answer

Querying public records with BuiltWith. BuiltWith is a passive reconnaissance tool that queries public web data and DNS records to identify a target's technology stack, such as web server software (e.g., Apache, Nginx) and frameworks (e.g., React, Django), without sending any packets to the target's systems. This makes it ideal for passive information gathering, as it relies on third-party databases and cached information rather than direct interaction.

Answer

Running Nmap with the -A flag against the target's public IP range

Answer

Using theHarvester to search for email addresses and subdomains

Answer

Performing a DNS zone transfer

Question 12

During a penetration test of a large e-commerce platform, the client requests additional testing on a newly discovered microservice mid-engagement. The scope defined in the rules of engagement (ROE) explicitly lists all target systems. What should the penetration tester do FIRST?

Accepted Answer

Inform the client that a scope amendment is needed and pause testing on the microservice until it is approved. The rules of engagement (ROE) are a legally binding document that defines the scope of testing. Adding a new microservice mid-engagement without an approved scope amendment violates the ROE and could lead to legal or contractual issues. The penetration tester must first pause testing on the microservice and formally request a scope amendment to ensure all activities remain authorized.

Answer

Add the microservice to the test and include it in the final report as an unadvertised finding

Answer

Decline the request because the microservice was not part of the original scope

Answer

Test the microservice only if it is using the same technology stack as other targets

Question 13

A penetration tester wants to use Google dorking to find publicly accessible documents containing sensitive information on a target domain 'example.com'. Which Google dork would be MOST appropriate to locate PDF files with the word 'confidential'?

Accepted Answer

site:example.com filetype:pdf confidential. The Google dork 'site:example.com filetype:pdf confidential' combines the site restriction to the target domain, the filetype filter for PDFs, and the keyword 'confidential' to search for PDF documents containing that word. This directly matches the requirement to locate publicly accessible PDF files with the word 'confidential' on example.com.

Answer

site:example.com intitle:confidential pdf

Answer

filetype:pdf site:example.com password

Answer

site:example.com inurl:pdf confidential

Question 14

In the context of OSINT, which resource would you use to find historical versions of a company's website that may reveal outdated information or hidden directories?

Accepted Answer

Wayback Machine. The Wayback Machine (archive.org) is the correct resource because it archives historical snapshots of websites, allowing you to view past versions that may contain outdated information, hidden directories, or old configurations no longer present on the live site. This is a core OSINT technique for discovering legacy content or forgotten endpoints.

Answer

crt.sh

Answer

Censys

Answer

Shodan

Question 15

During the information gathering phase, a penetration tester wants to discover subdomains of a target domain using DNS queries and potentially brute-forcing common subdomain names. Which of the following tools is specifically designed for subdomain enumeration and can perform both passive and active techniques?

Accepted Answer

Amass. Amass is a tool that performs subdomain enumeration using passive sources and active brute-forcing. Gobuster and dirsearch are for directory/file enumeration. Nmap is for port scanning.

Answer

Nmap

Answer

dirsearch

Answer

Gobuster