PT0-002 Practice Test 49 — 15 Questions

Question 1

A penetration tester needs to enumerate Active Directory users and groups from a Windows domain. Which PowerShell tool is specifically designed for AD enumeration and is commonly used in post-exploitation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

PowerView. PowerView (option D) is a PowerShell tool specifically designed for Active Directory enumeration, providing functions to query users, groups, computers, and permissions via LDAP. It is widely used in post-exploitation because it runs in-memory, avoids writing to disk, and integrates seamlessly with PowerShell's pipeline for stealthy reconnaissance.

Answer

Invoke-Mimikatz

Answer

Nmap

Answer

CrackMapExec

Question 2

During a penetration test, a tester captures NTLM hashes by spoofing LLMNR responses on the internal network. Which tool is most commonly used for this purpose?

Accepted Answer

Responder. Responder is the standard tool for LLMNR/NBT-NS/mDNS poisoning to capture NTLM hashes.

Answer

ntlmrelayx

Answer

Hashcat

Answer

Bettercap

Question 3

A penetration tester is writing a return-oriented programming (ROP) exploit for a Linux binary to bypass Data Execution Prevention (DEP). The binary has DEP enabled, but the tester identifies a gadget in a dynamically linked library that is not affected by ASLR. Which condition must be true for the ROP chain to succeed?

Accepted Answer

The library must be loaded at a fixed address. For a ROP chain to succeed when DEP is enabled, the attacker needs to control the execution flow by chaining together gadgets (small instruction sequences ending with a return) that reside in executable memory regions. If a dynamically linked library is not affected by ASLR, it means it is loaded at a fixed, predictable address, allowing the tester to reliably use gadgets from that library without needing to bypass ASLR for that specific module. This fixed address ensures the ROP chain's addresses are valid across runs, which is essential for the exploit to work.

Answer

The stack must be executable

Answer

The binary must be compiled with stack canaries

Answer

The exploit must bypass ASLR for the main binary

Question 4

A penetration tester is calculating the severity of a vulnerability using the DREAD model. Which of the following factors is assessed under the 'Damage' category?

Accepted Answer

The potential data loss or system damage that could result from exploitation.. In the DREAD model, the 'Damage' category specifically assesses the potential harm from a successful exploit, such as data loss, system corruption, or service disruption. Option B correctly captures this by focusing on the impact to confidentiality, integrity, or availability, which is the core of the Damage factor.

Answer

The likelihood that an attacker can reproduce the exploit.

Answer

How easy it is for an attacker to discover the vulnerability.

Answer

The number of users affected by the vulnerability.

Question 5

A penetration tester wants to quickly identify which of the top 100 common ports are open on a target system, while minimizing network traffic and scan time. Which Nmap command is most appropriate?

Accepted Answer

nmap -T5 -F target. The `-T5` flag sets the fastest timing template (insane), which reduces delays and speeds up the scan, while the `-F` flag (fast mode) limits scanning to only the top 100 most common ports as defined in Nmap's nmap-services file. This combination minimizes network traffic and scan time while quickly identifying open ports among the top 100, aligning with the goal of efficiency.

Answer

nmap -p- target

Answer

nmap -sn target

Answer

nmap -sV target

Question 6

A vulnerability scanner reports an unauthenticated critical finding on an internal server. Manual testing shows the vulnerable package is present, but the vulnerable service is disabled and not reachable. How should the tester report this?

Accepted Answer

Report the finding with contextual risk adjustment and explain that the vulnerable service is disabled and not reachable.. The vulnerability scanner identified a real package vulnerability, but manual verification revealed the service is disabled and unreachable. The tester must report the finding with a contextual risk adjustment to accurately reflect the reduced exploitability, as per standard risk assessment practices in penetration testing. This ensures the organization understands the actual risk without ignoring the presence of the vulnerable package, which could be enabled in the future.

Answer

Delete the finding because the package exists but is not currently exploitable.

Answer

Report it as critical without context because the scanner assigned critical severity.

Answer

Exploit the service by enabling it first.

Question 7

A penetration tester is analyzing a Python script that imports the 'scapy' library. The script defines a function that sends a series of TCP SYN packets to a target IP and port range, and then waits for SYN-ACK responses. Which attack is the script performing?

Accepted Answer

Port scanning. The script sends TCP SYN packets to a range of ports and waits for SYN-ACK responses. This is the classic behavior of a SYN scan, a type of port scanning that identifies open ports by observing which ports respond with a SYN-ACK. The use of Scapy to craft and send these packets confirms the script is performing port scanning, not a denial-of-service attack.

Answer

TCP SYN flood

Answer

ARP poisoning

Answer

DNS spoofing

Question 8

A penetration tester is analyzing a Python script used during a test. The script contains the following code: 'import requests; r = requests.get('http://target', headers={'User-Agent': 'Mozilla/5.0'}); print(r.text)'. What is the primary purpose of setting the User-Agent header in this script?

Accepted Answer

To mimic a legitimate browser to evade detection by web application firewalls.. Setting the User-Agent header to 'Mozilla/5.0' makes the HTTP request appear to originate from a standard web browser rather than a Python script. This helps evade detection by web application firewalls (WAFs) and other security controls that may block or flag requests with non-browser User-Agent strings, which are common indicators of automated or malicious traffic.

Answer

To bypass IP-based rate limiting.

Answer

To authenticate to the web server.

Answer

To enable SSL/TLS encryption.

Question 9

During a penetration test report review, the client's IT manager asks for a 'quick reference' that lists each vulnerability, its severity, and the affected system, without detailed exploit steps. Which section of the report should the tester point to?

Accepted Answer

Technical findings section. The technical findings section is the correct place because it provides a structured list of each vulnerability, its severity rating (e.g., CVSS score), and the affected system, while intentionally omitting detailed exploit steps. This directly satisfies the IT manager's request for a 'quick reference' without the operational risk of exposing attack procedures. The executive summary is too high-level, and the appendix with raw scan results lacks the curated, severity-ranked format needed for a quick reference.

Answer

Executive summary

Answer

Appendix with raw scan results

Answer

Remediation recommendations

Question 10

A penetration tester has completed the testing phase and is preparing the final report for the client's board of directors. The board members are non-technical and need to understand the overall security posture and business risk. Which section of the report should the tester focus on for this audience?

Accepted Answer

An executive summary highlighting key risks and business impact. The board of directors requires a high-level overview that translates technical findings into business risk. An executive summary achieves this by focusing on key risks, potential financial or reputational impact, and strategic recommendations, avoiding technical jargon like CVSS scores or command logs.

Answer

A detailed list of all vulnerabilities with CVSS scores and exploitation steps

Answer

A complete log of all commands executed during the test

Answer

A network diagram showing all discovered hosts and open ports

Question 11

A penetration tester is writing the executive summary for a report. The client's CEO needs to understand the business impact of a critical SQL injection vulnerability. Which of the following should the tester include?

Accepted Answer

The potential for data breach and financial loss. The CEO needs to understand the business impact, not technical details. Option C directly addresses the core concern: a SQL injection vulnerability can lead to unauthorized data access, resulting in a data breach and significant financial loss from fines, remediation costs, and reputational damage. This aligns with the executive summary's goal of translating technical risk into business risk.

Answer

The exact SQL injection payload used

Answer

The CVSS vector string

Answer

The remediation steps in detail

Question 12

A penetration tester is preparing a report that includes technical findings. Which TWO of the following should be included in each technical finding? (Select TWO.)

Accepted Answer

Remediation steps with code or commands. Each technical finding should include remediation steps and evidence such as screenshots.

Answer

Executive summary

Answer

Client's network diagram

Answer

Business impact analysis

Question 13

Which of the following is a common community string used in SNMP enumeration?

Accepted Answer

public. The default community strings for SNMP are often 'public' for read-only and 'private' for read-write access.

Answer

root

Answer

snmp

Answer

admin

Question 14

During an internal penetration test, a tester discovers a Windows server running a custom service that is vulnerable to a stack-based buffer overflow. The binary has Data Execution Prevention (DEP) enabled but Address Space Layout Randomization (ASLR) is disabled. Which exploitation technique would be MOST effective to achieve code execution?

Accepted Answer

Constructing a ROP chain using gadgets from loaded DLLs to simulate shellcode execution. With DEP enabled, the stack is marked non-executable, so injecting shellcode directly (option A) would fail. ASLR being disabled means the addresses of loaded DLLs are predictable, making it feasible to construct a ROP chain using gadgets from those DLLs to simulate shellcode execution. Option C is correct because ROP chains bypass DEP by reusing existing executable code (gadgets) without needing to execute code on the stack.

Answer

Injecting shellcode directly onto the stack and overwriting the return address to jump to it

Answer

Using a return-to-libc attack to call system() with a command string

Answer

Enabling the execute bit on the stack via a memory corruption primitive

Question 15

A penetration tester is conducting a grey box test on a web application. During the test, the tester discovers that the application is hosted on a cloud infrastructure that belongs to a third-party provider. The client did not mention this provider in the scope. What is the best course of action regarding testing this infrastructure?

Accepted Answer

Stop testing the cloud infrastructure and notify the client. Testing third-party infrastructure without permission is illegal and violates the rules of engagement. The tester should stop testing that part and inform the client.

Answer

Add the cloud provider to the scope without notifying the client

Answer

Continue testing because the application is owned by the client

Answer

Obtain verbal permission from the cloud provider and proceed