PT0-002 Hard Questions — 25 Difficult Questions

Question 1

A penetration tester is analyzing a Python script that performs a buffer overflow attack. The script imports the struct module and the socket module. It constructs a payload by packing a pattern of characters, then overwriting a return address with a specific offset. Which of the following is the most critical piece of information the tester must determine before running this script against the target?

Accepted Answer

The exact location of a JMP ESP instruction in memory. The script performs a buffer overflow attack by overwriting a return address. To redirect execution to attacker-controlled shellcode, the tester must overwrite the return address with the address of a JMP ESP instruction (or equivalent) that is reliably located in memory. Without this address, the overwritten return pointer will cause a crash or unpredictable behavior, making exploitation impossible.

Answer

The IP address and port of the target service

Answer

The version of the operating system running on the target

Answer

The username and password for the target service

Question 2

A penetration tester has gained a foothold on a Linux server through a vulnerable web application. The server has an outbound firewall that blocks all traffic except DNS queries (UDP 53). The tester needs to establish a reverse shell to maintain access. Which technique is most likely to succeed?

Accepted Answer

Encode the payload in Base64 and use DNS tunneling to execute commands. Option B is correct because DNS tunneling encapsulates non-DNS traffic (e.g., command output) within DNS query and response packets, which are allowed through the firewall on UDP port 53. This technique bypasses the outbound firewall restriction by making the malicious traffic appear as legitimate DNS queries, enabling the tester to execute commands and exfiltrate data without triggering network-level blocks.

Answer

Use a bind shell on a high TCP port and connect from the tester's machine

Answer

Attempt a reverse shell over HTTP using TCP port 80

Answer

Use SSH reverse port forwarding to the tester's server on port 443

Question 3

A client is subject to PCI DSS compliance and requests a penetration test. The client's network has a mix of in-scope systems (cardholder data environment) and out-of-scope systems. During scoping, the tester recommends a specific approach to ensure accurate segmentation testing. Which of the following is the most important consideration for the rules of engagement?

Accepted Answer

The tester must be provided with a diagram of the network segmentation. For accurate segmentation testing under PCI DSS, the tester must verify that the segmentation controls (e.g., firewalls, VLANs, ACLs) effectively isolate the cardholder data environment (CDE) from out-of-scope systems. A network diagram is essential because it documents the expected segmentation boundaries, IP ranges, and traffic flows, allowing the tester to design targeted tests (e.g., using traceroute, nm scans, or firewall rule validation) to confirm that no unauthorized paths exist between segments. Without this diagram, the tester cannot determine which systems should be reachable and which should be blocked, making segmentation validation unreliable.

Answer

The tester must have network access to both in-scope and out-of-scope systems

Answer

The tester must agree not to scan any out-of-scope IP addresses

Answer

The tester must obtain written authorization from the client's security team

Question 4

A penetration tester discovers that a web application uses a vulnerable Java deserialization endpoint. The classpath includes the Apache Commons Collections library. Which attack technique is most likely to achieve remote code execution?

Accepted Answer

Java deserialization of untrusted data (RCE via Commons Collections).. The correct answer is A because the presence of the Apache Commons Collections library in the classpath, combined with a vulnerable Java deserialization endpoint, enables the classic 'gadget chain' attack. Attackers craft a malicious serialized object that, when deserialized, invokes methods in Commons Collections (e.g., InvokerTransformer) to execute arbitrary system commands, achieving remote code execution (RCE). This is a well-documented exploit chain (e.g., CVE-2015-7501) that directly leverages the library's reflection-based classes.

Answer

SQL injection.

Answer

Cross-site scripting.

Answer

Command injection.

Question 5

A penetration tester discovers a web application that uses client-side JavaScript to validate user input before form submission. The input is then sent to the server and used directly in a SQL query without server-side validation. Which attack would most effectively exploit this vulnerability?

Accepted Answer

SQL injection. The correct answer is A because the vulnerability described—client-side JavaScript validation with no server-side sanitization, followed by direct use of input in a SQL query—is the classic precondition for SQL injection. An attacker can bypass client-side controls (e.g., by disabling JavaScript or using a proxy like Burp Suite) and submit crafted SQL syntax (e.g., `' OR 1=1 --`) to manipulate the query, extract data, or execute arbitrary SQL commands on the database server.

Answer

Cross-site scripting (XSS)

Answer

Command injection

Answer

Parameter pollution

Question 6

A penetration tester has discovered a local file inclusion (LFI) vulnerability in a PHP web application. The vulnerable code uses the following pattern: include($_GET['page']);. The application runs on a Linux server with Apache and PHP. The tester wants to achieve remote code execution (RCE). Which technique is most likely to succeed given this LFI?

Accepted Answer

Use the php://input wrapper and send PHP code in the POST body.. The correct technique is to use the php://input wrapper because it allows the attacker to pass arbitrary PHP code in the HTTP POST body, which the include() function will execute as PHP. Since the vulnerable code directly includes user input without sanitization, the php://input stream reads the raw POST data and processes it as a PHP script, achieving remote code execution.

Answer

Use the file:// wrapper to read sensitive files like /etc/passwd.

Answer

Use the data:// wrapper with a base64-encoded PHP payload.

Answer

Set allow_url_include to On in php.ini via the LFI.

Question 7

During a penetration test, a tester gains access to a Linux server as a low-privileged user. The server has a cron job that executes a script owned by root but writable by the tester's group. Which privilege escalation technique should the tester use?

Accepted Answer

Cron job exploitation via script modification. The cron job executes a script owned by root but writable by the tester's group. This means the tester can modify the script's contents. When the cron job runs (as root), the modified script executes with root privileges, allowing the tester to gain a root shell or execute arbitrary commands as root. This is a classic cron job exploitation via script modification.

Answer

Kernel exploit

Answer

Misconfigured sudo permissions

Answer

Path hijacking in the cron job

Question 8

A penetration tester is performing a vulnerability scan on a web server that uses HTTPS. The tester wants to identify the server's SSL/TLS configuration weaknesses without overwhelming the server. Which Nmap command is most appropriate?

Accepted Answer

nmap -sV --script ssl-enum-ciphers -p 443 target. Option A is correct because the `ssl-enum-ciphers` NSE script enumerates all supported SSL/TLS ciphers and protocols on the target, providing a detailed assessment of cryptographic weaknesses (e.g., weak ciphers, outdated TLS versions). The `-sV` flag enables version detection, and `-p 443` targets the HTTPS port, while the script itself is designed to be lightweight and not overwhelm the server, making it ideal for a non-intrusive vulnerability scan.

Answer

nmap -sT -A -T4 -p 443 target

Answer

nmap -sU -p 443 target

Answer

nmap -sC -p 443 target

Question 9

A penetration testing firm is hired to assess a healthcare organization's network. The client has strict regulatory requirements (HIPAA) and wants to ensure that all patient data is protected during testing. Which scoping document should specify the data handling procedures and the destruction of any collected sensitive information?

Accepted Answer

Data Protection Addendum. A Data Protection Addendum (DPA) or equivalent data handling agreement is the appropriate document to define how sensitive data will be handled, stored, and destroyed. The Rules of Engagement cover authorization and constraints, but specific data protection clauses are often in a separate addendum or included in the contract. The Methodology and Scope of Work do not typically detail data destruction procedures.

Answer

Rules of Engagement

Answer

Testing Methodology

Answer

Scope of Work

Question 10

During an internal penetration test, a tester gains access to a domain-joined Windows 10 workstation as a local administrator. The tester wants to escalate privileges to Domain Admin. Which attack involves requesting Kerberos service tickets that can be cracked offline to reveal the plaintext password of a service account?

Accepted Answer

Kerberoasting. Kerberoasting is the correct attack because it involves requesting Kerberos service tickets (TGS-REP) for service accounts registered with Service Principal Names (SPNs) in Active Directory. These tickets are encrypted with the service account's NTLM hash, which can be cracked offline to reveal the plaintext password. Since the tester has local administrator access on a domain-joined workstation, they can use tools like Rubeus or Impacket to request these tickets without needing domain admin privileges initially.

Answer

Pass-the-hash

Answer

Golden ticket

Answer

Silver ticket

Question 11

During an internal penetration test, a tester captures an NTLMv2 hash of a domain admin account using a Responder attack. The organization's password policy requires at least 12 characters with uppercase, lowercase, numbers, and special characters. Which password cracking technique is most likely to succeed first?

Accepted Answer

Hybrid attack combining dictionary words with numbers and special characters. Option C is correct because NTLMv2 hashes are computationally expensive to crack, and a hybrid attack that combines dictionary words with numbers and special characters is the most efficient approach given the 12-character minimum policy. This technique leverages common password patterns (e.g., 'Password123!') that users often create to meet complexity requirements, making it faster than brute-forcing all possible 12-character combinations.

Answer

Dictionary attack with common passwords

Answer

Brute-force attack with all possible 8-character combinations

Answer

Rainbow table attack on the hash

Question 12

A penetration tester has successfully exploited a buffer overflow vulnerability in a Linux binary. However, the binary has Data Execution Prevention (DEP) enabled and Address Space Layout Randomization (ASLR) disabled. Which exploitation technique is MOST appropriate to achieve code execution in this environment?

Accepted Answer

Return-oriented programming (ROP) to bypass DEP. Return-oriented programming (ROP) is the most appropriate technique because DEP marks the stack and heap as non-executable, preventing direct shellcode injection. With ASLR disabled, the attacker can reliably locate and chain small instruction sequences (gadgets) from the binary or loaded libraries to achieve arbitrary code execution without needing executable memory regions.

Answer

Simple shellcode injection on the stack

Answer

ASLR bypass techniques

Answer

Heap spraying

Question 13

A penetration tester is analyzing a PowerShell script used during an internal test. The script contains the following code block: ```powershell $cred = Get-Credential $session = New-PSSession -ComputerName 'Server01' -Credential $cred Invoke-Command -Session $session -ScriptBlock { Get-ChildItem C:\Secrets.txt } Remove-PSSession $session ``` What is the primary purpose of this script?

Accepted Answer

To achieve lateral movement and access a file on a remote server. The script uses Get-Credential to obtain user credentials, creates a remote PowerShell session (PSSession) to Server01 via New-PSSession, and then executes Get-ChildItem C:\Secrets.txt on that remote server using Invoke-Command. This is the classic pattern for lateral movement: authenticating to a remote host and accessing a file stored there, not performing any local privilege escalation or password brute-forcing.

Answer

To perform a local privilege escalation using stored credentials

Answer

To brute-force the password of the user account via 'Get-Credential'

Answer

To execute a script from the remote server using the ScriptBlock

Question 14

A penetration tester is using a vulnerability scanner to assess an internal network. The scanner reports a critical vulnerability in a custom web application, but manual verification shows the application is not vulnerable. Which of the following is the MOST likely cause of this false positive?

Accepted Answer

The scanner detected a vulnerable library used by the application, but the application's implementation does not expose the vulnerable code path. Option C is correct because vulnerability scanners often identify libraries or components with known CVEs, but they cannot determine whether the application's code actually invokes the vulnerable functions. In this case, the scanner flagged a library with a known vulnerability, but the custom web application's implementation does not expose the vulnerable code path, resulting in a false positive. This is a common limitation of static or version-based detection versus dynamic, context-aware analysis.

Answer

The scanner used an outdated vulnerability database that does not match the application's patches

Answer

The scanner identified the application version from the HTTP response header, but the vulnerability was already patched in that version

Answer

The scanner performed an exploit attempt that succeeded on a different service on the same host

Question 15

A penetration tester is writing a return-oriented programming (ROP) exploit for a Linux binary to bypass Data Execution Prevention (DEP). The binary has DEP enabled, but the tester identifies a gadget in a dynamically linked library that is not affected by ASLR. Which condition must be true for the ROP chain to succeed?

Accepted Answer

The library must be loaded at a fixed address. Option A is correct because for a ROP chain to succeed when DEP is enabled, the attacker needs to control the execution flow by chaining together gadgets (small instruction sequences ending with a return) that reside in executable memory regions. If a dynamically linked library is not affected by ASLR, it means it is loaded at a fixed, predictable address, allowing the tester to reliably use gadgets from that library without needing to bypass ASLR for that specific module. This fixed address ensures the ROP chain's addresses are valid across runs, which is essential for the exploit to work.

Answer

The stack must be executable

Answer

The binary must be compiled with stack canaries

Answer

The exploit must bypass ASLR for the main binary

Question 16

A penetration testing firm is engaged to assess a cloud infrastructure hosted in multiple AWS regions. The client specifies that only systems in US-based regions should be tested due to data sovereignty concerns. Which of the following is the MOST critical documentation to include in the rules of engagement (ROE) to ensure compliance?

Accepted Answer

List of allowed AWS regions and associated VPC CIDR ranges. Option B is correct because the rules of engagement (ROE) must explicitly define the authorized scope to prevent testing outside US-based regions, which could violate data sovereignty laws. Listing allowed AWS regions and their associated VPC CIDR ranges provides a precise technical boundary for the penetration test, ensuring that only in-scope systems are targeted. Without this, the testing team might inadvertently access resources in non-US regions, leading to legal and compliance breaches.

Answer

Statement of Work (SOW)

Answer

Data Processing Agreement (DPA)

Answer

Penetration testing methodology document

Question 17

A tester has low-privilege shell access on a Linux server. Which two checks are most appropriate for local privilege escalation enumeration? (Choose 2.)

Accepted Answer

Review sudo privileges with sudo -l.. Option A is correct because `sudo -l` lists the commands the current user can execute with elevated privileges, which is a standard first step in privilege escalation enumeration. If the user has sudo rights to any command without a password or with a known password, they can potentially run that command as root, leading to full system compromise.

Answer

Run a full SYN scan of the public IP range.

Answer

Send phishing emails to the finance department.

Question 18

A penetration tester is performing internal reconnaissance on a network that uses IPv6. The tester wants to discover alive hosts and their IPv6 addresses without sending many packets. Which technique is most effective for this purpose?

Accepted Answer

Ping the IPv6 all-nodes multicast address (ff02::1) and analyze the responses to discover active hosts. Option B is correct because sending a ping to the IPv6 all-nodes multicast address (ff02::1) triggers a response from all active hosts on the local link that have IPv6 enabled, allowing the tester to discover alive hosts and their IPv6 addresses with minimal packets. This technique leverages the inherent multicast behavior of IPv6, where hosts join the all-nodes multicast group by default, making it highly efficient for reconnaissance without scanning each address individually.

Answer

Perform a full TCP SYN scan on the entire /64 subnet using Nmap with IPv6 addressing

Answer

Request the DHCPv6 server log from the network administrator to obtain a list of assigned IPv6 addresses

Answer

Use the `ip neighbor` command on the tester's machine to view the IPv6 neighbor cache after generating traffic

Question 19

After completing a penetration test, the client's technical team requests the detailed raw data (e.g., scan results, exploit logs, packet captures) used to support the findings. According to best practices, which of the following should the penetration tester do?

Accepted Answer

Provide the raw data in a separate, sanitized deliverable with a data handling agreement. Option B is correct because raw data such as scan results, exploit logs, and packet captures often contain sensitive information like IP addresses, credentials, or system details. Best practices (e.g., PTES, NIST SP 800-115) dictate that raw data should be provided in a separate, sanitized deliverable accompanied by a data handling agreement to ensure confidentiality and proper data governance, rather than embedding it directly in the final report.

Answer

Include all raw data in the appendices of the final report

Answer

Refuse to provide raw data to protect the confidentiality of the testing process

Answer

Provide the raw data only if the client signs a non-disclosure agreement

Question 20

A penetration tester has obtained a TGT from a domain controller by cracking the krbtgt hash. Which attack can the tester now perform to gain persistent administrative access to any resource in the domain?

Accepted Answer

Golden Ticket. A Golden Ticket attack is the correct answer because the tester has cracked the krbtgt hash, which is the key used by the Key Distribution Center (KDC) to sign all Ticket Granting Tickets (TGTs). With this hash, the tester can forge a TGT for any user (including a domain admin) with an arbitrary long validity period, granting persistent administrative access to any resource in the domain without needing to interact with the domain controller again.

Answer

Pass-the-Hash

Answer

Silver Ticket

Answer

DCSync