PT0-002 Practice Test 9 — 10 Questions

Question 1

A penetration tester is reviewing a Python script that attempts to exploit a command injection vulnerability. The script uses the 'subprocess' module with the 'shell=True' argument. Which of the following code changes would be MOST effective to reduce the risk of unintended consequences when executing system commands?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Avoid using shell=True and pass the command as a list of arguments. Setting `shell=True` in Python's `subprocess` module causes the command string to be interpreted by the system shell, which introduces command injection risks if any part of the string is user-controlled. By passing the command as a list of arguments (e.g., `['ls', '-l', filename]`) and omitting `shell=True`, the subprocess module directly executes the binary without shell interpretation, eliminating shell metacharacter injection. This is the most effective mitigation as it avoids shell parsing entirely, which is the root cause of the vulnerability.

Answer

Replace subprocess with os.system()

Answer

Use the 'shlex.quote()' function to sanitize user input before passing to subprocess

Answer

Use the 'exec()' function to run the command

Question 2

A tester is performing a post-exploitation phase on a compromised Linux server and wants to establish persistence. Which THREE of the following methods are commonly used for Linux persistence? (Choose THREE.)

Accepted Answer

Adding an SSH public key to ~/.ssh/authorized_keys. Common Linux persistence methods include adding cron jobs (crontab), creating a systemd service that starts on boot, and adding SSH authorized keys for backdoor access. Scheduled tasks are Windows-specific; Registry Run keys are also Windows-only.

Answer

Adding a registry Run key

Answer

Creating a scheduled task using schtasks

Question 3

A penetration tester is attempting to exploit a buffer overflow vulnerability in a Linux binary. The binary has Data Execution Prevention (DEP) enabled but Address Space Layout Randomization (ASLR) is disabled. Which exploitation technique would be the MOST effective to achieve code execution?

Accepted Answer

Perform a return-to-libc attack to call system("/bin/sh"). With DEP enabled, the stack is non-executable, so injecting shellcode directly into the buffer (Option A) would fail. Since ASLR is disabled, library addresses are fixed, making a return-to-libc attack viable. Option C exploits this by overwriting the return address with the address of system() and placing the string "/bin/sh" in memory, achieving code execution without needing an executable stack.

Answer

Inject shellcode into the buffer and redirect execution to it

Answer

Use a ROP chain to call mprotect() to make the stack executable, then jump to shellcode

Answer

Use a heap spray to place shellcode at a known address and then trigger the overflow

Question 4

A penetration tester has discovered a critical SQL injection vulnerability in a web application. The developer team will fix the issue. Which level of detail is most appropriate for this audience?

Accepted Answer

Include the full proof-of-concept code and the exact HTTP requests used.. The developer team needs the exact technical details to reproduce and fix the vulnerability. Providing the full proof-of-concept code and exact HTTP requests allows developers to understand the injection point, the payload structure, and the vulnerable parameter, enabling them to implement a precise fix such as parameterized queries or input validation.

Answer

Provide the CVSS score and a brief description.

Answer

Describe the business impact in financial terms.

Answer

List all findings in a bullet-point summary without additional context.

Question 5

A penetration tester is performing an NTLM relay attack against a Windows network. The tester uses ntlmrelayx to relay captured NTLM authentication attempts to a target server. What must be true for this attack to succeed?

Accepted Answer

SMB signing must be disabled or not enforced. SMB signing must be disabled or not enforced on the target server, otherwise the relayed authentication will be rejected.

Answer

LLMNR must be enabled

Answer

The relayed hash must be crackable

Answer

The target server must have SMB signing enabled

Question 6

Which of the following is an example of a custom severity rating based on business context?

Accepted Answer

Risk rating of 'Critical' based on high business impact and likelihood. Custom severity often uses impact and likelihood to determine risk, as not all vulnerabilities affect the business equally.

Answer

DREAD score of 7

Answer

High/Medium/Low based on CVSS

Answer

CVSS score of 9.0

Question 7

A penetration tester is preparing a remediation recommendation for a SQL injection vulnerability found in a legacy application. The development team cannot immediately update the framework due to compatibility issues. What should the tester recommend as a compensating control?

Accepted Answer

Implement a web application firewall (WAF) with rules to block SQL injection attempts.. When a full fix is not immediately possible, compensating controls such as a WAF can provide temporary protection.

Answer

Disable the affected functionality until the framework can be updated.

Answer

Conduct manual code reviews to identify and fix the vulnerability immediately.

Answer

Upgrade the database to a newer version to prevent SQL injection.

Question 8

A client hires a penetration testing firm to assess a web application. The client uses a third-party content delivery network (CDN) for static assets and explicitly wants to exclude the CDN infrastructure from testing. In which document should this restriction be formally documented?

Accepted Answer

Rules of Engagement (ROE). The Rules of Engagement (ROE) document is the correct place to formally document restrictions such as excluding the CDN infrastructure from testing. The ROE defines the scope, boundaries, and specific constraints for the penetration test, including which IP ranges, domains, or systems are off-limits. This ensures the testing team does not inadvertently target the third-party CDN, which could violate contractual agreements or cause unintended disruptions.

Answer

Statement of Work (SOW)

Answer

Non-Disclosure Agreement (NDA)

Answer

Master Services Agreement (MSA)

Question 9

A tester is exploiting a SQL injection vulnerability in a login form. The application returns different responses for valid and invalid queries. However, the tester cannot see the database output. Which type of SQL injection is most likely?

Accepted Answer

Blind SQL injection. Blind SQL injection occurs when query results are not directly reflected, but the application behavior changes based on truth values.

Answer

Out-of-band SQL injection

Answer

UNION-based SQL injection

Answer

Error-based SQL injection

Question 10

In a penetration test report, the tester includes a screenshot of a successful exploit. What metadata should the screenshot include to ensure proper evidence documentation?

Accepted Answer

A timestamp and the IP address or hostname of the affected system.. Screenshots should include timestamps and relevant context such as the affected system to provide clear evidence.

Answer

Only the exploit output without any timestamps or identifiers.

Answer

A diagram of the network architecture instead of the exploit screenshot.

Answer

The tester's name and the date of the test, but not the system details.