PT0-002 Practice Questions 2 — 50 Questions

Question 1

A penetration tester is performing passive reconnaissance to discover email addresses associated with a target domain. The tester wants to avoid sending any packets directly to the target's infrastructure. Which tool is most appropriate for this task?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Using theHarvester to search public sources like search engines, PGP key servers, and social media. TheHarvester is designed specifically for passive reconnaissance, gathering email addresses, subdomains, and other data from public sources such as search engines, PGP key servers, and social media without sending any packets directly to the target's infrastructure. This aligns perfectly with the requirement to avoid direct interaction with the target domain.

Answer

Using the whois command to query domain registration details

Answer

Using Shodan to identify email servers and associated addresses

Answer

Using Google dorking with advanced search queries to find email addresses in indexed pages

Question 2

A penetration tester is preparing the executive summary for a report. Which of the following metrics would be MOST valuable to include for non-technical stakeholders to understand the overall security posture?

Accepted Answer

The number of critical and high-risk findings along with the average time to exploit them. Non-technical stakeholders (e.g., executives) need a high-level, risk-focused summary that communicates the severity and urgency of findings. The number of critical/high-risk findings directly indicates the most dangerous exposures, and the average time to exploit them conveys how quickly an attacker could compromise the environment. This metric translates technical risk into business impact, which is the core goal of an executive summary.

Answer

A list of all tools used during the penetration test

Answer

The total number of vulnerabilities discovered and their average CVSS score

Answer

A detailed step-by-step exploitation walkthrough of one critical vulnerability

Question 3

A penetration tester is conducting passive reconnaissance on a target organization using Google dorking. The tester wants to find PDF documents that may contain usernames and passwords. Which Google search query is most appropriate for this task?

Accepted Answer

site:target.com filetype:pdf password. It uses the `filetype:pdf` operator to specifically target PDF documents, combined with the keyword `password` to find files likely containing credentials. Google dorking with `site:target.com` restricts results to the target domain, making this query efficient for passive reconnaissance of exposed sensitive information in PDFs.

Answer

site:target.com username password

Answer

site:target.com filetype:xls password

Answer

site:target.com intitle:'index of' password

Question 4

A penetration tester analyzes a PowerShell script that uses the 'Invoke-Command' cmdlet to run a command on multiple remote Windows systems. The script checks if the local Administrator account is using a default password. Which phase of the penetration test is this script most directly supporting?

Accepted Answer

Enumeration of misconfigurations. The script uses Invoke-Command to check if the local Administrator account on multiple remote Windows systems uses a default password. This directly supports the enumeration of misconfigurations phase, as it identifies a common security weakness (default credentials) that could be exploited. It does not involve moving between systems (lateral movement) or extracting stored credentials (credential dumping).

Answer

Lateral movement

Answer

Credential dumping

Answer

Privilege escalation

Question 5

A client wants to conduct a penetration test of their e-commerce website. They are concerned about impacting live transactions. Which clause should be included in the Rules of Engagement to address this?

Accepted Answer

Exclusion of network stress testing and availability testing.. The client's primary concern is avoiding disruption to live transactions. A clause excluding network stress testing and availability testing (e.g., DoS attacks, resource exhaustion, or high-volume scanning) directly addresses this by prohibiting any action that could degrade performance or cause downtime. This is a standard Rules of Engagement (RoE) safeguard for production e-commerce environments where transaction integrity and uptime are critical.

Answer

Out-of-scope systems list.

Answer

In-scope IP addresses.

Answer

Authorization for testing.

Question 6

A penetration tester wants to perform DNS brute-force enumeration to discover subdomains of a target domain. Which tool is specifically designed for this purpose?

Accepted Answer

dnsrecon. B is correct because dnsrecon is a specialized DNS enumeration tool that includes a brute-force mode for discovering subdomains. It uses a wordlist to query DNS servers for common subdomain names, leveraging the DNS protocol's inherent structure to map out a target's domain hierarchy without relying on zone transfers.

Answer

nmap

Answer

Wireshark

Answer

Hydra

Question 7

A penetration tester is scoping an engagement for a client that hosts a public-facing web application and an internal database server. The client wants to ensure that testing does not cause any disruption to the database server. Which of the following should the tester include in the rules of engagement to address this concern?

Accepted Answer

Define the database server as an out-of-scope target.. Defining the database server as out-of-scope explicitly removes it from all testing activities, ensuring zero disruption as requested. This is the only option that fully prevents any interaction with the database server, including passive reconnaissance or exploitation attempts, which could still cause unintended load or queries.

Answer

Specify that only passive reconnaissance techniques will be used on the database server.

Answer

Include a clause that the tester will not attempt to exploit any vulnerabilities on the database server.

Answer

Require that all testing activities be performed during off-peak hours only.

Question 8

A penetration tester is performing passive reconnaissance to discover email addresses associated with a target domain. The tester wants to avoid sending any packets directly to the target's infrastructure. Which tool is most appropriate for this task?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Querying public BGP route databases and looking up the organization's autonomous system (AS) number. Querying public BGP route databases (e.g., RADB, ARIN) using the organization's AS number allows a tester to retrieve IP prefixes announced by the target. This is passive reconnaissance because it uses publicly available routing data without sending any packets to the target's network, making it ideal for identifying internal IP ranges from an external perspective.

Answer

Performing a DNS zone transfer against the target's authoritative DNS servers

Answer

Using Shodan to search for devices from the target organization

Answer

Sending ARP requests on the local network segment to discover hosts

Question 9

A penetration tester is conducting passive reconnaissance on a target organization. The tester wants to identify all publicly accessible cloud storage buckets that might belong to the target without directly interacting with the target's infrastructure. Which of the following techniques would be most effective for this purpose?

Accepted Answer

Search for exposed cloud storage buckets using search engine dorks (e.g., 'site:s3.amazonaws.com target-company'). Search engine dorks allow a penetration tester to query publicly indexed content on cloud storage platforms like AWS S3 without sending any traffic to the target's infrastructure. By using a dork such as 'site:s3.amazonaws.com target-company', the tester leverages the search engine's pre-cached index to identify buckets that may be misconfigured or publicly accessible, which aligns perfectly with passive reconnaissance requirements.

Answer

Perform DNS enumeration using tools like `dnsrecon` to discover subdomains pointing to cloud storage services

Answer

Query certificate transparency logs to find SSL certificates issued to the target's cloud storage endpoints

Answer

Perform a WHOIS lookup to find IP ranges owned by the target and then scan those ranges for open storage services

Question 10

A penetration tester writes a Python script to test an API for vulnerabilities. The script sends requests with multiple payloads and checks if the response contains an error message indicating a potential injection. Which of the following code snippets would BEST reduce false positives by verifying that the injected parameter is processed?

Accepted Answer

Compare the response of the injected request to the response of a benign request with the same parameter structure. Comparing the response of an injected request to a benign request with the same parameter structure directly confirms that the injected parameter was processed and caused a different application behavior, thereby reducing false positives. This technique, often called differential analysis, isolates the effect of the injection from normal variations in the API response, such as dynamic content or session tokens. It is more reliable than checking for specific error messages or status codes, which may be suppressed or generic.

Answer

Check if the response status code is 500 for each payload

Answer

Compare the response time of the injected request to a baseline without injection

Answer

Check if the response contains a specific error message that is only triggered when the injection is successful

Question 11

A penetration tester is using a vulnerability scanner to assess a web application. The scanner reports a 'SQL Injection' finding with a high confidence level. However, manual verification of the same payload does not trigger the vulnerability in a browser. Which of the following is the most likely reason for this discrepancy?

Accepted Answer

The scanner might have generated a false positive due to a misinterpretation of the server's response. The most likely reason is that the scanner generated a false positive due to a misinterpretation of the server's response. Vulnerability scanners often infer SQL injection based on response patterns (e.g., database error messages, timing differences) that may not actually be exploitable. Manual verification in a browser failed because the payload did not produce a true SQL error or data leak, confirming the scanner's alert was incorrect.

Answer

The scanner used a different HTTP method than the one used in manual testing

Answer

The scanner's payloads were URL-encoded differently

Answer

The vulnerability exists only in the scanner's simulated environment

Question 12

A client requires a penetration test of their web application that uses Single Sign-On (SSO) with a third-party identity provider. The client is concerned that testing could lock out real user accounts and disrupt operations. Which of the following should be included in the rules of engagement to address this concern?

Accepted Answer

Provide test accounts that are excluded from lockout policies. Providing test accounts that are excluded from lockout policies allows the penetration tester to thoroughly assess the SSO authentication mechanism—including the SAML or OIDC flows—without risking the lockout of real user accounts. This directly addresses the client's operational concern while still enabling comprehensive testing of the identity provider integration.

Answer

Prohibit all testing of the authentication mechanism

Answer

Only perform testing during business hours

Answer

Require the tester to use only passive reconnaissance techniques

Question 13

During a penetration test, a tester finds a custom binary that is vulnerable to a stack-based buffer overflow. The binary has DEP enabled but no ASLR. Which of the following exploitation techniques would be MOST effective to achieve code execution?

Accepted Answer

ret2libc to call system() with a controlled argument. Ret2libc allows the tester to call the system() function from libc with a controlled argument (e.g., "/bin/sh") to spawn a shell, bypassing DEP (which prevents code execution on the stack) without needing to execute shellcode. Since ASLR is disabled, the address of system() and the string "/bin/sh" in libc are predictable, making this technique reliable and effective.

Answer

Return-oriented programming (ROP) to bypass DEP

Answer

Heap spraying to inject shellcode

Answer

Stack pivoting to redirect execution to a known location

Question 14

A penetration tester wants to identify the web server software and version used by a target organization without sending any packets to the target's infrastructure. Which of the following techniques is most effective for this purpose?

Accepted Answer

Use Shodan to search for the target's IP address or domain and review the gathered banners.. Shodan is a search engine that continuously scans the internet and stores service banners from various ports. By querying the target's IP address or domain, the penetration tester can retrieve previously collected HTTP headers and other service banners without sending any packets to the target, thus achieving passive reconnaissance.

Answer

Perform a DNS zone transfer to obtain internal server information.

Answer

Use netcat to connect to port 80 and read the HTTP banner.

Answer

Use nmap -sV with a delayed scan to avoid detection.

Question 15

A penetration tester is analyzing a Python script that uses the 'requests' library. The script sends a GET request to a target URL with a crafted parameter value containing a SQL sleep function, then measures the response time. What attack is the script most likely performing?

Accepted Answer

Blind time-based SQL injection.. The script sends a crafted parameter containing a SQL sleep function (e.g., `' OR SLEEP(5)--`) and measures the response time. If the database executes the sleep, the response is delayed, confirming a SQL injection vulnerability without relying on visible output. This is the hallmark of a blind time-based SQL injection attack using the `requests` library to time the HTTP response.

Answer

Cross-site scripting (XSS) attack.

Answer

Command injection attack.

Answer

Error-based SQL injection.

Question 16

A penetration tester is analyzing the results of a vulnerability scan against a web application. The scanner reports a potential SQL injection vulnerability in a login form parameter. However, manual testing with the same payload does not produce any error messages or changes in behavior. Which of the following is the most likely reason for the false positive?

Accepted Answer

The web application is using a parameterized query that sanitizes input. The use of parameterized queries (prepared statements) separates SQL logic from user input, preventing SQL injection even if the input contains malicious payloads. The scanner's payload triggered a false positive because the application's database layer safely handles the input, so no error or behavioral change occurs during manual testing.

Answer

The scanner used a payload that was not URL-encoded

Answer

The scanning engine is outdated and does not support the latest SQL syntax

Answer

The login form is protected by a CAPTCHA that blocks automated scanning

Question 17

A penetration tester has gained access to a Windows workstation and extracted NTLM password hashes. The tester wants to move laterally to a server that authenticates using NTLM. The tester does not have the plaintext passwords. Which technique is MOST appropriate to authenticate to the server using the captured hashes?

Accepted Answer

Pass-the-hash. Pass-the-hash (PtH) is the correct technique because it allows the tester to authenticate to the remote server using the captured NTLM hash directly, without needing the plaintext password. NTLM authentication uses a challenge-response protocol where the hash itself is the secret; by presenting the hash in the response, the tester can impersonate the user. This is a well-known lateral movement technique in Windows environments, often executed with tools like Mimikatz (sekurlsa::pth) or Impacket's wmiexec.py.

Answer

Brute force

Answer

Rainbow tables

Answer

Keylogging

Question 18

A client is planning a penetration test of their internal network but refuses to provide network diagrams or access to a staging environment. The tester is concerned about causing a denial of service (DoS) on critical systems. Which clause should be included in the rules of engagement to mitigate this risk?

Accepted Answer

A rate-limiting clause that restricts scan speed and concurrent connections.. A rate-limiting clause directly addresses the risk of causing a denial of service (DoS) by controlling the speed and concurrency of the penetration test. By restricting scan rates (e.g., using tools like Nmap with `--max-rate` or `--min-hostgroup`) and limiting concurrent connections, the tester can prevent overwhelming critical systems, even without network diagrams or a staging environment. This clause mitigates the risk without requiring the client to provide additional information or shifting liability.

Answer

A clause requiring the client to provide a complete list of in-scope IP addresses.

Answer

A waiver stating that any service disruption is the client's responsibility.

Answer

An exclusion list for systems that should not be tested.

Question 19

A penetration tester has compromised a Linux server and gained a low-privilege shell. The tester discovers that the /etc/shadow file is readable by the tester's user. Which attack is most directly enabled by this finding?

Accepted Answer

Password cracking offline. The /etc/shadow file contains the hashed passwords for all users on the system. If a low-privilege user can read this file, they can copy the password hashes and attempt to crack them offline using tools like John the Ripper or Hashcat. This directly enables an offline password cracking attack, as the tester can brute-force or use dictionary attacks against the hashes without needing to interact with the live system.

Answer

Pass-the-hash

Answer

LLMNR poisoning

Answer

Kerberoasting

Question 20

A penetration tester wants to identify all publicly accessible Amazon S3 buckets that belong to a specific organization. Which technique is most effective for passive reconnaissance?

Accepted Answer

Use Google dorks to search for bucket names and URLs.. Google dorks (e.g., site:s3.amazonaws.com "companyname") allow a penetration tester to passively discover publicly accessible S3 bucket names and URLs indexed by search engines without sending any traffic to the target organization. This technique leverages existing search engine caches, making it purely passive and highly effective for identifying misconfigured buckets that have been crawled.

Answer

Send DNS queries for common bucket name prefixes.

Answer

Use nmap to scan all AWS IP ranges for open ports.

Answer

Perform a DNS zone transfer on the target organization's domain.