PT0-002 Practice Test 43 — 15 Questions

Question 1

A penetration tester is gathering information using passive reconnaissance techniques. Which of the following are considered passive reconnaissance methods? (Choose two.)

Accepted Answer

Reviewing the target's social media profiles. Options D and E are correct because passive reconnaissance relies on publicly available information gathered without directly interacting with the target's systems. Reviewing the target's social media profiles (D) is passive since it only involves reading publicly posted content, which can reveal employee names, roles, and organizational details useful for social engineering or OSINT. Analyzing job postings for technology stack clues (E) is also passive because job ads are public documents that may disclose specific tools, platforms, and versions in use, without sending any traffic to the target. In contrast, using nmap to scan for open ports (A) actively sends packets to the target and is therefore active reconnaissance. Performing a DNS brute force attack (B) actively queries DNS servers with many candidate names, making it active. Conducting a vulnerability scan with Nessus (C) directly probes the target's systems for weaknesses, which is also active reconnaissance.

Answer

Using nmap to scan for open ports

Answer

Performing a DNS brute force attack

Answer

Conducting a vulnerability scan with Nessus

Question 2

A client requests that the penetration tester deliver the final report in an encrypted format via email. Which encryption method should the tester use to ensure confidentiality?

Accepted Answer

Use S/MIME or PGP to encrypt the email message. The correct option is D: use S/MIME or PGP to encrypt the email message. These are end-to-end message encryption standards that protect the report's contents so only the intended recipient with the corresponding private key can decrypt it, ensuring confidentiality even if the message is stored or intercepted along the way. Option A is insufficient because TLS only encrypts the transport hop between mail servers and does not protect the message at rest or from the mail provider. Option B changes the delivery method rather than encrypting the emailed report as requested, and HTTPS only secures the download channel. Option C is weak because password-protected ZIP encryption (especially legacy ZipCrypto) is vulnerable to cracking and the password would need separate secure transmission.

Answer

Rely on TLS encryption for the email transport

Answer

Upload the report to a web server using HTTPS

Answer

Compress the report in a password-protected ZIP file

Question 3

During a penetration test, the tester discovers that a third-party vendor has remote access to the client's network. The vendor was not mentioned in the scope of work. How should the tester communicate this finding in the report?

Accepted Answer

Document it in the 'Observations' or 'Out-of-Scope Findings' section.. The correct option is B: Document it in the 'Observations' or 'Out-of-Scope Findings' section. Even though the third-party vendor's remote access was not in the scope of work, it is a relevant security-relevant discovery that the client should know about, and standard penetration testing reporting practices (e.g., PTES, OWASP Testing Guide) provide an out-of-scope or observations section for exactly such items. This preserves the integrity of the agreed scope while still delivering value to the client. Option A is wrong because ignoring a discovered risk is unprofessional and could harm the client. Option C is wrong because it was not tested or validated as a vulnerability, so labeling it critical in the main findings would misrepresent the engagement. Option D is wrong because removing the finding entirely withholds potentially important information from the client.

Answer

Ignore it entirely because it is outside the testing agreement.

Answer

Include it as a critical vulnerability in the main findings.

Answer

Remove the finding because it is out of scope.

Question 4

A penetration tester needs to perform an online brute-force attack against an SSH service. Which tool is most appropriate?

Accepted Answer

Hydra. Hydra is a versatile online brute-force tool supporting many protocols including SSH.

Answer

John the Ripper

Answer

CrackMapExec

Answer

Hashcat

Question 5

During a web application test, a penetration tester intercepts requests between the browser and server and modifies them in real time. Which Burp Suite tool is designed for this purpose?

Accepted Answer

Proxy. Burp Proxy intercepts and allows modification of HTTP/HTTPS requests.

Answer

Repeater

Answer

Sequencer

Answer

Intruder

Question 6

A large enterprise hires your firm to perform a penetration test on a new cloud-based product that integrates with several third-party services. The product is built on AWS and uses serverless functions (Lambda), API Gateway, DynamoDB, and S3. The client provides you with access to a staging environment that mirrors production in architecture but with relaxed security controls: the staging environment has less restrictive security groups, enabled debugging endpoints, and broad IAM permissions. The client insists that the staging environment is sufficient for testing and that production testing is not allowed due to compliance constraints. What is the best recommendation?

Accepted Answer

Request that the staging environment be reconfigured to match production security controls, then test.. The correct option is B: request that the staging environment be reconfigured to match production security controls, then test. Because the staging environment has relaxed security groups, enabled debugging endpoints, and broad IAM permissions, findings from it would not accurately reflect the production attack surface, and reconfiguring it to mirror production lets the penetration test produce valid, compliance-safe results. Option A is wrong because it violates the client's compliance constraint and unnecessarily exposes production to risk. Option C is wrong because it is overly rigid; production access is not strictly required if staging can be made representative. Option D is wrong because testing a deliberately weakened environment and merely noting differences would yield misleading findings and miss production-relevant vulnerabilities.

Answer

Propose a limited production test during a maintenance window, accepting the compliance risk.

Answer

Refuse to proceed until production access is granted.

Answer

Test the staging environment as is and note the differences in the final report.

Question 7

A penetration tester is conducting passive reconnaissance on a target organization. The tester wants to discover subdomains and associated email addresses without directly interacting with the target's infrastructure. Which combination of tools and sources would be most effective for this task?

Accepted Answer

theHarvester with Shodan and Google dorks. theHarvester is an OSINT tool that can gather emails, subdomains, and other data from public sources like search engines, PGP key servers, and the Shodan database. It performs passive collection. Maltego can also be used but requires more setup. Shodan and Google dorks are specific searches but theHarvester automates multiple sources.

Answer

Wireshark capturing network traffic

Answer

Nikto scanning the web server

Answer

Nmap with subdomain bruteforce

Question 8

A penetration tester is analyzing a network packet capture to identify potential attacks. Which two indicators suggest a successful SQL injection attempt?

Accepted Answer

A query string containing ' OR 1=1--. Option C is correct because a query string containing ' OR 1=1-- is a classic SQL injection payload: the single quote breaks out of the intended string literal, OR 1=1 makes the WHERE clause always true, and -- comments out the remainder of the original query, so its presence in captured HTTP traffic is a strong indicator of an injection attempt. Option D is correct because unexpected data in the response body (for example, database error messages, extra rows, or records the application should not return) indicates the injected SQL was actually executed and influenced the query result, which distinguishes a successful injection from a mere attempt. The other options are not specific to SQL injection: A (multiple failed login attempts) points to brute-force or credential-stuffing activity, B (a large number of HTTP 500 errors) is a generic sign of server-side faults or fuzzing that may accompany many attack types, and E (a significant increase in outbound traffic) suggests data exfiltration or command-and-control traffic rather than SQL injection itself.

Answer

Multiple failed login attempts

Answer

A large number of HTTP 500 errors

Answer

A significant increase in outbound traffic

Question 9

A medium-sized e-commerce company, CyberMart, has contracted your penetration testing firm to assess their security posture. The company operates from three physical locations: headquarters, a data center, and a remote warehouse. They have a flat internal network but separate VLANs for production, development, and guest Wi-Fi. CyberMart's CISO insists that the test must be conducted without causing any disruption to the production environment, especially the payment processing system. The test should simulate an external attacker targeting the public-facing web servers and an internal attacker who has gained initial access to the guest network. The CISO also requests that all testing be done during off-peak hours to minimize impact. You are preparing the rules of engagement. Which of the following is the most appropriate action to include in the ROE to satisfy the client's requirements while maintaining a realistic test scenario?

Accepted Answer

Allow testing on all VLANs except the production VLAN containing payment processing, with a rule to immediately stop if any degradation is observed.. Option B is correct because it satisfies the CISO's requirement of avoiding disruption to the production payment system by explicitly excluding the production VLAN from testing, while still allowing realistic external and internal (guest network) attack simulation and adding a stop condition if degradation occurs. This balances test coverage with the no-disruption constraint during off-peak hours. Option A is wrong because permitting denial-of-service tests, even off-peak, risks disrupting production and violates the no-disruption requirement. Option C is wrong because excluding all internal testing fails to simulate the internal attacker on the guest network. Option D is wrong because restricting testing to only the guest network and external IPs unnecessarily excludes other non-production VLANs such as development, reducing test scope without a stated need.

Answer

Include all VLANs but with explicit permission to conduct denial-of-service tests only during off-peak hours.

Answer

Focus exclusively on the external web servers and exclude internal network testing due to the risk of disruption.

Answer

Restrict testing to only the guest network and external IPs, excluding all production VLANs.

Question 10

A tester uses OllyDbg to step through a binary. The EAX register contains 0x00401234. What does this represent?

Accepted Answer

A memory address. The value 0x00401234 is a 32-bit hexadecimal value in the typical range of a process's virtual address space, and EAX commonly holds pointers or addresses during execution in OllyDbg. In a Windows PE binary, addresses around 0x00400000 are the default image base, so 0x00401234 likely points into the executable's code or data section. It is not a system call number, which would be a small integer index (e.g., in Linux EAX holds syscall numbers like 1 for write), nor a file handle, which is typically a small opaque integer returned by CreateFile/OpenFile, nor an ASCII character, which would be a single byte value such as 0x41 ('A').

Answer

A system call number

Answer

A file handle

Answer

An ASCII character

Question 11

A client wants a penetration test that simulates a disgruntled employee with access to the internal network but no administrative privileges. The client provides a standard user account on the domain. The tester discovers that the account has local administrator rights on a critical file server. Which step should the tester take according to typical Rules of Engagement?

Accepted Answer

Pause testing and inform the client of the unexpected privilege level for guidance. The Rules of Engagement (RoE) require the tester to operate within the agreed scope and privilege level. Discovering that the provided standard user account has unexpected local administrator rights on a critical file server represents a scope change that could invalidate the test's assumptions and potentially cause unintended damage. The tester must pause and inform the client to obtain explicit guidance before proceeding with elevated privileges.

Answer

Continue testing with the elevated privileges because they were provided

Answer

Use the privileges to escalate to domain admin and test further

Answer

Revert to a lower-privileged account provided by the client

Question 12

During a web application penetration test, a tester identifies a SQL injection vulnerability. Which TWO techniques could be used to extract data from the database? (Select TWO.)

Accepted Answer

Blind time-based SQL injection. Blind time-based SQL injection (C) is correct because when the application returns no visible query output or error messages, the tester can inject conditional statements (e.g., WAITFOR DELAY in MSSQL or SLEEP() in MySQL) and infer data by measuring response delays. UNION-based SQL injection (E) is correct because it appends a crafted UNION SELECT statement to the original query, allowing the attacker to retrieve data from other tables or columns directly in the application's response when the column count and data types match. Command injection (A) targets OS command execution, not SQL query manipulation, so it does not extract database data. XXE injection (B) exploits XML external entity parsing to read files or perform SSRF, which is unrelated to SQL injection. Reflected XSS (D) is a client-side scripting attack that executes JavaScript in a victim's browser and cannot query a database.

Answer

Command injection

Answer

XXE injection

Answer

Reflected XSS

Question 13

Which THREE of the following are best practices when communicating findings to stakeholders during a penetration test?

Accepted Answer

Provide regular status updates to the client point of contact. Option B is correct because providing regular status updates to the client point of contact keeps stakeholders informed of progress, emerging risks, and any scope or scheduling changes, which is a core engagement-management practice during a penetration test. Option D is correct because a critical vulnerability—such as an easily exploitable remote code execution or domain admin compromise—can cause immediate business impact, so the client must be notified right away through the agreed escalation path so they can begin containment and remediation. Option E is correct because effective stakeholder communication tailors technical depth to the audience: executives need business risk, impact, and remediation priorities, while technical staff need specifics like affected hosts, CVEs, and reproduction steps. Option A is not appropriate because sharing unsanitized raw exploit code and logs can leak sensitive data, credentials, or weaponized payloads beyond authorized recipients and violates data-handling and confidentiality obligations. Option C is not appropriate because including full technical details in every communication overwhelms non-technical stakeholders and ignores the need to adapt messaging to the audience and purpose of each report or briefing.

Answer

Share raw exploit code and logs without sanitization

Answer

Always include full technical details in every communication

Question 14

Which TWO of the following are appropriate ways to handle sensitive data discovered during a penetration test when producing the final report? (Select TWO.)

Accepted Answer

Securely delete any copies of sensitive data after the report is delivered.. Option E is correct because redacting or masking sensitive data (e.g., replacing credit card numbers with tokens or showing only the last four digits) preserves the finding's evidentiary value while preventing unnecessary exposure of PII, credentials, or other confidential information to report readers. Option D is correct because once the engagement ends and the report is delivered, retaining raw copies of sensitive data increases the attack surface and violates data-minimization principles; securely deleting them (e.g., using cryptographic erasure or tools like shred/secure wipe) limits liability and complies with privacy regulations. Option A is not appropriate because including raw sensitive data, even in a restricted appendix, still creates a persistent exposure risk and is generally discouraged in favor of redaction. Option B is wrong because emailing an encrypted report to all stakeholders distributes sensitive material too broadly and email is not a secure delivery channel for such data. Option C is wrong because labeling the report 'Sensitive' without altering the data does nothing to reduce the actual exposure of the sensitive information.

Answer

Include the raw sensitive data in an appendix with restricted distribution.

Answer

Encrypt the report with a strong password and email it to all stakeholders.

Answer

Label the entire report as 'Sensitive' and leave data unaltered.

Question 15

During a web application test, a tester discovers that the application uses JWTs for session management. The tester captures a JWT and notices the 'alg' header is set to 'none'. Which attack is the tester likely to perform?

Accepted Answer

Algorithm confusion (alg:none). If the server accepts 'none' algorithm, an attacker can forge arbitrary tokens by setting alg=none and removing the signature.

Answer

Weak secret brute-force

Answer

Kid injection

Answer

Key confusion