PT0-002 Practice Test 46 — 15 Questions

Question 1

A penetration tester wants to crack NTLM hashes obtained from a Windows domain. Which hashcat mode should the tester use?

Accepted Answer

-m 1000. Hashcat mode 1000 is for NTLM hashes.

Answer

-m 22000

Answer

-m 13100

Answer

-m 0

Question 2

A tester is using Hashcat to crack NTLM hashes. They want to try all possible passwords consisting of exactly 8 lowercase letters. Which attack mode and mask should they use?

Accepted Answer

-a 3 -m 1000 ?l?l?l?l?l?l?l?l. Brute-force mode (-a 3) with mask ?l?l?l?l?l?l?l?l tries all 8-letter lowercase combinations.

Answer

-a 6 -m 1000 ?l?l?l?l?l?l?l?l

Answer

-a 3 -m 0 ?l?l?l?l?l?l?l?l

Answer

-a 0 -m 1000 dictionary.txt

Question 3

A penetration tester has captured a WPA2 handshake. Which tool from the Aircrack-ng suite is used to crack the pre-shared key?

Accepted Answer

aircrack-ng. Aircrack-ng (option D) is the tool in the Aircrack-ng suite specifically designed to crack WPA2 pre-shared keys (PSK) by performing an offline dictionary or brute-force attack against the captured four-way handshake. It uses the handshake data (specifically the EAPOL frames) to derive the Pairwise Master Key (PMK) and verify it against candidate passphrases, making it the correct choice for this task.

Answer

airmon-ng

Answer

airodump-ng

Answer

aireplay-ng

Question 4

In a web application test, you find a parameter that directly references internal object IDs (e.g., user_id=123) and changing the ID allows access to another user's data. This vulnerability is known as:

Accepted Answer

Insecure Direct Object Reference (IDOR). IDOR (Insecure Direct Object Reference) occurs when an application exposes internal object references without proper access control checks.

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

Cross-site request forgery (CSRF)

Question 5

A penetration tester gains a low-privileged shell on a Linux server and discovers that the user is a member of the 'docker' group. The tester wants to escalate privileges to root. Which technique is most effective?

Accepted Answer

Run a Docker container with the host filesystem mounted and access it as root. Members of the 'docker' group can run Docker containers with the `-v /:/mnt` flag to mount the host filesystem into the container. Inside the container, the user effectively has root privileges (since the container runs as root by default) and can access the host's `/mnt` directory, allowing them to modify files like `/mnt/etc/shadow` or add an SSH key to `/mnt/root/.ssh/authorized_keys` to gain root access on the host.

Answer

Use cron job misconfigurations to execute a reverse shell

Answer

Exploit kernel vulnerabilities using a local exploit suggester

Answer

Abuse SETUID binaries to execute commands as root

Question 6

A penetration tester is performing a web application test and wants to exploit a SQL injection vulnerability to extract data from a database. The tester knows that the application returns results in the HTTP response. Which type of SQL injection is being used?

Accepted Answer

UNION-based. UNION-based SQL injection returns results directly in the application's output.

Answer

Blind boolean-based

Answer

Blind time-based

Answer

Out-of-band

Question 7

A penetration tester is preparing the executive summary of a report for a client's board of directors. Which of the following metrics would be MOST valuable for this audience to understand the overall security posture?

Accepted Answer

A heat map showing the number of vulnerabilities by severity (Critical, High, Medium, Low). The board of directors needs a high-level, risk-based overview of the security posture, not technical details. A heat map with vulnerability counts by severity (Critical, High, Medium, Low) provides an immediate visual representation of risk distribution, enabling strategic decisions without requiring technical expertise. This aligns with the PT0-002 objective of tailoring reporting to the audience.

Answer

The exact CVSS score for each vulnerability found

Answer

A detailed list of commands used during exploitation

Answer

The names of the operating systems and applications that were tested

Question 8

A tester is exploiting a web application and identifies a parameter that reflects user input in the response without sanitization. The tester wants to steal session cookies from other users. Which type of cross-site scripting (XSS) attack should the tester use?

Accepted Answer

Reflected XSS. Reflected XSS occurs when input is immediately reflected in the response. Stored XSS persists on the server. DOM-based XSS occurs client-side. For stealing cookies, reflected XSS can be crafted into a link sent to the victim.

Answer

Stored XSS

Answer

Blind XSS

Answer

DOM-based XSS

Question 9

Which PowerShell script is commonly used for post-exploitation enumeration of Active Directory, such as querying user accounts and group memberships?

Accepted Answer

PowerView. PowerView (option D) is a PowerShell script within the PowerSploit framework specifically designed for post-exploitation enumeration of Active Directory. It provides cmdlets like Get-NetUser, Get-NetGroup, and Get-NetComputer to query user accounts, group memberships, and domain trust relationships via LDAP queries, making it the correct choice for this task.

Answer

Nishang

Answer

Empire

Answer

Invoke-Mimikatz

Question 10

A client wants to test a web application that uses a third-party payment gateway. The client explicitly wants the payment gateway to be excluded from the test to avoid service disruption. Where should this exclusion be formally documented?

Accepted Answer

Rules of Engagement (ROE). The Rules of Engagement (ROE) document is the correct place to formally exclude the third-party payment gateway from testing. The ROE defines the scope, boundaries, and constraints of the penetration test, including specific systems or services that must not be targeted. This ensures the client's requirement to avoid service disruption to the payment gateway is legally and operationally enforced.

Answer

Non-Disclosure Agreement (NDA)

Answer

Statement of Work (SOW)

Answer

Penetration Test Plan

Question 11

A penetration tester discovers a remote command injection vulnerability in a Java-based web application on a Windows server. The tester wants to execute a PowerShell reverse shell. Which encoding technique is most effective to avoid filter restrictions on special characters?

Accepted Answer

Base64 encoding. Base64 encoding is the most effective technique because it allows the tester to encode the entire PowerShell command, including special characters like semicolons, pipes, and quotes, into a safe ASCII string that bypasses filter restrictions. PowerShell natively supports the `-EncodedCommand` parameter, which decodes Base64 input directly, making it ideal for remote command injection scenarios where character filtering is strict.

Answer

URL encoding

Answer

Unicode encoding

Answer

Hex encoding

Question 12

A penetration tester needs to crack NTLM hashes obtained from a Windows domain. The hashes are in the format used by Windows. Which hashcat mode should the tester use?

Accepted Answer

-m 1000. Hashcat mode 1000 is for NTLM hashes.

Answer

-m 22000

Answer

-m 0

Answer

-m 13100

Question 13

During a penetration test, you are asked to discover all live hosts on a subnet without generating excessive traffic or being too intrusive. Which Nmap command best achieves this goal?

Accepted Answer

nmap -sn 192.168.1.0/24. The `-sn` flag (ping scan) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests to discover live hosts without performing port scans or service detection, minimizing traffic and intrusiveness. This meets the requirement of discovering all live hosts on a subnet efficiently.

Answer

nmap -O 192.168.1.0/24

Answer

nmap -A 192.168.1.0/24

Answer

nmap -sS 192.168.1.0/24

Question 14

A penetration tester wants to query Certificate Transparency logs to find all SSL/TLS certificates issued for a target domain, which may reveal subdomains. Which tool or website is specifically designed for this purpose?

Accepted Answer

crt.sh. crt.sh is a website that queries Certificate Transparency logs and returns certificates for a domain, often revealing subdomains. Shodan and Censys also provide certificate data but crt.sh is focused on CT logs. Let's Encrypt is a CA, not a log query tool.

Answer

Censys

Answer

Let's Encrypt

Answer

Shodan

Question 15

A tester is scanning a target network using Nmap. The client wants minimal disruption and asks to avoid completing TCP three-way handshakes. Which scan type should the tester use?

Accepted Answer

SYN scan (-sS). A SYN scan (nmap -sS) sends SYN packets and analyzes responses without completing the handshake, making it stealthier than a full connect scan.

Answer

TCP connect scan (-sT)

Answer

UDP scan (-sU)

Answer

Ping sweep (-sn)