PT0-002 Planning and Scoping Practice Test 6 — 15 Questions

Question 1

A penetration tester is scoping a test for a client that uses a hybrid identity system. The client wants to ensure that the test does not affect production authentication. Which TWO actions should the tester recommend?

Accepted Answer

Test using non-production accounts. Using non-production accounts and a separate test domain isolate the test from production identity systems. Password spraying against all users could disrupt accounts, and disabling MFA may weaken security. Off-peak scheduling reduces impact but does not prevent direct interaction with production systems.

Answer

Conduct testing during off-peak hours

Answer

Perform password spraying against all users

Answer

Disable MFA for test accounts

Question 2

Based on the exhibit, which host or network can SSH to 10.0.1.10?

Accepted Answer

None. The first rule drops all traffic from any source to the 10.0.1.0/24 network. Since 10.0.1.10 falls within that subnet, all traffic to it is dropped before subsequent rules are evaluated, including the SSH allow rule. Therefore, no host can SSH to 10.0.1.10.

Answer

192.168.1.0/24

Answer

10.0.1.0/24

Answer

0.0.0.0/0

Question 3

Refer to the exhibit. During scoping, what risk does this policy pose?

Accepted Answer

Public read access to all objects. The policy allows any principal (Principal: *) to perform the GetObject action on all objects in the company-data bucket, meaning public read access. Unauthorized deletion is not allowed (only GetObject). SSL configuration and encryption are not addressed in this policy.

Answer

Insecure SSL configuration

Answer

Lack of encryption

Answer

Unauthorized deletion of objects

Question 4

Refer to the exhibit. A penetration tester is scoping a test and needs to reach a host at 10.0.1.50. Through which interface will traffic be routed?

Accepted Answer

eth2. The most specific route matches the destination. 10.0.1.50 falls within the 10.0.1.0/24 network (Genmask 255.255.255.0), which is routed via eth2. The default route via eth0 and the broader 10.0.0.0/8 route via eth1 are less specific.

Answer

The route is ambiguous

Answer

eth0

Answer

eth1

Question 5

A company needs to test the security of its web application without causing any service disruption. Which testing methodology is most appropriate to include in the scope?

Accepted Answer

White-box code review and static analysis. Option A is correct because white-box code review and static analysis do not interact with the live environment, minimizing disruption. Option B is wrong because black-box testing may involve active scanning that could cause performance issues. Option C is wrong because gray-box testing still involves active testing. Option D is wrong because high-intensity scanning can cause denial of service.

Answer

Automated vulnerability scanning with a high intensity profile

Answer

Black-box penetration testing against the production environment

Answer

Gray-box penetration testing with a read-only account

Question 6

During scoping, a client asks the tester to avoid a specific IP range containing legacy systems. The tester discovers these systems are vulnerable but out of scope. What should the tester do?

Accepted Answer

Notify the client and request a scope change. Option C is correct because the tester should notify the client and request a scope change before testing out-of-scope systems. Option A is wrong because it violates the agreed scope. Option B is wrong because ignoring a critical vulnerability is not best practice. Option D is wrong because passive monitoring may still be considered testing.

Answer

Passively monitor traffic without active exploitation

Answer

Ignore the legacy systems and continue as agreed

Answer

Exploit the legacy systems and include them in the report

Question 7

A contract prohibits DoS testing, but a tester finds a WAF that could be tested with a technique resembling slowloris. What is the best course of action?

Accepted Answer

Request a scope change to include DoS testing. Option D is correct because the tester should request a scope change to include DoS testing after explaining the risk. Option A is wrong because it violates the contract. Option B is wrong because even a single request might be considered excessive. Option C is wrong because it does not address the prohibition.

Answer

Use a different technique, such as a buffer overflow

Answer

Proceed with a slowloris attack

Answer

Send a single malformed HTTP request and observe

Question 8

A client wants a social engineering test focusing on phishing. What should be included in the scope to ensure ethical handling?

Accepted Answer

The rules of engagement for notifying employees after the test. Option B is correct because the rules of engagement should include how to notify employees after the test. Option A is wrong because attacker infrastructure details are operational, not scope. Option C is wrong because expected failure rates are not typically defined. Option D is wrong although important, notification rules are more critical.

Answer

The attacker infrastructure details

Answer

The list of approved sender domains to use

Answer

The expected number of employees who should fall for the email

Question 9

A multi-tenant SaaS application needs tenant isolation testing. Which type of testing is most appropriate?

Accepted Answer

Gray-box testing with a tenant account. Option A is correct because gray-box testing with a tenant account allows authentication and testing of isolation. Option B is wrong because black-box from the internet cannot test isolation. Option C is wrong because white-box with source code may not reflect real access. Option D is wrong because infrastructure scanning does not test isolation.

Answer

White-box testing with access to source code

Answer

Vulnerability scanning of the underlying infrastructure

Answer

Black-box testing from the internet

Question 10

The scope allows only Nmap, but it is ineffective against heavy packet filtering. The tester wants to use an alternate tool. What should the tester do?

Accepted Answer

Request approval from the client to use a different tool. Option B is correct because the tester should request approval before using an alternate tool. Option A is wrong because using an unapproved tool violates scope. Option C is wrong because the question states alternate tool is needed. Option D is wrong because aborting is premature.

Answer

Use the alternate tool and note it in the report

Answer

Abort the scan and report that the network is not testable

Answer

Use Nmap with different parameters

Question 11

A client has limited budget for a penetration test covering critical assets. Which scoping decision best balances coverage and cost?

Accepted Answer

Perform full-scope test of a representative subset. Option C is correct because testing a representative subset of critical systems is efficient. Option A is wrong because it only tests perimeter. Option B is wrong because it is too limited. Option D is wrong because it is not comprehensive.

Answer

Test only the external perimeter

Answer

Focus on physical security assessments

Answer

Conduct only automated scans

Question 12

A wireless network test must not disrupt the network. How can the tester crack WPA2 passwords without disruption?

Accepted Answer

Use passive sniffing to capture traffic and crack offline. Option D is correct because passive sniffing captures the handshake without sending packets. Option A is wrong because deauth is active. Option B is wrong because brute-force is active. Option C is wrong because it doesn't test password strength.

Answer

Scan for rogue access points

Answer

Perform a deauthentication attack

Answer

Attempt a brute-force attack against the Wi-Fi password

Question 13

A 'no-fail' clause prohibits service outages. How should the tester address high-risk tests like SQL injection?

Accepted Answer

Require a staging environment for testing. Option B is correct because testing in a staging environment prevents real outages. Option A is wrong because it removes important tests. Option C is wrong because it does not prevent outages. Option D is wrong because it is irresponsible.

Answer

Remove all high-risk tests from the scope

Answer

Include a clause that the tester is not liable

Answer

Proceed with testing and hope no outages occur

Question 14

A tester is planning a physical security assessment. Which TWO should be included in the scope? (Choose two.)

Accepted Answer

Testing the ability to tailgate through secured entrances. Options A and C are correct because tailgating and dumpster diving are common physical assessment tests. Option B is too specialized and may need specific approval. Options D and E are network-based, not physical.

Answer

Running vulnerability scans on internal servers

Answer

Performing a man-in-the-middle attack on the Wi-Fi

Answer

Attempting to bypass biometric locks using fake fingerprints

Question 15

A web application test must cover OWASP Top 10. Which THREE should be explicitly included? (Choose three.)

Accepted Answer

SQL injection testing. Options A, B, and D are correct because XSS, SQL injection, and broken authentication are consistently in the OWASP Top 10. Option C is not typically a web vulnerability. Option E is sometimes considered but not always as a separate category.

Answer

Directory traversal testing

Answer

Buffer overflow testing