PT0-002 Timed Hard Questions — 25 Difficult Questions

Question 1

A penetration tester has gained access to a Linux server and wants to move laterally to a Windows server. The tester captured a hash of a domain user. Which tool can be used to authenticate to the Windows server using the hash?

15 minute time limit — choose an answer to begin.

Accepted Answer

evil-winrm. evil-winrm supports pass-the-hash authentication over WinRM, allowing lateral movement.

Answer

Ligolo-ng

Answer

SSH

Answer

Chisel

Question 2

During a penetration test, the tester gains access to a domain-joined Windows machine and wants to perform Kerberoasting. Which THREE conditions are necessary for a successful Kerberoasting attack?

Accepted Answer

Ability to request TGS-REP tickets. The user must have domain credentials, there must be service accounts with SPNs, and the attacker must be able to request TGS tickets. Plaintext passwords are not required, and local admin is not needed.

Answer

Local administrator privileges on the target

Answer

Plaintext password of the service account

Question 3

During post-engagement, a penetration tester needs to ensure proper data handling. Which THREE actions should the tester take?

Accepted Answer

Securely destroy test artifacts after the client accepts the report. After the engagement, test artifacts should be securely destroyed, data should be purged from test systems, and confidential information must be handled per agreement.

Answer

Retain all test data indefinitely for future reference

Answer

Share findings with other clients to demonstrate expertise

Question 4

During an internal penetration test, the tester wants to relay captured NTLM authentication to a server to gain access. Which tool from the Impacket suite is specifically designed for NTLM relay attacks?

Accepted Answer

ntlmrelayx. ntlmrelayx is the Impacket tool for relaying NTLM authentication.

Answer

CrackMapExec

Answer

Metasploit

Answer

Responder

Question 5

A penetration tester discovers evidence of ongoing criminal activity, such as a data breach by an internal employee, during a white box penetration test. The client's legal team has not provided specific instructions on handling such discoveries. According to best practices and legal considerations, what should the tester do first?

Accepted Answer

Stop testing and contact the client's emergency contact. The tester should immediately stop testing and inform the client's emergency contact to handle the criminal activity appropriately.

Answer

Notify law enforcement directly

Answer

Continue testing and document the evidence for later reporting

Answer

Ignore the activity and proceed as planned

Question 6

You are performing reconnaissance on a target's web application. Which of the following techniques can be used to discover hidden directories and files? (Select THREE.)

Accepted Answer

Using feroxbuster. Directory bruteforce tools like dirsearch, gobuster, and feroxbuster are designed to discover hidden directories and files by using wordlists. Nikto is a vulnerability scanner, not primarily for directory discovery. theHarvester is for email/subdomain harvesting.

Answer

Running Nikto with default options

Answer

Querying theHarvester

Question 7

A penetration tester needs to communicate the financial impact of a critical vulnerability to the board of directors. Which metric is most appropriate for this audience?

Accepted Answer

Annualized loss expectancy (ALE).. The board of directors is concerned with financial risk and business impact, not technical severity. Annualized loss expectancy (ALE) quantifies the expected monetary loss per year from a vulnerability, making it directly relevant for executive decision-making. CVSS scores and risk ratings are technical metrics that do not translate to financial terms.

Answer

CVSS base score (e.g., 9.8 out of 10).

Answer

Risk rating (High, Medium, Low).

Answer

Number of affected systems.

Question 8

A penetration tester is attempting to exploit a server-side request forgery (SSRF) vulnerability in a cloud-hosted web application to access the cloud metadata service. Which IP address should the tester target?

Accepted Answer

169.254.169.254. The cloud metadata service for most cloud providers (AWS, GCP, Azure) is accessible via 169.254.169.254.

Answer

192.168.1.1

Answer

127.0.0.1

Answer

10.0.0.1

Question 9

A penetration tester is preparing for a web application penetration test. The client application is hosted on a cloud platform that serves multiple tenants. Which THREE of the following are critical legal and scoping considerations?

Accepted Answer

Understand how the client's data privacy policies affect handling of any discovered data. Legal considerations include authorization from the cloud provider, handling sensitive data, and defining permissible testing methods.

Answer

Include a clause in the SOW that the tester is not liable for any data exposure

Answer

Test all tenant data to ensure comprehensive coverage

Question 10

You are attacking a web application and notice that it makes requests to internal services. You attempt to access the cloud metadata endpoint at http://169.254.169.254/. Which vulnerability are you most likely exploiting?

Accepted Answer

SSRF (Server-Side Request Forgery). SSRF (Server-Side Request Forgery) allows an attacker to make requests from the server to internal resources, including cloud metadata endpoints.

Answer

XXE (XML External Entity)

Answer

Command injection

Answer

CSRF (Cross-Site Request Forgery)

Question 11

A penetration tester is presenting findings to a technical audience. Which THREE practices are MOST appropriate for this setting? (Select THREE.)

Accepted Answer

Demonstrate the exploit steps. Technical audiences benefit from details about exploitation, technical steps, and evidence.

Answer

Use high-level business language only

Answer

Focus on strategic recommendations

Question 12

A 'no-fail' clause prohibits service outages. How should the tester address high-risk tests like SQL injection?

Accepted Answer

Require a staging environment for testing. Testing in a staging environment prevents real outages. Option A is wrong because it removes important tests. Option C is wrong because it does not prevent outages. Option D is wrong because it is irresponsible.

Answer

Remove all high-risk tests from the scope

Answer

Include a clause that the tester is not liable

Answer

Proceed with testing and hope no outages occur

Question 13

A penetration tester is analyzing a web application and wants to discover hidden API endpoints by brute-forcing common paths. Which tool is best suited for this task?

Accepted Answer

Feroxbuster. Feroxbuster is a fast, recursive content discovery tool that supports wordlist-based brute-forcing of directories, files, and API endpoints, with automatic recursion.

Answer

WPScan

Answer

theHarvester

Answer

Nikto

Question 14

During a source code review of a PHP application, the tester finds the following line: $query = "SELECT * FROM users WHERE username = '" . $_POST['username'] . "'"; Which vulnerability is present?

Accepted Answer

SQL injection. Concatenating user input directly into an SQL query without sanitization leads to SQL injection.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Command injection

Question 15

During a web application test, the tester discovers a parameter that reflects user input in the response without proper encoding. The tester crafts a payload that executes JavaScript when another user views the page. Which type of XSS is this, and what is a primary risk?

Accepted Answer

Reflected XSS; risk of session hijacking. Reflected XSS executes in the victim's browser when the malicious link is clicked, allowing session hijacking.

Answer

Stored XSS; risk of data theft from database

Answer

Blind XSS; risk of internal network scanning

Answer

DOM-based XSS; risk of client-side logic bypass

Question 16

A penetration testing firm is hired to assess a healthcare organization's network. The client has strict regulatory requirements (HIPAA) and wants to ensure that all patient data is protected during testing. Which scoping document should specify the data handling procedures and the destruction of any collected sensitive information?

Accepted Answer

Data Protection Addendum. A Data Protection Addendum (DPA) or equivalent data handling agreement is the appropriate document to define how sensitive data will be handled, stored, and destroyed. The Rules of Engagement cover authorization and constraints, but specific data protection clauses are often in a separate addendum or included in the contract. The Methodology and Scope of Work do not typically detail data destruction procedures.

Answer

Rules of Engagement

Answer

Testing Methodology

Answer

Scope of Work

Question 17

A penetration tester has gained a low-privileged command shell on a Windows 10 system. The tester suspects there is a vulnerable service with an unquoted service path that can be exploited for privilege escalation. Which command should the tester use to identify all services with this vulnerability?

Accepted Answer

reg query HKLM\SYSTEM\CurrentControlSet\Services\ /s /v ImagePath. The `reg query` command with the `/s` switch recursively searches the registry key `HKLM\SYSTEM\CurrentControlSet\Services` for the `ImagePath` value of each service. An unquoted service path vulnerability occurs when the `ImagePath` contains spaces and is not enclosed in quotes, allowing an attacker to execute arbitrary code by placing a malicious executable in a path that Windows interprets as a command with arguments. This command directly retrieves the raw path strings from the registry, making it the most reliable method to identify unquoted paths.

Answer

Get-Service | Format-List Name,PathName

Answer

sc query type= all state= all | findstr "SERVICE_NAME"

Answer

net start

Question 18

During a post-exploitation phase, a tester needs to establish persistence on a Windows target. Which THREE methods are commonly used for persistence on Windows?

Accepted Answer

Registry Run keys. Scheduled tasks, registry Run keys, and WMI subscriptions are common persistence mechanisms. Pass-the-hash is lateral movement, and cron jobs are Linux-specific.

Answer

Pass-the-hash

Answer

Cron jobs

Question 19

During a vulnerability scan of a web application, a tester receives an HTTP response with a '405 Method Not Allowed' error when trying to use a PUT request. What does this indicate about the web server's configuration?

Accepted Answer

The server blocks the PUT method for that specific URI.. A 405 Method Not Allowed error indicates that the server recognized the PUT method as valid but has explicitly disallowed it for the requested URI. This is a server-level access control configuration, often enforced via web server directives (e.g., Apache's `<LimitExcept>` or IIS's request filtering) or application-level routing rules. The tester's PUT request reached the server and was processed, but the server's configuration prevented it from being fulfilled for that specific endpoint.

Answer

The PUT method is allowed but the resource does not exist.

Answer

The server does not support the PUT method.

Answer

The request was malformed and rejected.

Question 20

A penetration tester is presenting findings to a group of executives. Which of the following is the most effective way to communicate a critical vulnerability?

Accepted Answer

Describe the vulnerability in terms of potential financial and reputational damage.. Executives need to understand business impact, not technical details. Use business language and focus on risk.

Answer

Recommend specific code changes without context.

Answer

Explain the technical exploit steps in detail.

Answer

Show raw network captures as evidence.