PT0-002 Practice Test 39 — 15 Questions

Question 1

A penetration tester wants to quickly identify the listening services on a target Linux server without performing a full port scan. The tester has obtained an unauthenticated shell as a low-privileged user. Which built-in command is most likely available on a modern Linux distribution to list all listening TCP sockets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ss -tlnp. `ss -tlnp` is the modern replacement for `netstat` on Linux distributions that have deprecated `netstat` (e.g., RHEL 7+, Ubuntu 16.04+). It uses the `netlink` interface to read socket information directly from the kernel, making it faster and more reliable than parsing `/proc/net/tcp`. The flags `-t` (TCP), `-l` (listening), `-n` (numeric addresses/ports), and `-p` (show process) precisely list all listening TCP sockets without requiring root privileges for basic socket listing.

Answer

netstat -tlnp

Answer

lsof -i

Answer

ifconfig -a

Question 2

A penetration tester is analyzing a Python script that uses the Impacket library to perform an SMB relay attack. The script is failing to capture NTLM hashes from target machines. Which part of the script is MOST likely misconfigured?

Accepted Answer

The listener IP address. In an SMB relay attack using Impacket, the listener IP address must be set to the attacker's IP address where the relayed authentication is received. If the listener IP is misconfigured (e.g., set to the target's IP or left as localhost), the relay server will not receive the forwarded NTLM hashes, causing the capture to fail. This is a common configuration error when using Impacket's 'smbrelayx' or similar scripts.

Answer

The target IP address

Answer

The SMB version negotiation

Answer

The authentication method (NTLMv1 vs NTLMv2)

Question 3

A client requests a penetration test of a new mobile application that is still in development and only accessible on a test server behind the corporate VPN. The tester should include which of the following in the scope?

Accepted Answer

Only the test server and the mobile application client. The scope of a penetration test for an application still in development should be limited to the test server and the mobile application client. This ensures the assessment focuses on the application's security posture without including production systems that are not yet live or the corporate VPN infrastructure, which is typically out of scope unless explicitly requested. The tester should only evaluate the components directly relevant to the application's functionality and security during development.

Answer

The production servers hosting the app when it goes live

Answer

The corporate VPN infrastructure

Answer

All third-party APIs used by the application

Question 4

A penetration tester has gained low-privilege shell access on a Linux server. The tester runs `sudo -l` and sees the following entry: `(root) NOPASSWD: /usr/bin/python3 /opt/scripts/*.py` The `/opt/scripts/` directory is owned by the tester's current user. Which technique is most effective for escalating privileges to root?

Accepted Answer

Write a malicious Python script to /opt/scripts/ that spawns a root shell. The tester's user owns `/opt/scripts/` and can write arbitrary files there. The sudo rule allows executing any `.py` file in that directory as root without a password. By writing a Python script that calls `os.setuid(0); os.system('/bin/bash')` or similar, the tester can spawn a root shell, directly leveraging the misconfigured sudoers entry.

Answer

Create a symbolic link from a Python script to a system file like /etc/shadow

Answer

Exploit a kernel vulnerability to overwrite the sudo binary

Answer

Overwrite an existing Python script in /usr/bin/ with a malicious payload

Question 5

A penetration tester has gained initial access to an internal Windows server and wants to escalate privileges to SYSTEM. The tester identified that the current user has the SeImpersonatePrivilege enabled. Which TWO of the following tools or techniques would be most appropriate to exploit this privilege for privilege escalation?

Accepted Answer

PrintSpoofer. Option A, PrintSpoofer, is correct because it abuses the SeImpersonatePrivilege by coercing the Print Spooler service into authenticating to a controlled named pipe, then impersonating the resulting SYSTEM token to gain elevated privileges. Option B, Potato attacks such as JuicyPotato, is correct because these techniques also leverage SeImpersonatePrivilege (or SeAssignPrimaryTokenPrivilege) by tricking a privileged service into connecting to an attacker-controlled COM server or named pipe, allowing token impersonation to SYSTEM. Option C, PsExec, is not appropriate here because it is a remote execution/lateral movement tool that requires administrative credentials or SMB access, not a local SeImpersonatePrivilege escalation technique. Option D, Pass-the-Hash, is incorrect because it uses captured NTLM hashes for authentication to other systems and does not exploit SeImpersonatePrivilege. Option E, Kerberoasting, is incorrect because it targets service accounts with SPNs to crack their passwords offline and is unrelated to token impersonation privilege escalation.

Answer

PsExec

Answer

Pass-the-Hash

Answer

Kerberoasting

Question 6

A penetration tester is writing the findings section of a report. The tester identified a critical SQL injection vulnerability that allows extraction of the entire customer database. The client's technical team has already remediated the issue. How should the tester present this finding to ensure clarity and usefulness?

Accepted Answer

Document the vulnerability in full, including reproduction steps, impact, and evidence, and note the remediation status. Penetration testing standards (e.g., PTES, OWASP) require full documentation of all findings regardless of remediation status. Including reproduction steps, impact analysis, and evidence ensures the report serves as a permanent record for compliance, audit, and future reference. Noting the remediation status provides clear context that the issue has been resolved, which is critical for stakeholders who need to verify the fix.

Answer

Include the vulnerability with the risk rating, a brief description, and a note that it was remediated during the test

Answer

Exclude the vulnerability from the report because it has already been fixed

Answer

Reduce the risk rating of the vulnerability because it has been fixed, and include it in an appendix

Question 7

A penetration tester is performing a wireless penetration test. The RoE states that testing is only allowed between 8 PM and 6 AM. At 7:30 PM, the tester begins active scanning. At 8:15 PM, a client employee calls emergency contact to report suspicious activity. According to the RoE, which of the following is the most likely reason for the call?

Accepted Answer

The tester started testing outside the agreed time window. The RoE explicitly restricts testing to 8 PM – 6 AM, but the tester began active scanning at 7:30 PM — 30 minutes before the allowed window. Active scanning generates detectable wireless traffic (probe requests, deauth frames, association attempts) that a client employee could notice and report. The call at 8:15 PM is most likely a delayed report of the activity that started at 7:30 PM, outside the agreed window.

Answer

The tester used an unauthorized tool

Answer

The tester targeted an out-of-scope access point

Answer

The tester exceeded the allowed signal strength

Question 8

During a Windows privilege escalation attempt, a tester finds that the current user has the SeImpersonatePrivilege enabled. Which tool can be used to exploit this privilege to gain SYSTEM access?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits the SeImpersonatePrivilege by abusing the Windows Print Spooler service's named pipe (\.\pipe\spoolss) to coerce a SYSTEM-level token and impersonate it, yielding NT AUTHORITY\SYSTEM. It is specifically designed for the SeImpersonatePrivilege/SeAssignPrimaryTokenPrivilege abuse class (alongside JuicyPotato, RoguePotato, and GodPotato). Because the question explicitly names SeImpersonatePrivilege, PrintSpoofer is the direct match.

Answer

PowerUp

Answer

CrackMapExec

Answer

Mimikatz

Question 9

During a penetration test, a vulnerability scanner reports a critical SQL injection vulnerability in a web application. However, manual testing shows that the parameter is not injectable due to proper parameterized queries. Which of the following is the MOST likely cause of this false positive?

Accepted Answer

The scanner matched a generic error message that is not specific to SQL injection. A vulnerability scanner often relies on pattern matching in HTTP responses to flag SQL injection. If the application returns a generic error message (e.g., 'An error occurred') after sending a malicious payload, the scanner may incorrectly classify it as SQL injection. However, because the application uses parameterized queries, the payload is safely handled, and the error is unrelated to SQL syntax — making this a classic false positive caused by generic error message matching.

Answer

The scanner used a payload that caused a different error unrelated to SQL injection

Answer

The scanner detected a stored XSS instead

Answer

The scanner tested a different parameter than what was reported

Question 10

A penetration tester is performing passive reconnaissance and wants to identify subdomains associated with a target domain without directly querying the target's DNS servers. Which tool is specifically designed for this purpose?

Accepted Answer

theHarvester. TheHarvester is specifically designed for passive reconnaissance, gathering subdomains from public sources like search engines (Google, Bing), PGP key servers, and the Shodan database without querying the target's DNS servers directly. This aligns with the requirement to avoid direct interaction with the target's infrastructure, making it the correct choice for passive subdomain enumeration.

Answer

WPScan

Answer

Nmap

Answer

Gobuster

Question 11

A penetration tester is reviewing a Python script used for a custom exploit. Which of the following code snippets contains a dangerous function that could lead to remote code execution?

Accepted Answer

eval(user_input). The `eval()` function in Python interprets and executes the string passed to it as a Python expression. If an attacker can control the `user_input` string, they can inject arbitrary Python code, leading to remote code execution (RCE). This is a classic dangerous function in Python that should never be used with untrusted input.

Answer

input('Enter name:')

Answer

open(filename, 'r')

Answer

subprocess.run(['ls'])

Question 12

Drag and drop the steps to perform privilege escalation on a Linux system using kernel exploit enumeration into the correct order.

Accepted Answer

Gather system information (kernel version, architecture, distribution) -> Search for kernel exploits using searchsploit or similar -> Download or compile the exploit code -> Run the exploit -> Verify privilege escalation (e.g., id command). Privilege escalation requires system info gathering, exploit search, compilation, execution, and verification.

Answer

Search for kernel exploits -> Gather system information -> Download or compile the exploit -> Run the exploit -> Verify privilege escalation

Answer

Gather system information -> Search for kernel exploits -> Run the exploit -> Verify privilege escalation -> Download or compile the exploit

Answer

Run the exploit -> Verify privilege escalation -> Gather system information -> Search for kernel exploits -> Download or compile the exploit

Question 13

During an internal penetration test, a tester gains a shell as the 'www-data' user on a Linux server. The server runs a PHP web application that connects to a PostgreSQL database using credentials stored in a config file. The tester discovers that the PostgreSQL server trusts all local connections (no password required) and that the web application's database user has the 'CREATEFUNC' privilege. Which technique is most effective for escalating privileges to database administrator (superuser) and executing system commands as the database service account?

Accepted Answer

Create a PostgreSQL function using a trusted language like Python or Perl that executes arbitrary system commands, then run it.. The 'CREATEFUNC' privilege allows the web application database user to create user-defined functions in PostgreSQL. By creating a function in a trusted language (e.g., Python, Perl, or C) that executes arbitrary system commands, the tester can run those commands with the privileges of the database service account (e.g., 'postgres'), effectively escalating to superuser-level control and executing system commands without needing a password.

Answer

Use the stored credentials to log in as the web application user and run SELECT * FROM pg_shadow; to extract password hashes of other users.

Answer

Exploit a kernel vulnerability to gain root access and then dump the database files.

Answer

Use the 'sudo' command to switch to the postgres user if the www-data user has sudo privileges.

Question 14

A penetration testing firm has been hired to test the internal network of a large enterprise. During the scoping meeting, the client states that they want to include all IP ranges, including those used by the HR department's sensitive systems. The tester should recommend which of the following to minimize business impact and avoid disruption?

Accepted Answer

Perform the test during off-peak hours and provide prior notification. Performing the test during off-peak hours and providing prior notification minimizes business impact by reducing the likelihood of disrupting critical HR operations during normal business hours. This approach aligns with the scoping requirement to include all IP ranges while allowing the client to prepare for potential service interruptions, such as those caused by active scanning techniques like TCP SYN scans or service enumeration. Prior notification ensures that HR staff can take precautions, such as backing up sensitive data or pausing batch jobs, thereby avoiding data corruption or system unavailability.

Answer

Exclude the HR department's IP range from the test

Answer

Use only passive reconnaissance techniques on the HR systems

Answer

Include the HR systems but require written authorization from HR management

Question 15

The client's development team needs to reproduce a cross-site scripting vulnerability found in the login form. They require the exact payload and steps. Which deliverable should the penetration tester provide to meet this need?

Accepted Answer

A proof of concept code or walkthrough in the report appendix. The correct deliverable is a proof of concept (PoC) code or walkthrough in the report appendix because the client's development team needs the exact payload and step-by-step instructions to reproduce the cross-site scripting (XSS) vulnerability. This allows them to validate the finding and implement a fix by injecting a crafted script (e.g., ) into the login form's input fields, demonstrating how user input is not properly sanitized or encoded. Including this in the appendix ensures the technical details are documented for replication without cluttering the main report.

Answer

An executive summary

Answer

A spreadsheet of findings with CVSS scores

Answer

A verbal explanation during the readout