PT0-002 Practice Test 8 — 10 Questions

Question 1

A penetration tester wants to perform a slow and stealthy port scan to avoid intrusion detection systems. Which Nmap option should be used?

Accepted Answer

-T0. The -T0 option sets the timing template to Paranoid, which is extremely slow and avoids IDS detection. -O is for OS detection, -sV for version detection, and -A for aggressive scan.

Answer

-O

Answer

-A

Answer

-sV

Question 2

A penetration tester is presenting findings to a group of executives. Which of the following is the most effective way to communicate a critical vulnerability?

Accepted Answer

Describe the vulnerability in terms of potential financial and reputational damage.. Executives need to understand business impact, not technical details. Use business language and focus on risk.

Answer

Recommend specific code changes without context.

Answer

Explain the technical exploit steps in detail.

Answer

Show raw network captures as evidence.

Question 3

A penetration tester is preparing a report for a client that includes both a technical security team and an executive leadership team. The executive team needs to understand the overall risk posture, while the technical team requires detailed reproduction steps. Which reporting structure best serves both audiences?

Accepted Answer

A single report with an executive summary and technical appendices. A single report with an executive summary and technical appendices is the correct structure because it satisfies both audiences: the executive summary provides a high-level risk posture overview (e.g., CVSS scores, business impact), while the technical appendices contain detailed reproduction steps (e.g., exact commands, payloads, and packet captures) for the technical team. This approach aligns with the PT0-002 objective of tailoring communication to stakeholders without losing technical rigor.

Answer

Two completely separate reports: one for executives and one for technical staff

Answer

Only an executive summary, omitting technical details

Answer

Only a technical report with all details

Question 4

A penetration tester is performing a cloud security audit of an AWS environment. Which tool is specifically designed for AWS exploitation and post-exploitation, including privilege escalation and persistence?

Accepted Answer

Pacu. Pacu is an AWS exploitation framework that provides modules for enumeration, privilege escalation, and persistence.

Answer

CrackMapExec

Answer

ScoutSuite

Answer

Prowler

Question 5

Which legal framework in the United States prohibits unauthorized access to computer systems and is commonly referenced in penetration testing authorization documents?

Accepted Answer

CFAA. The Computer Fraud and Abuse Act (CFAA) is the primary U.S. law against unauthorized computer access.

Answer

HIPAA

Answer

GLBA

Answer

SOX

Question 6

A penetration tester is contracted to perform a grey box test of a company's internal network. The client provides a VPN account for remote access but does not disclose that the account has been used by a former employee. The tester connects and is immediately locked out. Which pre-engagement document should have addressed this scenario?

Accepted Answer

Rules of Engagement (RoE). The rules of engagement (RoE) should specify the accounts and credentials provided, including any limitations or known issues.

Answer

Emergency contact list

Answer

Data handling agreement

Answer

Statement of Work (SOW)

Question 7

A penetration tester is tasked with performing active reconnaissance on an internal network. The tester wants to identify live hosts and their open ports efficiently while minimizing noise. Which Nmap scan type should be used first to quickly discover which hosts are online?

Accepted Answer

nmap -sn 192.168.1.0/24. The `-sn` flag (ping scan) sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default to determine if hosts are online without performing port scans. This minimizes network noise and quickly identifies live hosts on the subnet, which is the first step in active reconnaissance before deeper scanning.

Answer

nmap -sS -sV 192.168.1.0/24

Answer

nmap -A 192.168.1.0/24

Answer

nmap -sT 192.168.1.0/24

Question 8

A penetration tester is examining a compiled binary obtained during an engagement. The tester wants to identify potential buffer overflow vulnerabilities and understand the control flow. Which TWO tools would be most appropriate for this task?

Accepted Answer

OllyDbg. OllyDbg is a debugger that allows dynamic analysis to identify overflow vulnerabilities by examining memory and registers. Ghidra is a disassembler and decompiler that provides static analysis of control flow and potential vulnerabilities. Nmap is a network scanner, Wireshark is a packet analyzer, and Burp Suite is a web proxy, none of which are suitable for binary analysis.

Answer

Wireshark

Answer

Nmap

Answer

Burp Suite

Question 9

A penetration tester is performing a full-scope engagement and needs to identify potential privilege escalation vectors on a Windows system. Which TWO of the following are valid Windows privilege escalation techniques?

Accepted Answer

Unquoted service path exploitation. Unquoted service paths and AlwaysInstallElevated are both valid Windows privilege escalation techniques. Kerberoasting and pass-the-hash are for credential access, not local escalation; SUID/SGID is Linux.

Answer

Pass-the-hash

Answer

Kerberoasting

Answer

SUID/SGID binary exploitation

Question 10

A penetration tester is using Hashcat to crack NTLM hashes obtained from a Windows system. The tester wants to use a rule-based attack to maximize cracking success. Which Hashcat mode should be used for NTLM hashes?

Accepted Answer

-m 1000. Hashcat mode -m 1000 is specifically designated for NTLM hashes, which are the Windows NT LAN Manager hash format stored in the SAM database. A rule-based attack with this mode applies transformation rules to wordlists to generate candidate passwords, maximizing cracking success by leveraging common password patterns and mutations.

Answer

-m 1100

Answer

-m 3000

Answer

-m 5500