PT0-002 Practice Test 44 — 15 Questions

Question 1

A penetration test is being conducted for a healthcare organization subject to HIPAA. The tester is given access to a production system that contains electronic protected health information (ePHI). Which of the following should be included in the rules of engagement to ensure compliance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A detailed data handling and destruction procedure within the rules of engagement.. HIPAA requires covered entities to ensure the confidentiality, integrity, and availability of ePHI, which includes proper disposal of data after testing. A detailed data handling and destruction procedure within the rules of engagement (RoE) ensures that test data containing ePHI is securely wiped or destroyed in compliance with 45 CFR § 164.310(d)(2)(i) and NIST SP 800-88 guidelines. Without this clause, the tester might leave residual ePHI on production systems, violating HIPAA's security rule.

Answer

A clause requiring encryption of all test data at rest and in transit.

Answer

A business associate agreement (BAA) signed between the client and the testing firm.

Answer

A restriction to only test in non-production environments.

Question 2

A tester runs the following Metasploit commands:
```
msf6 > use exploit/multi/handler
msf6 exploit(multi/handler) > set PAYLOAD windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 10.0.0.5
msf6 exploit(multi/handler) > set LPORT 4444
msf6 exploit(multi/handler) > run
```
What is the purpose of this configuration?

Accepted Answer

To receive a reverse shell from a target that already executed the payload. The multi/handler is a generic handler used to receive reverse connections from payloads that were delivered separately (e.g., via phishing). It waits for the target to connect back.

Answer

To exploit a remote service directly

Answer

To perform a bind shell attack

Answer

To stage a payload for later execution

Question 3

While exploiting a Windows machine, a tester gains a shell with limited privileges. They attempt to escalate privileges using a tool that exploits the SeImpersonatePrivilege. Which tool is specifically designed for this purpose on modern Windows versions?

Accepted Answer

PrintSpoofer. PrintSpoofer exploits SeImpersonatePrivilege on Windows 10/Server 2016+ to gain SYSTEM.

Answer

Mimikatz

Answer

JuicyPotato

Answer

PowerUp

Question 4

A tester wants to perform a Kerberoasting attack against an Active Directory domain. The tester has a domain account with no special privileges. Which of the following is required to successfully request TGS tickets for offline cracking?

Accepted Answer

A valid domain user account. Kerberoasting requires a valid domain account to request TGS tickets for service accounts. No special privileges are needed beyond being authenticated. AS-REP roasting targets users without pre-authentication, not service accounts.

Answer

The service account's password hash

Answer

Administrator privileges on a domain controller

Answer

Local administrator access on a client machine

Question 5

A penetration tester is conducting an internal assessment of a company's web application. The application provides a file upload feature that accepts images but does not validate the file type on the server side. The tester has identified that the application runs on an Apache server with PHP support. The tester wants to execute a command on the server to establish a reverse shell. The tester has a Linux client and has already crafted a PHP reverse shell payload. The tester has also verified that outbound connections are allowed from the server. After uploading the malicious PHP file, the tester attempts to access it via a browser but receives a 404 error. The tester suspects the uploaded file may have been renamed or moved. Which of the following steps should the tester take next to achieve code execution?

Accepted Answer

Check the web server access and error logs to identify the actual path where the file was saved.. The correct option is D: check the web server access and error logs to identify the actual path where the file was saved. Since the upload succeeded but the tester gets a 404, the most likely cause is that the file was renamed or relocated by the application, and Apache's access/error logs will reveal the real request path and any 404 entries pointing to the actual stored location. This is a reconnaissance step that directly addresses the suspected rename/move before attempting further exploitation. Option A is irrelevant because antivirus detection would not produce a 404, and no AV behavior has been indicated. Option B is unlikely to help because the file is not hidden but stored under a different name or directory, and directory listing is often disabled. Option C is unnecessary because PHP support is already confirmed and the issue is path/name, not extension handling.

Answer

Modify the PHP payload to avoid detection by antivirus on the server.

Answer

Use a directory listing tool to scan for hidden files in the upload directory.

Answer

Re-upload the file with a different extension like .php5 or .phtml.

Question 6

During a penetration test, you successfully execute a Meterpreter session on a Windows target. You want to dump password hashes from the SAM database. Which Meterpreter command should you use?

Accepted Answer

hashdump. hashdump is the Meterpreter command to dump SAM hashes.

Answer

getsystem

Answer

getuid

Answer

sysinfo

Question 7

You are contracted to perform a penetration test for a healthcare organization. During the testing, you discover a critical SQL injection vulnerability that exposes patient health information. The deadline for the final report is one week away. The client's IT manager asks you to exclude this finding from the report because they are already aware of it and are working on a fix. The IT manager claims that including it would cause panic among stakeholders. What is the BEST course of action?

Accepted Answer

Explain that findings must be included in the report regardless of awareness, and offer to present the finding in a controlled manner to management. Option B is correct because a penetration tester has an ethical and professional obligation to report all discovered vulnerabilities, especially a critical SQL injection exposing patient health information, which may also trigger HIPAA breach-notification duties; the tester should refuse to omit it while offering a controlled, confidential briefing to management to reduce panic. This preserves report integrity and the client's ability to remediate and meet regulatory obligations. Option A is wrong because agreeing to exclude the finding, even with a verbal note, still suppresses a material risk from the official record. Option C is wrong because bypassing the IT manager to notify the compliance officer unilaterally breaks the agreed communication channel and may not be the proper escalation path. Option D is wrong because relegating a critical finding to a technical appendix still hides it from the executive summary and key decision-makers who need to act on it.

Answer

Agree to exclude it but note it verbally

Answer

Report the issue to the client's compliance officer without informing the IT manager

Answer

Include it only in the technical appendix

Question 8

A penetration tester is conducting a vulnerability scan of a network segment that contains several legacy servers. The tester uses a commercial vulnerability scanner with default settings. The scan completes and reports a critical vulnerability on a server running an outdated version of Apache with known remote code execution. However, the tester suspects this might be a false positive because the server is behind an application-layer firewall that blocks the specific exploit. Which of the following steps should the tester take to confirm the vulnerability?

Accepted Answer

Manually test the vulnerability by sending a crafted exploit payload to the server. The correct option is C: manually test the vulnerability by sending a crafted exploit payload to the server. This is the only way to confirm whether the reported Apache RCE is actually exploitable in this scenario, since a vulnerability scanner's default settings can produce false positives and an application-layer firewall may block the exploit even if the underlying service is vulnerable. Manual exploitation validates the finding end-to-end rather than relying on scanner signatures or assumptions. Option A is wrong because increasing scan intensity does not prove exploitability and may still be blocked or produce the same signature-based result. Option B is wrong because a firewall blocking one exploit path does not mean the vulnerability is absent or unexploitable via other vectors. Option D is wrong because firewall logs only show whether the scanner's traffic was blocked, not whether the vulnerability itself is real or exploitable.

Answer

Rerun the scan with increased intensity to ensure the vulnerability is real

Answer

Ignore the finding because the vulnerability is protected by the firewall

Answer

Check the firewall logs to see if the scanner's traffic was blocked

Question 9

You are conducting a penetration test on a web application that uses a JavaScript challenge-response authentication mechanism. During testing, you notice that the client-side JavaScript code is heavily obfuscated and includes a function that seems to compute a token based on user input and a server-provided nonce. Your goal is to bypass the authentication by generating valid tokens without interacting with the server's intended logic. You have extracted the obfuscated JavaScript and used a beautifier to make it more readable, but the logic is still complex. Which of the following approaches is most likely to succeed in bypassing the authentication?

Accepted Answer

Use a JavaScript debugger to dynamically analyze the obfuscated function and replicate its token generation. Dynamic analysis with a JavaScript debugger lets you set breakpoints, inspect runtime variables, and step through the obfuscated token-generation function, revealing the exact algorithm and inputs needed to replicate valid tokens offline without invoking the server's intended logic. This is the most reliable approach against obfuscated client-side challenge-response code, since static beautification alone often leaves control flow and string transformations unclear. Option A fails because a token is typically bound to a specific nonce, so replaying it with a new nonce will not validate. Option C is impractical because token entropy makes random guessing statistically infeasible. Option D is also infeasible because brute-forcing all token values based on the nonce is computationally prohibitive for any reasonably sized token space.

Answer

Capture a valid token and replay it with a new nonce

Answer

Send random tokens to the server and rely on statistical guessing

Answer

Use a brute-force script to try all possible token values based on the nonce

Question 10

A penetration tester is analyzing a Bash script that uses the tool 'curl' to send HTTP requests. The script contains the following line: curl -X POST -d "username=admin&password[$ne]=a" http://target/login. Which type of attack is this script most likely attempting?

Accepted Answer

NoSQL Injection. The payload `password[$ne]=a` uses MongoDB's `$ne` (not equal) operator, which is a NoSQL query operator. When the backend parses this as a MongoDB query, it will match any document where the password is not equal to 'a', effectively bypassing authentication. This is a classic NoSQL injection attack, not SQL injection, because the syntax targets NoSQL databases like MongoDB.

Answer

Cross-Site Scripting (XSS)

Answer

SQL Injection

Answer

Directory Traversal

Question 11

A penetration tester has discovered a local file inclusion (LFI) vulnerability in a PHP web application. The vulnerable code uses the following pattern: include($_GET['page']);. The application runs on a Linux server with Apache and PHP. The tester wants to achieve remote code execution (RCE). Which technique is most likely to succeed given this LFI?

Accepted Answer

Use the php://input wrapper and send PHP code in the POST body.. The correct technique is to use the php://input wrapper because it allows the attacker to pass arbitrary PHP code in the HTTP POST body, which the include() function will execute as PHP. Since the vulnerable code directly includes user input without sanitization, the php://input stream reads the raw POST data and processes it as a PHP script, achieving remote code execution.

Answer

Use the file:// wrapper to read sensitive files like /etc/passwd.

Answer

Use the data:// wrapper with a base64-encoded PHP payload.

Answer

Set allow_url_include to On in php.ini via the LFI.

Question 12

During code review, a penetration tester identifies the following line in a PHP web application: $sql = "SELECT * FROM users WHERE username='" . $_GET['user'] . "'"; Which type of vulnerability is most likely present?

Accepted Answer

SQL injection. Direct concatenation of user input into an SQL query without sanitization results in SQL injection vulnerability.

Answer

Insecure deserialization

Answer

Command injection

Answer

Cross-site scripting (XSS)

Question 13

During a penetration test, you want to discover API endpoints and hidden parameters in a web application. Which tool combination is most effective for this task?

Accepted Answer

Arjun and ffuf. Arjun is a specialized tool for discovering hidden HTTP parameters by fuzzing with a wordlist and analyzing responses, while ffuf is a fast web fuzzer used for directory, file, and parameter discovery. Together, they efficiently uncover API endpoints and hidden parameters that are not linked in the application's visible interface. This combination is specifically designed for the reconnaissance phase of API testing.

Answer

Wappalyzer and curl

Answer

WhatWeb and theHarvester

Answer

Gobuster and Nikto

Question 14

A tester has exploited a Linux system and gained a low-privilege shell. The tester runs 'sudo -l' and sees that the current user can run /usr/bin/find as root without a password. Which privilege escalation technique should the tester use?

Accepted Answer

GTFOBins technique for find. The find command can be used to execute other commands via its -exec parameter, allowing privilege escalation.

Answer

SUID binary exploitation

Answer

PATH manipulation

Answer

Kernel exploit

Question 15

A penetration tester is performing active reconnaissance on a web application and needs to discover parameters that the application accepts. Which TWO tools are most commonly used for parameter discovery? (Select TWO.)

Accepted Answer

ffuf. ffuf (A) is correct because it is a fast web fuzzer that can brute-force URL parameters, directories, and POST data using wordlists, making it a standard tool for parameter discovery during active reconnaissance. Arjun (E) is correct because it is purpose-built for HTTP parameter discovery, using a large built-in wordlist and heuristics to find hidden GET/POST parameters efficiently. theHarvester (B) is not correct because it focuses on OSINT gathering of emails, subdomains, and hosts from public sources rather than discovering application parameters. WPScan (C) is not correct because it targets WordPress-specific vulnerabilities and enumeration, not generic parameter discovery. Nikto (D) is not correct because it is a web server scanner for misconfigurations and known issues, not a parameter brute-forcing tool.

Answer

theHarvester

Answer

WPScan

Answer

Nikto