PT0-002 Practice Test 32 — 15 Questions

Question 1

A penetration tester is analyzing a Python script that uses the 'requests' library to send HTTP POST requests to a target URL with different payloads. The script also implements a retry mechanism with exponential backoff. What is the most likely purpose of this script?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Password spraying. The script sends HTTP POST requests with different payloads and implements a retry mechanism with exponential backoff. This behavior is characteristic of password spraying, where an attacker attempts a small number of common passwords against many usernames to avoid account lockouts. The exponential backoff helps evade rate-limiting and intrusion detection systems by gradually increasing delays between attempts.

Answer

Directory brute-forcing

Answer

SQL injection testing

Answer

Session hijacking

Question 2

While performing web application reconnaissance, a tester wants to enumerate hidden directories and files on a web server. Which of the following tools is specifically designed for directory brute-forcing?

Accepted Answer

Gobuster. Gobuster is specifically designed for directory brute-forcing by using a wordlist to discover hidden directories and files on a web server. It sends HTTP GET requests to the target and reports valid responses (e.g., 200, 301, 403), making it the correct tool for this task.

Answer

Nikto

Answer

WPScan

Answer

Nmap

Question 3

A penetration tester has been given a target IP address and needs to quickly determine which services are running on the target. Which Nmap option should the tester use to perform a SYN scan with service version detection and default NSE scripts?

Accepted Answer

nmap -sS -sV -sC 192.168.1.10. The -sS flag initiates a SYN stealth scan, -sV enables service version detection by probing open ports to determine application and version information, and -sC runs the default set of NSE scripts for common enumeration tasks. Together, these three options fulfill the requirement to quickly identify running services with version details and additional script-based reconnaissance, all while using a half-open TCP scan to minimize log generation.

Answer

nmap -sT -sV -sC 192.168.1.10

Answer

nmap -A 192.168.1.10

Answer

nmap -sS -O 192.168.1.10

Question 4

A tester needs to enumerate Windows domain users and groups from a compromised system. Which PowerShell script would be most useful?

Accepted Answer

PowerView. PowerView is a PowerShell tool specifically designed for Windows domain enumeration, allowing testers to query Active Directory for users, groups, computers, and permissions via LDAP. It leverages the Active Directory Services Interface (ADSI) to gather detailed information without requiring additional privileges beyond those already obtained on the compromised system.

Answer

Invoke-Mimikatz

Answer

Prowler

Answer

ScoutSuite

Question 5

A penetration tester is conducting a web application test and discovers an XML External Entity (XXE) vulnerability. Which of the following attacks can the tester perform using XXE? (Choose THREE.)

Accepted Answer

Read sensitive files from the server. XXE can be used to read files, perform SSRF, and cause denial of service via entity expansion.

Answer

SQL injection through entity values

Answer

Remote code execution

Question 6

A penetration tester gained low-privileged access to a Linux server and found that the user can run a custom script located at /opt/tool/backup.sh with setuid root. The script begins with a hashbang #!/bin/bash and uses an internal variable defined as BASEDIR=$(dirname $0) to determine paths. Which technique is most likely to allow privilege escalation?

Accepted Answer

Create a malicious executable named 'dirname' in a directory earlier in the PATH. The script uses `BASEDIR=$(dirname $0)` to resolve paths. If the user can place a malicious executable named `dirname` earlier in the PATH than the legitimate `/usr/bin/dirname`, then when the script runs with setuid root, the shell will execute the attacker's `dirname` binary instead, allowing arbitrary code execution as root.

Answer

Modify the $0 variable during execution

Answer

Overwrite /opt/tool/backup.sh with a reverse shell

Answer

Exploit a buffer overflow in the Bash interpreter

Question 7

A penetration testing firm is scoping a test for a financial institution. The client insists that the test only be performed on systems located in the corporate headquarters, excluding cloud-based infrastructure and remote branch offices. Which of the following should the penetration tester emphasize during the scoping discussion?

Accepted Answer

The exclusion of cloud infrastructure may leave critical assets untested. The client's exclusion of cloud-based infrastructure and remote branch offices creates a significant gap in the test scope. A penetration test that ignores cloud assets (e.g., AWS, Azure, or SaaS applications) may miss critical vulnerabilities in systems that process or store sensitive financial data, as these are often part of the institution's attack surface. The tester must emphasize that such exclusions can lead to a false sense of security, as attackers frequently target cloud and remote assets due to their accessibility and potential misconfigurations.

Answer

The test will include social engineering of remote employees

Answer

The test can only be performed during off-hours

Answer

The tester will require VPN access to the corporate network

Question 8

Which tool would be best for capturing and analyzing network packets to troubleshoot a web application?

Accepted Answer

Wireshark. Wireshark is the correct tool because it is designed specifically for deep packet inspection, allowing you to capture live network traffic and analyze individual packets at multiple OSI layers. For troubleshooting a web application, you can filter HTTP/HTTPS requests and responses, examine TCP handshakes, and identify latency or payload issues, which is essential for diagnosing performance or functional problems.

Answer

Nmap

Answer

Burp Suite

Answer

Aircrack-ng

Question 9

A tester wants to crack a password hash using a wordlist combined with rules to generate variations. Which hashcat attack mode should be used?

Accepted Answer

-a 0 with -r. Mode 0 with rule files applies rules to a wordlist.

Answer

-a 3

Answer

-a 6

Answer

-a 1

Question 10

A penetration tester wants to use Metasploit to exploit a remote service. After selecting an exploit module, which command is used to set the remote host IP address?

Accepted Answer

set RHOSTS. In Metasploit, 'set RHOSTS' is used to specify the target IP address.

Answer

set LHOST

Answer

set TARGET

Answer

set LPORT

Question 11

A penetration tester is using a vulnerability scanner to assess an internal network. The scanner reports a critical vulnerability in a custom web application, but manual verification shows the application is not vulnerable. Which of the following is the MOST likely cause of this false positive?

Accepted Answer

The scanner detected a vulnerable library used by the application, but the application's implementation does not expose the vulnerable code path. Vulnerability scanners often identify libraries or components with known CVEs, but they cannot determine whether the application's code actually invokes the vulnerable functions. In this case, the scanner flagged a library with a known vulnerability, but the custom web application's implementation does not expose the vulnerable code path, resulting in a false positive. This is a common limitation of static or version-based detection versus dynamic, context-aware analysis.

Answer

The scanner used an outdated vulnerability database that does not match the application's patches

Answer

The scanner identified the application version from the HTTP response header, but the vulnerability was already patched in that version

Answer

The scanner performed an exploit attempt that succeeded on a different service on the same host

Question 12

A penetration tester has compromised a Linux server and wants to move laterally to a Windows server. The Linux server has network access to the Windows server on port 445. The tester has a captured NTLM hash of a domain administrator account. Which technique is most likely to allow the tester to authenticate and execute commands on the Windows server?

Accepted Answer

Pass-the-hash using Impacket's psexec. The tester has a captured NTLM hash of a domain administrator account and network access to the Windows server on port 445 (SMB). Pass-the-hash (PtH) allows authentication using the NTLM hash directly without needing the plaintext password. Impacket's psexec uses the SMB protocol to authenticate with the hash and execute commands remotely, making it the most direct and effective technique for lateral movement in this scenario.

Answer

Kerberos Golden Ticket attack

Answer

SMB relay attack using the hash

Answer

Brute-force password cracking of the hash

Question 13

A penetration tester is preparing a report for a client who has both a technical security team and a non-technical executive team. The tester wants to ensure that each audience receives the appropriate level of detail. Which of the following is the most effective approach?

Accepted Answer

Create a single report that includes an executive summary at the beginning and a detailed technical section later.. It provides a single report with an executive summary for non-technical stakeholders and a detailed technical section for the security team, satisfying both audiences' needs without duplication or omission. This approach aligns with industry best practices for penetration testing reporting, as outlined in standards like PTES and NIST SP 800-115, ensuring clear communication of risks and technical findings.

Answer

Provide the same comprehensive report to both audiences, assuming the security team will interpret it for executives.

Answer

Write two separate reports: one for executives with only business impact and another for technical staff with all details.

Answer

Present only the executive summary and invite the technical team to ask questions orally.

Question 14

A vulnerability scanner reports a reflected XSS vulnerability in a web application. Manual testing confirms that the application HTML-encodes all user input in the response. Which scanner misconfiguration is MOST likely causing this false positive?

Accepted Answer

The scanner's payload triggered a server error that echoed back the input without encoding. A server error that echoes back the unencoded input bypasses the application's normal HTML-encoding logic. In this scenario, the vulnerability scanner detects the reflected payload in the error response, which is not subject to the same encoding as the application's standard output. This creates a false positive because the reflected XSS is not exploitable through the normal application flow, but only through an error condition that the scanner inadvertently triggered.

Answer

The scanner used a POST request instead of a GET request for the payload

Answer

The scanner's payload was reflected in a different context not subject to HTML encoding

Answer

The scanner used a payload with special characters that were truncated by the server

Question 15

A penetration tester is using Burp Suite to intercept and modify HTTP traffic. When browsing to an HTTPS site, the tester observes that the requests are encrypted and not being intercepted by Burp. Which configuration step is most likely missing?

Accepted Answer

The Burp CA certificate has not been installed in the browser's trust store. Burp Suite intercepts HTTPS traffic by acting as a man-in-the-middle, which requires the browser to trust Burp's self-signed CA certificate. Without installing the Burp CA certificate in the browser's trust store, the browser will refuse to establish a TLS connection through the proxy, leaving requests encrypted end-to-end and invisible to Burp.

Answer

The proxy listener is not configured to listen on the correct port

Answer

The browser's proxy settings are not configured to use Burp

Answer

The target site is not in Burp's scope