PT0-002 Practice Exam 52 — 20 Questions

Question 1

A penetration testing firm is hired to perform a test on a multinational company that has offices in Europe and North America. The client wants to test all systems including those in the European office, which is subject to GDPR. Which of the following is the MOST important legal consideration to include in the rules of engagement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data protection and privacy clauses addressing handling of personal data. The engagement involves testing systems in a European office subject to GDPR, which imposes strict requirements on the processing and protection of personal data. The rules of engagement must include data protection and privacy clauses to define how the penetration tester will handle any personal data encountered during the test, ensuring compliance with GDPR Article 5 (lawfulness, fairness, transparency) and Article 32 (security of processing). Without these clauses, the tester could inadvertently violate GDPR by collecting or storing personal data without a lawful basis, exposing both the client and the testing firm to significant fines.

Answer

A limitation of liability clause

Answer

A non-disclosure agreement

Answer

A schedule of testing hours

Question 2

Which tool is specifically designed for scanning WordPress websites to detect vulnerabilities, such as outdated plugins, themes, and weak passwords?

Accepted Answer

WPScan. WPScan is a dedicated WordPress security scanner that enumerates WordPress-specific vulnerabilities, including outdated plugins, themes, and weak passwords via XML-RPC brute-force testing. It uses the WordPress vulnerability database (wpvulndb.com) to match installed versions against known CVEs, making it the correct tool for this targeted task.

Answer

OpenVAS

Answer

Nikto

Answer

Nessus

Question 3

During a web application test, a tester discovers an endpoint that fetches a URL from user input without validation. They attempt to access the AWS metadata endpoint. Which IP address is commonly used for the cloud metadata service?

Accepted Answer

169.254.169.254. 169.254.169.254 is the link-local IPv4 address used by AWS EC2 Instance Metadata Service (IMDS), and it is also used by Azure, GCP, and OpenStack for their metadata services. An SSRF vulnerability that can reach this address can retrieve IAM credentials from the instance role, making it a critical finding in cloud-hosted web app tests.

Answer

10.0.0.1

Answer

127.0.0.1

Answer

192.168.1.1

Question 4

During a penetration test, a penetration tester discovers a critical vulnerability that allows unauthenticated remote code execution on a public-facing web server. According to best practices for communication during a penetration test, what should the tester do next?

Accepted Answer

Immediately notify the client of the critical finding and provide initial remediation steps.. Penetration testing best practices and most rules of engagement require immediate notification of the client when a critical vulnerability — especially unauthenticated RCE on a public-facing system — is discovered, because it represents an active, exploitable risk. Providing initial remediation guidance at the same time helps the client mitigate before the finding is weaponized. This balances the tester's duty to the client with the goal of the engagement.

Answer

Document the finding and inform the client only after verifying with a second tester.

Answer

Wait until the end of the test to include it in the final report.

Answer

Exploit the vulnerability to demonstrate the full impact before notifying the client.

Question 5

During a web application test, you find a feature that allows users to export data as PDF. The PDF generation uses user input without sanitization. You inject an XML external entity that reads /etc/passwd and the content appears in the PDF. Which vulnerability is present?

Accepted Answer

XML External Entity (XXE). The vulnerability is XML External Entity (XXE) because the PDF generator parses user-supplied XML and resolves external entity references, allowing the attacker to read local files like /etc/passwd. The defining signature is the injection of a DOCTYPE declaration with an ENTITY that references a file:// or similar URI, and the content appearing in the output. This is the textbook XXE file-disclosure scenario.

Answer

Server-Side Request Forgery (SSRF)

Answer

Command injection

Answer

Cross-Site Scripting (XSS)

Question 6

A penetration tester has obtained a set of NTLM password hashes from a Windows domain controller. The tester wants to perform an offline cracking attack using GPU acceleration. Which tool is best suited for this purpose?

Accepted Answer

Hashcat. Hashcat is purpose-built for offline password cracking and is optimized for GPU acceleration via OpenCL and CUDA, supporting NTLM hashes with modes like '-m 1000'. It scales across multiple GPUs and offers rule-based, mask, and combinator attacks, making it the standard tool for high-speed offline cracking.

Answer

CrackMapExec

Answer

John the Ripper

Answer

Hydra

Question 7

Which of the following tools would best assist a penetration tester in identifying known vulnerabilities in a WordPress installation?

Accepted Answer

WPScan. WPScan is specifically designed to enumerate and identify vulnerabilities in WordPress installations, including outdated plugins, themes, and core files. It uses a comprehensive database of WordPress CVEs and security issues, making it the most targeted tool for this task.

Answer

OpenVAS

Answer

Nessus

Answer

Nikto

Question 8

A penetration tester has compromised a Windows host and wants to perform lateral movement using WMI. The tester has obtained local administrator credentials for the target host but wants to avoid writing files to disk. Which two methods can be used to execute commands remotely via WMI without creating files on the target? (Choose two.)

Accepted Answer

Using wmic /node:target process call create "cmd.exe /c ...". Two WMI-based methods for remote command execution without writing files to disk are using the wmic command-line tool with process call create, and using PowerShell's Invoke-WmiMethod to call Win32_Process Create. Both leverage WMI to spawn processes on the target. PsExec writes a service binary to disk, schtasks creates a scheduled task on disk, and WinRS uses WinRM, not WMI.

Answer

Using winrs -r:target cmd.exe

Answer

Using schtasks /create /s target /tn ... /tr ... /sc once /st ...

Answer

Using psexec.exe \target -accepteula cmd.exe

Question 9

A penetration tester is analyzing a web application and discovers that it uses a JSON Web Token (JWT) for session management. The tester captures a token and notices that the signature algorithm is 'none'. The application accepts tokens with the 'none' algorithm. Which type of vulnerability does this represent, and what is the immediate impact?

Accepted Answer

JWT signature bypass due to 'none' algorithm acceptance, enabling token forgery. Accepting JWTs with the 'none' algorithm means the application does not verify the token's integrity. An attacker can craft a token with any claims and set the algorithm to 'none', and the server will trust it. This is a critical authentication bypass. The immediate impact is that the tester can impersonate any user or escalate privileges by modifying the token payload. Proper validation should reject tokens with 'none' unless explicitly intended and secured.

Answer

Weak signing key vulnerability, allowing brute-force of the HMAC secret

Answer

Token replay attack due to lack of expiration validation

Answer

Algorithm confusion attack, allowing token forgery with arbitrary claims

Question 10

A penetration tester is conducting a red team engagement for a financial institution. The client has requested that the tester simulate a ransomware attack to test the incident response process. During the test, the tester encrypts a file share containing simulated customer data. The client's security team detects the encryption and initiates their incident response plan. Which of the following should the tester do FIRST to ensure the engagement remains within scope and does not cause operational disruption?

Accepted Answer

Immediately stop all testing activities and notify the primary point of contact. In a red team engagement, when the client's incident response team detects simulated malicious activity, the tester should immediately stop testing and notify the primary point of contact. This prevents unnecessary escalation and operational disruption, and confirms that the activity is authorized. Continuing the attack or exfiltrating data could exceed the scope and cause unintended consequences. Proactive communication is key to maintaining trust and safety.

Answer

Document the encryption activity and wait for the client's incident response team to contact the tester

Answer

Attempt to exfiltrate the simulated customer data to test data loss prevention controls

Answer

Continue encrypting additional file shares to fully simulate the ransomware attack

Question 11

A penetration tester is performing reconnaissance on a target web application. The tester wants to identify the web server software and version without causing any disruption. Which tool is specifically designed for this purpose and can also enumerate other web technologies?

Accepted Answer

WhatWeb. WhatWeb is specifically designed for web technology fingerprinting, including server software and version, CMS, and JavaScript libraries. It is non-intrusive and efficient for reconnaissance. Nmap is more general, Wireshark requires manual analysis, and Nikto focuses on vulnerabilities rather than enumeration.

Answer

Nikto

Answer

Wireshark

Answer

Nmap with the -sV flag

Question 12

A penetration tester is conducting a vulnerability assessment of a Linux web server. The tester runs a scan with Nikto and receives a finding indicating that the server is potentially vulnerable to a cross-site scripting (XSS) attack on a specific parameter. To confirm the finding, the tester wants to manually verify the XSS vulnerability. Which action should the tester take?

Accepted Answer

Use a web browser to inject a benign script payload into the parameter and observe if it executes. To confirm an XSS vulnerability, the tester must inject a script payload into the vulnerable parameter and observe if it executes in the context of the application. This manual verification is crucial because automated scanners like Nikto can produce false positives. Using a browser or an intercepting proxy to inject a benign alert script is the most direct and reliable method. It confirms that the application fails to sanitize input and that the payload is reflected or stored and executed.

Answer

Use a SQL injection tool like sqlmap to test the parameter for injection flaws

Answer

Run a full port scan with Nmap to check for open ports related to the web service

Answer

Perform a directory brute-force with Gobuster to find hidden files

Question 13

During an external penetration test, a tester needs to enumerate DNS records for a target domain to identify mail servers and potential subdomains. The tester has no credentials and wants to use a tool that queries DNS servers directly. Which tool is most appropriate for this task?

Accepted Answer

dnsrecon. dnsrecon is purpose-built for DNS enumeration, supporting queries for MX, NS, and other record types as well as zone transfer attempts and subdomain brute-forcing. It operates without credentials and directly queries DNS servers. The other tools serve unrelated functions such as packet capture, password cracking, or SQL injection exploitation and cannot perform the required DNS record discovery.

Answer

sqlmap

Answer

Wireshark

Answer

John the Ripper

Question 14

A penetration tester is conducting a wireless network assessment for a client. The client has provided a list of authorized SSIDs and MAC addresses of access points. During the assessment, the tester discovers a rogue access point that is not on the authorized list and is broadcasting a similar SSID to the corporate network. Which TWO of the following actions should the tester take? (Choose two.)

Accepted Answer

Notify the client's point of contact immediately about the rogue access point. When a rogue access point is discovered, the tester should document its details and notify the client's point of contact immediately. These actions provide the client with the necessary information to investigate and remove the rogue device, while adhering to the rules of engagement. Active countermeasures like deauthentication or DoS attacks should not be taken unless explicitly authorized. Connecting to the rogue AP could be risky and is generally not recommended.

Answer

Immediately deauthenticate all clients connected to the rogue access point

Answer

Attempt to connect to the rogue access point to determine its security configuration

Answer

Perform a denial-of-service attack to disable the rogue access point

Question 15

A penetration tester has gained access to a Windows domain controller and wants to extract Kerberos tickets from memory to perform a pass-the-ticket attack. Which tool and command should the tester use to list and export all Kerberos tickets from the current session?

Accepted Answer

mimikatz # sekurlsa::tickets /export. To perform pass-the-ticket, the tester needs to extract Kerberos tickets from memory. Mimikatz's sekurlsa::tickets module lists all tickets in the current session and can export them with /export. The exported .kirbi files can then be injected using kerberos::ptt. Other commands like kerberos::golden forge new tickets, lsadump::dcsync retrieves the KRBTGT hash, and sekurlsa::logonpasswords extracts passwords but not tickets.

Answer

mimikatz # lsadump::dcsync /user:krbtgt

Answer

mimikatz # sekurlsa::logonpasswords

Answer

mimikatz # kerberos::golden /user:Administrator /domain:example.com /sid:S-1-5-21-... /krbtgt:... /ticket:golden.kirbi

Question 16

A penetration tester obtains a low-privilege shell on a Linux host during an engagement. While enumerating, the tester finds a cron job that runs a script located in a world-writable directory as root every five minutes. Which action should the tester take to escalate privileges using this finding?

Accepted Answer

Modify the script in the world-writable directory to execute a reverse shell when the cron job runs. The exploitable condition is a scheduled task running as root that executes a file the low-privilege user can write. Overwriting that script causes the cron daemon to run attacker-controlled code with root privileges on the next interval. This directly converts the enumerated misconfiguration into elevated access, which is the intended outcome.

Answer

Search for SUID binaries and abuse one that permits arbitrary file reads

Answer

Run 'sudo -l' to list permitted commands and find a binary that can be abused for escalation

Answer

Read /etc/crontab to confirm the schedule and then wait for the job to run unmodified

Question 17

A penetration tester is preparing for a social engineering engagement. The client has requested that the tester attempt to gain access to the building by impersonating a delivery person. Which of the following should the tester obtain from the client before conducting the test?

Accepted Answer

A get-out-of-jail letter. For physical social engineering engagements, the tester must obtain a get-out-of-jail letter from the client. This document authorizes the tester to be on the premises and protects them from legal action if they are caught. It is essential for legal protection and should be carried at all times during the engagement. Other documents like NDAs or security policies do not provide this authorization.

Answer

A copy of the client's security policy

Answer

A non-disclosure agreement (NDA)

Answer

A list of employee names and phone numbers

Question 18

During an internal assessment, a penetration tester captures Kerberos traffic and identifies a service account whose SPN is registered but whose password was set years ago and never rotated. The tester wants to request a service ticket offline and crack it to recover the plaintext password. Which technique is the tester performing?

Accepted Answer

Kerberoasting, by requesting a TGS for the SPN and cracking the RC4-HMAC encrypted portion offline. Kerberoasting exploits the fact that any authenticated user may request a service ticket for a registered SPN, and the returned TGS is encrypted with the service account's key. Extracting and cracking that encrypted blob offline yields the plaintext password. The long-lived, unrotated password in the scenario is the classic enabling condition, making this the correct identification.

Answer

AS-REP roasting, by sending an AS-REQ without pre-authentication for a targeted account

Answer

Golden Ticket creation, by forging a TGT with the KRBTGT account hash

Answer

Pass-the-ticket, by injecting a stolen TGS into the current session for lateral movement

Question 19

A penetration tester is asked to assess whether an organization's employees can be tricked into revealing credentials. The client approves an assessment in which the tester registers a look-alike domain and sends emails directing staff to a fake login page. Which type of assessment is the tester conducting?

Accepted Answer

A phishing simulation targeting credential harvesting. The engagement uses a spoofed domain and a counterfeit login page delivered through email to induce employees to surrender credentials. That combination of social engineering and credential capture defines a phishing simulation. Its purpose is to quantify human risk and test the effectiveness of awareness training and email controls, which aligns exactly with the client's approved objective.

Answer

A wireless assessment targeting rogue access points

Answer

A vulnerability scan of the external attack surface

Answer

A physical intrusion test using tailgating techniques

Question 20

A penetration tester has compromised a Linux web server and wants to maintain persistent access by creating a new user account with a known password. The tester has root privileges. Which of the following commands will create a new user named 'support' with a home directory and a bash shell?

Accepted Answer

useradd -m -s /bin/bash support. The useradd command with -m and -s creates a new user with a home directory and specified shell. This is the standard low-level utility available on most Linux distributions. After creating the account, the tester would set a password using passwd. The other commands either modify existing users, use non-standard syntax, or are for password management only, making them unsuitable for creating a new persistent account.

Answer

passwd support --create --home /home/support --shell /bin/bash

Answer

adduser support --shell /bin/bash --home /home/support

Answer

usermod -aG support -d /home/support -s /bin/bash