PT0-002 Practice Test 35 — 15 Questions

Question 1

You are conducting a penetration test for a financial institution. The rules of engagement specify that you are not to access any production customer data. During the test, you discover a SQL injection vulnerability in a public-facing web application that allows you to extract customer personally identifiable information (PII). You successfully demonstrate the injection but do not extract any actual PII. According to ethical guidelines and the rules of engagement, what is the appropriate course of action?

Accepted Answer

Immediately stop the test and notify the client with details of the finding.. Accessing PII would violate the ROE and likely breach confidentiality. The best practice is to halt testing, notify the client immediately, and let them assess the critical risk. Option A violates ROE; C ignores the urgency; D fails to alert the client promptly.

Answer

Extract a small sample of PII to prove impact, then report the vulnerability.

Answer

Continue the test but avoid exploiting the SQL injection further to stay within scope.

Answer

Document the vulnerability and include it in the final report without further action.

Question 2

You are contracted to perform a penetration test for a healthcare organization. During the testing, you discover a critical SQL injection vulnerability that exposes patient health information. The deadline for the final report is one week away. The client's IT manager asks you to exclude this finding from the report because they are already aware of it and are working on a fix. The IT manager claims that including it would cause panic among stakeholders. What is the BEST course of action?

Accepted Answer

Explain that findings must be included in the report regardless of awareness, and offer to present the finding in a controlled manner to management. Option A is correct. According to reporting best practices, all findings must be documented regardless of awareness. Offering to present the finding in a controlled manner addresses the client's concern while ensuring transparency. Option B is wrong because verbal notes are not part of the formal report and may be forgotten. Option C is wrong because hiding the finding in an appendix still includes it but may not give it appropriate visibility. Option D is wrong because bypassing the IT manager could damage trust and violate reporting protocols.

Answer

Agree to exclude it but note it verbally

Answer

Report the issue to the client's compliance officer without informing the IT manager

Answer

Include it only in the technical appendix

Question 3

You are conducting a penetration test on a web application that uses a JavaScript challenge-response authentication mechanism. During testing, you notice that the client-side JavaScript code is heavily obfuscated and includes a function that seems to compute a token based on user input and a server-provided nonce. Your goal is to bypass the authentication by generating valid tokens without interacting with the server's intended logic. You have extracted the obfuscated JavaScript and used a beautifier to make it more readable, but the logic is still complex. Which of the following approaches is most likely to succeed in bypassing the authentication?

Accepted Answer

Use a JavaScript debugger to dynamically analyze the obfuscated function and replicate its token generation. Option D is correct because using a JavaScript debugger to step through the obfuscated code allows you to understand the token generation logic and replicate it locally. Option A is wrong because sending random tokens has a negligible chance of success. Option B is wrong because brute-forcing the token algorithm is impractical without understanding the logic. Option C is wrong because replaying the nonce from a previous session will likely be rejected by the server due to nonce expiration or reuse protection.

Answer

Capture a valid token and replay it with a new nonce

Answer

Send random tokens to the server and rely on statistical guessing

Answer

Use a brute-force script to try all possible token values based on the nonce

Question 4

Refer to the exhibit. A penetration tester finds this configuration file during an assessment. Which of the following is the most critical security concern with this configuration?

Accepted Answer

The use of LDAP instead of LDAPS. LDAP transmits credentials and queries in cleartext over TCP port 389, making it vulnerable to sniffing and credential theft. LDAPS (LDAP over SSL/TLS) encrypts the entire session on port 636, protecting the bind password and directory data in transit. Since the configuration uses LDAP instead of LDAPS, an attacker on the network can capture the bind password and potentially gain unauthorized access to the directory service.

Answer

The bind password is stored in plaintext

Answer

The server name is an internal hostname

Answer

The port is non-standard

Question 5

A tester is using the following Nmap command: nmap -sC -sV -p 1-65535 target_ip. What is the primary purpose of the -sC option?

Accepted Answer

Use default scripts. The -sC option in Nmap is equivalent to --script=default, which runs a collection of common, non-intrusive enumeration scripts against the target. These scripts perform tasks such as service banner grabbing, HTTP title extraction, and SSL/TLS certificate retrieval, providing valuable reconnaissance data without requiring manual script selection.

Answer

Scan all ports

Answer

Perform a version scan

Answer

Do a SYN scan

Question 6

A penetration tester is using a vulnerability scanner that reports a 'Critical' severity for an 'SMBv1 vulnerability' on a Windows server. Which of the following is the correct remediation recommendation?

Accepted Answer

Disable SMBv1 on the server. The correct remediation for an SMBv1 vulnerability is to disable SMBv1 on the server. SMBv1 is a legacy protocol that lacks modern security features and is known to be exploited by malware like EternalBlue (used in WannaCry). Disabling SMBv1 eliminates the attack surface without affecting SMBv2 or SMBv3, which are secure and still functional.

Answer

Apply the latest Windows security patches

Answer

Enable SMB signing

Answer

Enable SMB encryption

Question 7

A penetration tester discovers that a previously reported vulnerability from a prior test has not been remediated. How should this be communicated in the current report?

Accepted Answer

Include it as a recurring finding and note the lack of remediation.. Option B is correct because penetration testing standards (e.g., PTES, OWASP) require that previously identified vulnerabilities that remain unpatched be documented as recurring findings with explicit reference to the prior report. This ensures the client understands the risk persists and can track remediation progress over time. Including the finding with a note on lack of remediation maintains the integrity of the current risk assessment and supports compliance with reporting frameworks like NIST SP 800-115.

Answer

Only mention it in the executive summary, referencing the past report.

Answer

Omit the finding to avoid repetition.

Answer

Reduce the severity rating because it was already reported.

Question 8

A penetration tester is exploiting a web application that stores session tokens in HTTP cookies without the HttpOnly flag. Which attack is most likely to succeed?

Accepted Answer

Session hijacking through cross-site scripting. The absence of the HttpOnly flag on session cookies allows client-side scripts (e.g., JavaScript) to access the cookie. An attacker can exploit a cross-site scripting (XSS) vulnerability to execute arbitrary JavaScript in the victim's browser, which then reads the session cookie and sends it to the attacker. This enables session hijacking without needing to guess or brute-force the token.

Answer

SQL injection

Answer

Cross-site request forgery

Answer

Server-side request forgery

Question 9

A penetration tester is performing a man-in-the-middle attack on a network using ARP spoofing. What is the primary purpose of ARP spoofing?

Accepted Answer

To associate the attacker's MAC address with the IP address of a legitimate host. ARP spoofing works by sending forged ARP replies to associate the attacker's MAC address with the IP address of a legitimate host (e.g., the default gateway). This causes traffic destined for that IP to be sent to the attacker instead, enabling interception and manipulation of network communications.

Answer

To assign a fake IP address to the attacker's device

Answer

To modify the routing table of the target

Answer

To poison the DNS cache of the target

Question 10

Which of the following tools is primarily used for enumerating subdomains via search engine queries?

Accepted Answer

theHarvester. theHarvester is specifically designed to gather emails, subdomains, IPs, and URLs from public sources, including search engines like Google, Bing, and Yahoo. It leverages search engine APIs and scraping techniques to enumerate subdomains without directly interacting with the target infrastructure, making it the correct tool for this task.

Answer

Metasploit

Answer

Netcat

Answer

Nmap

Question 11

A penetration tester is performing a social engineering campaign against a client. The tester wants to send a phishing email that bypasses the email security gateway and appears to come from an internal source. Which technique is most effective?

Accepted Answer

Set the Reply-To address to an attacker-controlled email. Setting the Reply-To address to an attacker-controlled email is the most effective technique because many email security gateways (ESGs) perform SPF, DKIM, and DMARC validation on the SMTP envelope sender (Return-Path) but do not validate the Reply-To header. By spoofing the From address to an internal user and setting Reply-To to an attacker-controlled address, replies bypass the ESG's authentication checks while the email appears to come from an internal source, increasing the likelihood of user interaction.

Answer

Insert a custom email header that mimics internal mail

Answer

Use a URL shortener to hide the malicious link

Answer

Register a similar domain and spoof the display name

Question 12

During a red team engagement, a penetration tester needs to pivot from a compromised internal web server to a database server that is not directly accessible. The web server has two network interfaces: 10.0.1.5 and 192.168.1.5. The database server is at 192.168.1.10. Which technique should the tester use to reach the database?

Accepted Answer

Pivoting through the web server. D is correct because the web server has two network interfaces (10.0.1.5 and 192.168.1.5), making it a dual-homed host that can act as a pivot point. The tester can use the compromised web server as a proxy or relay to route traffic from the attacker's machine (reachable via 10.0.1.5) to the database server at 192.168.1.10, which is on a separate subnet not directly accessible. This technique, known as pivoting, typically involves tools like SSH port forwarding, Metasploit's route add, or a SOCKS proxy to forward traffic through the compromised host.

Answer

ARP spoofing

Answer

DNS tunneling

Answer

Port knocking

Question 13

A penetration tester is exploiting a Linux system that has ASLR enabled but no stack canaries. The vulnerability is a classic stack-based buffer overflow. Which of the following is the most effective method to achieve code execution?

Accepted Answer

Return to the PLT entry for system(). Option C is correct because with ASLR enabled, direct shellcode injection fails due to randomized stack addresses, but the PLT entry for system() has a fixed, known address in the binary. Since there are no stack canaries, a simple buffer overflow can overwrite the return address to jump directly to system() in the PLT, passing a pointer to a command string (e.g., "/bin/sh") already in memory, achieving code execution without needing to know runtime addresses.

Answer

Prepend a NOP sled and inject shellcode into the buffer

Answer

Return-to-libc (ret2libc)

Answer

Use a ROP chain to bypass ASLR and execute shellcode

Question 14

A penetration tester needs to escalate privileges on a Linux target after gaining initial shell access. The /etc/passwd file shows a user 'jake' with UID 0. What does this indicate?

Accepted Answer

The user 'jake' has the same privileges as root. In Linux, a UID (User ID) of 0 is reserved exclusively for the root superuser. When the /etc/passwd file shows a user 'jake' with UID 0, the system treats 'jake' with the same privileges as root, regardless of the username. This is because the kernel checks the UID, not the username, for permission decisions. Therefore, 'jake' has full root-level access, making option C correct.

Answer

The user 'jake' is a normal user with UID misconfiguration

Answer

The user 'jake' is a member of the root group

Answer

There is a duplicate user 'jake' and 'root'

Question 15

A penetration tester is targeting a web application that uses parameterized queries for all database interactions. Which attack vector is most likely to succeed?

Accepted Answer

Business logic flaws. Parameterized queries prevent SQL injection by separating SQL code from user input, making option B ineffective. Business logic flaws (D) are vulnerabilities in the application's design or workflow that are not mitigated by secure coding practices like parameterized queries, so they remain exploitable. This attack vector targets the intended functionality of the application, such as manipulating pricing or bypassing authentication steps, which parameterized queries do not protect against.

Answer

Cross-site request forgery

Answer

SQL injection

Answer

Cross-site scripting