PT0-002 Practice Questions 2 — 50 Questions

Question 1

After a penetration test, the client's technical team wants to understand the exact steps required to reproduce a cross-site scripting vulnerability found in the web application. In which section of the standard penetration testing report should this information be included?

Accepted Answer

Technical Findings and Recommendations. The Technical Findings and Recommendations section is the correct place for step-by-step reproduction steps because it provides detailed, actionable technical information for the client's technical team. This section typically includes specific payloads, HTTP request/response details, and the exact sequence of user interactions needed to trigger the XSS vulnerability, enabling the team to verify and remediate the issue.

Answer

Executive Summary

Answer

Methodology

Answer

Appendices

Question 2

During an internal penetration test, a tester gains access to a domain-joined Windows 10 workstation as a local administrator. The tester wants to escalate privileges to Domain Admin. Which attack involves requesting Kerberos service tickets that can be cracked offline to reveal the plaintext password of a service account?

Accepted Answer

Kerberoasting. Kerberoasting is the correct attack because it involves requesting Kerberos service tickets (TGS-REP) for service accounts registered with Service Principal Names (SPNs) in Active Directory. These tickets are encrypted with the service account's NTLM hash, which can be cracked offline to reveal the plaintext password. Since the tester has local administrator access on a domain-joined workstation, they can use tools like Rubeus or Impacket to request these tickets without needing domain admin privileges initially.

Answer

Pass-the-hash

Answer

Golden ticket

Answer

Silver ticket

Question 3

During an internal penetration test, a tester captures an NTLMv2 hash of a domain admin account using a Responder attack. The organization's password policy requires at least 12 characters with uppercase, lowercase, numbers, and special characters. Which password cracking technique is most likely to succeed first?

Accepted Answer

Hybrid attack combining dictionary words with numbers and special characters. Option C is correct because NTLMv2 hashes are computationally expensive to crack, and a hybrid attack that combines dictionary words with numbers and special characters is the most efficient approach given the 12-character minimum policy. This technique leverages common password patterns (e.g., 'Password123!') that users often create to meet complexity requirements, making it faster than brute-forcing all possible 12-character combinations.

Answer

Dictionary attack with common passwords

Answer

Brute-force attack with all possible 8-character combinations

Answer

Rainbow table attack on the hash

Question 4

During the scoping phase of a penetration test, a client wants to test a third-party API that is integral to their web application. However, they do not have permission from the third-party provider. Which of the following should the tester do first?

Accepted Answer

Exclude the third-party API from the scope and document the limitation. Option B is correct because testing a third-party API without explicit permission from the provider violates legal and ethical boundaries, potentially constituting unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA). The penetration tester must first document this limitation in the scope to ensure the client understands the risk and to maintain the test's legality. Proceeding without permission could lead to liability for both the tester and the client.

Answer

Proceed with testing the API but restrict the test to read-only operations

Answer

Contact the third-party provider directly to obtain permission

Answer

Include the API in the scope and note the legal risks in the report

Question 5

A penetration tester is preparing the executive summary for a report. Which of the following metrics would be MOST valuable to include for non-technical stakeholders to understand the overall security posture?

Accepted Answer

The number of critical and high-risk findings along with the average time to exploit them. Option C is correct because non-technical stakeholders (e.g., executives) need a high-level, risk-focused summary that communicates the severity and urgency of findings. The number of critical/high-risk findings directly indicates the most dangerous exposures, and the average time to exploit them conveys how quickly an attacker could compromise the environment. This metric translates technical risk into business impact, which is the core goal of an executive summary.

Answer

A list of all tools used during the penetration test

Answer

The total number of vulnerabilities discovered and their average CVSS score

Answer

A detailed step-by-step exploitation walkthrough of one critical vulnerability

Question 6

Match each penetration testing tool to its primary function.

Question 7

Match each wireless attack to its description.

Question 8

Match each scanning technique to its description.

Question 9

Match each evasion technique to its description.

Question 10

Match each Phase of the Penetration Testing Execution Standard (PTES) to its description.

Question 11

Match each compliance standard to its focus area.

Question 12

A client requires a penetration test of their web application that uses Single Sign-On (SSO) with a third-party identity provider. The client is concerned that testing could lock out real user accounts and disrupt operations. Which of the following should be included in the rules of engagement to address this concern?

Accepted Answer

Provide test accounts that are excluded from lockout policies. Option B is correct because providing test accounts that are excluded from lockout policies allows the penetration tester to thoroughly assess the SSO authentication mechanism—including the SAML or OIDC flows—without risking the lockout of real user accounts. This directly addresses the client's operational concern while still enabling comprehensive testing of the identity provider integration.

Answer

Prohibit all testing of the authentication mechanism

Answer

Only perform testing during business hours

Answer

Require the tester to use only passive reconnaissance techniques

Question 13

A client asks why a medium-severity finding should be remediated before a high-severity finding. The medium finding is internet-facing and actively exploited; the high finding is isolated in a lab subnet. What is the best explanation?

Accepted Answer

Prioritization should account for exposure and active exploitation, not only the scanner severity.. Option A is correct because risk-based prioritization must consider real-world factors like internet exposure and active exploitation, not just the CVSS base score. A medium-severity finding that is internet-facing and actively exploited poses a higher immediate risk to the organization than a high-severity finding isolated in a lab subnet, which has no external attack surface. This aligns with industry frameworks like CVSS environmental metrics and the FIRST CVSS v3.1 specification, which allow adjusting severity based on attack vector, complexity, and environmental context.

Answer

Medium findings must always be fixed before high findings.

Answer

The high finding should be ignored permanently because it is in a lab.

Answer

Only CVSS base score matters for remediation order.

Question 14

A penetration tester is conducting passive reconnaissance on a target organization. Which of the following techniques would provide the MOST useful information about internal network architecture without directly interacting with the target's systems?

Accepted Answer

Searching for the target's SSL certificates in Certificate Transparency logs. Certificate Transparency (CT) logs are publicly accessible, append-only ledgers of SSL/TLS certificates. By searching CT logs for certificates issued to the target organization, a penetration tester can discover subdomains, hostnames, and even internal-facing server names that are included in Subject Alternative Names (SANs) or Common Names (CNs). This reveals internal network architecture details (e.g., 'mail.internal.example.com') without any direct interaction with the target's systems, making it a purely passive reconnaissance technique.

Answer

Performing a zone transfer against the target's DNS servers

Answer

Using Nmap to scan common ports on the target's public IP range

Answer

Querying the target's WHOIS records for IP addresses

Question 15

A client wants a penetration test that includes social engineering attacks against employees. They request that the testing team not target the executive leadership team. What should be included in the rules of engagement to address this requirement?

Accepted Answer

A list of excluded users or groups, specifically the executive leadership team. Option A is correct because the rules of engagement (RoE) must explicitly define the scope and boundaries of the test. Including a list of excluded users or groups, specifically the executive leadership team, ensures that social engineering attacks are not directed at them, directly addressing the client's requirement. This is a standard scoping practice in penetration testing to prevent unintended consequences and maintain legal and ethical compliance.

Answer

The maximum number of phishing emails that can be sent

Answer

The time window for conducting social engineering activities

Answer

A description of the social engineering techniques that will be used

Question 16

A penetration tester has discovered a critical SQL injection vulnerability in a web application. The developer team will fix the issue. Which level of detail is most appropriate for this audience?

Accepted Answer

Include the full proof-of-concept code and the exact HTTP requests used.. Option B is correct because the developer team needs the exact technical details to reproduce and fix the vulnerability. Providing the full proof-of-concept code and exact HTTP requests allows developers to understand the injection point, the payload structure, and the vulnerable parameter, enabling them to implement a precise fix such as parameterized queries or input validation.

Answer

Provide the CVSS score and a brief description.

Answer

Describe the business impact in financial terms.

Answer

List all findings in a bullet-point summary without additional context.

Question 17

A penetration tester has completed the technical portion of a test and is now writing the executive summary. Which of the following is most important to include in this section to effectively communicate with senior management?

Accepted Answer

The total number of vulnerabilities found and their risk ratings, with a focus on business impact. The executive summary is intended for senior management, who need to understand the business impact of findings rather than technical details. Option B focuses on the total number of vulnerabilities, their risk ratings, and business impact, which directly aligns with management's decision-making needs. This ensures the report communicates risk in terms of potential financial or operational consequences, not just technical severity.

Answer

A detailed list of all tools and commands used during the test

Answer

Step-by-step instructions on how to reproduce the most critical vulnerability

Answer

The names of the penetration testers and their certifications

Question 18

A penetration tester has compromised a Windows workstation and obtained a low-privileged domain user account. The tester discovers that this user belongs to a group that has the 'GenericWrite' privilege over a computer object in Active Directory. Which attack is most directly enabled by this misconfiguration?

Accepted Answer

Shadow Credentials. The 'GenericWrite' privilege over a computer object allows the attacker to write to the msDS-KeyCredentialLink attribute of that object. By adding a rogue key credential, the attacker can trigger the Key Distribution Center (KDC) to accept a certificate-based authentication, enabling the Shadow Credentials attack to obtain a TGT for the computer account and escalate privileges.

Answer

Kerberoasting

Answer

AS-REP Roasting

Answer

DCSync Attack

Question 19

A penetration tester has gained a foothold on a Windows server and wants to move laterally to a domain controller. The tester has access to a service account that is a member of the 'Remote Management Users' group on the domain controller. Which of the following tools would be MOST appropriate for lateral movement in this scenario?

Accepted Answer

WinRM. WinRM (Windows Remote Management) is the most appropriate tool because the tester's service account is a member of the 'Remote Management Users' group on the domain controller, which grants explicit permission to connect via WinRM over HTTP/HTTPS (ports 5985/5986). This allows direct PowerShell remoting or winrs execution for lateral movement without requiring administrative privileges or additional exploits.

Answer

PsExec

Answer

MS16-075 exploit

Answer

BloodHound

Question 20

A penetration tester is analyzing a Bash script that uses 'curl' to send HTTP requests with payloads and checks for a specific string in the response. The script contains: 'if echo $response | grep -q "root:x:0:0"'. Which vulnerability is the script most likely testing for?

Accepted Answer

Local file inclusion. The script checks for the string 'root:x:0:0' in the HTTP response, which is the standard format of the root user entry in the /etc/passwd file on Unix-like systems. This indicates the script is testing whether the server is returning the contents of a local file (e.g., /etc/passwd) via a path traversal or file inclusion vulnerability, making Local File Inclusion (LFI) the correct answer.

Answer

SQL injection

Answer

Cross-site scripting

Answer

Remote code execution