PT0-002 Multiple Select — 60 Questions

Question 1

A penetration tester is reviewing source code and wants to identify common hardcoded credentials and input validation gaps. Which three checks should the tester perform? (Choose THREE.)

Accepted Answer

Identify usage of eval, exec, or system with user input. Hardcoded credentials, concatenated SQL queries, and dangerous functions like eval/exec/system are common vulnerabilities.

Answer

Verify the use of HTTPS

Answer

Check for proper session timeout implementation

Question 2

During a penetration test, the tester gains access to a domain-joined Windows machine and wants to perform Kerberoasting. Which THREE conditions are necessary for a successful Kerberoasting attack?

Accepted Answer

Ability to request TGS-REP tickets. The user must have domain credentials, there must be service accounts with SPNs, and the attacker must be able to request TGS tickets. Plaintext passwords are not required, and local admin is not needed.

Answer

Local administrator privileges on the target

Answer

Plaintext password of the service account

Question 3

A penetration tester is conducting passive reconnaissance and wants to gather information about a target organization's employees, email addresses, and internal structure. Which TWO tools are best suited for this purpose? (Select TWO.)

Accepted Answer

Maltego. Maltego is a data mining tool that visualizes relationships and can collect info from social media, DNS, and other sources. theHarvester gathers emails, subdomains, and names from public sources. LinkedIn is also used for organizational chart mapping, but the question asks for tools specifically.

Answer

Gobuster

Answer

Nmap

Answer

Nikto

Question 4

During post-engagement, a penetration tester needs to ensure proper data handling. Which THREE actions should the tester take?

Accepted Answer

Securely destroy test artifacts after the client accepts the report. After the engagement, test artifacts should be securely destroyed, data should be purged from test systems, and confidential information must be handled per agreement.

Answer

Retain all test data indefinitely for future reference

Answer

Share findings with other clients to demonstrate expertise

Question 5

You are performing reconnaissance on a target's web application. Which of the following techniques can be used to discover hidden directories and files? (Select THREE.)

Accepted Answer

Using feroxbuster. Directory bruteforce tools like dirsearch, gobuster, and feroxbuster are designed to discover hidden directories and files by using wordlists. Nikto is a vulnerability scanner, not primarily for directory discovery. theHarvester is for email/subdomain harvesting.

Answer

Running Nikto with default options

Answer

Querying theHarvester

Question 6

Which TWO of the following are components of the DREAD model for risk assessment? (Select TWO.)

Accepted Answer

Reproducibility. DREAD stands for Damage, Reproducibility, Exploitability, Affected users, Discoverability.

Answer

Likelihood

Answer

Severity

Answer

Impact

Question 7

A penetration tester is preparing for a web application penetration test. The client application is hosted on a cloud platform that serves multiple tenants. Which THREE of the following are critical legal and scoping considerations?

Accepted Answer

Understand how the client's data privacy policies affect handling of any discovered data. Legal considerations include authorization from the cloud provider, handling sensitive data, and defining permissible testing methods.

Answer

Include a clause in the SOW that the tester is not liable for any data exposure

Answer

Test all tenant data to ensure comprehensive coverage

Question 8

A penetration tester is presenting findings to a technical audience. Which THREE practices are MOST appropriate for this setting? (Select THREE.)

Accepted Answer

Demonstrate the exploit steps. Technical audiences benefit from details about exploitation, technical steps, and evidence.

Answer

Use high-level business language only

Answer

Focus on strategic recommendations

Question 9

A penetration tester is conducting passive reconnaissance using OSINT techniques. Which TWO of the following are examples of passive OSINT sources?

Accepted Answer

Certificate transparency logs (crt.sh). Certificate transparency logs (crt.sh) (B) are a passive OSINT source because they are public, third-party repositories of issued TLS certificates that a tester can query without sending any traffic to the target's infrastructure, revealing subdomains and hostnames. WHOIS databases (D) are also passive OSINT, as registration records for domains and IP ranges are queried from registry/RIR servers rather than the target itself, exposing registrant, contact, and nameserver data. By contrast, social engineering (A) is an active engagement technique that involves direct interaction with people, not passive collection. snmpwalk (C) actively sends SNMP queries to a device, and an Nmap SYN scan (E) actively probes target ports with TCP SYN packets, so both generate traffic toward the target and are not passive.

Answer

Social engineering

Answer

snmpwalk

Answer

Nmap SYN scan

Question 10

Which TWO of the following are typical deliverables of a penetration test?

Accepted Answer

Technical findings and remediation guidance. Standard deliverables include an executive summary for management and technical findings for remediation.

Answer

User credentials for all accounts

Answer

Source code of the tested application

Answer

Video recording of the testing process

Question 11

During a post-exploitation phase, a tester needs to establish persistence on a Windows target. Which THREE methods are commonly used for persistence on Windows?

Accepted Answer

Registry Run keys. Scheduled tasks, registry Run keys, and WMI subscriptions are common persistence mechanisms. Pass-the-hash is lateral movement, and cron jobs are Linux-specific.

Answer

Pass-the-hash

Answer

Cron jobs

Question 12

You are conducting passive reconnaissance on a target organization. Which of the following are examples of passive reconnaissance techniques? (Select TWO.)

Accepted Answer

Querying certificate transparency logs. Passive reconnaissance involves collecting information without directly interacting with the target's systems. WHOIS lookups and certificate transparency logs are passive. DNS zone transfer and port scanning are active. Social engineering is active.

Answer

DNS zone transfer

Answer

Scanning ports with Nmap

Answer

Sending phishing emails

Question 13

Which TWO of the following are types of penetration testing based on the level of knowledge provided to the tester? (Select TWO.)

Accepted Answer

Black box. Black box and white box are two common types based on knowledge level; grey box is the third.

Answer

Social engineering

Answer

Network penetration test

Answer

Red team

Question 14

A penetration tester is examining a compiled binary obtained during an engagement. The tester wants to identify potential buffer overflow vulnerabilities and understand the control flow. Which TWO tools would be most appropriate for this task?

Accepted Answer

OllyDbg. OllyDbg is a debugger that allows dynamic analysis to identify overflow vulnerabilities by examining memory and registers. Ghidra is a disassembler and decompiler that provides static analysis of control flow and potential vulnerabilities. Nmap is a network scanner, Wireshark is a packet analyzer, and Burp Suite is a web proxy, none of which are suitable for binary analysis.

Answer

Wireshark

Answer

Nmap

Answer

Burp Suite

Question 15

A penetration tester is performing a full-scope engagement and needs to identify potential privilege escalation vectors on a Windows system. Which TWO of the following are valid Windows privilege escalation techniques?

Accepted Answer

Unquoted service path exploitation. Unquoted service paths and AlwaysInstallElevated are both valid Windows privilege escalation techniques. Kerberoasting and pass-the-hash are for credential access, not local escalation; SUID/SGID is Linux.

Answer

Pass-the-hash

Answer

Kerberoasting

Answer

SUID/SGID binary exploitation

Question 16

A tester is performing a post-exploitation phase on a compromised Linux server and wants to establish persistence. Which THREE of the following methods are commonly used for Linux persistence? (Choose THREE.)

Accepted Answer

Adding an SSH public key to ~/.ssh/authorized_keys. Common Linux persistence methods include adding cron jobs (crontab), creating a systemd service that starts on boot, and adding SSH authorized keys for backdoor access. Scheduled tasks are Windows-specific; Registry Run keys are also Windows-only.

Answer

Adding a registry Run key

Answer

Creating a scheduled task using schtasks

Question 17

A penetration tester is exploiting a web application and discovers an XML External Entity (XXE) vulnerability. Which TWO attacks can be performed using XXE?

Accepted Answer

Server-Side Request Forgery (SSRF). XXE can be used to read local files via external entities and also to perform SSRF by making the server request internal resources.

Answer

Remote code execution

Answer

Cross-Site Scripting (XSS)

Answer

SQL injection

Question 18

A penetration tester is exploiting a web application and discovers an endpoint that allows an attacker to read arbitrary files on the server by manipulating XML input. The application uses an XML parser that does not disable external entities. Which TWO attacks can the tester perform using this vulnerability? (Choose TWO.)

Accepted Answer

SSRF via XXE. XXE (XML External Entity) allows file reads and can also lead to SSRF if the entity points to an internal URL. Command injection typically requires different input. SQL injection needs SQL syntax. XSS is client-side.

Answer

Command injection

Answer

SQL injection

Answer

XSS

Question 19

A penetration tester is conducting a web application test and finds a parameter that is vulnerable to XXE. Which THREE of the following actions can the tester perform using XXE?

Accepted Answer

Cause a denial of service. XXE can read files, perform SSRF, and cause denial of service. SQL injection is not typically a direct result of XXE.

Answer

Execute SQL injection

Answer

Bypass authentication

Question 20

A penetration tester is scoping a test for a client that uses a hybrid identity system. The client wants to ensure that the test does not affect production authentication. Which TWO actions should the tester recommend?

Accepted Answer

Test using non-production accounts. Using non-production accounts and a separate test domain isolate the test from production identity systems. Password spraying against all users could disrupt accounts, and disabling MFA may weaken security. Off-peak scheduling reduces impact but does not prevent direct interaction with production systems.

Answer

Conduct testing during off-peak hours

Answer

Perform password spraying against all users

Answer

Disable MFA for test accounts