PT0-002 Practice Test 4 — 10 Questions

Question 1

You are attacking a web application and notice that it makes requests to internal services. You attempt to access the cloud metadata endpoint at http://169.254.169.254/. Which vulnerability are you most likely exploiting?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSRF (Server-Side Request Forgery). SSRF (Server-Side Request Forgery) allows an attacker to make requests from the server to internal resources, including cloud metadata endpoints.

Answer

XXE (XML External Entity)

Answer

Command injection

Answer

CSRF (Cross-Site Request Forgery)

Question 2

A penetration tester is writing a report and needs to assign a severity rating to a vulnerability that has a CVSS base score of 7.5. According to CVSS v3.1, which severity level does this score correspond to?

Accepted Answer

High. CVSS v3.1 defines scores from 0.0 to 10.0: 0.0 = None, 0.1-3.9 = Low, 4.0-6.9 = Medium, 7.0-8.9 = High, 9.0-10.0 = Critical.

Answer

Critical

Answer

Low

Answer

Medium

Question 3

A penetration tester is presenting findings to a technical audience. Which THREE practices are MOST appropriate for this setting? (Select THREE.)

Accepted Answer

Demonstrate the exploit steps. Technical audiences benefit from details about exploitation, technical steps, and evidence.

Answer

Use high-level business language only

Answer

Focus on strategic recommendations

Question 4

A 'no-fail' clause prohibits service outages. How should the tester address high-risk tests like SQL injection?

Accepted Answer

Require a staging environment for testing. Testing in a staging environment prevents real outages. Option A is wrong because it removes important tests. Option C is wrong because it does not prevent outages. Option D is wrong because it is irresponsible.

Answer

Remove all high-risk tests from the scope

Answer

Include a clause that the tester is not liable

Answer

Proceed with testing and hope no outages occur

Question 5

During the information gathering phase, a penetration tester uses Google dorks to find exposed documents on a target's website. Which Google dork would be most appropriate to find PDF files containing sensitive information?

Accepted Answer

filetype:pdf. The filetype:pdf dork restricts results to PDF files. Other dorks target different file types or content.

Answer

inurl:admin

Answer

site:target.com password

Answer

intitle:index.of

Question 6

A penetration tester is conducting passive reconnaissance using OSINT techniques. Which TWO of the following are examples of passive OSINT sources?

Accepted Answer

Certificate transparency logs (crt.sh). Certificate transparency logs (crt.sh) (B) are a passive OSINT source because they are public, third-party repositories of issued TLS certificates that a tester can query without sending any traffic to the target's infrastructure, revealing subdomains and hostnames. WHOIS databases (D) are also passive OSINT, as registration records for domains and IP ranges are queried from registry/RIR servers rather than the target itself, exposing registrant, contact, and nameserver data. By contrast, social engineering (A) is an active engagement technique that involves direct interaction with people, not passive collection. snmpwalk (C) actively sends SNMP queries to a device, and an Nmap SYN scan (E) actively probes target ports with TCP SYN packets, so both generate traffic toward the target and are not passive.

Answer

Social engineering

Answer

snmpwalk

Answer

Nmap SYN scan

Question 7

A penetration tester is performing a vulnerability scan on a web server using Nikto. After the scan, the tester notices several findings related to outdated software versions and missing security headers. What should the tester do to validate the findings and reduce false positives?

Accepted Answer

Manually verify a subset of the findings. Manually verifying findings is the best practice to confirm if they are real vulnerabilities or false positives. Relying on scanner output alone is insufficient.

Answer

Ignore findings related to missing headers as low priority

Answer

Increase the scan intensity to get more details

Answer

Accept all findings as true since Nikto is a reliable tool

Question 8

A penetration tester is analyzing a web application and wants to discover hidden API endpoints by brute-forcing common paths. Which tool is best suited for this task?

Accepted Answer

Feroxbuster. Feroxbuster is a fast, recursive content discovery tool that supports wordlist-based brute-forcing of directories, files, and API endpoints, with automatic recursion.

Answer

WPScan

Answer

theHarvester

Answer

Nikto

Question 9

During a source code review of a PHP application, the tester finds the following line: $query = "SELECT * FROM users WHERE username = '" . $_POST['username'] . "'"; Which vulnerability is present?

Accepted Answer

SQL injection. Concatenating user input directly into an SQL query without sanitization leads to SQL injection.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Command injection

Question 10

A penetration tester is using Shodan to identify internet-facing devices associated with a target organization. Which of the following is Shodan's primary function in the context of passive reconnaissance?

Accepted Answer

Searching for devices and services exposed to the internet. Shodan is a search engine for internet-connected devices, providing information about services and banners. It does not perform active scans itself; it indexes data from active scanning.

Answer

Analyzing malware samples

Answer

Exploiting vulnerabilities in IoT devices

Answer

Performing live port scans on target IPs