PT0-002 Practice Test 41 — 15 Questions

Question 1

During a web application penetration test, the tester wants to identify the technologies used by the target website. Which of the following tools is best suited for technology fingerprinting?

Accepted Answer

WhatWeb. WhatWeb (option D) is the correct choice because it is a dedicated web technology fingerprinting tool that identifies CMS platforms, JavaScript libraries, web servers, and frameworks by analyzing HTTP responses, headers, meta tags, and file signatures. In a web application penetration test, this directly addresses the goal of enumerating the technologies behind the target site. Nikto (A) is a web server vulnerability scanner, not a technology fingerprinter, though it may incidentally reveal some server details. Nmap (B) is a network/host discovery and port scanning tool with limited HTTP fingerprinting via NSE scripts, and Gobuster (C) is a directory and DNS brute-forcing tool, neither of which is purpose-built for identifying web technologies.

Answer

Nikto

Answer

Nmap

Answer

Gobuster

Question 2

A penetration testing firm is scoping a test for a client that uses a hybrid infrastructure with both on-premises servers and cloud-based services (IaaS). The client specifies that only the cloud environment should be tested this year. Which concept is MOST important for the tester to discuss during the scoping meeting to avoid testing out-of-scope assets?

Accepted Answer

The shared responsibility model between the client and the cloud provider. The shared responsibility model defines which security controls and operational tasks are managed by the cloud provider versus the client. In a scoping meeting, understanding this model is critical because the penetration tester must only target the client's side of the responsibility boundary (e.g., guest OS, applications, and IaaS configurations) and avoid testing the provider's underlying infrastructure, which is out-of-scope. Without this discussion, the tester could inadvertently probe the provider's hypervisor or physical network, violating the scope agreement and potentially causing legal or contractual issues.

Answer

The need to test on-premises systems as well to get a complete picture

Answer

The potential for false positives in cloud vulnerability scanners

Answer

The cost of third-party cloud penetration testing tools

Question 3

During the scoping phase of a penetration test, the tester and client must define the rules of engagement (ROE). Which THREE of the following should be included in the ROE? (Select THREE.)

Accepted Answer

Contact information for the client to report issues during the test.. Option A is correct because the ROE must include emergency and escalation contact information so the tester can immediately notify the client of critical findings, outages, or accidental impact during testing. Option B is correct because the ROE defines which attack types are authorized, such as phishing, social engineering, or physical intrusion, preventing the tester from exceeding the agreed scope. Option E is correct because the ROE must specify in-scope and out-of-scope boundaries, including exact IP ranges, subnets, domains, and excluded hosts, to avoid testing unauthorized systems. Option C is not included because the ROE defines authorized activities and scope, not a predetermined list of specific vulnerabilities to exploit, which is discovered during the assessment. Option D is not included because remediation steps occur after the test and belong in the final report or a separate remediation plan, not in the rules of engagement.

Answer

Specific vulnerabilities that will be exploited.

Answer

Post-test remediation steps.

Question 4

Which TWO of the following are valid uses of the 'socat' tool during a penetration test? (Select TWO.)

Accepted Answer

Forwarding TCP ports to pivot through a compromised host. Option B is correct because socat is a general-purpose relay tool that can forward TCP ports, e.g. 'socat TCP-LISTEN:8080,fork TCP:internal-host:80', which is a standard technique for pivoting through a compromised host to reach otherwise unreachable internal services. Option D is correct because socat can act as a listener for a reverse shell, e.g. 'socat TCP-LISTEN:4444 STDOUT' or 'socat TCP-LISTEN:4444 EXEC:/bin/bash', allowing a target to connect back and deliver an interactive shell. Option A is not a socat use case; FTP file extraction is done with an FTP client such as 'ftp', 'wget', or 'curl'. Option C is not a socat use case; HTTPS man-in-the-middle requires TLS interception/proxy tooling such as mitmproxy, Burp Suite, or sslstrip, not socat's raw stream relaying. Option E is not a socat use case; HTTP form brute-forcing is performed with tools like Hydra, Burp Intruder, or ffuf.

Answer

Extracting files from an FTP server

Answer

Performing a man-in-the-middle attack on HTTPS

Answer

Brute-forcing HTTP form authentication

Question 5

A penetration tester is analyzing a PowerShell script that uses the 'Invoke-Command' cmdlet to execute commands on remote machines, and 'Set-Service' to change service startup types. What attack is this script most likely performing?

Accepted Answer

Remote service modification for persistence.. The script uses Invoke-Command to execute commands on remote machines and Set-Service to change service startup types. This combination is commonly used to modify a service to start automatically or to create a new service that runs malicious code, establishing persistence on a remote system. The attack does not involve lateral movement via PsExec (which uses SMB and service control manager differently) nor credential dumping (which requires tools like Mimikatz or direct memory access).

Answer

Lateral movement via PsExec.

Answer

Credential dumping.

Answer

Data exfiltration.

Question 6

A penetration tester has completed testing and identified several vulnerabilities: a critical SQL injection (CVSS 9.8), a medium stored XSS (CVSS 6.1), and a low self-signed certificate (CVSS 3.7). The client's security manager asks for a simplified way to prioritize remediation. Which of the following is the most effective approach for the tester to present the findings?

Accepted Answer

Provide a risk matrix that maps likelihood and impact for each finding.. A risk matrix that maps likelihood and impact for each finding provides a more nuanced prioritization than raw CVSS scores alone. CVSS scores reflect intrinsic severity but do not account for the client's specific threat environment, asset criticality, or compensating controls. By presenting a risk matrix, the tester enables the security manager to make informed decisions based on the actual risk to the organization, which is the core goal of the reporting and communication domain in PT0-002.

Answer

List all vulnerabilities in descending order of CVSS score only.

Answer

Present only the critical SQL injection finding because it overshadows the others.

Answer

Calculate a single overall risk score for the entire engagement by averaging all CVSS scores.

Question 7

After completing a penetration test, the tester is writing the report. The client's Chief Information Security Officer (CISO) is the primary audience and wants to understand the overall security posture and the most critical risks to the business. Which section of the report should the tester most heavily focus on for this audience?

Accepted Answer

Executive Summary. The Executive Summary is the section of a penetration test report that provides a high-level overview of the security posture, focusing on business risks and strategic recommendations. For a CISO, who needs to understand the most critical risks to the business without delving into technical details, this section is the most relevant. It translates technical vulnerabilities into business impact, aligning with the CISO's role in risk management and decision-making.

Answer

Technical Findings

Answer

Appendix - Vulnerability Details

Answer

Methodology

Question 8

A penetration testing firm is hired to assess a client's hybrid infrastructure with on-premises and cloud servers in multiple regions. The client specifies testing only the on-premises systems due to budget and compliance. Which of the following should the tester emphasize in the rules of engagement (ROE)?

Accepted Answer

Explicit exclusion of all cloud-based assets. The client explicitly restricted testing to on-premises systems due to budget and compliance. The rules of engagement (ROE) must clearly define the authorized scope to prevent accidental testing of cloud assets, which could violate the contract and potentially breach the cloud provider's terms of service. Option B is correct because explicitly excluding all cloud-based assets ensures the tester does not touch any cloud resources, aligning with the client's constraints.

Answer

Detailed network diagrams of the cloud environment

Answer

Approval from the cloud service provider

Answer

A list of all cloud API endpoints

Question 9

A penetration tester is analyzing a web application's JavaScript files to discover hidden API endpoints and potential client-side vulnerabilities. Which tool is specifically designed to extract URLs and endpoints from JavaScript files?

Accepted Answer

LinkFinder. LinkFinder is a Python-based tool specifically designed to extract URLs and endpoints from JavaScript files by using regular expressions and parsing techniques. It analyzes JS files for patterns like API routes, relative paths, and hardcoded URLs, making it ideal for discovering hidden endpoints during web application penetration testing.

Answer

Wireshark

Answer

Burp Suite's Target scope

Answer

Nmap

Question 10

A penetration tester is using a vulnerability scanner that reports a 'Critical' severity for an 'SMBv1 vulnerability' on a Windows server. Which of the following is the correct remediation recommendation?

Accepted Answer

Disable SMBv1 on the server. The correct remediation for an SMBv1 vulnerability is to disable SMBv1 on the server. SMBv1 is a legacy protocol that lacks modern security features and is known to be exploited by malware like EternalBlue (used in WannaCry). Disabling SMBv1 eliminates the attack surface without affecting SMBv2 or SMBv3, which are secure and still functional.

Answer

Apply the latest Windows security patches

Answer

Enable SMB signing

Answer

Enable SMB encryption

Question 11

A penetration tester wants to discover all subdomains of a target domain without directly querying the target's DNS servers to avoid detection. Which technique is most appropriate?

Accepted Answer

Passive DNS enumeration using public data sources. Passive DNS enumeration leverages public data sources such as certificate transparency logs, search engine caches, and passive DNS databases (e.g., VirusTotal, SecurityTrails) to discover subdomains without sending any queries to the target's authoritative DNS servers. This approach avoids generating DNS traffic that could be logged or detected by the target's monitoring systems, making it ideal for stealthy reconnaissance.

Answer

DNS zone transfer

Answer

Brute-force subdomain enumeration using a wordlist

Answer

SNMP community string enumeration

Question 12

A client requests a penetration test of their production environment, which includes critical financial transaction systems. The client is concerned about potential service disruptions. Which of the following should the tester include in the Rules of Engagement to address this concern?

Accepted Answer

A scope that limits testing to off-peak hours and includes a rollback plan for any changes. It directly addresses the client's concern about service disruptions by limiting testing to off-peak hours and including a rollback plan. This ensures that any changes made during the test can be reversed quickly, minimizing the risk to critical financial transaction systems. The Rules of Engagement (RoE) must balance thorough testing with operational stability, and this scope provision achieves that.

Answer

A detailed schedule of every attack method to be used

Answer

A clause stating that testing will stop immediately if any service degradation is detected

Answer

A list of all tools and versions that will be used during the test

Question 13

A penetration tester is analyzing a Python script that uses the 'requests' library to send HTTP requests with a custom header that mimics a mobile device. The script also uses 'beautifulsoup4' to parse the response and extract specific data. Which task is this script most likely performing?

Accepted Answer

Web scraping to gather publicly available information.. The script uses the 'requests' library to send HTTP requests with a custom header mimicking a mobile device, and 'beautifulsoup4' to parse the HTML response and extract data. This combination is specifically designed for web scraping, where the custom header helps avoid bot detection by making the request appear to come from a mobile browser, and BeautifulSoup extracts targeted information from the page structure.

Answer

Fuzzing for SQL injection.

Answer

Performing a brute-force attack on a login form.

Answer

Testing for directory traversal vulnerabilities.

Question 14

A penetration tester is conducting an external assessment of a target organization and wants to gather information without sending any packets that might be logged by the target's network monitoring systems. Which TWO of the following methods are considered passive reconnaissance?

Accepted Answer

Use Shodan to identify exposed services. Option C is correct because Shodan is a third-party search engine that indexes internet-facing services from data it has already collected, so querying it does not send any traffic to the target's own infrastructure and therefore cannot be logged by the target's monitoring systems. Option D is correct because WHOIS lookups query public domain registration databases maintained by registrars and registries, retrieving ownership, contact, and nameserver data without touching the target's network. Option A is not passive reconnaissance but an active social-engineering attack that directly contacts employees. Option B is active because nslookup sends DNS queries directly to the target's DNS servers, generating loggable traffic. Option E is active because an Nmap port scan sends packets to the target's hosts and is readily detected by IDS/IPS and firewall logs.

Answer

Send spear-phishing emails to employees

Answer

Query the target's DNS servers using nslookup

Answer

Perform a full port scan using Nmap

Question 15

Which penetration testing standard provides a structured methodology for conducting penetration tests, including pre-engagement, reconnaissance, and reporting phases?

Accepted Answer

PTES. The Penetration Testing Execution Standard (PTES) covers the entire testing lifecycle.

Answer

NIST SP 800-115

Answer

OWASP Testing Guide

Answer

OSSTMM