PT0-002 Practice Test 37 — 15 Questions

Question 1

A penetration tester is conducting information gathering on a target company. The company has an internal Confluence wiki that is only accessible from within the corporate network. The tester wants to discover any externally accessible references to the wiki without actively interacting with the target's systems. Which of the following techniques would be MOST effective?

Accepted Answer

Query the target's TLS certificate transparency logs for subdomains. Querying TLS certificate transparency logs is the most effective technique because it allows the tester to discover subdomains associated with the target's domain without any active interaction. Certificate Transparency (CT) logs are publicly accessible records of all SSL/TLS certificates issued by Certificate Authorities (CAs), and they often include subdomains that may point to internal services like Confluence if they were ever exposed via a public certificate. This passive reconnaissance method reveals externally accessible references that the target may have inadvertently made public.

Answer

Search for exposed Confluence login pages on Shodan

Answer

Use the Wayback Machine to find historical public references

Answer

Perform a zone transfer on the target's DNS servers

Question 2

Which THREE of the following are common techniques used to evade antivirus (AV) detection of post-exploitation tools? (Choose three.)

Accepted Answer

Obfuscate the payload code. Obfuscating the payload code transforms the malicious code into a different representation (e.g., XOR encoding, Base64, or custom encryption) that does not match known AV signatures. AV engines rely on static signature matching, so by altering the byte sequence without changing the payload's functionality, the tool evades signature-based detection. This is a fundamental technique used in frameworks like Metasploit with its 'shikata_ga_nai' encoder.

Answer

Enable SMB file sharing

Answer

Apply the latest Windows patches

Question 3

A penetration tester is tasked with identifying live hosts on a large subnet without generating excessive traffic. Which of the following techniques is most appropriate for efficient host discovery?

Accepted Answer

TCP SYN scan on port 80 and 443. A TCP SYN scan on ports 80 and 443 is the most appropriate technique because it targets common web service ports, which are often open on live hosts, and generates minimal traffic compared to a full port scan. Unlike ICMP or ARP scans, a TCP SYN scan can bypass firewalls that block ICMP echo requests and is effective across routed subnets where ARP is limited to the local broadcast domain. This approach balances stealth and efficiency for large-scale host discovery.

Answer

ARP scan

Answer

DNS zone transfer

Answer

ICMP echo sweep

Question 4

A penetration tester needs to gather information about a target organization's employees and email addresses from public sources. Which passive reconnaissance tool is BEST suited for this task?

Accepted Answer

Maltego. Maltego is a passive reconnaissance tool that excels at gathering information from public sources, including employee names, email addresses, and organizational relationships, by querying open-source intelligence (OSINT) data such as social media, search engines, and DNS records. It uses transforms to automate data collection and link analysis, making it ideal for this task without directly interacting with the target's systems.

Answer

Nikto

Answer

Nmap

Answer

Wireshark

Question 5

Refer to the exhibit. A penetration tester has performed a basic Nmap scan and found an open MySQL service. Which of the following should the tester do NEXT to further investigate the MySQL service?

Accepted Answer

Run a version detection scan using -sV on port 3306. Option C is correct because the next logical step after discovering an open MySQL service (port 3306) is to perform version detection using `-sV` in Nmap. This identifies the exact MySQL version, which is critical for determining known vulnerabilities (CVEs) and appropriate exploitation techniques. Without version information, the tester cannot assess whether the service is outdated or misconfigured.

Answer

Perform a UDP scan on port 3306

Answer

Connect to the MySQL service using default credentials

Answer

Scan for other hosts with port 3306 open

Question 6

A penetration tester is performing information gathering using DNS enumeration. Which of the following records can be queried to discover additional subdomains or hostnames? (Choose three.)

Accepted Answer

MX. The A record maps a hostname to an IPv4 address. During DNS enumeration, querying A records for known subdomains or performing a brute-force of common hostnames (e.g., admin.example.com, mail.example.com) can reveal additional subdomains and hostnames by returning valid IP addresses. This is a standard technique in reconnaissance to expand the attack surface.

Answer

PTR

Answer

CNAME

Question 7

A penetration tester is planning to perform a vulnerability scan of an internal network. Which of the following should be considered before scanning? (Choose three.)

Accepted Answer

Obtain written authorization from the client. Option A is correct because written authorization from the client is a legal and ethical prerequisite before any scanning activity. Without explicit permission, the penetration tester could be liable for unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA) or similar regulations, as vulnerability scanning involves sending probes that may trigger intrusion detection systems or cause unintended disruptions.

Answer

Perform the scan during peak business hours

Answer

Test all available exploit modules

Question 8

During a vulnerability scan of a web application, the penetration tester notices that the scanner reports a critical SQL injection vulnerability in the login parameter. However, manual testing confirms that the input is properly sanitized and the vulnerability is a false positive. Which of the following actions should the tester take to ensure accurate vulnerability identification and avoid wasting time on false positives in future scans?

Accepted Answer

Correlate the scanner output with manual verification and document the discrepancy. Option B is correct because the penetration tester should correlate automated scanner output with manual verification to confirm findings, then document the discrepancy for future reference. This ensures accurate vulnerability identification by leveraging human analysis to filter false positives, which is a standard practice in PT0-002 methodology for information gathering and vulnerability scanning.

Answer

Increase the scan intensity to ensure the vulnerability is accurately detected

Answer

Modify the scanner's configuration to exclude false positive patterns

Answer

Ignore the finding and proceed with manual testing only

Question 9

A penetration tester is engaged to assess a corporate network that uses a centralized logging server (SIEM) with a 24/7 SOC. The tester has gained initial access to a Windows workstation via a phishing email. The goal is to move laterally to a domain controller without triggering alerts. The internal network is segmented into VLANs: a user VLAN (192.168.1.0/24) and a server VLAN (10.0.0.0/24) with strict firewall rules allowing only specific ports (e.g., RDP from user VLAN to server VLAN is denied). The tester discovers that the workstation has a PowerShell script that runs every hour to check for drive space on all servers using WinRM (port 5985) with stored domain admin credentials. The script is scheduled via a domain GPO. Which of the following actions should the tester perform to achieve lateral movement to the domain controller with the lowest chance of detection?

Accepted Answer

Modify the existing PowerShell script to include a reverse shell that connects back to the tester. Option C is correct because modifying the existing PowerShell script to include a reverse shell allows the tester to execute code on the domain controller using WinRM (port 5985), which is already permitted by the firewall and part of a legitimate scheduled task. This approach leverages the stored domain admin credentials and the trusted script execution path, avoiding any new connections or anomalies that would trigger SOC alerts. The reverse shell blends into the normal WinRM traffic, making detection by the SIEM or SOC highly unlikely.

Answer

Alter the firewall rules to allow direct access from the user VLAN to the server VLAN

Answer

Use a RDP client to connect directly to the domain controller from the workstation

Answer

Perform a pass-the-hash attack from the workstation to the domain controller using SMB

Question 10

A penetration tester is conducting an external assessment against a client's web application hosted on an AWS EC2 instance behind an Application Load Balancer (ALB). The tester has performed passive reconnaissance and identified the public IP of the ALB, but the web application is only accessible via a specific domain name. During active scanning, the tester runs Nmap against the public IP and only sees port 443 open. The tester then performs a DNS Zone Transfer attempt against the authoritative name servers, which fails. While reviewing the web application, the tester notices that the application sets a cookie with the path '/admin'. The tester suspects there is an internal subnet used for backend services. Which of the following techniques would be MOST effective to discover internal hostnames or IP ranges?

Accepted Answer

Examine SSL certificate Subject Alternative Names (SANs) in the certificate presented by the ALB.. Option D is correct because SSL certificates often include Subject Alternative Names (SANs) that list internal hostnames. Option A is impossible from outside the network; Option B requires internal access to the metadata service; Option C already failed.

Answer

Attempt a zone transfer against a different authoritative DNS server.

Answer

Use the AWS Metadata Service to extract information about the underlying EC2 instance.

Answer

Perform a ping sweep of the internal RFC 1918 addresses and look for responses.

Question 11

You are a penetration tester conducting an internal network penetration test for a medium-sized company. The network consists of a Windows domain with multiple servers and workstations. The scope includes testing the Active Directory security. The client has provided a low-privileged domain user account for initial access. During the reconnaissance phase, you discover that the domain controller is running Windows Server 2012 R2 with no recent patches. There is a known privilege escalation vulnerability (e.g., Zerologon) that could allow you to become Domain Admin. However, the client's rules of engagement explicitly prohibit the use of any exploit that could cause a denial of service on the domain controller. The Zerologon exploit, if not carefully executed, could crash the domain controller. Which of the following actions should you take?

Accepted Answer

Avoid the exploit and instead attempt Kerberoasting or AS-REP roasting. Option B is correct because it adheres to the rules of engagement while still testing AD security. Option A is wrong because it could cause DoS and violate scope. Option C is wrong because the tester should still perform other tests. Option D is wrong because modifying exploits is risky and not approved.

Answer

Modify the exploit code to ensure no disruption, then run it

Answer

Proceed with the Zerologon exploit during off-hours to minimize risk

Answer

Report the vulnerability immediately without attempting exploitation

Question 12

A small business owner contacts you to perform a penetration test. The company has a single office with 50 employees, uses a cloud-based email service (Office 365), and hosts a public-facing website on a shared server. The owner is concerned about external threats but does not allow any testing that could disrupt operations. The owner wants to test the security of the website and the email system against common attacks, such as SQL injection, XSS, and phishing. Based on these constraints and the environment, which type of penetration test is most appropriate?

Accepted Answer

External gray-box test with a restricted schedule and prior notification.. Given the owner's concern about disruption and the need to test external assets, a gray-box test (some information provided) with a schedule that avoids peak hours and with prior notification best balances effectiveness and risk. Black-box could be disruptive; red team is covert and may cause alarm; internal assessment is not relevant for external assets.

Answer

Covert red team exercise simulating a persistent attacker.

Answer

Full disclosure black-box test from an external perspective.

Answer

Internal vulnerability assessment of the local network.

Question 13

A large enterprise hires your firm to perform a penetration test on a new cloud-based product that integrates with several third-party services. The product is built on AWS and uses serverless functions (Lambda), API Gateway, DynamoDB, and S3. The client provides you with access to a staging environment that mirrors production in architecture but with relaxed security controls: the staging environment has less restrictive security groups, enabled debugging endpoints, and broad IAM permissions. The client insists that the staging environment is sufficient for testing and that production testing is not allowed due to compliance constraints. What is the best recommendation?

Accepted Answer

Request that the staging environment be reconfigured to match production security controls, then test.. Testing a non-representative environment may produce false positives or miss real vulnerabilities. The correct approach is to align the staging environment to production as closely as possible. Option A may lead to inaccurate conclusions; B is too rigid; D violates compliance and likely is not feasible.

Answer

Propose a limited production test during a maintenance window, accepting the compliance risk.

Answer

Refuse to proceed until production access is granted.

Answer

Test the staging environment as is and note the differences in the final report.

Question 14

You are a penetration tester performing an internal assessment of a corporate network. The network consists of a Windows Active Directory domain with Windows 10 clients and Windows Server 2019 servers. The goal is to escalate privileges from a standard domain user to domain administrator. You have obtained initial access to a workstation as a low-privileged user named 'jdoe'. During reconnaissance, you discover that the workstation has PowerShell Remoting (WinRM) enabled and that a scheduled task runs every 5 minutes with the credentials of a service account 'svc_app'. The service account is a member of the 'Backup Operators' group, which has SeBackupPrivilege. You also find that the system has an outdated version of the PsExec tool in the PATH. Which of the following is the most effective course of action to escalate privileges?

Accepted Answer

Exploit the SeBackupPrivilege by using the Windows Backup and Restore capabilities to copy the SAM registry hive and dump local account hashes.. Option C is correct because by leveraging SeBackupPrivilege, you can backup and restore system files, such as the SAM and SYSTEM hives, to extract local administrator password hashes. Option A is less effective because PsExec may not work without admin rights. Option B relies on guessable credentials. Option D is noisy and may alert defenders.

Answer

Wait for the scheduled task to run and capture the service account password using a network sniffer.

Answer

Use PsExec to run a command as SYSTEM directly.

Answer

Modify the scheduled task to run a reverse shell with the service account's privileges.

Question 15

You are performing a web application penetration test for a client that uses a custom content management system (CMS). During the initial reconnaissance, you identify that the CMS has a file upload feature that accepts JPEG images. You suspect that the application may be vulnerable to unrestricted file upload, allowing you to upload a malicious PHP script to gain remote code execution. However, the application validates file extensions and checks the MIME type of the uploaded file. You have access to Burp Suite and a Python environment. Which of the following approaches is most likely to successfully bypass the file upload restrictions and achieve remote code execution?

Accepted Answer

Create a polyglot file that starts with JPEG magic bytes but contains PHP code at the end, and upload with a .php extension. Option B is correct because appending PHP code to a valid JPEG image (polyglot) can bypass MIME type checks and extension filters if the application only inspects the magic bytes. Option A is wrong because changing the extension to .php.jpg will likely be rejected by the extension whitelist. Option C is wrong because curl's --data-binary is not designed for file upload with multipart/form-data. Option D is wrong because base64 encoding the payload does not change the content type and will still be detected as PHP.

Answer

Change the file extension to .php.jpg and submit using Burp Repeater

Answer

Encode the PHP payload in base64 and submit it as a JPEG file

Answer

Use curl with --data-binary to send a raw PHP payload with a proper JPEG content-type header