PT0-002 Information Gathering and Vulnerability Scanning Practice Test 5 — 15 Questions

Question 1

Drag and drop the steps to exploit a SQL injection vulnerability using sqlmap into the correct order.

Question 2

Drag and drop the steps to perform a wireless network audit using aircrack-ng into the correct order.

Question 3

Match each penetration testing tool to its primary function.

Question 4

Match each wireless attack to its description.

Question 5

A penetration tester is conducting information gathering on a target organization. The tester discovers a public code repository that contains configuration files with embedded credentials. Which of the following is the BEST next step?

Accepted Answer

Notify the organization's security team of the exposed credentials.. Option A is correct because the tester has discovered exposed credentials in a public code repository, which is a critical security finding that requires immediate disclosure to the organization's security team. Ethical penetration testing mandates that any discovered vulnerabilities, especially those involving credential exposure, be reported promptly to prevent unauthorized access and potential data breaches. Proceeding with further exploitation without authorization violates the rules of engagement and could cause legal or operational harm.

Answer

Attempt to crack the passwords to gain further access.

Answer

Document the findings and proceed with passive reconnaissance.

Answer

Use the credentials to log into the target system immediately.

Question 6

A penetration tester is performing a port scan on a target network and receives no response to SYN packets sent to port 443. However, the service is known to be running. Which scanning technique should the tester use next to confirm the service?

Accepted Answer

TCP connect scan. Option B (TCP connect scan) is correct because when a SYN scan receives no response to port 443, it may indicate that a firewall or packet filter is dropping the SYN packets. A TCP connect scan completes the full three-way handshake (SYN, SYN-ACK, ACK), which can bypass some stateless firewall rules that only block initial SYN packets but allow established connections. This technique confirms the service by successfully establishing a connection, even if SYN packets are filtered.

Answer

SYN scan

Answer

UDP scan

Answer

Idle scan

Question 7

During a vulnerability scan of a web application, a tester receives an HTTP response with a '405 Method Not Allowed' error when trying to use a PUT request. What does this indicate about the web server's configuration?

Accepted Answer

The server blocks the PUT method for that specific URI.. A 405 Method Not Allowed error indicates that the server recognized the PUT method as valid but has explicitly disallowed it for the requested URI. This is a server-level access control configuration, often enforced via web server directives (e.g., Apache's `<LimitExcept>` or IIS's request filtering) or application-level routing rules. The tester's PUT request reached the server and was processed, but the server's configuration prevented it from being fulfilled for that specific endpoint.

Answer

The PUT method is allowed but the resource does not exist.

Answer

The server does not support the PUT method.

Answer

The request was malformed and rejected.

Question 8

A penetration tester is tasked with identifying live hosts on a large subnet without generating excessive traffic. Which of the following techniques is most appropriate for efficient host discovery?

Accepted Answer

TCP SYN scan on port 80 and 443. A TCP SYN scan on ports 80 and 443 is the most appropriate technique because it targets common web service ports, which are often open on live hosts, and generates minimal traffic compared to a full port scan. Unlike ICMP or ARP scans, a TCP SYN scan can bypass firewalls that block ICMP echo requests and is effective across routed subnets where ARP is limited to the local broadcast domain. This approach balances stealth and efficiency for large-scale host discovery.

Answer

ARP scan

Answer

DNS zone transfer

Answer

ICMP echo sweep

Question 9

A tester is using the following Nmap command: nmap -sC -sV -p 1-65535 target_ip. What is the primary purpose of the -sC option?

Accepted Answer

Use default scripts. The -sC option in Nmap is equivalent to --script=default, which runs a collection of common, non-intrusive enumeration scripts against the target. These scripts perform tasks such as service banner grabbing, HTTP title extraction, and SSL/TLS certificate retrieval, providing valuable reconnaissance data without requiring manual script selection.

Answer

Scan all ports

Answer

Perform a version scan

Answer

Do a SYN scan

Question 10

During a penetration test, the tester finds that a web application is vulnerable to server-side template injection (SSTI). Which of the following payloads would be most effective to test for SSTI in an Express-based Node.js application using Handlebars?

Accepted Answer

{{7*7}}. In Handlebars, the expression {{7*7}} evaluates the multiplication directly, returning 49. This confirms SSTI because the server processes the template expression before rendering. Other payloads like {{7*'7'}} may cause type coercion errors or not execute in the same way, making {{7*7}} the most reliable test.

Answer

Answer

<%= 7*7 %>

Answer

${7*7}

Question 11

A penetration tester is performing a vulnerability scan of a network and finds that one server is running an outdated version of OpenSSL. Which of the following is the most likely security implication of this finding?

Accepted Answer

The server is vulnerable to Heartbleed. Outdated versions of OpenSSL, particularly versions 1.0.1 through 1.0.1f, are vulnerable to the Heartbleed bug (CVE-2014-0160). This vulnerability allows an attacker to read up to 64 KB of memory from the server's heap, potentially exposing private keys, session tokens, and other sensitive data. The Heartbleed bug is a specific buffer over-read vulnerability in the TLS/DTLS heartbeat extension, making D the correct answer.

Answer

The server is vulnerable to SQL injection

Answer

The server is vulnerable to cross-site scripting

Answer

The server is vulnerable to buffer overflow

Question 12

Which of the following tools would a penetration tester most likely use to perform passive reconnaissance on a target domain?

Accepted Answer

theHarvester. theHarvester is a passive reconnaissance tool that gathers information from public sources such as search engines, PGP key servers, and the Shodan API without directly interacting with the target domain. It collects email addresses, subdomains, IPs, and employee names using OSINT (Open Source Intelligence) techniques, making it ideal for passive information gathering.

Answer

Wireshark

Answer

Nmap

Answer

Metasploit

Question 13

A tester needs to identify all open ports on a target system behind a firewall that is blocking ICMP and dropping unsolicited SYN packets. Which of the following scanning techniques is most likely to succeed?

Accepted Answer

TCP connect scan. A TCP connect scan (option B) completes the full three-way handshake, which is more likely to succeed against a firewall that drops unsolicited SYN packets because the firewall may allow outbound connections initiated from inside the network. Since the tester is behind the firewall, the SYN packet is sent as part of a legitimate connection attempt, and if the port is open, the target responds with SYN-ACK, completing the handshake. This technique bypasses the firewall's rule against unsolicited SYN packets because the connection appears to be initiated from the trusted side.

Answer

Ping sweep

Answer

FIN scan

Answer

UDP scan

Question 14

A penetration tester is analyzing the results of a vulnerability scan. Which of the following findings indicate that a vulnerability is likely exploitable? (Choose two.)

Accepted Answer

The vulnerability is classified as 'critical' by the scanner. Option A is correct because a 'critical' classification by the scanner typically indicates a high-severity vulnerability with a CVSS base score of 9.0 or higher, which often corresponds to remotely exploitable flaws that can lead to complete compromise. Scanners like Nessus or OpenVAS assign critical severity based on factors such as attack vector, complexity, and impact, making such vulnerabilities highly likely to be exploitable in practice.

Answer

CVSS base score of 4.0

Answer

The vulnerability has been patched by the vendor

Answer

Multiple hosts share the same vulnerability

Question 15

A penetration tester is performing information gathering using DNS enumeration. Which of the following records can be queried to discover additional subdomains or hostnames? (Choose three.)

Accepted Answer

MX. The A record maps a hostname to an IPv4 address. During DNS enumeration, querying A records for known subdomains or performing a brute-force of common hostnames (e.g., admin.example.com, mail.example.com) can reveal additional subdomains and hostnames by returning valid IP addresses. This is a standard technique in reconnaissance to expand the attack surface.

Answer

PTR

Answer

CNAME