PT0-002 Practice Test 47 — 15 Questions

Question 1

A penetration testing firm is contracted to test a multi-tenant SaaS application. During scoping, the client needs to ensure that testing does not affect other tenants' data. Which scoping control is most important to implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolated testing environment. An isolated testing environment is the most important scoping control because it ensures that the penetration testing activities, including any potentially disruptive scans or exploits, are contained within a dedicated instance of the SaaS application. This prevents any cross-tenant data leakage or service degradation, as the tester's actions are restricted to a logically or physically separate environment that does not share databases or compute resources with production tenants. Without isolation, even read-only testing could inadvertently access or modify data belonging to other tenants due to shared multi-tenant architecture.

Answer

Data anonymization

Answer

Signed waiver from all tenants

Answer

Limit test to read-only operations

Question 2

A penetration tester is performing a web application assessment. Which of the following are common techniques to identify and exploit IDOR vulnerabilities? (Select TWO.)

Accepted Answer

Enumerate sequential IDs in URLs. IDOR involves manipulating object references; enumeration of IDs and modifying parameter values are common techniques.

Answer

Perform a man-in-the-middle attack

Answer

Use SQL injection to bypass authentication

Answer

Inject malicious scripts into input fields

Question 3

During a web application penetration test, the tester captures a login request in Burp Suite and wants to automate a brute-force attack against the password field. Which Burp Suite tool is specifically designed for this purpose?

Accepted Answer

Intruder. Intruder is the correct tool because it is specifically designed for automated customized attacks, including brute-force attacks, against web application parameters. It allows the tester to define a payload position (e.g., the password field in a login request) and iterate through a list of candidate passwords, automatically resending the request with each payload value and analyzing the responses.

Answer

Scanner

Answer

Sequencer

Answer

Repeater

Question 4

A penetration tester has captured network traffic and wants to analyze it using Wireshark. Which two actions can the tester perform to focus on specific types of communication? (Choose TWO.)

Accepted Answer

Use the Conversations window. Option A is correct because Wireshark's Conversations window (Statistics > Conversations) groups captured packets by protocol and endpoint pairs (Ethernet, IPv4, IPv6, TCP, UDP), letting the tester quickly identify and isolate specific communication flows between hosts. Option C is correct because display filters (e.g., tcp.port == 443, ip.addr == 10.0.0.5, http) narrow the visible packet list to only the traffic matching specified protocol fields, which is the primary way to focus on particular types of communication. Option B is not appropriate here because decrypting SSL/TLS requires possessing the private key or session keys and is not a filtering/focusing action Wireshark performs on its own. Option D is incorrect because a port scan is an active reconnaissance technique that generates new traffic rather than analyzing the already-captured traffic. Option E is incorrect because Nmap is a separate scanning tool and does not produce Wireshark analysis reports.

Answer

Decrypt SSL/TLS traffic

Answer

Run a port scan

Answer

Generate a report with Nmap

Question 5

A penetration tester is conducting passive reconnaissance on a target organization. Which of the following tools is specifically designed for gathering OSINT by extracting email addresses, subdomains, and employee names from public sources?

Accepted Answer

theHarvester. theHarvester is a popular OSINT tool used to gather emails, subdomains, IPs, and employee names from public sources like search engines, PGP key servers, and social networks.

Answer

Nikto

Answer

WPScan

Answer

Nmap

Question 6

A penetration tester is planning a social engineering engagement targeting employees of a client. The client requests that only non-managerial staff be tested. Which scoping consideration is most directly affected by this request?

Accepted Answer

Personnel scope. Personnel scope determines which individuals or groups are targeted in social engineering tests.

Answer

IP address range

Answer

Production vs. staging

Answer

Third-party services

Question 7

A penetration tester is conducting a network attack and wants to intercept traffic between two hosts on the same local network by spoofing ARP responses. Which tool is specifically designed for this purpose?

Accepted Answer

Bettercap. Bettercap is a powerful tool that includes ARP spoofing capabilities for man-in-the-middle attacks on local networks.

Answer

Responder

Answer

Hashcat

Answer

John the Ripper

Question 8

During a reconnaissance phase, a penetration tester is using a tool to enumerate NetBIOS names on a target internal network. The tester issues the command 'nbtstat -A 192.168.1.100' on a Windows machine. What type of information is the tester most likely trying to obtain?

Accepted Answer

The NetBIOS name table including computer name, logged-in users, and domain. The `nbtstat -A` command queries the NetBIOS name table of a remote system using its IP address. This table contains the computer name, logged-in users, and domain/workgroup information, which are critical for identifying targets and potential trust relationships during internal reconnaissance.

Answer

The operating system version and patch level

Answer

A list of currently open TCP ports on the remote system

Answer

The MAC address of the remote network interface

Question 9

A penetration tester gains a foothold on a Linux system with ASLR and NX enabled. The tester identifies a stack buffer overflow in a SUID binary. The binary has no PIE (Position Independent Executable) and is compiled without stack canaries. The tester wants to execute a shell. Which technique should be used?

Accepted Answer

ROP chain. Since the binary has no PIE and lacks stack canaries, the attacker can predict the address of the return address on the stack. However, with ASLR and NX enabled, the stack is non-executable and system library addresses are randomized. A ROP chain allows the tester to bypass both protections by chaining small instruction sequences (gadgets) already present in the binary or loaded libraries to achieve arbitrary code execution, such as calling execve to spawn a shell.

Answer

Return-to-libc attack

Answer

Heap spraying

Answer

Buffer overflow with NOP sled

Question 10

A penetration tester discovers a web application that uses client-side JavaScript to validate user input before form submission. The input is then sent to the server and used directly in a SQL query without server-side validation. Which attack would most effectively exploit this vulnerability?

Accepted Answer

SQL injection. The vulnerability described—client-side JavaScript validation with no server-side sanitization, followed by direct use of input in a SQL query—is the classic precondition for SQL injection. An attacker can bypass client-side controls (e.g., by disabling JavaScript or using a proxy like Burp Suite) and submit crafted SQL syntax (e.g., `' OR 1=1 --`) to manipulate the query, extract data, or execute arbitrary SQL commands on the database server.

Answer

Cross-site scripting (XSS)

Answer

Command injection

Answer

Parameter pollution

Question 11

A penetration tester is performing a web application test and identifies a potential SQL injection vulnerability. Which TWO methods can the tester use to confirm the vulnerability and extract data?

Accepted Answer

Blind time-based SQL injection. UNION-based and blind time-based are classic SQL injection techniques. XSS and command injection are different attacks. XXE is also different.

Answer

XXE injection

Answer

Command injection

Answer

XSS injection

Question 12

A penetration testing firm is scoping a test for a client that has a hybrid infrastructure with on-premises servers and cloud-based virtual machines. The client insists on testing only the on-premises systems due to budget constraints. Which of the following should the penetration tester emphasize during the scoping discussion?

Accepted Answer

Limiting the scope to on-premises may result in an incomplete risk picture because cloud systems are part of the attack surface.. The client's hybrid infrastructure means that cloud-based virtual machines are part of the overall attack surface, and limiting the scope to on-premises systems ignores potential attack vectors such as misconfigured cloud APIs, insecure inter-VPC routing, or compromised cloud credentials that could lead to lateral movement into on-premises systems. A penetration test must assess all components that can be exploited to provide a complete risk picture, as cloud systems often serve as entry points or pivot points into the on-premises environment.

Answer

The on-premises systems are more critical, so testing them is sufficient.

Answer

Cloud systems are generally more secure and do not require testing.

Answer

Testing cloud systems would violate the shared responsibility model.

Question 13

During scoping, a tester learns that the client's network has multiple subsidiaries with different IP ranges. The client wants a test that covers all subsidiaries but with a limited number of target IPs. How should the tester proceed?

Accepted Answer

Select a representative sample of IPs from each subsidiary. Selecting a representative sample of IPs from each subsidiary allows coverage across all subsidiaries while respecting the target limit. Testing only headquarters ignores subsidiaries, and combining ranges may produce too many targets. Asking for a larger budget may not be an option.

Answer

Ask for a larger budget

Answer

Test only the corporate headquarters and ignore subsidiaries

Answer

Use a subnet calculator to combine all ranges

Question 14

A penetration tester needs to provide a metric that communicates the financial risk of the identified vulnerabilities to the client's CFO. Which metric is most appropriate?

Accepted Answer

Annual Loss Expectancy (ALE).. Annual Loss Expectancy (ALE) is the most appropriate metric for communicating financial risk to a CFO because it quantifies the expected monetary loss per year from a vulnerability, calculated as ALE = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO). This directly translates technical risk into financial terms, enabling informed budget decisions for remediation. CVSS base scores and critical finding counts lack a financial dimension, making them unsuitable for executive-level risk communication.

Answer

CVSS base score.

Answer

Number of critical findings.

Answer

Technical difficulty of exploitation.

Question 15

Which two tools are commonly used for password cracking in penetration testing?

Accepted Answer

Hashcat. Hashcat (C) is a GPU-accelerated password recovery tool that supports hundreds of hash types (MD5, NTLM, bcrypt, WPA-PBKDF2, etc.) and attack modes like dictionary, brute-force, mask, and rule-based, making it a standard choice for cracking captured password hashes during penetration tests. John the Ripper (D) is another dedicated password cracker that auto-detects many hash formats, supports wordlist and incremental modes, and is widely used to crack /etc/shadow, NTLM, and other credential stores. The other options are not password-cracking tools: Metasploit (A) is an exploitation framework that may invoke crackers but is not itself one, Nmap (B) is a port scanner and service/OS fingerprinting tool, and Wireshark (E) is a packet capture and protocol analyzer.

Answer

Metasploit

Answer

Nmap

Answer

Wireshark