PT0-002 Practice Test 34 — 15 Questions

Question 1

A penetration tester is assessing a custom web application that uses JSON Web Tokens (JWT) for authentication. The tester suspects the token may be using a weak secret. Which tool is best suited to attempt cracking the JWT secret?

Accepted Answer

Hashcat. Hashcat is a powerful password cracking tool that can crack JWT secrets using dictionary or brute-force attacks. John the Ripper is similar but hashcat is generally faster and more GPU-optimized. DirBuster is for directory discovery, sqlmap for SQL injection, and Burp Suite Intruder can be used but is less efficient for offline cracking.

Answer

DirBuster

Answer

Burp Suite Intruder

Answer

sqlmap

Question 2

During a penetration test, a tester needs to perform a man-in-the-middle (MITM) attack on a local network to capture credentials. Which tool should the tester use to ARP spoof and intercept traffic?

Accepted Answer

Ettercap. Ettercap is a comprehensive MITM tool that supports ARP spoofing, sniffing, and injection. Wireshark is for packet analysis, not active spoofing. TCPDump is for packet capture only. Nmap can be used for discovery but not MITM.

Answer

Wireshark

Answer

Nmap

Answer

TCPDump

Question 3

Which TWO of the following are benefits of using a fuzzing tool during the code analysis phase of a penetration test? (Select TWO.)

Accepted Answer

Identifies input validation vulnerabilities. Fuzzing can discover input validation flaws (A) and reveal crashes or error conditions (D). It does not directly perform static code analysis (B) or validate authentication (C). It may help find buffer overflows, but that is a subset of input validation issues.

Answer

Replaces the need for static code analysis

Answer

Validates authentication mechanisms

Answer

Guarantees 100% code coverage

Question 4

A penetration tester is performing an internal network assessment and needs to quickly identify all live hosts and their open ports across a large subnet (10.0.0.0/16). The tester wants to minimize network disruption and avoid IDS detection. Which tool and technique should the tester use?

Accepted Answer

Use a combination of ping sweep with fping followed by nmap -sS (SYN scan) on discovered hosts. Option B is correct because it reduces the scan scope with a ping sweep, then uses a stealthy SYN scan to identify open ports, minimizing traffic and detection risk. Option A scans all ports with connect scan which is noisy. Option C is extremely slow and inefficient. Option D masscan is fast but less stealthy and may still trigger alerts.

Answer

Use nmap with -sT (TCP connect scan) and -p- (all ports) on the entire subnet

Answer

Use masscan with a low rate (--rate=100) to scan all ports on all IPs

Answer

Use netcat to perform a sequential port scan on each IP in the subnet

Question 5

During a penetration test of a corporate network, you discover a Linux server running a custom Python application that handles authentication for a web portal. The server is configured to allow SSH access only from a specific management subnet. You have obtained a limited shell on a different host within the same VLAN as the target server. From your limited shell, you can reach the target server on TCP port 22, but you do not have valid credentials. The Python authentication script uses a flat file database to store user credentials in the format 'username:hashed_password'. You suspect the script has a vulnerability that allows reading arbitrary files, such as the password file. Which of the following actions should you take to exploit this vulnerability?

Accepted Answer

Craft an HTTP request to the web portal's authentication script with a path traversal payload to read the password file. Option C is correct because a path traversal vulnerability in the authentication script can be used to read arbitrary files, including the password file, allowing you to extract hashes. Option A is wrong because brute-forcing SSH without knowing the management subnet source is unlikely to succeed and may be blocked. Option B is wrong because port knocking is not indicated in the scenario. Option D is wrong because Wireshark is not available from the limited shell and would require local privilege escalation.

Answer

Use Wireshark on the limited shell to capture SSH traffic and extract credentials

Answer

Perform a port knocking sequence to open SSH access to the target server

Answer

Use Hydra to brute-force SSH credentials from the limited shell because it is on the same VLAN

Question 6

A penetration tester is conducting an external assessment of a target organization and wants to gather information without sending any packets that might be logged by the target's network monitoring systems. Which TWO of the following methods are considered passive reconnaissance?

Accepted Answer

Use Shodan to identify exposed services. Passive reconnaissance involves collecting information from publicly available sources without directly interacting with the target's systems. WHOIS lookups and Shodan searches both rely on public databases and do not send probes to the target network. DNS queries (option D) can be logged by the target's DNS servers and are therefore active. Port scanning (option A) and phishing emails (option C) are active techniques that directly interact with the target.

Answer

Send spear-phishing emails to employees

Answer

Query the target's DNS servers using nslookup

Answer

Perform a full port scan using Nmap

Question 7

Refer to the exhibit. A penetration tester performed an Nmap scan of a target server and received the above output. The tester recalls that one of these services is associated with a well-known remote code execution vulnerability that can be exploited without authentication. Which service is most likely vulnerable?

Accepted Answer

Microsoft-DS (port 445). Port 445/tcp is Microsoft-DS (SMB). The SMB protocol has known remote code execution vulnerabilities such as EternalBlue (MS17-010) that can be exploited without authentication. SSH (option A) and HTTP (option B) typically require credentials or application-level vulnerabilities. RDP (option D) has had vulnerabilities, but the most notorious unauthenticated RCE on SMB is EternalBlue.

Answer

HTTP (port 80)

Answer

SSH (port 22)

Answer

ms-wbt-server (port 3389)

Question 8

Refer to the exhibit. A penetration tester is presenting this finding to a non-technical executive. Which improvement should be made to the description?

Accepted Answer

Describe the business impact in plain language. Describing the business impact in plain language helps executives understand the risk without technical jargon.

Answer

Include the CVSS vector

Answer

List the exact database tables affected

Answer

Add a proof-of-concept screenshot

Question 9

A penetration tester is developing a rules of engagement document for a client. Which TWO elements should the tester include to ensure proper scope boundaries?

Accepted Answer

Target IP addresses and subnets. The rules of engagement should clearly define what is in scope and how to handle findings. Target IP addresses and subnets (B) specify the scope of systems to test, and escalation procedures (D) outline how to communicate critical findings. While authorized tools (A) may be listed, they are not scope boundaries; privileged credentials (C) are sometimes provided but not a scope boundary; emergency contact info (E) is typically part of incident response, not ROE scope.

Answer

List of authorized testing tools

Answer

Credentials for privileged accounts

Answer

Emergency contact information for law enforcement

Question 10

Refer to the exhibit. A penetration tester has run an initial reconnaissance scan and obtained the above output. The tester needs to decide which attack vector to prioritize based on the principle of exploiting the oldest software version. Which of the following is the most appropriate next step?

Accepted Answer

Launch a brute-force attack against SSH. The SSH service is running OpenSSH 6.6, which is relatively old and known to have several vulnerabilities that can be exploited via brute-force or remote code execution. Therefore, launching a brute-force attack against SSH is prioritized. The MySQL version (5.1.73) is also old but less likely to be directly exploitable without credentials. The web server version is not listed but Apache 2.4.29 is newer. RDP is a common target but no version indicator suggests it's old.

Answer

Exploit the MySQL service using default credentials

Answer

Attempt to exploit the Remote Desktop Protocol (RDP) service

Answer

Perform a vulnerability scan on the web applications

Question 11

A medium-sized e-commerce company, CyberMart, has contracted your penetration testing firm to assess their security posture. The company operates from three physical locations: headquarters, a data center, and a remote warehouse. They have a flat internal network but separate VLANs for production, development, and guest Wi-Fi. CyberMart's CISO insists that the test must be conducted without causing any disruption to the production environment, especially the payment processing system. The test should simulate an external attacker targeting the public-facing web servers and an internal attacker who has gained initial access to the guest network. The CISO also requests that all testing be done during off-peak hours to minimize impact. You are preparing the rules of engagement. Which of the following is the most appropriate action to include in the ROE to satisfy the client's requirements while maintaining a realistic test scenario?

Accepted Answer

Allow testing on all VLANs except the production VLAN containing payment processing, with a rule to immediately stop if any degradation is observed.. Option C allows testing on all VLANs except the critical production VLAN with payment processing, and includes a stop condition if degradation is observed. This balances realism (testing internal segmentation from guest network) with safety (protecting payment systems). Option A is too restrictive and does not test internal movement from guest network. Option B includes denial-of-service tests which are explicitly not allowed due to disruption. Option D ignores the internal testing requirement entirely.

Answer

Include all VLANs but with explicit permission to conduct denial-of-service tests only during off-peak hours.

Answer

Focus exclusively on the external web servers and exclude internal network testing due to the risk of disruption.

Answer

Restrict testing to only the guest network and external IPs, excluding all production VLANs.

Question 12

A penetration tester is preparing a final report after a web application test. The tester wants to prioritize vulnerabilities based on risk. Which TWO factors should the tester primarily consider when assigning risk ratings?

Accepted Answer

Business impact. CVSS base score and business impact are the primary factors for risk ratings per CompTIA PenTest+ objectives.

Answer

Ease of exploitation

Answer

Number of times the vulnerability was detected

Answer

Time to remediate

Question 13

A penetration tester is examining a compiled binary obtained during an engagement. The tester wants to identify potential buffer overflow vulnerabilities and understand the control flow. Which TWO tools would be most appropriate for this task?

Accepted Answer

OllyDbg. OllyDbg is a debugger that allows dynamic analysis to identify overflow vulnerabilities by examining memory and registers. Ghidra is a disassembler and decompiler that provides static analysis of control flow and potential vulnerabilities. Nmap is a network scanner, Wireshark is a packet analyzer, and Burp Suite is a web proxy, none of which are suitable for binary analysis.

Answer

Wireshark

Answer

Nmap

Answer

Burp Suite

Question 14

Refer to the exhibit. A penetration tester runs this script against a target service and receives the output 'Error: [Errno 104] Connection reset by peer'. What is the most likely cause?

Accepted Answer

The payload caused the service to crash due to a buffer overflow.. The connection reset indicates that the remote server closed the connection abruptly, often because the service crashed. Sending a large payload of 'A' characters suggests a buffer overflow attempt, which could cause the service to crash. Option B correctly identifies this. If the service were not running, the error would be 'Connection refused'. Option C is possible but less likely given the script's purpose. Option D is not supported by the evidence.

Answer

The target service is not running.

Answer

The target service expects a different protocol.

Answer

The target is blocking the IP after detecting scanning.

Question 15

A penetration tester is conducting an internal assessment of a company's web application. The application provides a file upload feature that accepts images but does not validate the file type on the server side. The tester has identified that the application runs on an Apache server with PHP support. The tester wants to execute a command on the server to establish a reverse shell. The tester has a Linux client and has already crafted a PHP reverse shell payload. The tester has also verified that outbound connections are allowed from the server. After uploading the malicious PHP file, the tester attempts to access it via a browser but receives a 404 error. The tester suspects the uploaded file may have been renamed or moved. Which of the following steps should the tester take next to achieve code execution?

Accepted Answer

Check the web server access and error logs to identify the actual path where the file was saved.. The 404 error suggests the file is not at the expected location. Checking the web server access logs can reveal the actual path or filename that the server used for the uploaded file. Option C is the most logical next step. Option A is incorrect because the server is providing a 404, not a parsing error. Option B is premature before determining the file path. Option D would only be relevant if the file were successfully accessed but not executed.

Answer

Modify the PHP payload to avoid detection by antivirus on the server.

Answer

Use a directory listing tool to scan for hidden files in the upload directory.

Answer

Re-upload the file with a different extension like .php5 or .phtml.