PT0-002 Practice Test 8 — 10 Questions

Question 1

A penetration tester is exploiting a Linux system that has ASLR enabled but no stack canaries. The vulnerability is a classic stack-based buffer overflow. Which of the following is the most effective method to achieve code execution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Return to the PLT entry for system(). With ASLR enabled, direct shellcode injection fails due to randomized stack addresses, but the PLT entry for system() has a fixed, known address in the binary. Since there are no stack canaries, a simple buffer overflow can overwrite the return address to jump directly to system() in the PLT, passing a pointer to a command string (e.g., "/bin/sh") already in memory, achieving code execution without needing to know runtime addresses.

Answer

Prepend a NOP sled and inject shellcode into the buffer

Answer

Return-to-libc (ret2libc)

Answer

Use a ROP chain to bypass ASLR and execute shellcode

Question 2

A penetration tester has obtained a TGT from a domain controller by cracking the krbtgt hash. Which attack can the tester now perform to gain persistent administrative access to any resource in the domain?

Accepted Answer

Golden Ticket. A Golden Ticket attack is the correct answer because the tester has cracked the krbtgt hash, which is the key used by the Key Distribution Center (KDC) to sign all Ticket Granting Tickets (TGTs). With this hash, the tester can forge a TGT for any user (including a domain admin) with an arbitrary long validity period, granting persistent administrative access to any resource in the domain without needing to interact with the domain controller again.

Answer

Pass-the-Hash

Answer

Silver Ticket

Answer

DCSync

Question 3

During a penetration test, a tester has access to a Windows domain-joined machine. The tester finds that the machine is running a service that uses named pipes for interprocess communication. The tester wants to perform a relay attack to capture authentication credentials. Which of the following conditions is necessary for an SMB relay attack to succeed?

Accepted Answer

SMB signing must be disabled or not enforced. SMB relay attacks work by intercepting an authentication attempt and forwarding it to a target server. For the relay to succeed, the target server must not require SMB signing, because signing ensures that the relayed authentication packet is cryptographically bound to the original session, preventing the attacker from replaying it. When SMB signing is disabled or not enforced, the relayed authentication is accepted as valid, allowing credential capture.

Answer

The attacker must be on the same subnet

Answer

The target must have a publicly available SMB share

Answer

The attacker must have admin privileges on the relay machine

Question 4

A penetration tester is performing internal reconnaissance on a network that uses IPv6. The tester wants to discover alive hosts and their IPv6 addresses without sending many packets. Which technique is most effective for this purpose?

Accepted Answer

Ping the IPv6 all-nodes multicast address (ff02::1) and analyze the responses to discover active hosts. Sending a ping to the IPv6 all-nodes multicast address (ff02::1) triggers a response from all active hosts on the local link that have IPv6 enabled, allowing the tester to discover alive hosts and their IPv6 addresses with minimal packets. This technique leverages the inherent multicast behavior of IPv6, where hosts join the all-nodes multicast group by default, making it highly efficient for reconnaissance without scanning each address individually.

Answer

Perform a full TCP SYN scan on the entire /64 subnet using Nmap with IPv6 addressing

Answer

Request the DHCPv6 server log from the network administrator to obtain a list of assigned IPv6 addresses

Answer

Use the `ip neighbor` command on the tester's machine to view the IPv6 neighbor cache after generating traffic

Question 5

A penetration tester is performing reconnaissance on a target domain. The tester queries the public DNS records and finds an SPF record that includes an 'include' mechanism pointing to a third-party email service. Which technique can the tester use to potentially discover more subdomains or internal infrastructure?

Accepted Answer

Query the TXT records of the third-party domain. The SPF record's 'include' mechanism points to a third-party email service, which itself may have SPF or other TXT records that reveal additional domains or subdomains used for email infrastructure. By querying the TXT records of the third-party domain, the tester can discover these included domains, potentially expanding the attack surface. This technique leverages the recursive nature of SPF includes to map out related infrastructure.

Answer

Perform a DNS zone transfer

Answer

Enumerate MX records for the third-party

Answer

Use Google dorks to find exposed email addresses

Question 6

A penetration tester discovers that a web application uses a vulnerable Java deserialization endpoint. The classpath includes the Apache Commons Collections library. Which attack technique is most likely to achieve remote code execution?

Accepted Answer

Java deserialization of untrusted data (RCE via Commons Collections).. The presence of the Apache Commons Collections library in the classpath, combined with a vulnerable Java deserialization endpoint, enables the classic 'gadget chain' attack. Attackers craft a malicious serialized object that, when deserialized, invokes methods in Commons Collections (e.g., InvokerTransformer) to execute arbitrary system commands, achieving remote code execution (RCE). This is a well-documented exploit chain (e.g., CVE-2015-7501) that directly leverages the library's reflection-based classes.

Answer

SQL injection.

Answer

Cross-site scripting.

Answer

Command injection.

Question 7

During a penetration test, the tester identifies a low-risk information disclosure vulnerability in a public-facing web server. The tester includes this finding in the final report. Which component of the risk rating should the tester use to justify the low severity?

Accepted Answer

CVSS base score. The CVSS base score is the correct component to justify the low severity because it represents the intrinsic and fundamental characteristics of a vulnerability that are constant over time and across user environments. In this case, the information disclosure vulnerability has a low base score due to factors such as low attack complexity and low impact on confidentiality, which are captured in the base metrics. The base score is the standard starting point for communicating severity, making it the appropriate justification for the low-risk rating in the report.

Answer

Exploitability metrics

Answer

Impact metrics

Answer

Temporal score

Question 8

A penetration testing firm is contracted to test a cloud-based infrastructure. The client uses a shared responsibility model. Which of the following should be clarified in the rules of engagement to avoid legal issues?

Accepted Answer

Whether the tester needs authorization from the cloud provider. In a shared responsibility model, the cloud provider is responsible for the security of the cloud, while the customer is responsible for security in the cloud. However, penetration testing activities may violate the cloud provider's terms of service or acceptable use policy, potentially triggering legal action. Therefore, obtaining explicit authorization from the cloud provider is critical to ensure the tester's actions are legally permitted and to avoid liability for unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA).

Answer

Who is responsible for patching the operating system

Answer

The encryption method for data at rest

Answer

The backup strategy for logs

Question 9

A client wants to test a web application that uses multiple third-party APIs for payment processing, shipping, and customer relationship management. The client states that the APIs are critical for operations but cannot be taken offline. Which scoping consideration is most important to include in the rules of engagement?

Accepted Answer

The tester must use only non-intrusive scanning techniques on the APIs.. The client explicitly stated that the APIs are critical for operations and cannot be taken offline. Non-intrusive scanning techniques, such as passive traffic analysis or read-only API calls with safe HTTP methods (GET, HEAD), minimize the risk of service disruption, data corruption, or rate-limit triggering. This aligns with the scoping requirement to maintain availability while still allowing security testing of the API layer.

Answer

The tester must exclude all API endpoints from testing.

Answer

The tester must coordinate testing schedules with the API vendors.

Answer

The tester must provide a list of all API calls to be made prior to testing.

Question 10

A penetration tester is conducting passive reconnaissance on a target organization. The tester wants to identify the technologies and frameworks used by the target's web application without making any requests to the target's servers. Which resource is BEST suited for this task?

Accepted Answer

BuiltWith.com. BuiltWith.com is a passive reconnaissance resource that profiles web application technologies by analyzing publicly available data, such as JavaScript libraries, web frameworks, and analytics tools, without sending any requests to the target's servers. It aggregates information from various public sources and historical data, making it ideal for identifying technologies without direct interaction.

Answer

Nmap service scan with -sV

Answer

Shodan.io

Answer

Wappalyzer browser extension