PT0-002 Practice Test 35 — 15 Questions

Question 1

A penetration tester is reviewing a Python script that automates a common network attack. The script imports the 'ftplib' and 'telnetlib' libraries. It reads a list of IP addresses from a file and, for each host, attempts to connect using a predefined username and password. If the connection succeeds, it logs the success. Which attack is the script most likely performing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Brute-force attack against FTP and Telnet services. The script uses 'ftplib' and 'telnetlib' to attempt connections with a predefined username and password against multiple IP addresses. This is characteristic of a brute-force attack, where the attacker tries a single credential pair against many hosts to gain unauthorized access to FTP and Telnet services.

Answer

Vulnerability scanning for open ports

Answer

Password spraying attack against web applications

Answer

Service enumeration using banner grabbing

Question 2

A penetration tester is documenting evidence for a finding and takes a screenshot. Which of the following is the most important metadata to include with the screenshot?

Accepted Answer

A timestamp. Timestamps provide context and prove when the evidence was captured.

Answer

The tool version used

Answer

The file size of the screenshot

Answer

The tester's name

Question 3

During a Linux privilege escalation attempt, a tester finds a binary with the SUID bit set that is not on the GTFOBins list. The binary executes /bin/bash with the effective UID of root. What is the most likely way to exploit this?

Accepted Answer

Run the binary with the -p flag. When an SUID binary executes /bin/bash, bash will drop the effective UID unless the -p (privileged) flag is used. Running the binary with '-p' preserves the effective UID, granting a root shell. Simply running the binary may result in a shell with the original user's privileges.

Answer

Use GTFOBins to find a suitable exploit

Answer

Perform a buffer overflow on the binary

Answer

Modify the PATH to include a fake binary

Question 4

A penetration tester is engaged to perform a red team exercise for a large enterprise. The client wants the test to simulate a realistic attack from an external threat actor. Which of the following scoping elements is most important to include in the rules of engagement?

Accepted Answer

The time window for the test. In a red team exercise simulating an external threat actor, the rules of engagement must define the time window for testing to ensure the test aligns with operational constraints and minimizes business disruption. This scoping element is critical because it sets legal and logistical boundaries, such as avoiding peak business hours or maintenance windows, which is a core requirement for realistic yet safe adversarial simulation.

Answer

A list of all IP addresses to be scanned

Answer

The amount of data to be exfiltrated

Answer

The specific vulnerabilities to be exploited

Question 5

During an internal penetration test, a tester is trying to identify live hosts on a network segment. The tester wants to avoid generating a high volume of traffic or alerts. Which scanning technique is most appropriate for this task?

Accepted Answer

ARP ping scan. An ARP ping scan (option D) is the most appropriate technique because it operates at Layer 2 (Data Link layer) using ARP requests to determine if an IP address is active on the local subnet. Since ARP traffic is confined to the local broadcast domain and does not generate IP-level packets, it produces minimal network traffic and is unlikely to trigger IDS/IPS alerts, making it ideal for stealthy host discovery on a local network segment.

Answer

Full TCP connect scan on common ports

Answer

ICMP echo request sweep

Answer

SYN stealth scan on port 80 and 443

Question 6

After the penetration test, the client requests a one-page summary of the test's scope, key findings, and recommended next steps for the board of directors. Which document should the penetration tester provide?

Accepted Answer

Executive Summary. The executive summary is specifically designed to provide a high-level overview of the penetration test's scope, key findings, and recommended next steps for non-technical stakeholders like the board of directors. It distills complex technical details into business-focused language, enabling informed decision-making without requiring deep cybersecurity expertise.

Answer

Detailed Technical Report

Answer

Vulnerability Scan Report

Answer

Remediation Plan

Question 7

A penetration tester is analyzing a Python script that uses the 'socket' module to create a TCP connection to a target IP and port. The script then sends a payload (e.g., 'GET / HTTP/1.0

') and waits for a response. Which tool function is this script most likely performing?

Accepted Answer

Banner grabbing. The script creates a TCP connection, sends an HTTP GET request, and waits for a response. This is the classic behavior of banner grabbing, where the goal is to retrieve the service banner (e.g., HTTP server version) from the target. The 'socket' module is used to manually craft the connection and payload, which is a low-level technique for service identification, not for scanning multiple ports or assessing vulnerabilities.

Answer

Port scanning

Answer

Vulnerability scanning

Answer

Password cracking

Question 8

A penetration tester is analyzing a Bash script that contains the following line: 'for ip in $(cat ip_list.txt); do nc -zv $ip 22; done'. What is the primary purpose of this script?

Accepted Answer

To test if port 22 is open on each IP in the list. The script uses `nc -zv $ip 22` which performs a TCP connection test to port 22 on each IP from the list. The `-z` flag tells netcat to scan without sending any data, and `-v` enables verbose output, so it only reports whether the connection succeeded (port open) or failed (port closed or filtered). This is a classic port connectivity check, not a full banner grab or shell establishment.

Answer

To perform a banner grab on port 22 for each IP

Answer

To establish a remote shell connection to each IP on port 22

Answer

To scan all 65535 ports on each IP in the list

Question 9

During a penetration test, a tester identifies a buffer overflow vulnerability in a Linux binary. The system has ASLR and NX (Non-Executable) enabled. The tester finds a ROP gadget at a fixed address in a library that is loaded at a constant address across reboots. Which exploitation method is the most appropriate to achieve code execution?

Accepted Answer

Return-Oriented Programming (ROP) chain. Return-Oriented Programming (ROP) is specifically designed to bypass both ASLR and NX when a fixed-address ROP gadget is available. Since the library is loaded at a constant address across reboots, the tester can chain gadgets from that library to execute arbitrary code without needing to inject executable shellcode.

Answer

Return-to-libc attack

Answer

Heap spraying

Answer

SEH overwrite exploit

Question 10

A company wants to test the security of their internet-facing web application without impacting production servers or user data. The tester must be authorized to attempt authentication bypass and SQL injection. Which item is most critical to include in the scope definition to ensure the test is focused and lawful?

Accepted Answer

A list of target URLs and IP addresses of the web application. The scope definition must explicitly list target URLs and IP addresses to establish legal authorization boundaries and prevent unintended access to production systems. Without precise targets, the tester could inadvertently impact non-authorized systems, violating the rules of engagement and potentially causing data breaches or service disruption.

Answer

A list of user accounts with credentials for authenticated testing

Answer

A detailed testing schedule and hours of operation

Answer

The testing methodology and tools to be used

Question 11

A penetration tester is performing active reconnaissance on a target network. The tester sends TCP SYN packets to a range of ports on a target host. Only a few ports respond with SYN-ACK packets. What does this indicate?

Accepted Answer

The ports that responded with SYN-ACK are open.. The TCP three-way handshake begins with a SYN packet; a SYN-ACK response indicates that the target port received the SYN and is willing to establish a connection, meaning the port is open and listening. Only ports that respond with SYN-ACK are confirmed open, while others may be closed or filtered, but the presence of any SYN-ACK replies directly indicates open ports.

Answer

The host is protected by a firewall that drops all packets.

Answer

The host is running a stealthy IDS.

Answer

The network is using IPv6.

Question 12

A penetration tester is performing passive reconnaissance on a target organization. Which of the following activities would be considered passive reconnaissance?

Accepted Answer

Using a search engine to find exposed documents. Passive reconnaissance involves gathering information without directly interacting with the target's systems. Using a search engine to find exposed documents (e.g., via Google dorking) relies on publicly indexed data, which does not send any packets to the target's infrastructure. This aligns with the definition of passive reconnaissance as it leverages third-party sources rather than engaging the target directly.

Answer

Scanning open ports on the target web server

Answer

Sending a crafted ICMP echo request to the target

Answer

Attempting a SQL injection on a login form

Question 13

A penetration tester is analyzing a Bash script that automates a password spraying attack. The script contains the following loop: 'for user in $(cat users.txt); do for pass in $(cat passwords.txt); do curl -s -o /dev/null -w "%{http_code}" --data "user=$user&pass=$pass" http://target/login; done; done'. The script runs but the output is a continuous stream of HTTP status codes that are hard to interpret. Which improvement would most effectively help the tester identify a successful login?

Accepted Answer

Add a conditional statement that checks if the HTTP status code is 302 (redirect) or 200, and if so, prints the successful credentials.. The script currently outputs a raw stream of HTTP status codes with no context. Adding a conditional to check for 302 (redirect, often indicating a successful login) or 200 (OK) and printing the corresponding credentials allows the tester to immediately identify which user/password pair succeeded, turning an unreadable output into actionable intelligence.

Answer

Add a delay with 'sleep 1' between requests to avoid rate limiting.

Answer

Pipe the output to 'grep -v 200' to exclude any responses that are not 200 OK.

Answer

Use 'curl -v' to see the full response headers.

Question 14

A penetration tester has completed an engagement and needs to present findings to a mixed audience of technical engineers and business executives. Which section of the penetration test report is BEST suited for communicating high-level risk ratings and potential business impact to the non-technical stakeholders?

Accepted Answer

Executive Summary. The Executive Summary is the correct section because it is specifically designed to communicate high-level risk ratings, business impact, and strategic recommendations to non-technical stakeholders such as executives. It avoids technical jargon and focuses on the business context, aligning with the PT0-002 objective of tailoring reports to the audience.

Answer

Technical Findings and Vulnerability Details

Answer

Remediation Steps

Answer

Appendix

Question 15

During a Windows privilege escalation attempt, a tester finds that the SeImpersonatePrivilege is enabled for the current user. Which tool can be used to escalate privileges to SYSTEM using this privilege?

Accepted Answer

PrintSpoofer. PrintSpoofer is a tool that exploits SeImpersonatePrivilege to impersonate SYSTEM tokens.

Answer

Mimikatz

Answer

Windows-Exploit-Suggester

Answer

PowerUp