PT0-002 Practice Test 8 — 10 Questions

Question 1

A penetration tester has successfully exploited a buffer overflow vulnerability in a Linux binary. However, the binary has Data Execution Prevention (DEP) enabled and Address Space Layout Randomization (ASLR) disabled. Which exploitation technique is MOST appropriate to achieve code execution in this environment?

Accepted Answer

Return-oriented programming (ROP) to bypass DEP. Return-oriented programming (ROP) is the most appropriate technique because DEP marks the stack and heap as non-executable, preventing direct shellcode injection. With ASLR disabled, the attacker can reliably locate and chain small instruction sequences (gadgets) from the binary or loaded libraries to achieve arbitrary code execution without needing executable memory regions.

Answer

Simple shellcode injection on the stack

Answer

ASLR bypass techniques

Answer

Heap spraying

Question 2

A penetration tester is analyzing a PowerShell script used during an internal test. The script contains the following code block: ```powershell $cred = Get-Credential $session = New-PSSession -ComputerName 'Server01' -Credential $cred Invoke-Command -Session $session -ScriptBlock { Get-ChildItem C:\Secrets.txt } Remove-PSSession $session ``` What is the primary purpose of this script?

Accepted Answer

To achieve lateral movement and access a file on a remote server. The script uses Get-Credential to obtain user credentials, creates a remote PowerShell session (PSSession) to Server01 via New-PSSession, and then executes Get-ChildItem C:\Secrets.txt on that remote server using Invoke-Command. This is the classic pattern for lateral movement: authenticating to a remote host and accessing a file stored there, not performing any local privilege escalation or password brute-forcing.

Answer

To perform a local privilege escalation using stored credentials

Answer

To brute-force the password of the user account via 'Get-Credential'

Answer

To execute a script from the remote server using the ScriptBlock

Question 3

A penetration tester is analyzing a Python script that uses the 'scapy' library. The script contains the line: `packet = IP(dst='10.0.0.1')/TCP(dport=80, flags='S')`. The tester then uses `sr1(packet, timeout=2)`. What is the primary purpose of this code?

Accepted Answer

Perform a TCP SYN scan to determine if port 80 is open. The code constructs an IP packet with destination 10.0.0.1 and a TCP segment with destination port 80 and the SYN flag set (flags='S'). The sr1() function sends this packet and waits for a response (up to 2 seconds). This is the classic technique for a TCP SYN scan: if a SYN-ACK is received, the port is open; if an RST is received, the port is closed. The primary purpose is therefore to probe whether port 80 on the target is open.

Answer

Perform a DNS resolution for the target IP

Answer

Send a TCP ACK packet to test firewall rules

Answer

Complete a full TCP three-way handshake

Question 4

A penetration tester is analyzing the results of a vulnerability scan against a web application. The scanner reports a potential SQL injection vulnerability in a login form parameter. However, manual testing with the same payload does not produce any error messages or changes in behavior. Which of the following is the most likely reason for the false positive?

Accepted Answer

The web application is using a parameterized query that sanitizes input. Option B is correct because the use of parameterized queries (prepared statements) separates SQL logic from user input, preventing SQL injection even if the input contains malicious payloads. The scanner's payload triggered a false positive because the application's database layer safely handles the input, so no error or behavioral change occurs during manual testing.

Answer

The scanner used a payload that was not URL-encoded

Answer

The scanning engine is outdated and does not support the latest SQL syntax

Answer

The login form is protected by a CAPTCHA that blocks automated scanning

Question 5

A penetration tester is compiling the final report. The client's compliance officer requires a section that maps each finding to specific regulatory requirements (e.g., PCI DSS, HIPAA). Which section of the report is best suited for this mapping?

Accepted Answer

Compliance Mapping. The Compliance Mapping section is specifically designed to cross-reference each technical finding with relevant regulatory frameworks such as PCI DSS, HIPAA, or GDPR. This allows the compliance officer to quickly verify that all required controls are addressed and that the report meets audit or legal standards. The other sections focus on summarizing or detailing technical issues, not on mapping findings to specific regulations.

Answer

Executive Summary

Answer

Technical Findings

Answer

Appendices

Question 6

A penetration tester is attempting to exploit a Linux system that has ASLR and DEP enabled. The tester has identified a buffer overflow vulnerability in a network service compiled without stack canaries and with a non-executable stack (NX). The binary is statically linked and not PIE. Which exploitation technique is most likely to succeed under these conditions?

Accepted Answer

Return-Oriented Programming (ROP) to call mprotect and then execute shellcode on the stack. Option C is correct because the binary is statically linked (no libc to return to) and has a non-executable stack (NX), so shellcode cannot execute directly on the stack. Return-Oriented Programming (ROP) allows the attacker to chain gadgets from the binary itself to call mprotect() and change the stack region to executable, then pivot to shellcode placed on the stack. Since ASLR is enabled but the binary is not PIE, its code base address is fixed, making ROP gadgets reliably addressable.

Answer

Heap spraying to place shellcode in the heap and then overwrite a function pointer to execute the shellcode

Answer

Return-to-libc attack using libc functions

Answer

Ret2plt to call system() via the PLT

Question 7

A penetration tester is performing internal reconnaissance. The tester discovers that the internal DNS server allows recursive queries from the tester's machine. Which technique can the tester use to enumerate internal hosts and network ranges?

Accepted Answer

Attempt a DNS zone transfer (AXFR). B is correct because a DNS zone transfer (AXFR) allows a client to request a complete copy of the DNS zone from a DNS server. If the server is misconfigured to allow recursive queries and does not restrict AXFR requests, the tester can enumerate all internal hostnames and IP addresses, effectively mapping the internal network ranges.

Answer

Perform DNS cache snooping

Answer

Query for all SRV records

Answer

Perform a reverse DNS sweep of the entire subnet

Question 8

A penetration tester is performing a vulnerability scan on a target network. The tester uses Nmap with the default NSE scripts against a web server. The scan report shows several 'http-vuln-cve2017-5638' findings. What does this indicate?

Accepted Answer

The target is vulnerable to Apache Struts2 remote code execution. The Nmap script 'http-vuln-cve2017-5638' specifically targets the Apache Struts2 remote code execution vulnerability (CVE-2017-5638). This vulnerability exists in the Jakarta Multipart parser used by Apache Struts2, allowing an attacker to execute arbitrary commands via crafted Content-Type headers. The presence of this finding in the scan report indicates the web server is running a vulnerable version of Apache Struts2.

Answer

The target is vulnerable to the Heartbleed bug in OpenSSL

Answer

The target is vulnerable to the Shellshock Bash vulnerability

Answer

The target has a SQL injection vulnerability

Question 9

A penetration tester is preparing a report for a client's CISO who is not technical. The CISO needs to understand the overall risk posture and the business impact of the findings. Which section of the report should be tailored for this audience?

Accepted Answer

Executive summary. The executive summary is designed for non-technical stakeholders like a CISO to quickly grasp the overall risk posture and business impact without needing to interpret raw data or technical jargon. It synthesizes findings into high-level business risks, such as potential financial loss or regulatory exposure, rather than detailing specific vulnerabilities or exploit chains. This section ensures the audience can make informed decisions about resource allocation and risk acceptance.

Answer

Technical findings

Answer

Appendices with raw scan data

Answer

Remediation details

Question 10

A penetration tester is performing reconnaissance on a target organization. The tester wants to discover the internal IP address scheme used by the company without making any direct connections to the company's network. Which technique is MOST effective for this purpose?

Accepted Answer

Analyzing job postings for technical requirements. Analyzing job postings for technical requirements is the most effective technique because it allows the tester to infer the internal IP address scheme without making any direct connections to the target network. Job postings often list specific technical skills, such as experience with certain subnet masks (e.g., /24, /16) or network ranges (e.g., 10.x.x.x, 192.168.x.x), which can reveal the internal addressing structure used by the organization. This passive reconnaissance method relies on publicly available information, avoiding any network traffic that could trigger detection.

Answer

DNS zone transfer

Answer

WHOIS lookup

Answer

Using Shodan to find exposed devices