PT0-002 Practice Test 42 — 15 Questions

Question 1

During a penetration test, you want to perform a stealthy port scan that minimizes the chance of being logged by the target. Which Nmap option should you use?

Accepted Answer

-sS. The -sS option performs a TCP SYN scan (half-open scan), which sends SYN packets and never completes the TCP handshake. Because the connection is never fully established, the target's application layer never logs the connection, making it the stealthiest common scan type. It requires raw socket privileges (root/admin) but is the default scan type when Nmap is run with elevated privileges.

Answer

-sU

Answer

-sV

Answer

-sT

Question 2

A penetration tester is performing internal reconnaissance on a Windows Active Directory environment. The tester has a low-privileged domain user account. Which of the following techniques is most likely to help identify all domain controllers and their IP addresses without generating excessive network traffic or alerts?

Accepted Answer

Query the DNS service for SRV records of _ldap._tcp.dc._msdcs.domain.local. Querying DNS for SRV records of _ldap._tcp.dc._msdcs.domain.local is a standard, low-noise method to discover all domain controllers in an Active Directory environment. This query leverages the automatic registration of LDAP service records by domain controllers, requiring only a single DNS lookup rather than sweeping the network, thus avoiding excessive traffic and typical security alerts.

Answer

Perform a full subnet ping sweep using Nmap

Answer

Use NetBIOS name resolution by sending broadcasts

Answer

Enumerate SMB shares on all IP addresses in the subnet

Question 3

During a penetration test, you capture NTLM hashes by poisoning LLMNR requests. Which tool would you use to exploit this and obtain the hashes?

Accepted Answer

Responder. Responder is the primary tool used for LLMNR/NBT-NS/mDNS poisoning to capture NTLM hashes from network authentication attempts.

Answer

CrackMapExec

Answer

ntlmrelayx

Answer

Metasploit

Question 4

During a web application test, you discover a parameter that reflects user input in the response without proper encoding. You craft a payload that executes JavaScript in the victim's browser. This vulnerability is best classified as:

Accepted Answer

Reflected XSS. Reflected XSS occurs when user input is immediately reflected back in the response without proper sanitization, allowing script execution.

Answer

Stored XSS

Answer

Server-side request forgery (SSRF)

Answer

DOM-based XSS

Question 5

A penetration tester is presenting findings to a mixed audience of technical staff and executives. The executives seem confused about the risk ratings. How should the tester adjust the presentation?

Accepted Answer

Explain the risk ratings in terms of business impact and likelihood, avoiding technical jargon.. When communicating to a mixed audience, the tester should tailor the message to each group's needs, focusing on risk and business impact for executives.

Answer

Ask the executives to leave and schedule a separate meeting with them later.

Answer

Provide the executives with a separate written report and continue the technical presentation.

Answer

Skip the technical details and focus only on the executive summary.

Question 6

A penetration tester wants to identify all subdomains for a target domain using only public records. Which technique is most effective for this purpose?

Accepted Answer

Searching crt.sh (Certificate Transparency logs).. Certificate Transparency logs, accessible via crt.sh, are a public record of all SSL/TLS certificates issued for a domain. Since certificates often include Subject Alternative Names (SANs) listing subdomains, querying crt.sh reveals subdomains without any interaction with the target's infrastructure. This technique is passive, requires no authorization, and leverages mandatory logging per RFC 6962, making it highly effective for enumeration from public records.

Answer

DNS zone transfer.

Answer

Using Nmap to brute-force subdomains.

Answer

Querying the domain's MX records.

Question 7

A penetration tester has gained initial access to a Linux server through a vulnerable web application. The server has a restrictive outbound firewall that only allows traffic on ports 80, 443, and 53. The tester wants to establish a reverse shell that is likely to bypass the firewall. Which of the following techniques would be most effective?

Accepted Answer

Use a reverse shell over DNS by encoding commands in DNS queries. DNS traffic on port 53 is typically allowed through restrictive outbound firewalls, and encoding reverse shell commands within DNS queries allows the tester to tunnel traffic over DNS, bypassing the firewall's port restrictions. Tools like dnscat2 or iodine can encapsulate TCP data in DNS requests, making the reverse shell appear as legitimate DNS traffic.

Answer

Use a reverse shell listener on TCP port 3389 and connect from the target

Answer

Use a bind shell on the target's port 4444 and connect directly

Answer

Use a reverse shell on TCP port 8080 and hope it is not blocked

Question 8

A penetration tester is preparing a report for a client that requires compliance with PCI DSS. Which of the following is the MOST important consideration for the report structure?

Accepted Answer

The report should map findings to specific PCI DSS requirements.. PCI DSS compliance reporting requires that each identified finding be traceable to the specific PCI DSS requirement it violates, enabling the client to demonstrate compliance status and remediation priorities to a QSA or acquirer. Mapping findings to PCI DSS requirements directly supports the standard's mandate for documented, requirement-specific evidence rather than generic vulnerability lists. Options A, B, and C, while potentially useful in some engagements, are not the most important structural consideration for a PCI DSS compliance report: ASV scan sections apply only to external scanning requirements, anonymization is not a PCI DSS reporting mandate, and encryption of the report itself is a data-handling control rather than a report-structure requirement.

Answer

Include a separate section for vulnerabilities found in the ASV scan.

Answer

The client's name and sensitive data should be anonymized.

Answer

All findings must be encrypted at rest and in transit.

Question 9

You are conducting a penetration test for a financial institution. The rules of engagement specify that you are not to access any production customer data. During the test, you discover a SQL injection vulnerability in a public-facing web application that allows you to extract customer personally identifiable information (PII). You successfully demonstrate the injection but do not extract any actual PII. According to ethical guidelines and the rules of engagement, what is the appropriate course of action?

Accepted Answer

Immediately stop the test and notify the client with details of the finding.. Option D is correct because the rules of engagement explicitly prohibit accessing production customer data, so upon discovering a SQL injection that could expose PII, the tester must halt testing and immediately notify the client to prevent any accidental or unauthorized data exposure. This aligns with ethical penetration testing principles, which require respecting scope constraints and reporting critical findings promptly rather than continuing to exploit them. Option A is wrong because extracting even a small sample of PII would violate the explicit prohibition on accessing production customer data. Option B is insufficient because merely avoiding further exploitation does not address the obligation to report a serious vulnerability that could compromise customer data. Option C is also inadequate because documenting the finding without notifying the client immediately delays critical risk communication and fails to follow the rules of engagement's implied duty to stop upon encountering such a boundary.

Answer

Extract a small sample of PII to prove impact, then report the vulnerability.

Answer

Continue the test but avoid exploiting the SQL injection further to stay within scope.

Answer

Document the vulnerability and include it in the final report without further action.

Question 10

A tester is reviewing code and sees a function that concatenates user input directly into a SQL query. Which vulnerability is most likely present?

Accepted Answer

SQL injection. SQL injection, because concatenating untrusted user input directly into a SQL query allows an attacker to alter the query's structure and execute arbitrary SQL statements. This is the classic pattern for SQL injection, where input such as ' OR '1'='1 or UNION SELECT can bypass authentication or extract data. Buffer overflow (A) involves writing beyond allocated memory bounds and is not indicated by string concatenation into a query. Command injection (C) occurs when input is passed to an OS shell or command interpreter, not a SQL query. Cross-site scripting (D) involves injecting script into web pages rendered to other users, which is a different context from SQL query construction.

Answer

Buffer overflow

Answer

Command injection

Answer

Cross-site scripting (XSS)

Question 11

Which of the following is typically included in the final deliverables of a penetration test?

Accepted Answer

Executive summary, technical findings, and remediation guidance. Standard deliverables include an executive summary, technical findings, and remediation guidance.

Answer

A list of all employee passwords

Answer

Network diagrams of the client's internal network

Answer

A copy of all data extracted during the test

Question 12

A penetration tester has completed a test and is finalizing the report. The client's security team needs to know the exact commands and steps to reproduce a critical remote code execution vulnerability. In which section of the report should this information be primarily documented?

Accepted Answer

Findings and Remediation. The Findings and Remediation section is the correct place to document the exact commands and steps to reproduce a critical remote code execution vulnerability. This section provides detailed technical evidence, including proof-of-concept (PoC) code, command syntax, and step-by-step reproduction steps, enabling the client's security team to validate and remediate the issue. The Executive Summary is too high-level for such technical details, and the Methodology section describes the overall testing approach, not specific exploit commands.

Answer

Executive Summary

Answer

Methodology

Answer

Appendix

Question 13

A penetration tester has gained a foothold on a Linux server through a vulnerable web application. The server has an outbound firewall that blocks all traffic except DNS queries (UDP 53). The tester needs to establish a reverse shell to maintain access. Which technique is most likely to succeed?

Accepted Answer

Encode the payload in Base64 and use DNS tunneling to execute commands. DNS tunneling encapsulates non-DNS traffic (e.g., command output) within DNS query and response packets, which are allowed through the firewall on UDP port 53. This technique bypasses the outbound firewall restriction by making the malicious traffic appear as legitimate DNS queries, enabling the tester to execute commands and exfiltrate data without triggering network-level blocks.

Answer

Use a bind shell on a high TCP port and connect from the tester's machine

Answer

Attempt a reverse shell over HTTP using TCP port 80

Answer

Use SSH reverse port forwarding to the tester's server on port 443

Question 14

A penetration tester is conducting an internal network test. During the engagement, the tester discovers a critical vulnerability that could be exploited to gain domain admin privileges. According to best practices, how should the tester communicate this finding to the client?

Accepted Answer

Immediately notify the client's point of contact via a secure channel. Option A is correct because best practices for penetration testing require immediately notifying the client's designated point of contact through a secure channel when a critical vulnerability—such as one enabling domain admin compromise—is discovered, so the client can begin remediation and risk mitigation without delay. This aligns with standard engagement rules of conduct and responsible disclosure, which prioritize urgent communication of high-impact findings over waiting for a scheduled report. Option B is wrong because critical findings must be proactively escalated, not withheld until the client requests a status update. Option C is wrong because waiting until the final report could leave the domain exposed to exploitation for the remainder of the engagement. Option D is wrong because exploiting the vulnerability to demonstrate impact and then attempting to "fix" it exceeds the tester's authorized scope and could cause damage or legal issues.

Answer

Only communicate it if the client asks for a status update

Answer

Wait until the end of the test to include it in the formal report

Answer

Exploit the vulnerability to demonstrate impact and then fix it before reporting

Question 15

A client requests a penetration test of their production environment that includes critical financial transaction systems. The client is concerned about potential service disruptions. Which of the following should the tester include in the Rules of Engagement to address this concern?

Accepted Answer

A 'stop loss' condition that requires immediate termination of testing if system metrics exceed defined thresholds. A 'stop loss' condition is a standard mechanism in Rules of Engagement (RoE) that defines specific system metrics (e.g., CPU utilization > 90%, memory usage > 80%, or transaction latency > 500ms) which, when exceeded, require immediate termination of testing. This directly addresses the client's concern about service disruptions in the production environment by providing a safety threshold that prevents the penetration test from causing performance degradation or outages in critical financial transaction systems.

Answer

The tester will only use passive reconnaissance techniques

Answer

Exclude all financial transaction systems from the scope of testing

Answer

The client must provide a service level agreement (SLA) to the tester