PT0-002 Practice Test 37 — 15 Questions

Question 1

During reconnaissance, a penetration tester discovers a public GitHub repository belonging to the target organization. The repository contains internal project names, server IP addresses, and code comments with database credentials. Which reconnaissance technique does this represent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OSINT (Open-Source Intelligence). The discovery of a public GitHub repository containing internal project names, server IP addresses, and database credentials is a classic example of OSINT (Open-Source Intelligence). OSINT involves collecting and analyzing publicly available information from sources like code repositories, social media, and websites to gain insights about a target without direct interaction. This technique leverages the fact that sensitive data is often inadvertently exposed in public repositories, making it a passive reconnaissance method.

Answer

DNS enumeration

Answer

Port scanning

Answer

Social engineering

Question 2

After completing a penetration test, the client's board of directors requests a document that provides a high-level overview of the test's objectives, key findings, and business impact. Which section of the standard penetration testing report should be produced for this audience?

Accepted Answer

Executive Summary. The executive summary is the section of a penetration testing report designed for non-technical stakeholders, such as the board of directors. It provides a high-level overview of the test's objectives, key findings, and business impact, avoiding technical jargon and focusing on risk and remediation priorities. This aligns with the PT0-002 objective of tailoring communication to the audience.

Answer

Technical Findings Section

Answer

Methodology Section

Answer

Appendix with Logs

Question 3

A client wants a penetration test that includes social engineering attacks against employees. They request that the testing team not target the executive leadership team. What should be included in the rules of engagement to address this requirement?

Accepted Answer

A list of excluded users or groups, specifically the executive leadership team. The rules of engagement (RoE) must explicitly define the scope and boundaries of the test. Including a list of excluded users or groups, specifically the executive leadership team, ensures that social engineering attacks are not directed at them, directly addressing the client's requirement. This is a standard scoping practice in penetration testing to prevent unintended consequences and maintain legal and ethical compliance.

Answer

The maximum number of phishing emails that can be sent

Answer

The time window for conducting social engineering activities

Answer

A description of the social engineering techniques that will be used

Question 4

A penetration tester is writing the executive summary of a report for a client. The client's executive team needs to understand the overall risk posture. Which of the following should be included in the executive summary?

Accepted Answer

A high-level overview of the test's objectives, scope, and key findings with business impact. The executive summary is intended for non-technical leadership who need to grasp the overall risk posture quickly. Option C provides a high-level overview of objectives, scope, and key findings with business impact, which aligns with the PT0-002 objective of tailoring communication to the audience. Detailed technical data like replication steps or raw CVSS scores belong in the technical report, not the executive summary.

Answer

Detailed step-by-step replication steps for each vulnerability

Answer

A list of all CVSS scores for each finding

Answer

Raw scan output from vulnerability scanners

Question 5

A penetration tester has obtained the NTLM hash of a local administrator account on a Windows domain-joined system. The tester wants to use this hash to authenticate to another system on the network and execute commands remotely. Which tool is commonly used for pass-the-hash attacks to achieve remote code execution?

Accepted Answer

Impacket's wmiexec.py. Impacket's wmiexec.py is the correct tool because it directly supports pass-the-hash (PtH) authentication using NTLM hashes over Windows Management Instrumentation (WMI). It accepts an NTLM hash via the `-hashes` flag and establishes a remote WMI session, enabling command execution without needing the plaintext password. This makes it ideal for lateral movement in a domain environment where a local administrator hash has been captured.

Answer

Hydra

Answer

PsExec

Answer

Sqlmap

Question 6

A penetration tester is performing a vulnerability scan on a web server that uses HTTPS. The tester wants to identify the server's SSL/TLS configuration weaknesses without overwhelming the server. Which Nmap command is most appropriate?

Accepted Answer

nmap -sV --script ssl-enum-ciphers -p 443 target. The `ssl-enum-ciphers` NSE script enumerates all supported SSL/TLS ciphers and protocols on the target, providing a detailed assessment of cryptographic weaknesses (e.g., weak ciphers, outdated TLS versions). The `-sV` flag enables version detection, and `-p 443` targets the HTTPS port, while the script itself is designed to be lightweight and not overwhelm the server, making it ideal for a non-intrusive vulnerability scan.

Answer

nmap -sT -A -T4 -p 443 target

Answer

nmap -sU -p 443 target

Answer

nmap -sC -p 443 target

Question 7

During the reconnaissance phase, a penetration tester wants to map out the target's DNS infrastructure without directly interacting with the target's servers. Which of the following techniques BEST achieves this?

Accepted Answer

Querying publicly available DNS records. Querying publicly available DNS records (e.g., via passive DNS, WHOIS, or DNS dumpster) allows the tester to gather DNS information without any direct interaction with the target's servers. This technique relies on third-party databases and cached records, avoiding any packets sent to the target, which is essential for stealth during reconnaissance. It aligns with passive information gathering, as defined in the PT0-002 objectives.

Answer

Performing a DNS zone transfer

Answer

Using Nmap to scan for DNS servers

Answer

Sending crafted DNS queries to the target's DNS server

Question 8

During a vulnerability scan, a penetration tester notices that the scanner is repeatedly attempting to exploit a service, causing the service to crash and generating misleading findings. Which of the following scan configurations would BEST help the tester avoid this issue while still identifying potential vulnerabilities?

Accepted Answer

Activate the 'safe checks' option in the scanner. The 'safe checks' option in vulnerability scanners (such as Nessus or OpenVAS) disables intrusive plug-ins that attempt to exploit services aggressively, which can cause service crashes. This configuration allows the scanner to identify potential vulnerabilities without disrupting the target service, avoiding misleading findings from crashed services.

Answer

Enable SYN scan instead of full TCP connect scan

Answer

Adjust the scan timing template to a slower rate

Answer

Increase the port range to include high ports

Question 9

A penetration tester is analyzing a PowerShell script used during an internal test. The script contains the following code block: ```powershell $cred = Get-Credential $session = New-PSSession -ComputerName 'Server01' -Credential $cred Invoke-Command -Session $session -ScriptBlock { Get-ChildItem C:\Secrets.txt } Remove-PSSession $session ``` What is the primary purpose of this script?

Accepted Answer

To achieve lateral movement and access a file on a remote server. The script uses Get-Credential to obtain user credentials, creates a remote PowerShell session (PSSession) to Server01 via New-PSSession, and then executes Get-ChildItem C:\Secrets.txt on that remote server using Invoke-Command. This is the classic pattern for lateral movement: authenticating to a remote host and accessing a file stored there, not performing any local privilege escalation or password brute-forcing.

Answer

To perform a local privilege escalation using stored credentials

Answer

To brute-force the password of the user account via 'Get-Credential'

Answer

To execute a script from the remote server using the ScriptBlock

Question 10

A penetration tester is scoping a test for a client that uses a SaaS application for customer relationship management. The client wants the tester to assess the application's security. What is the most important consideration regarding this SaaS application?

Accepted Answer

The tester should obtain explicit permission from the SaaS provider before testing. The tester must ensure that the SaaS provider's terms of service allow security testing and that permission is obtained.

Answer

The application is hosted on the cloud, so it is automatically in scope

Answer

The tester should only test the client's configuration of the SaaS application

Answer

The tester can test the application as long as the client provides administrative credentials

Question 11

A penetration testing firm is hired to assess a mobile banking application. The client wants to test both Android and iOS versions, but only the production environment. Which of the following is the MOST important scoping consideration to include in the rules of engagement?

Accepted Answer

Requiring jailbroken/rooted devices for testing. Requiring jailbroken or rooted devices is the most important scoping consideration because mobile banking applications often implement runtime integrity checks (e.g., MagiskHide, Frida detection) that prevent the app from running on compromised devices. Without explicit authorization to bypass these controls, the penetration tester cannot perform deep dynamic analysis, such as hooking API calls or inspecting encrypted local storage, which is essential for a thorough security assessment of the production environment.

Answer

Specifying the number of concurrent users during testing

Answer

Defining the test window to avoid peak hours

Answer

Excluding the backend API from testing

Question 12

A penetration tester wants to exploit a vulnerable service on a target using a known module. Which framework provides a large database of exploit modules, payloads, and post-exploitation tools?

Accepted Answer

Metasploit Framework. The Metasploit Framework (option D) is the correct answer because it is specifically designed as a penetration testing platform that includes a vast, regularly updated database of exploit modules, payloads, and post-exploitation tools. This framework allows a tester to select a known module for a vulnerable service, configure a payload, and execute the exploit against a target, making it the standard tool for this purpose.

Answer

Burp Suite

Answer

Wireshark

Answer

Nmap

Question 13

A penetration tester is hired to assess the security of a company's internal network. The tester is given full network diagrams, credentials, and source code. Which type of penetration test is being performed?

Accepted Answer

White box. White box testing provides the tester with full knowledge of the target environment, including credentials and documentation.

Answer

Black box

Answer

Grey box

Answer

Red team

Question 14

A penetration tester is performing internal reconnaissance from a compromised host and wants to map the local network without sending any packets. Which technique is most suitable?

Accepted Answer

Use tcpdump to passively capture and analyze broadcast traffic.. Tcpdump can passively capture broadcast traffic (e.g., ARP, NetBIOS, mDNS) without sending any packets. This allows the tester to map active hosts and services on the local network by listening to existing network chatter, fulfilling the 'no packets sent' constraint.

Answer

Send ARP requests to all possible IP addresses using a ping sweep.

Answer

Query the local DNS server for all host records in the domain.

Answer

Use traceroute to discover network paths.

Question 15

A client wants a penetration test of their cloud infrastructure hosted on AWS. The client states that they want to test the security of their EC2 instances, S3 buckets, and IAM configurations. The client's security team is concerned about potential service disruption due to testing. Which of the following should be included in the rules of engagement to address this concern?

Accepted Answer

A clear definition of what constitutes a denial-of-service condition and a requirement to stop testing immediately if such a condition is detected.. It directly addresses the client's concern about service disruption by establishing a clear threshold for denial-of-service (DoS) conditions and a mandatory stop action. In AWS, automated scanning or aggressive testing can inadvertently trigger Auto Scaling events, exhaust burst credits on EC2 instances, or saturate S3 request limits, leading to degraded performance. Defining what constitutes a DoS condition (e.g., CPU > 90%, network packet loss > 5%) ensures the tester can halt immediately, protecting the client's cloud infrastructure while still allowing effective security testing.

Answer

A clause that the tester will avoid using any automated scanning tools.

Answer

A requirement that the tester only performs manual testing and no tools.

Answer

A clause that the tester will test only during business hours.