PT0-002 Practice Test 34 — 15 Questions

Question 1

A penetration tester is performing passive reconnaissance on a target organization. Which of the following tools would be BEST suited to gather information about the organization's domain names, email addresses, and subdomains from publicly available sources without directly interacting with the target's systems?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

theHarvester. theHarvester is specifically designed for passive reconnaissance, gathering domain names, email addresses, subdomains, and other publicly available information from search engines and public sources without directly interacting with the target's systems. It queries sources like Google, Bing, and LinkedIn, making it ideal for this task.

Answer

Nmap

Answer

Nessus

Answer

Metasploit

Question 2

A client has a critical web application that cannot be tested in the production environment due to availability requirements. A staging environment exists that exactly mirrors production, but it uses different IP addresses, domain names, and a subset of data. The staging environment is isolated from production networks. Which scoping element is most important to include in the rules of engagement to ensure a valid test?

Accepted Answer

Explicitly define the staging environment as the target scope. The staging environment is an exact mirror of production but uses different IP addresses, domain names, and a subset of data. Explicitly defining the staging environment as the target scope ensures the tester focuses all activities on the authorized systems, preventing any accidental impact on production. This scoping element is critical for a valid test because it aligns the test with the client's availability requirements while still allowing comprehensive security testing on a representative environment.

Answer

Require the tester to use non-disruptive testing techniques only

Answer

Include the production IP ranges in the scope 'just in case'

Answer

Specify that the test must be performed from the internet only

Question 3

A penetration tester is planning to perform a vulnerability scan of an internal network. Which of the following should be considered before scanning? (Choose three.)

Accepted Answer

Obtain written authorization from the client. Option A is correct because written authorization from the client is a legal and ethical prerequisite before any vulnerability scanning; without it, the tester could be committing unauthorized access under laws such as the CFAA. Option B is correct because defining the scope and rules of engagement establishes which IP ranges, hosts, and time windows are permitted, preventing accidental disruption of production systems or scanning of out-of-scope assets. Option D is correct because vulnerability scanners rely on up-to-date plugin/signature databases (e.g., Nessus plugins, OpenVAS NVTs) to accurately detect current CVEs; outdated signatures produce false negatives and unreliable results. Option C is incorrect because scanning during peak business hours risks service degradation and is generally avoided unless explicitly authorized in the rules of engagement. Option E is incorrect because running every available exploit module is not a pre-scan consideration and would exceed the typical scope of a vulnerability scan, potentially causing damage and violating engagement boundaries.

Answer

Perform the scan during peak business hours

Answer

Test all available exploit modules

Question 4

A penetration tester has gained a shell on a Linux machine as a low-privileged user. The user can execute the binary 'less' with sudo privileges without a password. Which technique can the tester use to escalate privileges to root?

Accepted Answer

Use the '!' command within 'less' to execute a shell.. The 'less' binary, when executed with sudo, retains its ability to spawn a shell via the '!' command. Since the user can run 'less' as root without a password, typing '!/bin/bash' (or simply '!bash') inside 'less' will execute a shell with root privileges, effectively escalating to root.

Answer

Exploit a buffer overflow in the 'less' binary.

Answer

Run 'sudo -u root bash' to switch to a root shell.

Answer

Modify the PATH to trick sudo into running a malicious binary.

Question 5

During a cloud security assessment of AWS, a tester wants to identify misconfigurations using automated tools. Which THREE tools are specifically designed for AWS security auditing?

Accepted Answer

Pacu. Pacu is an open-source AWS exploitation framework designed for offensive security testing. It automates the identification of misconfigurations, such as overly permissive IAM policies, exposed S3 buckets, and vulnerable Lambda functions, making it a correct choice for cloud security auditing.

Answer

Hashcat

Answer

CrackMapExec

Question 6

After gaining initial access to a Windows domain controller, a tester wants to extract password hashes from the SAM database and domain account hashes. Which Impacket tool is designed for this purpose?

Accepted Answer

secretsdump.py. D is correct because secretsdump.py is the Impacket tool specifically designed to extract password hashes from the SAM database and domain account hashes (NTDS.dit) on a Windows domain controller. It can perform remote dump operations using techniques like DRSUAPI replication or volume shadow copy, making it the standard choice for credential harvesting in penetration testing.

Answer

psexec.py

Answer

GetUserSPNs.py

Answer

wmiexec.py

Question 7

During a network penetration test, the tester identifies that a web server is vulnerable to a buffer overflow. The server is running on a Windows system with DEP enabled. Which technique should the tester use to bypass DEP?

Accepted Answer

Return-Oriented Programming (ROP). Return-Oriented Programming (ROP) is the correct technique to bypass Data Execution Prevention (DEP) on Windows. DEP marks memory pages (like the stack and heap) as non-executable, preventing direct shellcode execution. ROP chains together small instruction sequences (gadgets) already present in executable memory (e.g., in loaded DLLs) to achieve arbitrary behavior without injecting or executing new code.

Answer

Return-to-libc attack

Answer

Use a NOP sled and shellcode injection

Answer

Stack pivoting

Question 8

A penetration tester has compromised a Linux host and wants to use it as a pivot point to access an internal network that is not directly reachable from the attacker's machine. Which tool can create a SOCKS proxy for routing traffic through the compromised host?

Accepted Answer

chisel. Chisel is a fast TCP/UDP tunnel over HTTP that can create a SOCKS proxy for pivoting.

Answer

Responder

Answer

nmap

Answer

netcat

Question 9

During a penetration test, a tester gains initial access to a Linux server and wants to pivot to an internal network that is not directly accessible. Which of the following tools is specifically designed for creating SOCKS proxies for pivoting?

Accepted Answer

chisel. Chisel is a tool that creates tunnels and SOCKS proxies over HTTP, ideal for pivoting through restrictive networks.

Answer

netcat

Answer

nmap

Answer

hydra

Question 10

A penetration testing firm is hired to assess a client's web application that integrates with a third-party payment processor's API. The client wants to include the payment processor's API in the test scope. Which action should the tester take FIRST?

Accepted Answer

Request written permission from the payment processor. The correct first action is to request written permission from the payment processor because the API is owned and operated by a third party, not the client. Testing a third-party API without explicit authorization could violate the Computer Fraud and Abuse Act (CFAA) and the payment processor's terms of service, potentially leading to legal liability for both the tester and the client. The scope of a penetration test must be legally defined and agreed upon by all parties whose systems are being tested.

Answer

Begin testing the API because it is part of the client's environment

Answer

Only test the client's internal systems, excluding the API

Answer

Use the payment processor's sandbox environment without notifying them

Question 11

A penetration tester wants to crack NTLM hashes obtained from a Windows system. Which Hashcat mode should be used?

Accepted Answer

-m 1000. Hashcat mode 1000 is for NTLM hashes.

Answer

-m 22000

Answer

-m 0

Answer

-m 13100

Question 12

A penetration tester is attempting to exploit a Linux system that has ASLR and DEP enabled. The tester has identified a buffer overflow vulnerability in a network service compiled without stack canaries and with a non-executable stack (NX). The binary is statically linked and not PIE. Which exploitation technique is most likely to succeed under these conditions?

Accepted Answer

Return-Oriented Programming (ROP) to call mprotect and then execute shellcode on the stack. The binary is statically linked (no libc to return to) and has a non-executable stack (NX), so shellcode cannot execute directly on the stack. Return-Oriented Programming (ROP) allows the attacker to chain gadgets from the binary itself to call mprotect() and change the stack region to executable, then pivot to shellcode placed on the stack. Since ASLR is enabled but the binary is not PIE, its code base address is fixed, making ROP gadgets reliably addressable.

Answer

Heap spraying to place shellcode in the heap and then overwrite a function pointer to execute the shellcode

Answer

Return-to-libc attack using libc functions

Answer

Ret2plt to call system() via the PLT

Question 13

During a penetration test, a tester needs to perform a deauthentication attack to force a client to reconnect and capture the WPA handshake. Which two tools from the Aircrack-ng suite are required? (Choose TWO.)

Accepted Answer

aireplay-ng. Airodump-ng captures the handshake, and aireplay-ng sends deauth packets.

Answer

airmon-ng

Answer

aircrack-ng

Answer

airolib-ng

Question 14

A penetration tester is preparing a report and wants to include proof-of-concept code to demonstrate a vulnerability. Which of the following is the best practice for including such code?

Accepted Answer

Provide code that demonstrates the vulnerability in a responsible manner without destructive payloads.. Proof-of-concept code should prove the vulnerability is exploitable without causing harm to the client's environment.

Answer

Include fully automated exploit scripts that could be used for attacks.

Answer

Include code that extracts sensitive data to prove impact.

Answer

Omit code and only describe the vulnerability verbally.

Question 15

A penetration tester is preparing the executive summary. Which THREE elements should be included? (Choose three.)

Accepted Answer

Key findings summary. Executive summary should include overall risk rating, key findings, and strategic recommendations. Technical details and methodology are not appropriate for this section.

Answer

Detailed exploit steps for each vulnerability

Answer

Description of the testing methodology