PT0-002 Practice Test 7 — 10 Questions

Question 1

Match each compliance standard to its focus area.

Question 2

A client requires a penetration test of their web application that uses Single Sign-On (SSO) with a third-party identity provider. The client is concerned that testing could lock out real user accounts and disrupt operations. Which of the following should be included in the rules of engagement to address this concern?

Accepted Answer

Provide test accounts that are excluded from lockout policies. Option B is correct because providing test accounts that are excluded from lockout policies allows the penetration tester to thoroughly assess the SSO authentication mechanism—including the SAML or OIDC flows—without risking the lockout of real user accounts. This directly addresses the client's operational concern while still enabling comprehensive testing of the identity provider integration.

Answer

Prohibit all testing of the authentication mechanism

Answer

Only perform testing during business hours

Answer

Require the tester to use only passive reconnaissance techniques

Question 3

A client asks why a medium-severity finding should be remediated before a high-severity finding. The medium finding is internet-facing and actively exploited; the high finding is isolated in a lab subnet. What is the best explanation?

Accepted Answer

Prioritization should account for exposure and active exploitation, not only the scanner severity.. Option A is correct because risk-based prioritization must consider real-world factors like internet exposure and active exploitation, not just the CVSS base score. A medium-severity finding that is internet-facing and actively exploited poses a higher immediate risk to the organization than a high-severity finding isolated in a lab subnet, which has no external attack surface. This aligns with industry frameworks like CVSS environmental metrics and the FIRST CVSS v3.1 specification, which allow adjusting severity based on attack vector, complexity, and environmental context.

Answer

Medium findings must always be fixed before high findings.

Answer

The high finding should be ignored permanently because it is in a lab.

Answer

Only CVSS base score matters for remediation order.

Question 4

A penetration tester is conducting passive reconnaissance on a target organization. Which of the following techniques would provide the MOST useful information about internal network architecture without directly interacting with the target's systems?

Accepted Answer

Searching for the target's SSL certificates in Certificate Transparency logs. Certificate Transparency (CT) logs are publicly accessible, append-only ledgers of SSL/TLS certificates. By searching CT logs for certificates issued to the target organization, a penetration tester can discover subdomains, hostnames, and even internal-facing server names that are included in Subject Alternative Names (SANs) or Common Names (CNs). This reveals internal network architecture details (e.g., 'mail.internal.example.com') without any direct interaction with the target's systems, making it a purely passive reconnaissance technique.

Answer

Performing a zone transfer against the target's DNS servers

Answer

Using Nmap to scan common ports on the target's public IP range

Answer

Querying the target's WHOIS records for IP addresses

Question 5

A client wants a penetration test that includes social engineering attacks against employees. They request that the testing team not target the executive leadership team. What should be included in the rules of engagement to address this requirement?

Accepted Answer

A list of excluded users or groups, specifically the executive leadership team. Option A is correct because the rules of engagement (RoE) must explicitly define the scope and boundaries of the test. Including a list of excluded users or groups, specifically the executive leadership team, ensures that social engineering attacks are not directed at them, directly addressing the client's requirement. This is a standard scoping practice in penetration testing to prevent unintended consequences and maintain legal and ethical compliance.

Answer

The maximum number of phishing emails that can be sent

Answer

The time window for conducting social engineering activities

Answer

A description of the social engineering techniques that will be used

Question 6

A penetration tester has discovered a critical SQL injection vulnerability in a web application. The developer team will fix the issue. Which level of detail is most appropriate for this audience?

Accepted Answer

Include the full proof-of-concept code and the exact HTTP requests used.. Option B is correct because the developer team needs the exact technical details to reproduce and fix the vulnerability. Providing the full proof-of-concept code and exact HTTP requests allows developers to understand the injection point, the payload structure, and the vulnerable parameter, enabling them to implement a precise fix such as parameterized queries or input validation.

Answer

Provide the CVSS score and a brief description.

Answer

Describe the business impact in financial terms.

Answer

List all findings in a bullet-point summary without additional context.

Question 7

A penetration tester has completed the technical portion of a test and is now writing the executive summary. Which of the following is most important to include in this section to effectively communicate with senior management?

Accepted Answer

The total number of vulnerabilities found and their risk ratings, with a focus on business impact. The executive summary is intended for senior management, who need to understand the business impact of findings rather than technical details. Option B focuses on the total number of vulnerabilities, their risk ratings, and business impact, which directly aligns with management's decision-making needs. This ensures the report communicates risk in terms of potential financial or operational consequences, not just technical severity.

Answer

A detailed list of all tools and commands used during the test

Answer

Step-by-step instructions on how to reproduce the most critical vulnerability

Answer

The names of the penetration testers and their certifications

Question 8

A penetration tester has compromised a Windows workstation and obtained a low-privileged domain user account. The tester discovers that this user belongs to a group that has the 'GenericWrite' privilege over a computer object in Active Directory. Which attack is most directly enabled by this misconfiguration?

Accepted Answer

Shadow Credentials. The 'GenericWrite' privilege over a computer object allows the attacker to write to the msDS-KeyCredentialLink attribute of that object. By adding a rogue key credential, the attacker can trigger the Key Distribution Center (KDC) to accept a certificate-based authentication, enabling the Shadow Credentials attack to obtain a TGT for the computer account and escalate privileges.

Answer

Kerberoasting

Answer

AS-REP Roasting

Answer

DCSync Attack

Question 9

A penetration tester has gained a foothold on a Windows server and wants to move laterally to a domain controller. The tester has access to a service account that is a member of the 'Remote Management Users' group on the domain controller. Which of the following tools would be MOST appropriate for lateral movement in this scenario?

Accepted Answer

WinRM. WinRM (Windows Remote Management) is the most appropriate tool because the tester's service account is a member of the 'Remote Management Users' group on the domain controller, which grants explicit permission to connect via WinRM over HTTP/HTTPS (ports 5985/5986). This allows direct PowerShell remoting or winrs execution for lateral movement without requiring administrative privileges or additional exploits.

Answer

PsExec

Answer

MS16-075 exploit

Answer

BloodHound

Question 10

A penetration tester is analyzing a Bash script that uses 'curl' to send HTTP requests with payloads and checks for a specific string in the response. The script contains: 'if echo $response | grep -q "root:x:0:0"'. Which vulnerability is the script most likely testing for?

Accepted Answer

Local file inclusion. The script checks for the string 'root:x:0:0' in the HTTP response, which is the standard format of the root user entry in the /etc/passwd file on Unix-like systems. This indicates the script is testing whether the server is returning the contents of a local file (e.g., /etc/passwd) via a path traversal or file inclusion vulnerability, making Local File Inclusion (LFI) the correct answer.

Answer

SQL injection

Answer

Cross-site scripting

Answer

Remote code execution