PT0-002 Practice Test 50 — 15 Questions

Question 1

Which of the following best describes the purpose of a vulnerability disclosure policy in the context of a penetration test?

Accepted Answer

To establish a process for reporting discovered vulnerabilities to the client and possibly to the public. A vulnerability disclosure policy outlines how vulnerabilities found during testing will be reported and remediated.

Answer

To list the assets that are out of scope

Answer

To define the rules of engagement for the test

Answer

To provide legal protection to the tester

Question 2

A penetration tester uses the DREAD model to assess a vulnerability. The tester assigns the following scores: Damage=8, Reproducibility=10, Exploitability=9, Affected users=7, Discoverability=6. What is the overall DREAD risk rating?

Accepted Answer

8.0. DREAD rating is the average of the five scores: (8+10+9+7+6)/5 = 40/5 = 8.0.

Answer

8.5

Answer

7.5

Answer

9.0

Question 3

A penetration tester is performing passive reconnaissance on a target organization. Which of the following tools would be BEST for discovering subdomains and email addresses associated with the target domain without sending any packets to the target?

Accepted Answer

theHarvester. theHarvester is an OSINT tool that collects emails, subdomains, IPs, and URLs from public sources like search engines and PGP key servers without interacting with the target network.

Answer

WPScan

Answer

Nmap

Answer

snmpwalk

Question 4

In a penetration test report, the executive summary is primarily intended for which audience?

Accepted Answer

Senior management (e.g., CISO, board of directors). The executive summary is designed for senior management (e.g., CISO, board of directors) because it provides a high-level overview of the penetration test's objectives, key findings, risk impact, and recommended strategic actions. It avoids technical jargon and detailed exploit steps, focusing instead on business risk and remediation priorities that inform decision-making and resource allocation.

Answer

IT system administrators

Answer

Software developers

Answer

External compliance auditors

Question 5

A company hires a penetration testing firm to simulate the tactics, techniques, and procedures of a real adversary. The engagement includes attempting to achieve specific objectives without being detected. This type of engagement is best described as:

Accepted Answer

Red team exercise. A red team exercise is an adversary simulation that aims to test detection and response capabilities.

Answer

Network penetration test

Answer

Web application penetration test

Answer

Social engineering engagement

Question 6

A penetration tester needs to crack a large number of NTLM hashes. They have a wordlist and want to apply common password mutations. Which hashcat option enables the use of a rule file to mutate words?

Accepted Answer

-r. Hashcat's -r option specifies a rule file that defines transformations (mutation) on dictionary words.

Answer

-a 0

Answer

-a 6

Answer

-m 1000

Question 7

A penetration tester is analyzing a Python script that uses the requests library to automate web vulnerability scanning. The script sends POST requests with payloads but receives 403 Forbidden responses for many requests, even though manual testing with the same payloads works. Which is the most likely cause?

Accepted Answer

Missing User-Agent header. Many web servers and WAFs (Web Application Firewalls) block requests that lack a User-Agent header or use a default one like 'python-requests/2.x.x'. Manual testing typically uses a browser, which sends a legitimate User-Agent, while the script's default header triggers the 403 Forbidden response. Setting a realistic User-Agent header in the script mimics browser behavior and bypasses this common filter.

Answer

Incorrect Content-Type header

Answer

Script is sending too many requests too fast

Answer

Payloads are URL-encoded incorrectly

Question 8

A penetration tester is conducting passive reconnaissance and wants to find historical snapshots of a target website to identify past vulnerabilities or hidden endpoints. Which online service should the tester use?

Accepted Answer

Wayback Machine. The Wayback Machine (archive.org) is the correct choice because it archives historical snapshots of websites, allowing a penetration tester to review past versions of a target site to identify previously exposed vulnerabilities, hidden endpoints, or outdated configurations. This aligns with passive reconnaissance, as the tester does not interact directly with the live target.

Answer

Shodan

Answer

Censys

Answer

Pastebin

Question 9

During the scoping phase of a penetration test, a client wants to test a third-party API that is integral to their web application. However, they do not have permission from the third-party provider. Which of the following should the tester do first?

Accepted Answer

Exclude the third-party API from the scope and document the limitation. Testing a third-party API without explicit permission from the provider violates legal and ethical boundaries, potentially constituting unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA). The penetration tester must first document this limitation in the scope to ensure the client understands the risk and to maintain the test's legality. Proceeding without permission could lead to liability for both the tester and the client.

Answer

Proceed with testing the API but restrict the test to read-only operations

Answer

Contact the third-party provider directly to obtain permission

Answer

Include the API in the scope and note the legal risks in the report

Question 10

A penetration tester has been given access to a network tap on a client's internal network. The tester wants to perform initial reconnaissance by identifying all live hosts and their operating systems without sending any packets that could be detected. Which technique is most appropriate?

Accepted Answer

Run Wireshark to capture traffic and analyze source IP addresses and TCP/IP stack signatures.. Capturing traffic with Wireshark from a network tap is entirely passive—it never injects packets into the network. By analyzing source IP addresses and TCP/IP stack signatures (e.g., TTL values, window sizes, and IP ID patterns), the tester can identify live hosts and infer their operating systems without sending any detectable traffic. This aligns perfectly with the requirement to avoid sending any packets.

Answer

Perform an ARP scan using arp-scan from a connected workstation.

Answer

Use Nmap with the -sn flag to perform a ping sweep of the subnet.

Answer

Initiate a DNS zone transfer request to the internal DNS servers.

Question 11

A penetration tester is exploiting a SQL injection vulnerability in a web application. They want to extract data from the database without displaying it on the page. Which SQL injection technique should they use?

Accepted Answer

Blind time-based SQL injection. Blind SQL injection techniques like time-based or boolean-based are used when data is not returned directly in the response. Time-based uses delays to infer information.

Answer

Stacked queries

Answer

UNION-based SQL injection

Answer

Error-based SQL injection

Question 12

During a penetration test, a tester gains shell access on a Linux server as a low-privileged user. The user is identified to be a member of the 'docker' group. Which technique is most effective for escalating privileges to root?

Accepted Answer

Use docker to mount the entire host filesystem and modify the root password.. Membership in the 'docker' group grants the user effective root-equivalent access because the Docker daemon runs as root and allows any member of the 'docker' group to issue commands that can mount arbitrary host paths. By running a container with the host filesystem mounted (e.g., `docker run -v /:/mnt --privileged -it alpine chroot /mnt`), the tester can directly modify the `/etc/shadow` file or the root password, thereby escalating privileges to root without needing any additional exploit.

Answer

Use docker to run a container with network host mode to access internal services.

Answer

Use docker to pull a malicious image from the internet to compromise other containers.

Answer

Use docker to create a new user with root privileges inside a container.

Question 13

During a web application test, the tester discovers that the application uses JSON Web Tokens (JWT) for authentication. The tester modifies the JWT header to set the algorithm to 'none' and removes the signature. The server accepts the token. What type of attack is this?

Accepted Answer

JWT algorithm confusion (alg:none). Setting the JWT algorithm to 'none' exploits a misconfiguration where the server does not enforce signature verification, leading to JWT algorithm confusion.

Answer

JWT injection

Answer

JWT session stealing

Answer

JWT secret brute-force

Question 14

A penetration tester uses Hashcat to crack NTLM hashes captured during a pass-the-hash attack. Which Hashcat mode should the tester use for NTLM hashes?

Accepted Answer

-m 1000. Hashcat mode -m 1000 is for NTLM hashes. Other modes correspond to different hash types.

Answer

-m 0

Answer

-m 13100

Answer

-m 22000

Question 15

Which TWO of the following should be included in the methodology section of a penetration test report?

Accepted Answer

The specific tools and commands used during testing. Option D is correct because the methodology section must document the specific tools and commands used during testing, such as Nmap, Metasploit, or Burp Suite invocations, so the client can understand exactly how the assessment was performed and reproduce or validate the results. Option E is correct because the testing approach (black-box, white-box, or gray-box) defines the scope, knowledge level, and perspective from which the testers operated, which is essential for interpreting the findings correctly. Options A, B, and C do not belong in the methodology section: discovered vulnerabilities are typically detailed in the findings/results section, remediation instructions belong in the recommendations or remediation section, and the client's network diagram is usually included as an appendix or supporting artifact rather than as part of the methodology narrative.

Answer

List of vulnerabilities discovered

Answer

Step-by-step remediation instructions

Answer

The client's network diagram