PT0-002 Practice Test 36 — 15 Questions

Question 1

Based on the exhibit, which tool would be most effective for exploiting this vulnerability?

Accepted Answer

sqlmap. The error log shows a SQL injection vulnerability. SQLmap is designed to automate SQL injection exploitation. Burp Suite Repeater can manually craft requests, but sqlmap automates the process. Hydra is for password cracking, and Nikto is for web scanning.

Answer

Burp Suite Repeater

Answer

Nikto

Answer

Hydra

Question 2

During a penetration test, the tester encounters a situation where the scope of the test is ambiguous. Which TWO actions should the tester take to clarify the situation?

Accepted Answer

Document the ambiguity and the agreed-upon resolution in the test plan.. When scope is unclear, the tester should communicate with the client and document the assumptions to avoid misunderstandings.

Answer

Proceed with the test based on the tester's best guess.

Answer

Test all systems within the network to ensure thoroughness.

Answer

Ignore the ambiguity and continue testing the original scope.

Question 3

During a web application test, a penetration tester suspects an LDAP injection vulnerability. The application uses user input to dynamically construct an LDAP query. The tester submits the following payload in the username field: 'admin)(&)'. The application returns a list of all users instead of the expected single user. Which of the following best describes the reason this payload was effective?

Accepted Answer

The payload closes the original filter and appends a tautology that returns all objects.. The payload 'admin)(&)' closes the original LDAP filter after 'admin' and appends '(&)' which is a tautology (always true). This causes the LDAP query to match all directory objects, returning the full user list instead of a single user. The attack exploits the way LDAP filters are parsed: injecting a closing parenthesis and a new filter that evaluates to true for every entry.

Answer

The payload causes an LDAP error that triggers a fallback to list all users.

Answer

The payload modifies the base DN to search the entire directory.

Answer

The payload introduces a logical OR that negates the original condition.

Question 4

A penetration tester is performing a client-side attack against a user. The tester sends an email with a malicious attachment that, when opened, executes a macro that downloads a payload. Which type of attack is this?

Accepted Answer

Spear phishing. Spear phishing is a targeted phishing attack where the attacker crafts a personalized email to a specific individual or organization, often including a malicious attachment. In this scenario, the email with a macro-enabled attachment that downloads a payload is a classic spear phishing technique, as it exploits human trust and social engineering to deliver malware. This contrasts with generic phishing, which casts a wide net, and the client-side attack vector relies on the user executing the macro.

Answer

Vishing

Answer

Smishing

Answer

Watering hole

Question 5

A penetration tester uses the CVSS base score to rate a vulnerability. The tester finds that the vulnerability has a high CVSS score but the affected system is isolated from the internet and has no sensitive data. Which approach should the tester take when assigning an overall severity rating?

Accepted Answer

Adjust the severity lower to reflect the reduced business impact.. CVSS is a good starting point but should be adjusted based on business context such as impact and likelihood in the specific environment.

Answer

Increase the severity because the system is isolated and may be overlooked.

Answer

Remove the finding from the report since the system is isolated.

Answer

Use the CVSS score as the final severity rating.

Question 6

A penetration tester wants to perform a network scan that minimizes the chance of detection by an intrusion detection system (IDS). Which Nmap timing template is MOST appropriate?

Accepted Answer

-T0. The -T0 (Paranoid) timing template is the most appropriate for minimizing detection by an IDS because it introduces extreme delays between packet transmissions (up to 5 minutes between probes) and uses a very slow scan rate. This makes the scan traffic blend into normal network noise, reducing the likelihood of triggering signature-based or anomaly-based IDS alerts that rely on detecting rapid, sequential connection attempts.

Answer

-T3

Answer

-T5

Answer

-T2

Question 7

A penetration tester is evaluating a cloud environment (AWS) and finds an S3 bucket with public write access. Which attack is most likely to succeed if the tester wants to plant malicious files that will be served to users?

Accepted Answer

Upload a malicious JavaScript file to the bucket. An S3 bucket with public write access allows anyone to upload objects without authentication. A penetration tester can upload a malicious JavaScript file (e.g., for cross-site scripting or drive-by download) that, when accessed by users via the bucket's public URL, executes in their browsers. This directly exploits the misconfiguration to serve malicious content to end users.

Answer

Exhaust the bucket's storage quota

Answer

Encrypt all objects in the bucket for ransom

Answer

Modify the bucket policy to grant further permissions

Question 8

During a penetration test for a financial institution, the tester discovers that a third-party vendor's system is vulnerable and could expose customer PII. The tester is unsure if the vendor is within scope. How should the tester proceed?

Accepted Answer

Communicate with the client to clarify whether the vendor is in scope. When a penetration tester discovers a vulnerability on a system whose scope status is unclear, the correct professional and ethical action is to stop and clarify scope with the client before doing anything else. Testing an out-of-scope third-party vendor system without authorization could be illegal and violate the rules of engagement. Communicating with the client to confirm scope is the safe, compliant step.

Answer

Perform additional testing on the vendor system to confirm the vulnerability

Answer

Ignore the finding since it is out of scope

Answer

Include the vulnerability in the final report as a high-risk finding

Question 9

During an internal test, a penetration tester discovers a web application that is vulnerable to Server-Side Template Injection (SSTI). The application uses a template engine that does not sandbox user input. Which of the following payloads would be MOST effective to achieve remote code execution on the server?

Accepted Answer

{{config.__class__.__init__.__globals__['os'].popen('id').read()}}. It exploits Python's object model to access the `os` module via `__class__.__init__.__globals__`, bypassing the template engine's lack of sandboxing. This allows the attacker to execute arbitrary system commands like `id` on the server, achieving remote code execution (RCE). The payload is specific to Jinja2 or similar Python-based template engines that expose built-in objects.

Answer

Answer

Answer

${7*7}

Question 10

A penetration tester is using Nmap to scan a target web server. The tester only wants to see which of the top 100 ports are open, but wants to minimize network traffic and time. Which Nmap command is most appropriate?

Accepted Answer

nmap -sV --top-ports 100 target. `--top-ports 100` instructs Nmap to scan only the 100 most commonly open ports, which minimizes network traffic and time compared to scanning all ports or a large range. The `-sV` flag enables version detection, which is not strictly required but is commonly used in information gathering; however, the key factor for minimizing traffic and time is the `--top-ports` option, which uses a statistically derived list to reduce scan scope.

Answer

nmap -sS -p- target

Answer

nmap -sT -p 1-100 target

Answer

nmap -sC -p 1-1000 target

Question 11

A penetration tester is finalizing a report. Which section should include a detailed technical explanation of how each vulnerability was exploited?

Accepted Answer

Findings and Recommendations. The Findings and Recommendations section is the correct place for detailed technical explanations of how each vulnerability was exploited because it provides the technical audience (e.g., system administrators, developers) with the step-by-step attack chain, including specific commands, payloads, and tools used. This section bridges the gap between raw scan data and actionable remediation, ensuring that the technical team can reproduce and verify the findings. The Executive Summary is too high-level for this detail, and the Methodology section describes the overall approach, not per-vulnerability exploitation steps.

Answer

Executive Summary

Answer

Methodology

Answer

Appendix

Question 12

A penetration tester is conducting passive reconnaissance on a target organization. Which of the following techniques would provide the MOST useful information about internal network architecture without directly interacting with the target's systems?

Accepted Answer

Searching for the target's SSL certificates in Certificate Transparency logs. Certificate Transparency (CT) logs are publicly accessible, append-only ledgers of SSL/TLS certificates. By searching CT logs for certificates issued to the target organization, a penetration tester can discover subdomains, hostnames, and even internal-facing server names that are included in Subject Alternative Names (SANs) or Common Names (CNs). This reveals internal network architecture details (e.g., 'mail.internal.example.com') without any direct interaction with the target's systems, making it a purely passive reconnaissance technique.

Answer

Performing a zone transfer against the target's DNS servers

Answer

Using Nmap to scan common ports on the target's public IP range

Answer

Querying the target's WHOIS records for IP addresses

Question 13

A penetration tester is conducting vulnerability scanning on a web application that uses a Web Application Firewall (WAF). The scanner triggers a WAF block after several requests. Which of the following techniques would be MOST effective to continue scanning while evading the WAF?

Accepted Answer

Randomize request parameters and headers. Randomizing request parameters and headers (option B) is the most effective WAF evasion technique here because it breaks the signature and pattern-matching heuristics WAFs rely on, making each request appear unique and preventing the scanner from being fingerprinted and blocked after repeated identical payloads. Varying parameter order, casing, encoding, and header values (e.g., User-Agent, Referer) also helps slip past rate- and anomaly-based rules. Increasing scan speed (A) would generate more suspicious traffic and trigger the WAF even faster. HTTP/2 multiplexing (C) only changes transport framing and does not alter the request signatures a WAF inspects. A full TCP connect scan (D) is a port-scanning technique and is irrelevant to evading a WAF at the application layer.

Answer

Increase scan speed

Answer

Use HTTP/2 multiplexing

Answer

Perform a full TCP connect scan

Question 14

A client requests a penetration test for a new e-commerce application. The application uses a microservices architecture with RESTful APIs and a React frontend. The tester recommends including both a vulnerability assessment and manual penetration testing. However, the client has a tight budget and asks to skip the vulnerability assessment to save costs. Which response best aligns with best practices?

Accepted Answer

Conduct a vulnerability assessment first and then manually validate findings.. Best practices recommend a vulnerability assessment to identify potential weaknesses, followed by manual validation to reduce false positives and exploit critical issues. Skipping the assessment may leave critical vulnerabilities undetected.

Answer

Perform only a vulnerability assessment because it covers more vulnerabilities.

Answer

Use automated scanning tools during the manual penetration test to compensate.

Answer

Agree to skip the vulnerability assessment and focus only on manual penetration testing.

Question 15

During a penetration test, a tester needs to perform a man-in-the-middle (MITM) attack on a local network to capture credentials. Which tool should the tester use to ARP spoof and intercept traffic?

Accepted Answer

Ettercap. Ettercap is a comprehensive MITM tool that supports ARP spoofing, sniffing, and injection. Wireshark is for packet analysis, not active spoofing. TCPDump is for packet capture only. Nmap can be used for discovery but not MITM.

Answer

Wireshark

Answer

Nmap

Answer

TCPDump