PT0-002 Practice Test 48 — 15 Questions

Question 1

During a penetration test, the tester discovers active ransomware on a critical server. Which communication should the tester perform FIRST according to standard rules of engagement?

Accepted Answer

Immediately notify the client's emergency contact. The standard rules of engagement (ROE) for penetration testing require immediate notification of the client's emergency contact upon discovery of active ransomware. This is because ransomware represents an active, ongoing security incident that demands urgent response to prevent data loss and further spread, overriding the normal testing timeline. The tester must not attempt containment or continue testing, as those actions could interfere with incident response or violate legal boundaries.

Answer

Include it in the final report

Answer

Attempt to contain the ransomware

Answer

Log the finding and continue testing

Question 2

A penetration tester successfully compromises a web server and wants to establish persistence on the system. Which THREE of the following are effective persistence mechanisms on a Linux system?

Accepted Answer

Creating a cron job that executes a reverse shell. Cron jobs, SSH authorized_keys, and systemd services are common persistence methods on Linux. Scheduled tasks and registry Run keys are Windows-specific.

Answer

Adding a registry Run key

Answer

Creating a scheduled task via schtasks

Question 3

During a penetration test, the tester wants to identify live hosts on a network without performing a full port scan. Which Nmap command is most appropriate for this task?

Accepted Answer

nmap -sn 192.168.1.0/24. The -sn flag in Nmap performs a ping sweep (host discovery) without port scanning, sending ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default.

Answer

nmap -A 192.168.1.0/24

Answer

nmap -O 192.168.1.0/24

Answer

nmap -sS 192.168.1.0/24

Question 4

A penetration tester is conducting an external network assessment for a client. During the reconnaissance phase, the tester identifies an IP address range that is not listed in the rules of engagement (ROE). The client had initially provided a list of authorized target IPs. What should the tester do next?

Accepted Answer

Stop testing and notify the client to update the ROE.. Testing outside the defined scope is unauthorized and could breach contract or legal boundaries. The correct course is to pause and seek clarification, updating the ROE before proceeding.

Answer

Include the new IPs in the test scope and proceed.

Answer

Perform a quick scan of the new IPs to gather more information.

Answer

Ignore the new IPs and only test the provided range.

Question 5

During a penetration test, a tester captures NTLMv2 hashes using Responder. The tester then uses ntlmrelayx to relay the captured hashes to a target server. Which of the following best describes this attack technique?

Accepted Answer

NTLM relay attack. NTLM relay attacks forward captured authentication attempts to other servers, allowing the attacker to authenticate without cracking the hash. This is distinct from pass-the-hash, which requires a hash of the target account for local authentication.

Answer

Kerberoasting attack

Answer

SMB relay attack

Answer

Pass-the-hash attack

Question 6

During a penetration test, a tester wants to crack NTLM hashes captured from a Windows domain. Which hashcat mode should the tester use for NTLM hashes?

Accepted Answer

-m 1000. Hashcat mode -m 1000 is specifically designated for NTLM hashes, which are the format stored in Windows SAM and NTDS.dit files and transmitted during NTLM authentication. When a tester captures NTLM challenge-response traffic or extracts hashes from a domain controller, -m 1000 tells hashcat to parse the 32-hex-character NTLM hash correctly. This is the standard mode used in tools like Responder + hashcat workflows during internal Active Directory penetration tests.

Answer

-m 13100

Answer

-m 22000

Answer

-m 0

Question 7

A penetration tester wants to perform a pass-the-hash attack on a Windows target. Which tools can be used for this purpose? (Choose the best answer.)

Accepted Answer

pth-winexe. pth-winexe is a common tool for pass-the-hash attacks on Windows.

Answer

sqlmap

Answer

John the Ripper

Answer

Hashcat

Question 8

A penetration testing engagement requires testing a production environment during business hours. The client is concerned about potential service disruption. Which document should specify the conditions under which the test must be halted?

Accepted Answer

Rules of Engagement. The Rules of Engagement (RoE) is the definitive document that outlines the scope, authorization, and constraints of a penetration test, including explicit conditions under which testing must be halted to prevent service disruption. Unlike other documents, the RoE is a legally binding agreement that specifies technical boundaries such as IP ranges, testing windows, and stop conditions (e.g., CPU threshold exceeded or application error rate spike). This ensures the client's production environment is protected during business hours.

Answer

Get-out-of-jail letter

Answer

Communication plan

Answer

Statement of Work

Question 9

A penetration tester has gained a low-privileged shell on a Linux server and discovers a binary with the SUID bit set owned by root. The binary executes a system command using a relative path without sanitizing user input. Which of the following techniques would the tester MOST likely use to escalate privileges?

Accepted Answer

Modify the PATH environment variable to point to a malicious script with the same name as the command called by the binary. The SUID binary executes a system command using a relative path without sanitizing user input. By modifying the PATH environment variable to include a directory containing a malicious script with the same name as the command, the tester can cause the binary to execute the attacker-controlled script instead of the intended system command, thereby escalating privileges to root when the SUID binary runs.

Answer

Exploit a kernel vulnerability to gain root

Answer

Impersonate the root user using sudo

Answer

Preload a shared library using LD_PRELOAD

Question 10

During a code review, a penetration tester identifies a PHP function that executes arbitrary shell commands. Which function poses the greatest security risk if user input is not sanitized?

Accepted Answer

system. system() executes commands and returns output, allowing arbitrary command execution if input is unsanitized.

Answer

echo

Answer

strlen

Answer

array_pop

Question 11

You are leading a penetration test for a financial institution. The scope was defined as the external network and web applications. During the test, you identify a vulnerability in an internal application that was accidentally exposed due to a misconfiguration. The client's project manager requests that you extend the test scope to include the internal network to fully assess the risk. The request comes on the last day of testing. According to reporting and communication best practices, what should you do FIRST?

Accepted Answer

Document the request and communicate it to both the client and your management for formal scope change approval. The correct answer is D: document the request and communicate it to both the client and your management for formal scope change approval. Because the original scope covered only the external network and web applications, any expansion to the internal network requires a formal change to the rules of engagement and authorization before testing can occur, especially on the last day of testing. This protects the tester legally and contractually while ensuring the client's project manager is not the sole authority for scope changes. Option A is wrong because testing immediately without written authorization could be unauthorized access, and option C is wrong because a scope change can be approved rather than simply rejected. Option B is also insufficient because the internal vulnerability should be reported, but the immediate first step is to handle the scope-change request through proper communication and approval channels.

Answer

Accept the request and test the internal network immediately

Answer

Include the internal vulnerability in the final report as an out-of-scope finding

Answer

Reject the request because it is outside the original scope

Question 12

A penetration tester is preparing the final report. The client's CEO wants a high-level overview of the test results, including the overall security posture and business risk, without technical details. Which section of the report should the tester emphasize for the CEO?

Accepted Answer

Executive summary. The executive summary is the section of a penetration testing report that provides a high-level overview of the test results, focusing on the overall security posture and business risk without technical details. It is specifically designed for non-technical stakeholders like the CEO, who need to understand the impact on the organization without delving into specific vulnerabilities or exploitation steps.

Answer

Technical findings and recommendations

Answer

Methodology

Answer

Appendices

Question 13

After completing a penetration test, the client's technical team requests a detailed list of all vulnerabilities found, prioritized by severity, along with step-by-step reproduction steps and remediation guidance. In which section of the standard penetration testing report should this information be provided?

Accepted Answer

Findings. The Findings section of a standard penetration testing report is the correct location for a detailed, prioritized list of vulnerabilities with step-by-step reproduction steps and remediation guidance. This section provides the technical depth required by the client's technical team, contrasting with the high-level summaries found elsewhere.

Answer

Executive Summary

Answer

Methodology

Answer

Appendices

Question 14

During a penetration test, the tester wants to gather information about the target organization's domain registration and contact details without sending any traffic to the target. Which OSINT source should the tester use first?

Accepted Answer

WHOIS. WHOIS lookups provide registration details for domains, including administrative contacts, name servers, and expiration dates, without sending traffic to the target. Shodan searches for internet-connected devices, Censys provides certificates and host information, and crt.sh shows certificate transparency logs.

Answer

Shodan

Answer

crt.sh

Answer

Censys

Question 15

Which of the following is the primary purpose of a get-out-of-jail letter in a penetration testing engagement?

Accepted Answer

To authorize the tester to perform testing activities and avoid prosecution. The get-out-of-jail letter provides legal authorization for the tester to perform activities that might otherwise be considered illegal, such as scanning or exploitation.

Answer

To protect the client from legal liability

Answer

To document emergency contacts

Answer

To outline the scope of the test