PT0-002 Practice Exam 53 — 20 Questions

Question 1

A penetration tester has gained a foothold on a Windows host and wants to escalate privileges by abusing a misconfigured Windows service. Which TWO conditions would allow the tester to escalate privileges by replacing a service binary? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The service's executable path points to a directory where the tester has write permissions. Binary-replacement escalation requires the tester to influence which executable the service runs. That happens either when the service binary sits in a directory the tester can write to, or when an unquoted path with spaces lets Windows resolve a planted file from a writable earlier directory. Both conditions let attacker code execute in the service's privileged context, while the other options concern unrelated permissions or start settings.

Answer

The service is configured with a delayed automatic start type on a domain-joined host

Answer

The service runs under the NetworkService account with SeShutdownPrivilege enabled

Answer

The service's DACL grants the tester SERVICE_STOP and SERVICE_START but not SERVICE_CHANGE_CONFIG

Question 2

You have compromised a low-privileged Windows user and want to move laterally to a domain controller. Which THREE techniques could be used for lateral movement if you have valid credentials? (Select THREE.)

Accepted Answer

WMIExec. WMIExec (A) is correct because it leverages valid credentials to execute commands remotely over DCOM/WMI (typically via TCP 135 and dynamic RPC ports), enabling lateral movement to a domain controller without needing an interactive logon. Pass-the-Hash with CrackMapExec (C) is correct because it uses captured NTLM hashes with valid credentials to authenticate via SMB (and other protocols), allowing remote command execution and lateral movement across the domain. PsExec (E) is correct because it authenticates with valid credentials over SMB, copies a service binary to ADMIN$, and creates a remote service to execute commands on the target domain controller. Token impersonation with PrintSpoofer (B) is not a lateral movement technique with valid credentials; it is a local privilege escalation method that abuses the SeImpersonate privilege to gain SYSTEM on the already-compromised host. AS-REP roasting (D) is not lateral movement; it is a credential access technique that requests AS-REP messages for accounts without Kerberos pre-authentication to crack their passwords offline.

Answer

Token impersonation with PrintSpoofer

Answer

AS-REP roasting

Question 3

A contract prohibits DoS testing, but a tester finds a WAF that could be tested with a technique resembling slowloris. What is the best course of action?

Accepted Answer

Request a scope change to include DoS testing. The correct option is D: Request a scope change to include DoS testing. Slowloris is a denial-of-service technique that holds many partial HTTP connections open to exhaust the web server's connection pool, so testing it would violate the contract's explicit prohibition on DoS testing; the tester must obtain written authorization via a scope change before performing it. Option A is wrong because a buffer overflow is also an intrusive availability/exploitation test outside the authorized scope. Option B is wrong because proceeding with slowloris directly breaches the contract. Option C is wrong because even a single malformed HTTP request is unauthorized testing against a WAF that was not in scope.

Answer

Use a different technique, such as a buffer overflow

Answer

Proceed with a slowloris attack

Answer

Send a single malformed HTTP request and observe

Question 4

A penetration tester is hired to perform a security assessment of a small business. The business has a single website hosted on a shared server, and the tester wants to identify the content management system (CMS) and plugins used without sending any traffic that might alert the hosting provider. The tester has no previous knowledge of the website. Which of the following techniques would be BEST for this task?

Accepted Answer

Use the Wayback Machine to view cached historical pages. The correct answer is B: using the Wayback Machine to view cached historical pages. This is a passive reconnaissance technique that retrieves archived copies of the site from the Internet Archive's servers, so no traffic is sent to the target or its hosting provider, satisfying the requirement to avoid alerting anyone. It can reveal CMS fingerprints and plugin paths preserved in older snapshots even without prior knowledge of the site. Option A is wrong because an nmap TCP port scan sends packets directly to the target host and is active reconnaissance that could be logged. Option C is wrong because browsing the live site and viewing source generates direct requests to the shared server, which the hosting provider can observe. Option D is wrong because submitting the URL to OpenVAS causes the scanner to actively probe the target, generating detectable traffic.

Answer

Perform a full TCP port scan with nmap on the server's IP

Answer

Use the 'view page source' feature after browsing the site normally

Answer

Submit the website URL to a vulnerability scanner like OpenVAS

Question 5

During a penetration test, the tester discovers a critical vulnerability that could lead to a data breach. The tester needs to communicate this to the client's management, who are non-technical. What is the BEST way to communicate this finding?

Accepted Answer

High-level summary with business impact and recommended timeline for fix. Communicating a critical vulnerability to non-technical management requires translating the technical finding into business terms, so a high-level summary that states the business impact (e.g., potential data breach, regulatory exposure, financial loss) plus a recommended remediation timeline gives executives what they need to prioritize and authorize action. This approach aligns with standard penetration-test reporting practices such as those in PTES, where executive summaries convey risk and urgency without technical jargon. Option A fails because burying a critical finding only in the final report delays awareness and response. Option C is inadequate because an 'URGENT' email with no details provides no context for decision-making. Option D is inappropriate for a non-technical audience since detailed exploit steps belong in the technical section of the report, not in management communication.

Answer

Include the finding only in the final report

Answer

Email with subject 'URGENT' and no further details

Answer

Detailed technical exploit steps

Question 6

A penetration tester is writing a report and needs to classify vulnerabilities by risk level. The client has a formal risk acceptance process. Which of the following best describes the purpose of including a risk acceptance section in the report?

Accepted Answer

To record vulnerabilities the client has decided not to fix, with justification. Option B is correct because a risk acceptance section formally records vulnerabilities that the client has consciously chosen not to remediate, along with the business justification and any compensating controls, which aligns with the client's formal risk acceptance process. This section documents the client's informed decision to retain the residual risk rather than fix it. Option A is wrong because remediation instructions belong in the findings/remediation guidance, not the risk acceptance section. Option C is wrong because a tester's decision not to exploit a vulnerability relates to testing scope or methodology, not risk acceptance. Option D is wrong because documenting all vulnerabilities is the purpose of the findings section, not the risk acceptance section.

Answer

To provide step-by-step remediation instructions

Answer

To justify why the tester did not exploit certain vulnerabilities

Answer

To document all vulnerabilities found during the test

Question 7

During a penetration test, the tester discovers evidence of an ongoing criminal activity, such as unauthorized data exfiltration by an insider. The client's legal team has not provided specific guidance on handling such discoveries. According to best practices and legal considerations, what should the tester do first?

Accepted Answer

Stop testing and report the finding to the client immediately. The correct option is D: stop testing and report the finding to the client immediately. In penetration testing, when evidence of ongoing criminal activity such as unauthorized data exfiltration by an insider is discovered and the client's legal team has not provided specific guidance, the tester's first duty is to halt testing and notify the client so their legal counsel can decide how to proceed, preserving evidence and avoiding interference with a potential investigation. Continuing testing (A) risks destroying evidence or tipping off the insider, and contacting law enforcement directly (B) bypasses the client's authority and could violate the engagement contract or legal privilege. Ignoring the finding (C) is unethical and potentially illegal, as it conceals known criminal activity rather than escalating it through the proper client channel.

Answer

Continue testing to gather more evidence

Answer

Contact law enforcement directly

Answer

Ignore the finding as it is out of scope

Question 8

During an internal penetration test, a tester discovers that the client's network uses ARP poisoning to intercept traffic for security monitoring. The tester wants to enumerate live hosts without being detected by network monitoring tools. Which of the following is the BEST approach?

Accepted Answer

Use passive network sniffing to capture broadcast traffic. Passive network sniffing (option A) is correct because it captures existing broadcast traffic such as ARP requests, DHCP, and NetBIOS announcements without sending any packets, making it invisible to the ARP-poisoning-based monitoring and other network detection tools. Since the tester only listens promiscuously, no active probes are generated that could trigger alerts or be correlated by the monitoring system. UDP scans (B) and SYN scans with decoys (C) both send packets that the monitoring infrastructure can detect, and decoys may still be flagged as anomalous. ARP requests (D) are active probes that would be observed by the ARP-poisoning monitoring setup, defeating the goal of staying undetected.

Answer

Perform a UDP scan

Answer

Perform a SYN scan with decoys

Answer

Use ARP requests to discover hosts

Question 9

A tester runs a Python script to perform a directory traversal attack. The output shows: 'Error: 403 Forbidden'. What is the most likely cause?

Accepted Answer

The web server is patched against traversal attacks. The web server is patched against traversal attacks. A 403 Forbidden response means the server understood the request but is explicitly refusing to authorize it, which is exactly what happens when a web server (or WAF) detects path traversal sequences like ../ and blocks them as a security policy. If the file simply did not exist, the server would typically return 404 Not Found rather than 403, and a malformed request would usually produce 400 Bad Request. Missing authentication would normally yield 401 Unauthorized (or a redirect to a login page), not 403, so option A does not fit either.

Answer

The script lacks authentication

Answer

The file does not exist

Answer

The request is malformed

Question 10

During a penetration test of a corporate network, you discover a Linux server running a custom Python application that handles authentication for a web portal. The server is configured to allow SSH access only from a specific management subnet. You have obtained a limited shell on a different host within the same VLAN as the target server. From your limited shell, you can reach the target server on TCP port 22, but you do not have valid credentials. The Python authentication script uses a flat file database to store user credentials in the format 'username:hashed_password'. You suspect the script has a vulnerability that allows reading arbitrary files, such as the password file. Which of the following actions should you take to exploit this vulnerability?

Accepted Answer

Craft an HTTP request to the web portal's authentication script with a path traversal payload to read the password file. Option C is correct because the scenario describes a custom Python authentication script with a suspected arbitrary file read vulnerability, which is typically exploited by sending a crafted request (e.g., HTTP) containing a path traversal payload such as ../../etc/passwd or the flat-file credential database path to the vulnerable script endpoint. This directly leverages the identified flaw to retrieve the 'username:hashed_password' file rather than attacking SSH itself. Option A is wrong because SSH traffic is encrypted, so Wireshark cannot extract credentials from captured packets. Option B is wrong because port knocking only manipulates firewall rules to permit SSH connections and does not bypass the lack of valid credentials. Option D is wrong because Hydra brute-forcing SSH is a credential-guessing attack, not exploitation of the arbitrary file read vulnerability, and the same-VLAN position does not make brute-forcing the intended or reliable path.

Answer

Use Wireshark on the limited shell to capture SSH traffic and extract credentials

Answer

Perform a port knocking sequence to open SSH access to the target server

Answer

Use Hydra to brute-force SSH credentials from the limited shell because it is on the same VLAN

Question 11

Which tool is best for performing static analysis of Python code to find security vulnerabilities?

Accepted Answer

Bandit. Bandit (option C) is the correct tool because it is a purpose-built static application security testing (SAST) tool that parses Python source code into an AST and flags insecure patterns such as use of eval, weak hashing like MD5, hardcoded passwords, and subprocess shell=True. It integrates directly into Python projects and CI pipelines (e.g., via pip install bandit and running bandit -r .), making it ideal for finding vulnerabilities without executing the code. sqlmap (A) is a dynamic SQL injection exploitation tool, nmap (B) is a network port and service scanner, and Metasploit (D) is an exploitation framework — all operate against running systems rather than analyzing Python source statically.

Answer

sqlmap

Answer

nmap

Answer

Metasploit

Question 12

Which of the following is the MOST appropriate format for delivering the final penetration test report to the client?

Accepted Answer

PDF with password protection and digital signature.. A PDF with password protection and digital signature ensures the penetration test report is delivered confidentially, tamper-evident, and verifiably authentic to the client. Password protection restricts access to authorized recipients, while the digital signature provides integrity and non-repudiation, which are critical for sensitive security findings. In contrast, an HTML file hosted on the tester's website (A) exposes the report publicly and lacks access control, a plain text file (B) offers no confidentiality or authenticity protections, and a Word document with tracked changes (C) may inadvertently reveal internal edits, comments, or metadata and is easily altered.

Answer

HTML file hosted on the tester's website.

Answer

Plain text file with no formatting.

Answer

Microsoft Word document with tracked changes.

Question 13

A penetration tester is writing a report that includes a vulnerability with a CVSS score of 9.8. The client's security team argues that the score should be lower due to compensating controls. How should the tester respond in the report?

Accepted Answer

Report the base CVSS score and include a note about the compensating controls. The correct response is A: report the base CVSS score and include a note about the compensating controls. CVSS base scores are intrinsic to the vulnerability itself and do not account for environmental or compensating controls, so the 9.8 base score should remain unchanged in the report. Compensating controls are instead reflected through the CVSS temporal and environmental metric groups (e.g., Environmental score via modified impact and exploitability metrics), which can be documented separately. Option B is wrong because the tester should not simply defer the scoring decision to the client, and CVSS scores are not adjusted by client preference. Option C is incorrect because omitting the CVSS score removes valuable, standardized severity information. Option D is incorrect because arbitrarily lowering the base score misrepresents the vulnerability and violates CVSS methodology.

Answer

Report both scores and let the client decide

Answer

Remove the CVSS score entirely to avoid disagreement

Answer

Adjust the CVSS score lower to reflect the client's compensating controls

Question 14

Which TWO of the following are key components that should be included in an executive summary of a penetration test report? (Select TWO.)

Accepted Answer

Overall risk score or security posture rating.. Option C is correct because an executive summary should convey the overall risk score or security posture rating, giving leadership a single, quantified indicator of how well the organization's security controls performed during the engagement. Option D is correct because the executive summary must present a high-level summary of findings along with their risk ratings, translating technical issues into business-relevant impact without diving into exploit mechanics. Options A, B, and E do not belong: a liability disclaimer is typically placed in the report's introductory or legal section rather than the executive summary, detailed step-by-step exploitation procedures belong in the technical findings/attack narrative section for remediation teams, and full command-line tool output is raw technical evidence that belongs in appendices, not a management-facing summary.

Answer

Disclaimer of liability for the testing company.

Answer

Detailed step-by-step exploitation procedures.

Answer

Full command-line output from penetration testing tools.

Question 15

Refer to the exhibit. A penetration tester performed an Nmap scan of a target server and received the above output. The tester recalls that one of these services is associated with a well-known remote code execution vulnerability that can be exploited without authentication. Which service is most likely vulnerable?

Accepted Answer

Microsoft-DS (port 445). Microsoft-DS on port 445, because SMBv1 (the service typically exposed on TCP 445) is associated with the well-known, unauthenticated remote code execution vulnerability EternalBlue (MS17-010), which was exploited by WannaCry and NotPetya. An Nmap scan showing Microsoft-DS on 445 should immediately raise this concern, since exploitation requires no credentials and can yield SYSTEM-level code execution. HTTP on port 80 (A) may host web vulnerabilities, but it is not tied to a single well-known unauthenticated RCE in the way SMBv1 is. SSH on port 22 (B) is an encrypted remote-login service that requires authentication and is not associated with an unauthenticated RCE of this kind. ms-wbt-server on port 3389 (D) is RDP, which is normally protected by authentication and credentials, so it does not fit the 'without authentication' criterion.

Answer

HTTP (port 80)

Answer

SSH (port 22)

Answer

ms-wbt-server (port 3389)

Question 16

The scope allows only Nmap, but it is ineffective against heavy packet filtering. The tester wants to use an alternate tool. What should the tester do?

Accepted Answer

Request approval from the client to use a different tool. Request approval from the client to use a different tool. Since the scope explicitly limits testing to Nmap, using any other tool would violate the agreed rules of engagement, so the tester must obtain written client authorization before substituting a different tool. Options B and D are wrong because they either bypass the scope restriction or continue with the ineffective Nmap approach without addressing the filtering problem. Option C is also incorrect because the engagement is not necessarily untestable—an approved alternate tool could still accomplish the objectives.

Answer

Use the alternate tool and note it in the report

Answer

Abort the scan and report that the network is not testable

Answer

Use Nmap with different parameters

Question 17

After completing a penetration test, a tester needs to dispose of test data securely. Which of the following methods is most appropriate for this purpose?

Accepted Answer

Use a secure data destruction tool that overwrites data multiple times. A secure data destruction tool that overwrites the data multiple times (e.g., using multi-pass overwrite algorithms like DoD 5220.22-M or Gutmann) renders the original test data unrecoverable, which is the goal of secure disposal after a penetration test. Standard deletion (A) only removes file system references, leaving data recoverable with forensic tools, and a single format (C) likewise does not guarantee the underlying blocks are wiped. Keeping the data encrypted (D) is not disposal at all and retains sensitive test data, creating ongoing confidentiality and compliance risk.

Answer

Delete the data using standard operating system commands

Answer

Format the storage device once

Answer

Keep the data encrypted for future reference

Question 18

A wireless network test must not disrupt the network. How can the tester crack WPA2 passwords without disruption?

Accepted Answer

Use passive sniffing to capture traffic and crack offline. Passive sniffing captures the WPA2 4-way handshake (or PMKID) from normal client traffic without sending any frames, and the captured handshake is then cracked offline against a wordlist, so the live network is never disrupted. This satisfies the requirement that the test must not disrupt the network. Option A, scanning for rogue access points, is a discovery activity and does not crack WPA2 passwords. Option C, a deauthentication attack, forcibly disconnects clients and is inherently disruptive. Option D, an online brute-force attack against the Wi-Fi password, would generate authentication attempts against the AP, which is disruptive and also impractical due to WPA2's key derivation.

Answer

Scan for rogue access points

Answer

Perform a deauthentication attack

Answer

Attempt a brute-force attack against the Wi-Fi password

Question 19

A penetration tester is preparing the executive summary of a penetration test report. Which of the following BEST describes the primary audience and appropriate level of technical detail?

Accepted Answer

High-level findings and business impact for management and executives.. Option B is correct because the executive summary is written for management and executives, who need high-level findings and business impact rather than technical minutiae. This audience typically lacks deep technical background and focuses on risk, cost, and strategic decisions, so the summary should translate technical issues into business consequences. Option A is wrong because a methodology narrative for other penetration testers belongs in the technical body of the report, not the executive summary. Option C is wrong because detailed technical analysis for system administrators is also part of the technical sections, not the executive-level overview. Option D is wrong because step-by-step exploitation procedures for developers are highly technical content inappropriate for an executive summary.

Answer

A narrative of the testing methodology for other penetration testers.

Answer

Detailed technical analysis for system administrators.

Answer

Step-by-step exploitation procedures for developers.

Question 20

A web application test must cover OWASP Top 10. Which THREE should be explicitly included? (Choose three.)

Accepted Answer

SQL injection testing. SQL injection testing (A) is explicitly required because injection flaws, including SQL injection, are a core OWASP Top 10 category (A03:2021 Injection) and must be tested by manipulating input fields and parameters to confirm the application safely handles untrusted data. Cross-site scripting (XSS) testing (C) is also explicitly required because XSS falls under the OWASP Top 10 injection category and involves verifying that user-supplied input is properly encoded or escaped in HTML, JavaScript, and attribute contexts. Broken authentication testing (E) is explicitly required because broken authentication is its own OWASP Top 10 category (A07:2021 Identification and Authentication Failures) and covers weak credential handling, session management flaws, and missing multi-factor authentication. Directory traversal testing (B) is not one of the OWASP Top 10 categories, although it may be tested as part of broader access control or misconfiguration checks. Buffer overflow testing (D) is not an OWASP Top 10 category either; it is primarily a memory-safety concern more relevant to native applications than typical web application testing.

Answer

Directory traversal testing

Answer

Buffer overflow testing