PT0-002 Practice Test 7 — 10 Questions

Question 1

During a vulnerability scan of a web application, a tester receives an HTTP response with a '405 Method Not Allowed' error when trying to use a PUT request. What does this indicate about the web server's configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The server blocks the PUT method for that specific URI.. A 405 Method Not Allowed error indicates that the server recognized the PUT method as valid but has explicitly disallowed it for the requested URI. This is a server-level access control configuration, often enforced via web server directives (e.g., Apache's `<LimitExcept>` or IIS's request filtering) or application-level routing rules. The tester's PUT request reached the server and was processed, but the server's configuration prevented it from being fulfilled for that specific endpoint.

Answer

The PUT method is allowed but the resource does not exist.

Answer

The server does not support the PUT method.

Answer

The request was malformed and rejected.

Question 2

A penetration tester is conducting information gathering on a target organization. The tester discovers a public code repository that contains configuration files with embedded credentials. Which of the following is the BEST next step?

Accepted Answer

Notify the organization's security team of the exposed credentials.. The tester has discovered exposed credentials in a public code repository, which is a critical security finding that requires immediate disclosure to the organization's security team. Ethical penetration testing mandates that any discovered vulnerabilities, especially those involving credential exposure, be reported promptly to prevent unauthorized access and potential data breaches. Proceeding with further exploitation without authorization violates the rules of engagement and could cause legal or operational harm.

Answer

Attempt to crack the passwords to gain further access.

Answer

Document the findings and proceed with passive reconnaissance.

Answer

Use the credentials to log into the target system immediately.

Question 3

A penetration tester runs the following command: nmap -sS -p 1-65535 -T4 -A -O --reason target. What is the primary purpose of the -A option in this command?

Accepted Answer

Enables OS detection, version detection, script scanning, and traceroute.. The -A option in nmap is a composite flag that enables OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (--traceroute) in a single switch. This is explicitly documented in nmap's man page and is designed to provide comprehensive reconnaissance in one command, making option A correct.

Answer

Sets the timing template to aggressive (level 4).

Answer

Enables aggressive scanning that is more likely to be detected by the target.

Answer

Performs a SYN (half-open) scan.

Question 4

A penetration tester is tasked with performing passive reconnaissance against a client without triggering any alerts. Which of the following techniques would be MOST appropriate?

Accepted Answer

Shodan search. Shodan is a search engine that indexes banners from internet-facing devices, allowing a penetration tester to gather information about a client's exposed services (e.g., open ports, software versions) without sending any packets to the target. This makes it a purely passive technique that will not trigger any alerts on the client's network or intrusion detection systems.

Answer

Nmap SYN scan

Answer

Brute-force login

Answer

Netcat banner grab

Question 5

A penetration tester needs to escalate privileges on a Linux system and finds that the user can run a script with sudo that has a vulnerable argument. Which resource should the tester consult to find exploitation techniques for common sudo misconfigurations?

Accepted Answer

GTFOBins. GTFOBins is a curated list of Unix binaries that can be exploited to bypass local security restrictions, including sudo misconfigurations.

Answer

Exploit-DB

Answer

Metasploit

Answer

CVE Details

Question 6

Refer to the exhibit. A penetration tester sends the request and receives the response shown. Which vulnerability is confirmed?

Accepted Answer

Reflected cross-site scripting. The response includes the parameter value 'John' reflected directly in the HTML body without sanitization or encoding, and the request uses an HTTP GET method. This confirms a reflected cross-site scripting (XSS) vulnerability, as the tester can inject arbitrary JavaScript by modifying the 'name' parameter, which will execute in the victim's browser.

Answer

Server-side request forgery

Answer

Cross-site request forgery

Answer

SQL injection

Question 7

During a penetration test, a tester needs to perform a man-in-the-middle attack on a network that uses WPA2-Enterprise with PEAP. Which tool is most appropriate for capturing the authentication handshake to attempt offline cracking?

Accepted Answer

hostapd-wpe. hostapd-wpe (Wireless Pwnage Edition) is specifically designed to set up a rogue access point that impersonates a legitimate WPA2-Enterprise network. It captures the MSCHAPv2 challenge-response from the PEAP authentication handshake, which can then be used for offline dictionary or brute-force attacks against the user's credentials. Unlike other tools, hostapd-wpe handles the full EAP/PEAP exchange required for this attack.

Answer

Wireshark

Answer

aircrack-ng

Answer

Ettercap

Question 8

A penetration tester is performing a password attack on a Windows domain and has captured NTLM hashes. Which tool can be used to perform a pass-the-hash attack to gain remote code execution on a target system?

Accepted Answer

pth-winexe. pth-winexe is a tool specifically designed for pass-the-hash attacks to execute commands on remote Windows systems.

Answer

Hashcat

Answer

Responder

Answer

John the Ripper

Question 9

Which of the following tools would a penetration tester most likely use to perform passive reconnaissance on a target domain?

Accepted Answer

theHarvester. theHarvester is a passive reconnaissance tool that gathers information from public sources such as search engines, PGP key servers, and the Shodan API without directly interacting with the target domain. It collects email addresses, subdomains, IPs, and employee names using OSINT (Open Source Intelligence) techniques, making it ideal for passive information gathering.

Answer

Wireshark

Answer

Nmap

Answer

Metasploit

Question 10

A penetration tester is conducting passive reconnaissance on a target organization. Which technique can be used to discover subdomains of the target's domain without sending any packets to the target's network?

Accepted Answer

Using the 'site:' operator in a search engine query. Using the 'site:' operator in a search engine query (e.g., 'site:example.com') retrieves indexed subdomains from the search engine's cache without sending any packets to the target's network. This is a purely passive technique that leverages publicly available data, aligning with the definition of passive reconnaissance.

Answer

Performing a DNS brute-force attack against the target's domain

Answer

Sending ICMP echo requests to potential subdomain IP addresses

Answer

Querying WHOIS databases for domain registration information