PT0-002 Practice Test 40 — 15 Questions

Question 1

A penetration tester is analyzing a Java application and finds the following code snippet: Object obj = ois.readObject(); where ois is an ObjectInputStream. What vulnerability is most likely present if the input is untrusted?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Insecure deserialization. Insecure deserialization occurs when readObject() is called on untrusted data, potentially leading to code execution.

Answer

SQL injection

Answer

Path traversal

Answer

Cross-site scripting

Question 2

A penetration tester is hired to assess the security of a company's internal network. The client provides the tester with full network diagrams, credentials, and source code. Which type of penetration test is being performed?

Accepted Answer

White box. White box testing provides the tester with full knowledge and credentials, which matches the scenario.

Answer

Grey box

Answer

Black box

Answer

Red team

Question 3

Which THREE of the following are common components of a pre-engagement agreement between a penetration tester and a client?

Accepted Answer

Rules of Engagement (RoE). Pre-engagement typically includes SOW, RoE, NDA, permission letters, emergency contacts, and communication plans.

Answer

List of all employee passwords

Answer

Full source code of the target application

Question 4

A penetration tester wants to exploit a Windows system using a known vulnerability and gain a meterpreter session. Which tool is most appropriate?

Accepted Answer

Metasploit Framework. Metasploit Framework (B) is the most appropriate tool because it provides a comprehensive exploit development and execution environment, including pre-built modules for known Windows vulnerabilities and seamless integration with Meterpreter payloads. Unlike the other options, Metasploit is specifically designed to deliver a Meterpreter session after exploitation, handling payload generation, staging, and post-exploitation tasks natively.

Answer

CrackMapExec

Answer

Impacket

Answer

Hydra

Question 5

Which of the following should be included in the appendix section of a penetration testing report?

Accepted Answer

Raw tool output and scan results. Appendices contain supporting details like scope, methodology, and raw tool output.

Answer

Remediation steps for each finding

Answer

Executive summary

Answer

Key findings and overall risk rating

Question 6

A penetration tester is following responsible disclosure timelines. Which TWO of the following actions align with responsible disclosure practices?

Accepted Answer

Notify the software vendor immediately after discovery.. Responsible disclosure involves notifying the vendor and providing a reasonable time to fix before public disclosure.

Answer

Publish exploit code on a public forum immediately.

Answer

Publicly disclose the vulnerability the same day.

Answer

Sell the vulnerability information to the highest bidder.

Question 7

A penetration tester is preparing a presentation for both technical and executive audiences. Which TWO of the following are effective strategies for communicating findings to an executive audience?

Accepted Answer

Focus on business risk and financial impact.. Executives need high-level overviews and business impact, not technical details.

Answer

Discuss each vulnerability's CVSS vector string.

Answer

Use technical jargon and detailed exploit steps.

Answer

Include raw command-line output in slides.

Question 8

A penetration tester is planning a social engineering campaign against a corporation. The goal is to trick the CEO into revealing sensitive information. Which type of attack should the tester use?

Accepted Answer

Whaling. Whaling is a targeted form of phishing that specifically focuses on high-profile individuals, such as the CEO. In this scenario, the goal is to trick the CEO into revealing sensitive information, making whaling the correct choice because it is designed to impersonate trusted entities or create urgent scenarios to deceive senior executives.

Answer

Vishing

Answer

Spear phishing

Answer

Pharming

Question 9

A penetration tester is conducting active reconnaissance and wants to perform a SYN scan on a target network. During the scan, the tester notices that some ports are reported as filtered. What does a filtered port status typically indicate in Nmap?

Accepted Answer

A firewall is blocking the probe packets.. Filtered ports in Nmap indicate that a firewall, packet filter, or other network obstacle is blocking the probe packets, preventing Nmap from determining whether the port is open or closed.

Answer

The port is closed and the target responded with a RST packet.

Answer

The port is open but no service is listening.

Answer

The target is not responding to any probes.

Question 10

A penetration tester is conducting active reconnaissance on a target network and wants to enumerate SNMP information. Which TWO of the following tools or commands can be used to query SNMP data from network devices? (Select TWO.)

Accepted Answer

snmpwalk. snmpwalk is a standard SNMP tool to retrieve a subtree of MIB data, and nmap can be used with SNMP scripts to enumerate information.

Answer

WPScan

Answer

dig

Answer

tcpdump

Question 11

A penetration tester is reviewing SSL/TLS certificate information for a target domain and wants to discover additional subdomains that share the same certificate. Which resource is best for this purpose?

Accepted Answer

crt.sh. Certificate Transparency logs (e.g., crt.sh) allow searching by domain or certificate fingerprint to find all certificates issued for that domain, often revealing subdomains.

Answer

Shodan

Answer

Google Dorks

Answer

Wayback Machine

Question 12

A penetration tester is conducting a vulnerability scan of a Linux server using OpenVAS. Which TWO scan configurations would provide the MOST comprehensive results? (Select TWO.)

Accepted Answer

Scan using the 'Full and fast' configuration. Authenticated scans with credentials allow the scanner to log in and check for missing patches, misconfigurations, and vulnerabilities that are not visible externally. Full and fast scan configurations are typical for comprehensive coverage.

Answer

Scan using only the 'Discovery' category

Answer

Scan using the 'Denial of Service' configuration

Answer

Unauthenticated scan with default settings

Question 13

A penetration tester is prioritizing remediation recommendations. Which approach is most aligned with industry best practices?

Accepted Answer

Address critical vulnerabilities first, then high, then medium, with quick wins highlighted.. Prioritization should address critical/high vulnerabilities first, including quick wins that can be implemented rapidly.

Answer

Recommend fixing all vulnerabilities simultaneously.

Answer

Prioritize by ease of remediation regardless of severity.

Answer

List all findings in alphabetical order.

Question 14

A tester is using the following Nmap command: nmap -sC -sV -p 1-65535 target_ip. What is the primary purpose of the -sC option?

Accepted Answer

Use default scripts. The -sC option in Nmap is equivalent to --script=default, which runs a collection of common, non-intrusive enumeration scripts against the target. These scripts perform tasks such as service banner grabbing, HTTP title extraction, and SSL/TLS certificate retrieval, providing valuable reconnaissance data without requiring manual script selection.

Answer

Scan all ports

Answer

Perform a version scan

Answer

Do a SYN scan

Question 15

During a penetration test, you find a web application that uses JavaScript to make API calls. You want to discover hidden API endpoints and potential secrets (e.g., API keys) embedded in the client-side code. Which approach is most appropriate?

Accepted Answer

Download and analyze the JavaScript files. JavaScript files in client-side web applications often contain hardcoded API endpoints, API keys, and other secrets that developers inadvertently leave in the source code. By downloading and analyzing these files (e.g., via browser developer tools or wget), you can discover hidden endpoints and sensitive tokens that are not exposed in the HTML or network traffic alone.

Answer

Perform a DNS zone transfer

Answer

Run a Nikto scan against the application

Answer

Use theHarvester to search for API endpoints