PT0-002 Practice Test 45 — 15 Questions

Question 1

A penetration tester wants to perform passive reconnaissance on a target organization. Which two activities are considered passive reconnaissance? (Choose TWO.)

Accepted Answer

Searching Pastebin for leaked credentials. Option A is correct because searching Pastebin for leaked credentials involves only reviewing publicly available third-party data without ever touching the target's systems, which is the definition of passive reconnaissance. Option E is correct because crt.sh queries public Certificate Transparency logs to enumerate SSL/TLS certificates and associated subdomains, again relying on externally published data rather than interacting with the target. Option B is not passive because sending SNMP queries directly contacts the target device and can be logged. Option C is not passive because Nmap port scanning actively probes the target's hosts and services. Option D is not passive because attempting a DNS zone transfer sends a direct AXFR request to the target's name server.

Answer

Sending SNMP queries to a network device

Answer

Scanning ports with Nmap

Answer

Performing a DNS zone transfer attempt

Question 2

A penetration tester is conducting a wireless assessment and needs to capture the four-way handshake to perform offline WPA cracking. Which tool is best suited for capturing the handshake?

Accepted Answer

airodump-ng. Airodump-ng (option D) is the correct tool for capturing the four-way handshake because it passively monitors wireless traffic and can save captured packets to a file (e.g., .cap or .pcap). The four-way handshake occurs during the WPA/WPA2 authentication process between a client and an access point, and airodump-ng's ability to filter on a specific channel and BSSID allows the tester to isolate and record the handshake frames for offline cracking.

Answer

aircrack-ng

Answer

aireplay-ng

Answer

Airmon-ng

Question 3

A penetration tester is analyzing a web application's JavaScript files for hardcoded secrets and API endpoints. Which THREE techniques or tools are MOST effective for this purpose? (Select THREE.)

Accepted Answer

Using LinkFinder to extract endpoints from JavaScript. LinkFinder (A) is correct because it parses JavaScript files with regex patterns to extract URL paths, endpoints, and parameters that are otherwise buried in minified or bundled code, directly serving the goal of discovering API endpoints. SecretFinder (C) is correct because it is built specifically to scan JavaScript for high-entropy strings and regex signatures matching API keys, tokens, and other hardcoded secrets. Manually examining JavaScript source files (E) is correct because human review catches context-dependent secrets, obfuscated logic, and endpoint patterns that automated regex tools may miss or misclassify. Wappalyzer (B) is not appropriate here because it only fingerprints technologies and frameworks from headers and page artifacts, not secrets or endpoints inside JS. Gobuster (D) is not appropriate because it performs directory and file brute-forcing against the web server, which does not analyze JavaScript content for secrets or embedded endpoints.

Answer

Using Wappalyzer to identify frameworks

Answer

Using Gobuster to bruteforce directories

Question 4

A penetration testing firm is contracted to perform an external test of a company's web applications. During the scoping meeting, the client mentions that they use a CDN and WAF provided by a third party. The client wants the test to accurately reflect the security of their backend servers behind these protections. What should the tester recommend?

Accepted Answer

Obtain the backend server IPs from the client and test them directly. The client wants the test to accurately reflect the security of their backend servers behind the CDN and WAF. By obtaining the backend server IPs directly, the tester can bypass the third-party protections and assess the actual security posture of the origin servers, which is the true target of the external test. This approach ensures that vulnerabilities not mitigated by the CDN/WAF are identified, aligning with the client's goal of evaluating backend security.

Answer

Test the CDN and WAF as part of the scope

Answer

Include a plan to bypass the WAF in the rules of engagement

Answer

Only test the public-facing URLs as they are

Question 5

After a penetration test, the client requests a document that includes the methodology used, a list of all vulnerabilities found along with their CVSS scores, and detailed steps for remediation. Which type of report section is this?

Accepted Answer

Technical report. The client's request for methodology, vulnerability list with CVSS scores, and remediation steps describes the detailed, technical findings of the penetration test. This content is characteristic of the Technical Report section, which provides in-depth analysis and actionable data for technical stakeholders, as opposed to high-level summaries or contractual documents.

Answer

Executive summary

Answer

Rules of engagement

Answer

Scope of work

Question 6

During a penetration test, a tester discovers a web application that reflects user input in the HTTP response without proper escaping or encoding. The input is not sanitized and is included in the page's HTML. Which type of vulnerability is most likely present?

Accepted Answer

Cross-Site Scripting (XSS). The vulnerability is reflected Cross-Site Scripting (XSS) because the web application immediately echoes user-supplied input in the HTTP response without proper escaping or encoding, allowing an attacker to inject arbitrary HTML or JavaScript that executes in the victim's browser. This matches the classic definition of reflected XSS, where the payload is part of the request and reflected back, not stored on the server.

Answer

SQL injection

Answer

Stored XSS

Answer

Cross-Site Request Forgery (CSRF)

Question 7

A penetration tester is conducting a web application reconnaissance and wants to discover API endpoints and hidden parameters. Which three tools are most appropriate for this task? (Choose THREE.)

Accepted Answer

ffuf. ffuf (A) is correct because it is a fast web fuzzer that can brute-force directories, files, and API endpoint paths using wordlists, making it ideal for discovering hidden API routes. Arjun (C) is correct because it is specifically designed to discover hidden HTTP parameters by sending requests with common parameter names and analyzing response differences, which directly addresses the hidden-parameter discovery goal. Gobuster (D) is correct because its dir and vhost modes perform dictionary-based brute-forcing of web paths and subdomains, effectively enumerating API endpoints and hidden directories. Wappalyzer (B) is not appropriate because it only fingerprints technologies (CMS, frameworks, libraries) from page content and headers, not endpoints or parameters. Whatweb (E) is also a fingerprinting tool that identifies web technologies and server banners, so it does not enumerate endpoints or hidden parameters.

Answer

Wappalyzer

Answer

Whatweb

Question 8

A tester is conducting a code review of a web application. Which three coding practices can help prevent cross-site scripting (XSS)?

Accepted Answer

Content Security Policy (CSP) headers. Content Security Policy (CSP) headers (B) are correct because a restrictive CSP, such as one using default-src 'self' and disallowing 'unsafe-inline', prevents the browser from executing injected inline or third-party scripts, which is a primary XSS mitigation. Output encoding (D) is correct because encoding untrusted data for the correct context (HTML entity encoding, JavaScript escaping, URL encoding, CSS escaping) ensures attacker-supplied markup is rendered as inert text rather than executable script. Input validation (E) is correct because validating input against a strict allowlist (for example, expected format, length, and character set) rejects or sanitizes malicious payloads before they can be stored or reflected, reducing XSS attack surface. Parameterized queries (A) are not correct here because they prevent SQL injection, not XSS. Disabling JavaScript in the client (C) is not a server-side coding practice and is impractical for a web application that depends on JavaScript, so it is not a recommended XSS prevention control.

Answer

Parameterized queries

Answer

Disabling JavaScript in the client

Question 9

Which of the following is an example of a responsible remediation recommendation?

Accepted Answer

Upgrade Apache to version 2.4.51 to fix the vulnerability.. It provides a specific, actionable remediation: upgrading Apache to version 2.4.51, which is known to address a particular vulnerability (e.g., CVE-2021-41773 or CVE-2021-42013 for path traversal). A responsible recommendation must include a concrete version number or patch identifier to ensure the fix is verifiable and not ambiguous.

Answer

Apply security patches regularly.

Answer

Update the web server software.

Answer

Configure the firewall to block all incoming traffic.

Question 10

A penetration tester is performing an internal network assessment and needs to quickly identify all live hosts and their open ports across a large subnet (10.0.0.0/16). The tester wants to minimize network disruption and avoid IDS detection. Which tool and technique should the tester use?

Accepted Answer

Use a combination of ping sweep with fping followed by nmap -sS (SYN scan) on discovered hosts. Option C is correct because combining fping for a fast ICMP ping sweep to identify live hosts with nmap -sS (a half-open SYN scan) on only those hosts is both efficient and stealthy: the SYN scan never completes the TCP handshake, reducing logging on target services and making IDS detection less likely, while scanning only live hosts minimizes traffic across the 10.0.0.0/16 range. Option A is wrong because -sT completes full TCP connections, which is slower, noisier, and more likely to be logged by target applications. Option B is wrong because masscan at --rate=100 across all ports on all IPs still generates heavy traffic and masscan's characteristic scan patterns are easily flagged by IDS. Option D is wrong because netcat sequential scanning is extremely slow and impractical for a /16 subnet.

Answer

Use nmap with -sT (TCP connect scan) and -p- (all ports) on the entire subnet

Answer

Use masscan with a low rate (--rate=100) to scan all ports on all IPs

Answer

Use netcat to perform a sequential port scan on each IP in the subnet

Question 11

Refer to the exhibit. A penetration tester performed an initial nmap scan and recorded the above output. The tester wants to include this in the report. What additional information should the tester add to make the finding more useful for remediation?

Accepted Answer

The version of services running on each port.. The correct option is A, the version of services running on each port, because knowing the exact service and version (e.g., Apache 2.4.49, OpenSSH 8.2p1) lets defenders map findings to known CVEs and apply targeted patches or upgrades. A raw nmap port list only shows TCP/UDP openness and cannot drive remediation without identifying the vulnerable software behind each port. Option B is insufficient because open ports alone do not reveal exploitable services. Option C, the OS of each host, is useful context but does not identify the vulnerable application layer. Option D, a UDP scan, expands coverage but still does not provide the service-version detail needed for remediation.

Answer

The list of open ports only.

Answer

The operating system of each host.

Answer

The result of a UDP scan for these ports.

Question 12

Which TWO of the following are benefits of using a fuzzing tool during the code analysis phase of a penetration test? (Select TWO.)

Accepted Answer

Identifies input validation vulnerabilities. Option B is correct because fuzzing feeds malformed, unexpected, or boundary-value inputs to an application and observes how it handles them, which is exactly how input validation weaknesses (e.g., missing length checks, improper sanitization) are surfaced. Option D is correct because a core benefit of fuzzing is detecting crashes, hangs, assertion failures, and error conditions such as segmentation faults or unhandled exceptions, which often point to memory corruption or other exploitable bugs. Option A is incorrect because fuzzing is dynamic and complements, rather than replaces, static code analysis, which inspects source or bytecode without executing it. Option C is incorrect because validating authentication mechanisms requires logic-aware testing of credential handling, session management, and access control, not random input generation. Option E is incorrect because fuzzing cannot guarantee 100% code coverage; reaching every path depends on input space, corpus quality, and time, and coverage is typically partial.

Answer

Replaces the need for static code analysis

Answer

Validates authentication mechanisms

Answer

Guarantees 100% code coverage

Question 13

A penetration tester is attempting a pass-the-hash (PtH) attack against a Windows domain-joined machine. The tester has obtained the NTLM hash of a local administrator account. Which tool can be used directly to authenticate using the hash to gain remote command execution?

Accepted Answer

Metasploit's psexec module. Metasploit's psexec module (exploit/windows/smb/psexec) directly accepts an NTLM hash via the 'SMBPass' option and uses it to authenticate over SMB, then creates a service on the target to execute commands. This is a classic pass-the-hash technique against Windows systems, as the module leverages the SMB protocol and Windows service control manager without needing the plaintext password.

Answer

John the Ripper

Answer

Mimikatz

Answer

Nmap

Question 14

A penetration tester is conducting a red team exercise. The goal is to simulate an advanced persistent threat (APT) and test the organization's detection and response capabilities. Which of the following engagement types best describes this scenario?

Accepted Answer

Red team exercise. A red team exercise (Option B) is the correct engagement type because it simulates an advanced persistent threat (APT) by emulating real-world adversarial tactics, techniques, and procedures (TTPs) across multiple attack vectors, with the primary objective of testing the organization's detection and response capabilities. Unlike a standard penetration test, a red team exercise is goal-oriented (e.g., gaining access to a specific system or data) and often operates under a covert or no-notice scenario, requiring the team to bypass security controls and evade detection over an extended period.

Answer

Wireless penetration test

Answer

Network penetration test

Answer

Web application penetration test

Question 15

A penetration tester wants to identify the operating system of a remote host without sending any traffic to the target network. Which of the following techniques is most effective for this purpose?

Accepted Answer

Use Shodan to search for the host's IP address and examine the service banners.. Shodan is a search engine that indexes service banners and metadata from internet-connected devices. By querying Shodan for the target's IP address, the tester can retrieve previously collected OS information without sending any packets to the target, satisfying the 'no traffic' constraint.

Answer

Perform an nmap OS fingerprint scan on the host.

Answer

Send a ping sweep to the host's network segment.

Answer

Use ARP scanning to discover the host's MAC address and look up the vendor.