PT0-002 Practice Test 38 — 15 Questions

Question 1

A penetration tester is performing a vulnerability scan of a network and finds that one server is running an outdated version of OpenSSL. Which of the following is the most likely security implication of this finding?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The server is vulnerable to Heartbleed. Outdated versions of OpenSSL, particularly versions 1.0.1 through 1.0.1f, are vulnerable to the Heartbleed bug (CVE-2014-0160). This vulnerability allows an attacker to read up to 64 KB of memory from the server's heap, potentially exposing private keys, session tokens, and other sensitive data. The Heartbleed bug is a specific buffer over-read vulnerability in the TLS/DTLS heartbeat extension, making D the correct answer.

Answer

The server is vulnerable to SQL injection

Answer

The server is vulnerable to cross-site scripting

Answer

The server is vulnerable to buffer overflow

Question 2

A penetration tester is testing a web application that uses JSON Web Tokens (JWTs) for authentication. The tester discovers that the server does not verify the JWT signature properly. The tester crafts a JWT with an arbitrary payload and sets the algorithm to 'none'. Which attack does this enable?

Accepted Answer

Authentication bypass. Setting the JWT algorithm to 'none' removes all cryptographic verification. If the server does not validate the signature, it will accept a token with an arbitrary payload, allowing the attacker to impersonate any user without knowing the secret key. This directly results in an authentication bypass, as the server trusts the forged token.

Answer

SQL injection

Answer

Server-side request forgery

Answer

Cross-site request forgery

Question 3

A penetration tester wants to enumerate user accounts and SMB shares from a Windows machine without authenticating. Which tool is specifically designed for this purpose and is commonly used in Linux penetration testing distributions?

Accepted Answer

enum4linux. enum4linux is specifically designed to enumerate user accounts, SMB shares, and other information from Windows machines via the SMB protocol without requiring authentication. It leverages the SMB null session vulnerability (CVE-1999-0504) to query the remote system for data such as user lists, share lists, and OS details, making it a standard tool in Linux penetration testing distributions like Kali Linux.

Answer

nmap

Answer

smbclient

Answer

hydra

Question 4

A penetration tester is preparing the executive summary for a client's board of directors. Which of the following is the most appropriate content for this section?

Accepted Answer

A high-level overview of risks, business impact, and recommended strategic improvements. The executive summary is intended for the board of directors, who require a high-level understanding of risks, business impact, and strategic recommendations rather than technical details. Option C aligns with the PT0-002 objective of tailoring communication to the audience, focusing on risk posture and remediation priorities that inform executive decision-making.

Answer

Detailed step-by-step reproduction steps for each vulnerability

Answer

A list of all discovered IP addresses and open ports

Answer

The raw output of automated scanning tools used during the test

Question 5

A penetration tester with a low-privileged domain user account performs a Kerberoasting attack. What is the primary goal of this attack?

Accepted Answer

Obtain the plaintext password of a user account with a Service Principal Name (SPN).. Kerberoasting targets service accounts that have a Service Principal Name (SPN) registered in Active Directory. The attacker requests a Kerberos service ticket (TGS) for the SPN, which is encrypted with the service account's NTLM hash. The attacker then cracks this hash offline to recover the plaintext password, enabling lateral movement or privilege escalation.

Answer

Obtain the NTLM hash of the krbtgt account.

Answer

Obtain a list of all domain users.

Answer

Obtain a Kerberos ticket that can be used to impersonate a domain admin.

Question 6

During a penetration test, the tester discovers evidence of an ongoing cyber attack by an external threat actor on the client's network. What is the tester's responsibility?

Accepted Answer

Immediately report the evidence to the client and recommend involving law enforcement.. The tester's primary responsibility is to protect the client's assets and data. Upon discovering evidence of an ongoing cyber attack, immediate notification allows the client to activate incident response procedures, potentially containing the threat and minimizing damage. Recommending law enforcement involvement is appropriate when criminal activity is suspected, as the tester is not authorized to conduct forensic investigation or engage with the attacker.

Answer

Document the evidence and include it in the final report without immediate notification.

Answer

Attempt to trace and engage the attacker to gather more information.

Answer

Ignore the evidence and continue with the planned test scope.

Question 7

A penetration tester is performing a security assessment of a network that uses SNMP. The tester successfully connects to a device using the community string 'public'. Which tool would the tester MOST likely use to enumerate the entire Management Information Base (MIB) tree to extract system information, running processes, and network interfaces?

Accepted Answer

snmpwalk. snmpwalk is the correct tool because it uses SNMP GETNEXT requests to systematically traverse the entire Management Information Base (MIB) tree, retrieving all OID values from a device. Given the tester already has a valid community string ('public'), snmpwalk can extract detailed system information, running processes, and network interfaces without needing to guess or brute-force credentials.

Answer

snmp-check

Answer

MIB Browser

Answer

Nmap with snmp-brute script

Question 8

A penetration testing firm is engaged to assess a cloud infrastructure hosted in multiple AWS regions. The client specifies that only systems in US-based regions should be tested due to data sovereignty concerns. Which of the following is the MOST critical documentation to include in the rules of engagement (ROE) to ensure compliance?

Accepted Answer

List of allowed AWS regions and associated VPC CIDR ranges. The rules of engagement (ROE) must explicitly define the authorized scope to prevent testing outside US-based regions, which could violate data sovereignty laws. Listing allowed AWS regions and their associated VPC CIDR ranges provides a precise technical boundary for the penetration test, ensuring that only in-scope systems are targeted. Without this, the testing team might inadvertently access resources in non-US regions, leading to legal and compliance breaches.

Answer

Statement of Work (SOW)

Answer

Data Processing Agreement (DPA)

Answer

Penetration testing methodology document

Question 9

A penetration tester is conducting a vulnerability scan of a web application that uses a custom API framework. The scanner reports several potential SQL injection vulnerabilities, but manual testing confirms they are false positives. The tester suspects the scanner is misinterpreting input validation. Which of the following is the most likely reason for these false positives?

Accepted Answer

The application reflects the injected payload in error messages or response content, causing the scanner to think the injection succeeded. The scanner likely detected the injected payload reflected in the application's response (e.g., in an error message or echoed input), which it interpreted as successful SQL execution. In custom API frameworks, input validation may reject the payload but still reflect it back in the response, causing the scanner to flag a false positive. Manual testing confirms the injection fails, so the reflection is merely a side effect of the API's error handling, not a sign of database interaction.

Answer

The scanner used a payload that was blocked by a Web Application Firewall (WAF) before reaching the application

Answer

The scanner used outdated signatures that do not match the custom API's input validation logic

Answer

The application returns a generic 'Invalid input' message for all types of invalid input, confusing the scanner

Question 10

A client wants a penetration test that simulates an external threat actor with no prior access. The client provides a list of public IP ranges and domain names. Which type of test is this?

Accepted Answer

External black-box test.. This is an external black-box test because the client provides only public IP ranges and domain names, simulating an external threat actor with no prior access. The tester has no internal knowledge or credentials, which defines a black-box approach, and the scope is limited to external-facing assets, making it external.

Answer

Internal white-box test.

Answer

Gray-box test.

Answer

Red team exercise.

Question 11

A client engages a penetration testing firm to evaluate the security of their internal network. During the scoping meeting, the client states that they use a network access control (NAC) solution that might block the tester's machine if it is connected to the internal network without prior authorization. Which of the following should be included in the rules of engagement to address this potential issue?

Accepted Answer

Add a clause requiring the client to whitelist the tester's MAC address in the NAC policy before testing.. Whitelisting the tester's MAC address in the NAC policy allows the tester's machine to connect to the internal network without being blocked, while keeping the NAC solution active for other devices. This approach preserves the real-world security posture of the client's environment and ensures the tester can perform internal network assessments as scoped. It is a standard practice in penetration testing to request MAC address whitelisting to avoid false positives from NAC enforcement.

Answer

Include a requirement that the client disables NAC during the testing window.

Answer

State that the tester will not connect to the internal network and will only test externally.

Answer

Specify that the tester will bypass NAC as part of the test objectives.

Question 12

A penetration tester is performing service enumeration on a discovered host and wants to grab banners from open ports to identify the exact software and version running. Which of the following command-line tools would be most appropriate for this task?

Accepted Answer

nc -v target.com 22. `nc -v target.com 22` uses Netcat in verbose mode to connect to port 22 on the target, which triggers the SSH server to send its banner (e.g., "SSH-2.0-OpenSSH_8.9p1"). This banner directly reveals the exact software and version running on that port, making it ideal for service enumeration and banner grabbing.

Answer

traceroute target.com

Answer

ping target.com

Answer

curl http://target.com

Question 13

A client has a highly dynamic cloud environment where resources are frequently spun up and down. What scoping challenge does this present?

Accepted Answer

Inconsistent attack surface. An inconsistent attack surface makes it difficult to define a stable scope of targets. Testing may miss transient resources or encounter resources that change during the engagement. Other options are risks but not specific scoping challenges.

Answer

Compliance issues

Answer

Lack of logs

Answer

Insufficient testing time

Question 14

A penetration tester is analyzing a Bash script that performs network scanning. The script contains the following command: 'for ip in $(seq 1 254); do hping3 -S -p 22 -c 1 $TARGET_SUBNET.$ip 2>/dev/null | grep -q "flags=SA" && echo "$TARGET_SUBNET.$ip: open"; done'. What is the primary purpose of this script?

Accepted Answer

Conduct a TCP SYN scan to identify hosts with port 22 open. The script uses hping3 with the -S flag (SYN) and -p 22 (port 22) to send TCP SYN packets to each IP in the target subnet. The grep -q 'flags=SA' checks for a SYN-ACK response, which indicates the port is open and listening. This is the classic behavior of a TCP SYN scan (half-open scan) to identify hosts with port 22 open.

Answer

Perform a vulnerability assessment against SSH services

Answer

Execute an ICMP ping sweep to discover live hosts

Answer

Complete a full TCP three-way handshake and log successful connections

Question 15

After completing a penetration test, the tester must deliver a report. According to standard practices, which of the following is a required component of the deliverables?

Accepted Answer

Executive summary, technical findings, and remediation guidance. A typical penetration test report includes an executive summary, technical findings, and remediation guidance.

Answer

Remediation guidance and a list of all tested IPs

Answer

Only technical findings and proof-of-concept code

Answer

Executive summary and raw data logs