PT0-002 Practice Test 36 — 15 Questions

Question 1

Refer to the exhibit. After running a port scan in Metasploit, what is the next best step to identify vulnerabilities on the open ports?

Accepted Answer

Use the scanner to run service version detection on those ports. After a port scan in Metasploit, the next best step is to run service version detection (e.g., using the `scanner/portscan/tcp` auxiliary module's `VERSION` option or the `db_nmap -sV` command) to identify the exact software and version running on each open port. This version information is critical for matching against known vulnerabilities in databases like CVE or Exploit-DB, enabling targeted exploitation. Option D is correct because it follows the systematic penetration testing methodology of enumeration before exploitation.

Answer

Perform a brute-force attack against SSH and HTTP

Answer

Immediately exploit the open HTTP service

Answer

Run a Nessus scan on the host

Question 2

During a penetration test, a tester exploits a buffer overflow vulnerability in a legacy application. After gaining code execution, what is the next best step to maintain access?

Accepted Answer

Create a backdoor user account. After gaining code execution via a buffer overflow, the next best step is to create a backdoor user account to maintain persistent access to the compromised system. This ensures the tester can re-enter the environment without re-exploiting the vulnerability, which may be patched or monitored. Creating a local user account (e.g., via `net user` or `useradd`) is a standard persistence technique in penetration testing, allowing continued access for lateral movement or data exfiltration.

Answer

Install an antivirus solution

Answer

Patch the buffer overflow vulnerability

Answer

Erase the application logs

Question 3

While performing a password audit, a tester finds that the hash of 'Password123' is stored in the LAN Manager (LM) hash format. What is the primary security weakness of LM hashes?

Accepted Answer

The password is split into two 7-character halves. The primary security weakness of LAN Manager (LM) hashes is that the password is converted to uppercase, padded or truncated to 14 characters, and then split into two 7-character halves. Each half is hashed independently using DES as the key for a known constant, which means an attacker can brute-force each 7-character half separately, drastically reducing the keyspace from 14 characters to two sets of 7 characters. This makes LM hashes extremely vulnerable to offline cracking, especially with modern tools like John the Ripper or Hashcat.

Answer

The hash is case-sensitive

Answer

The hash is salted with a weak random value

Answer

The hash uses the MD4 hashing algorithm

Question 4

A penetration tester has physical access to a small office. The network switch is in a locked cabinet, but the tester notices the lock is broken. The switch has multiple ports, and the tester wants to connect to the internal network. The tester has a laptop with an Ethernet port. However, the tester suspects that port security is enabled on the switch ports, which would block the connection if the MAC address is not authorized. Which action should the tester take first to gain network access?

Accepted Answer

Connect to the switch's console port and attempt default credentials.. Option D is correct because the tester has physical access to the switch and the lock is broken, allowing direct console access. If port security is enabled, plugging into a data port (Option C) would be blocked. The fastest first step is to connect to the console port and try default credentials (e.g., cisco/cisco) to gain administrative control of the switch, which can then be used to disable port security or add the tester's MAC address to the allowed list.

Answer

Perform a MAC flooding attack to fill the switch's MAC table.

Answer

Use a DHCP starvation attack to exhaust IP addresses.

Answer

Plug the laptop into an available switch port.

Question 5

During a penetration test, a tester discovers a web application that reflects user input in the HTTP response without sanitization. Which attack is most likely to be successful?

Accepted Answer

Reflected cross-site scripting. Reflected cross-site scripting (XSS) is the correct answer because the vulnerability described—user input reflected in the HTTP response without sanitization—directly enables an attacker to inject malicious scripts (e.g., JavaScript) that execute in the victim's browser. This occurs when the application fails to validate or encode the input before including it in the response, allowing the attacker to craft a URL with a script payload that, when visited, runs in the context of the vulnerable web application's origin.

Answer

Server-side request forgery

Answer

SQL injection

Answer

Cross-site request forgery

Question 6

Which THREE of the following are example of privilege escalation techniques on Linux systems? (Select THREE.)

Accepted Answer

Exploiting kernel vulnerabilities. Exploiting kernel vulnerabilities (Option A) is a privilege escalation technique because the Linux kernel operates with the highest system privileges (ring 0). A vulnerability in the kernel, such as a use-after-free or race condition in a syscall handler, can allow an attacker to execute arbitrary code with kernel-level privileges, effectively gaining root access. Common examples include the Dirty Cow (CVE-2016-5195) vulnerability, which exploited a race condition in the memory subsystem to achieve local privilege escalation.

Answer

Token manipulation

Answer

Pass-the-hash

Question 7

Refer to the exhibit. A penetration tester performed a port scan and collected the information shown. Which vulnerability is most likely present based on the software versions?

Accepted Answer

PHP CGI argument injection (CVE-2019-11043). The exhibit shows Apache/2.4.39 with PHP 7.3.9, which is vulnerable to CVE-2019-11043, a PHP CGI argument injection flaw. This vulnerability allows an attacker to send specially crafted query strings to a PHP-FPM server via the `PATH_INFO` parameter, leading to remote code execution. The specific software versions match the known affected range (PHP 7.3.x before 7.3.11 and Apache with mod_proxy_fcgi).

Answer

Sendmail remote code execution

Answer

OpenSSH user enumeration

Answer

Apache HTTP Server directory traversal

Question 8

During a penetration test, a tester needs to perform a man-in-the-middle attack on a network that uses WPA2-Enterprise with PEAP. Which tool is most appropriate for capturing the authentication handshake to attempt offline cracking?

Accepted Answer

hostapd-wpe. hostapd-wpe (Wireless Pwnage Edition) is specifically designed to set up a rogue access point that impersonates a legitimate WPA2-Enterprise network. It captures the MSCHAPv2 challenge-response from the PEAP authentication handshake, which can then be used for offline dictionary or brute-force attacks against the user's credentials. Unlike other tools, hostapd-wpe handles the full EAP/PEAP exchange required for this attack.

Answer

Wireshark

Answer

aircrack-ng

Answer

Ettercap

Question 9

A penetration tester is conducting information gathering on a target organization. The tester discovers a public code repository that contains configuration files with embedded credentials. Which of the following is the BEST next step?

Accepted Answer

Notify the organization's security team of the exposed credentials.. Option A is correct because the tester has discovered exposed credentials in a public code repository, which is a critical security finding that requires immediate disclosure to the organization's security team. Ethical penetration testing mandates that any discovered vulnerabilities, especially those involving credential exposure, be reported promptly to prevent unauthorized access and potential data breaches. Proceeding with further exploitation without authorization violates the rules of engagement and could cause legal or operational harm.

Answer

Attempt to crack the passwords to gain further access.

Answer

Document the findings and proceed with passive reconnaissance.

Answer

Use the credentials to log into the target system immediately.

Question 10

Which of the following tools would a penetration tester most likely use to perform passive reconnaissance on a target domain?

Accepted Answer

theHarvester. theHarvester is a passive reconnaissance tool that gathers information from public sources such as search engines, PGP key servers, and the Shodan API without directly interacting with the target domain. It collects email addresses, subdomains, IPs, and employee names using OSINT (Open Source Intelligence) techniques, making it ideal for passive information gathering.

Answer

Wireshark

Answer

Nmap

Answer

Metasploit

Question 11

Refer to the exhibit. The firewall rules shown are in effect. A tester has compromised a host at 192.168.1.100 and wants to exfiltrate data to an external server. Which technique will most likely succeed?

Accepted Answer

Send data over HTTPS to an external server. Option B is correct because HTTPS (TCP/443) is typically allowed through firewalls for web traffic, and the encrypted payload can bypass deep packet inspection. The compromised host at 192.168.1.100 can initiate an outbound HTTPS connection to an external server, making data exfiltration over HTTPS the most likely to succeed given the firewall rules.

Answer

Use DNS tunneling to an external DNS server

Answer

Exfiltrate via HTTP to an external server

Answer

Initiate an RDP connection to the external server

Question 12

A penetration tester is performing a vulnerability scan of a network and finds that one server is running an outdated version of OpenSSL. Which of the following is the most likely security implication of this finding?

Accepted Answer

The server is vulnerable to Heartbleed. Outdated versions of OpenSSL, particularly versions 1.0.1 through 1.0.1f, are vulnerable to the Heartbleed bug (CVE-2014-0160). This vulnerability allows an attacker to read up to 64 KB of memory from the server's heap, potentially exposing private keys, session tokens, and other sensitive data. The Heartbleed bug is a specific buffer over-read vulnerability in the TLS/DTLS heartbeat extension, making D the correct answer.

Answer

The server is vulnerable to SQL injection

Answer

The server is vulnerable to cross-site scripting

Answer

The server is vulnerable to buffer overflow

Question 13

During a network penetration test, the tester identifies that a web server is vulnerable to a buffer overflow. The server is running on a Windows system with DEP enabled. Which technique should the tester use to bypass DEP?

Accepted Answer

Return-Oriented Programming (ROP). Return-Oriented Programming (ROP) is the correct technique to bypass Data Execution Prevention (DEP) on Windows. DEP marks memory pages (like the stack and heap) as non-executable, preventing direct shellcode execution. ROP chains together small instruction sequences (gadgets) already present in executable memory (e.g., in loaded DLLs) to achieve arbitrary behavior without injecting or executing new code.

Answer

Return-to-libc attack

Answer

Use a NOP sled and shellcode injection

Answer

Stack pivoting

Question 14

A penetration tester is targeting a Windows domain controller. After compromising a standard user account, the tester wants to escalate to domain admin. Which attack is most effective if the tester can capture plaintext passwords from memory?

Accepted Answer

Pass-the-hash attack. Option C is correct because capturing plaintext passwords from memory (e.g., via Mimikatz sekurlsa::logonpasswords) allows the tester to directly use the domain admin's plaintext credentials in a pass-the-hash attack. This attack reuses the NTLM hash (or plaintext) to authenticate to other systems without needing to crack or forge tickets, making it the most direct escalation path from a standard user to domain admin when plaintext passwords are available.

Answer

Create a golden ticket

Answer

Create a silver ticket

Answer

DCSync attack

Question 15

During a vulnerability scan of a web application, a tester receives an HTTP response with a '405 Method Not Allowed' error when trying to use a PUT request. What does this indicate about the web server's configuration?

Accepted Answer

The server blocks the PUT method for that specific URI.. A 405 Method Not Allowed error indicates that the server recognized the PUT method as valid but has explicitly disallowed it for the requested URI. This is a server-level access control configuration, often enforced via web server directives (e.g., Apache's `<LimitExcept>` or IIS's request filtering) or application-level routing rules. The tester's PUT request reached the server and was processed, but the server's configuration prevented it from being fulfilled for that specific endpoint.

Answer

The PUT method is allowed but the resource does not exist.

Answer

The server does not support the PUT method.

Answer

The request was malformed and rejected.

PT0-002 Practice Test 36 — 15 Questions

Exhibit

PT0-002 Practice Test 36 — 15 Questions

Exhibit