PT0-002 Practice Questions 1 — 50 Questions

Question 1

A penetration tester has completed the test and is preparing the final report. The client asks the tester to include a section that describes the scope, methodology, and tools used. In which section should this information be placed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Appendices. Appendices are the appropriate place for supplementary information such as scope, methodology, and tools used.

Answer

Remediation section

Answer

Technical findings

Answer

Executive summary

Question 2

Which SQL injection technique involves injecting a query that causes a delay in response, allowing the attacker to infer information based on response time?

Accepted Answer

Blind time-based SQL injection. Blind time-based SQL injection uses delays (e.g., WAITFOR DELAY) to infer true/false conditions.

Answer

Error-based SQL injection

Answer

UNION-based SQL injection

Answer

Boolean-blind SQL injection

Question 3

During the reconnaissance phase, a penetration tester wants to identify subdomains of a target domain without making direct requests to the target's own DNS servers. Which technique would be BEST for this purpose?

Accepted Answer

Using search engines and public certificate transparency logs. Search engines (e.g., Google dorking) and public certificate transparency logs (e.g., crt.sh) allow a tester to discover subdomains by querying aggregated historical DNS and TLS certificate data, without sending any queries to the target's authoritative DNS servers. This passive reconnaissance technique avoids alerting the target's infrastructure and complies with the requirement of no direct requests to the target's DNS servers.

Answer

Using the 'nslookup' command interactively

Answer

Performing a zone transfer

Answer

Using the 'host' command

Question 4

A tester wants to enumerate SMB shares and execute commands remotely on a Windows target using captured credentials. Which tool is most appropriate?

Accepted Answer

CrackMapExec. CrackMapExec is a versatile tool for SMB enumeration, command execution, and lateral movement with credentials.

Answer

Hashcat

Answer

Responder

Answer

Bettercap

Question 5

A penetration tester has gained access to a Linux server and wants to move laterally to a Windows server. The tester captured a hash of a domain user. Which tool can be used to authenticate to the Windows server using the hash?

Accepted Answer

evil-winrm. evil-winrm supports pass-the-hash authentication over WinRM, allowing lateral movement.

Answer

Ligolo-ng

Answer

SSH

Answer

Chisel

Question 6

You are conducting a penetration test and need to identify subdomains of a target domain using a passive approach that does not generate traffic to the target's servers. Which technique should you use?

Accepted Answer

Certificate transparency logs. Certificate transparency logs (e.g., crt.sh) are public logs of SSL/TLS certificates, often containing subdomain names. Querying them is passive and does not interact with the target.

Answer

DNS cache snooping

Answer

Subdomain bruteforce with gobuster

Answer

DNS zone transfer

Question 7

A penetration tester wants to discover email addresses associated with a target domain (example.com) without sending any network packets to the target's systems. Which technique is BEST suited for this?

Accepted Answer

Google dorking. Google dorking uses advanced search operators (e.g., site:example.com intext:@example.com) to index publicly available information from Google's cached pages, allowing discovery of email addresses without sending any packets to the target's infrastructure. This passive reconnaissance technique relies solely on pre-existing search engine data, making it ideal for avoiding direct interaction with the target.

Answer

DNS brute forcing

Answer

WHOIS lookup

Answer

SMB enumeration

Question 8

A penetration tester is compiling the final report. The client's compliance officer requires a section that maps each finding to specific regulatory requirements (e.g., PCI DSS, HIPAA). Which section of the report is best suited for this mapping?

Accepted Answer

Compliance Mapping. The Compliance Mapping section is specifically designed to cross-reference each technical finding with relevant regulatory frameworks such as PCI DSS, HIPAA, or GDPR. This allows the compliance officer to quickly verify that all required controls are addressed and that the report meets audit or legal standards. The other sections focus on summarizing or detailing technical issues, not on mapping findings to specific regulations.

Answer

Executive Summary

Answer

Technical Findings

Answer

Appendices

Question 9

A penetration tester discovers a critical vulnerability during an assessment. According to best practices, when should the tester communicate this finding to the client?

Accepted Answer

Immediately upon discovery. Critical findings should be reported immediately to allow the client to take urgent action.

Answer

Only in the final report

Answer

After the test is complete

Answer

At the next scheduled status meeting

Question 10

In a Python script for a penetration test, you need to craft a custom TCP packet with specific flags. Which library is best suited for low-level packet manipulation?

Accepted Answer

scapy. Scapy allows crafting, sending, and sniffing network packets at a low level, supporting custom TCP flags.

Answer

requests

Answer

socket

Answer

impacket

Question 11

A penetration tester is reviewing source code and wants to identify common hardcoded credentials and input validation gaps. Which three checks should the tester perform? (Choose THREE.)

Accepted Answer

Identify usage of eval, exec, or system with user input. Hardcoded credentials, concatenated SQL queries, and dangerous functions like eval/exec/system are common vulnerabilities.

Answer

Verify the use of HTTPS

Answer

Check for proper session timeout implementation

Question 12

During a penetration test, a tester captures NTLMv2 hashes by spoofing LLMNR responses. Which tool is most commonly used for this purpose?

Accepted Answer

Responder. Responder is the standard tool for LLMNR/NBT-NS/mDNS poisoning to capture NTLM hashes.

Answer

John the Ripper

Answer

Bettercap

Answer

Hashcat

Question 13

During a penetration test, the tester gains access to a domain-joined Windows machine and wants to perform Kerberoasting. Which THREE conditions are necessary for a successful Kerberoasting attack?

Accepted Answer

Ability to request TGS-REP tickets. The user must have domain credentials, there must be service accounts with SPNs, and the attacker must be able to request TGS tickets. Plaintext passwords are not required, and local admin is not needed.

Answer

Local administrator privileges on the target

Answer

Plaintext password of the service account

Question 14

A penetration tester is conducting passive reconnaissance and wants to gather information about a target organization's employees, email addresses, and internal structure. Which TWO tools are best suited for this purpose? (Select TWO.)

Accepted Answer

Maltego. Maltego is a data mining tool that visualizes relationships and can collect info from social media, DNS, and other sources. theHarvester gathers emails, subdomains, and names from public sources. LinkedIn is also used for organizational chart mapping, but the question asks for tools specifically.

Answer

Gobuster

Answer

Nmap

Answer

Nikto

Question 15

During post-engagement, a penetration tester needs to ensure proper data handling. Which THREE actions should the tester take?

Accepted Answer

Securely destroy test artifacts after the client accepts the report. After the engagement, test artifacts should be securely destroyed, data should be purged from test systems, and confidential information must be handled per agreement.

Answer

Retain all test data indefinitely for future reference

Answer

Share findings with other clients to demonstrate expertise

Question 16

During an internal penetration test, the tester wants to relay captured NTLM authentication to a server to gain access. Which tool from the Impacket suite is specifically designed for NTLM relay attacks?

Accepted Answer

ntlmrelayx. ntlmrelayx is the Impacket tool for relaying NTLM authentication.

Answer

CrackMapExec

Answer

Metasploit

Answer

Responder

Question 17

A penetration tester discovers evidence of ongoing criminal activity, such as a data breach by an internal employee, during a white box penetration test. The client's legal team has not provided specific instructions on handling such discoveries. According to best practices and legal considerations, what should the tester do first?

Accepted Answer

Stop testing and contact the client's emergency contact. The tester should immediately stop testing and inform the client's emergency contact to handle the criminal activity appropriately.

Answer

Notify law enforcement directly

Answer

Continue testing and document the evidence for later reporting

Answer

Ignore the activity and proceed as planned

Question 18

A penetration tester is using a vulnerability scanner on a web application and notices that many findings are false positives caused by the scanner sending oversized payloads that the application truncates or rejects. Which scanner configuration change would MOST effectively reduce false positives in this scenario?

Accepted Answer

Enable safe checks or anti-false positive mode. Enabling safe checks or anti-false positive mode configures the scanner to send payloads that conform to expected application input constraints (e.g., length limits, character sets) rather than oversized or malformed payloads. This reduces false positives by ensuring that the scanner only reports vulnerabilities that are actually reachable and exploitable under normal application behavior, rather than triggering truncation or rejection logic that is not a security flaw.

Answer

Increase the scan intensity to send more payloads

Answer

Increase the HTTP request timeout

Answer

Disable vulnerability detection for certain plugins

Question 19

When a client disagrees with a finding's severity rating, what is the best approach for the penetration tester?

Accepted Answer

Discuss the rationale and adjust if valid business context is provided. The tester should listen to the client's perspective and discuss the risk assessment, providing rationale to explain the rating.

Answer

Escalate to the tester's manager

Answer

Insist on the original rating and refuse to change it

Answer

Lower the rating to satisfy the client

Question 20

You are performing reconnaissance on a target's web application. Which of the following techniques can be used to discover hidden directories and files? (Select THREE.)

Accepted Answer

Using feroxbuster. Directory bruteforce tools like dirsearch, gobuster, and feroxbuster are designed to discover hidden directories and files by using wordlists. Nikto is a vulnerability scanner, not primarily for directory discovery. theHarvester is for email/subdomain harvesting.

Answer

Running Nikto with default options

Answer

Querying theHarvester