PT0-002 Vulnerability Discovery and Analysis Practice Test 2 — 15 Questions

Question 1

After gaining initial access to a Windows domain controller, a tester wants to extract password hashes from the SAM database and domain account hashes. Which Impacket tool is designed for this purpose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

secretsdump.py. D is correct because secretsdump.py is the Impacket tool specifically designed to extract password hashes from the SAM database and domain account hashes (NTDS.dit) on a Windows domain controller. It can perform remote dump operations using techniques like DRSUAPI replication or volume shadow copy, making it the standard choice for credential harvesting in penetration testing.

Answer

psexec.py

Answer

GetUserSPNs.py

Answer

wmiexec.py

Question 2

A penetration tester has captured a WPA2 handshake. Which tool from the Aircrack-ng suite is used to crack the pre-shared key?

Accepted Answer

aircrack-ng. Aircrack-ng (option D) is the tool in the Aircrack-ng suite specifically designed to crack WPA2 pre-shared keys (PSK) by performing an offline dictionary or brute-force attack against the captured four-way handshake. It uses the handshake data (specifically the EAPOL frames) to derive the Pairwise Master Key (PMK) and verify it against candidate passphrases, making it the correct choice for this task.

Answer

airmon-ng

Answer

airodump-ng

Answer

aireplay-ng

Question 3

During a code review of a PHP web application, you encounter the following code: $result = mysql_query("SELECT * FROM users WHERE username='" . $_GET['user'] . "'");. Which vulnerability does this represent?

Accepted Answer

SQL injection. Direct concatenation of user input into SQL query without sanitization or parameterization is classic SQL injection.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Command injection

Question 4

A tester needs to brute-force SSH credentials on a target. Which tool is most appropriate for this task?

Accepted Answer

Hydra. Hydra is a versatile online brute-force tool supporting many protocols including SSH.

Answer

Aircrack-ng

Answer

Hashcat

Answer

John the Ripper

Question 5

In a Python script for a penetration test, you need to craft a custom TCP packet with specific flags. Which library is best suited for low-level packet manipulation?

Accepted Answer

scapy. Scapy allows crafting, sending, and sniffing network packets at a low level, supporting custom TCP flags.

Answer

requests

Answer

socket

Answer

impacket

Question 6

During a reverse engineering task on a .NET binary, which tool would allow you to decompile the code into readable C# source code?

Accepted Answer

dnSpy. dnSpy is a .NET decompiler that can produce high-level source code from .NET assemblies.

Answer

IDA Pro Free

Answer

Ghidra

Answer

jadx

Question 7

A tester wants to perform an evil twin attack to capture WPA handshakes. Which tool from the Aircrack-ng suite is used to deauthenticate clients from a legitimate AP to force reconnection to the rogue AP?

Accepted Answer

aireplay-ng. aireplay-ng can send deauthentication packets to disconnect clients, facilitating handshake capture.

Answer

airmon-ng

Answer

airodump-ng

Answer

aircrack-ng

Question 8

Which PowerShell script is commonly used for post-exploitation enumeration of Active Directory, such as querying user accounts and group memberships?

Accepted Answer

PowerView. PowerView (option D) is a PowerShell script within the PowerSploit framework specifically designed for post-exploitation enumeration of Active Directory. It provides cmdlets like Get-NetUser, Get-NetGroup, and Get-NetComputer to query user accounts, group memberships, and domain trust relationships via LDAP queries, making it the correct choice for this task.

Answer

Nishang

Answer

Empire

Answer

Invoke-Mimikatz

Question 9

During a cloud security assessment of AWS, a tester wants to identify misconfigurations using automated tools. Which THREE tools are specifically designed for AWS security auditing?

Accepted Answer

Pacu. Pacu is an open-source AWS exploitation framework designed for offensive security testing. It automates the identification of misconfigurations, such as overly permissive IAM policies, exposed S3 buckets, and vulnerable Lambda functions, making it a correct choice for cloud security auditing.

Answer

Hashcat

Answer

CrackMapExec

Question 10

A tester is reviewing source code for security vulnerabilities. Which TWO of the following are examples of insecure coding practices that often lead to critical vulnerabilities?

Accepted Answer

Concatenating user input directly into SQL queries. Option B is correct because concatenating user input directly into SQL queries builds the query string from untrusted data, allowing SQL injection (e.g., ' OR '1'='1) to alter query logic and potentially read, modify, or delete database contents. Option D is correct because storing plaintext credentials in configuration files exposes secrets to anyone with file or repository access, leading to credential theft, lateral movement, and full account compromise. Options A and C are secure practices: allowlist validation restricts input to known-good values, and parameterized queries separate code from data to prevent injection. Option E is also secure: prepared statements precompile the SQL structure so bound parameters cannot change query semantics.

Answer

Validating input with allowlists

Answer

Using parameterized queries for database operations

Answer

Using prepared statements in SQL

Question 11

During a web application test, a penetration tester needs to intercept and modify HTTP requests before forwarding them to the server. Which tool is best suited for this task?

Accepted Answer

Burp Suite. Burp Suite's proxy allows intercepting and modifying HTTP/S requests, making it the standard tool for web application testing.

Answer

Hydra

Answer

Nmap

Answer

Wireshark

Question 12

A penetration tester is performing a password cracking task against a dump of NTLM hashes obtained from a Windows domain controller. Which tool would be the most efficient for this task?

Accepted Answer

Hashcat. Hashcat is a GPU-accelerated password cracker that can crack NTLM hashes quickly, especially with a good wordlist and rules.

Answer

Hydra

Answer

John the Ripper

Answer

CrackMapExec

Question 13

A tester wants to perform a Kerberoasting attack against an Active Directory environment. Which Impacket tool would be most appropriate?

Accepted Answer

GetUserSPNs. GetUserSPNs is the correct Impacket tool for Kerberoasting because it queries Active Directory for Service Principal Names (SPNs) associated with user accounts, then requests TGS tickets for those services. These tickets can be cracked offline to recover the service account's password hash, enabling privilege escalation.

Answer

wmiexec

Answer

psexec

Answer

secretsdump

Question 14

A penetration tester is reviewing a Python script used for a custom exploit. Which of the following code snippets contains a dangerous function that could lead to remote code execution?

Accepted Answer

eval(user_input). The `eval()` function in Python interprets and executes the string passed to it as a Python expression. If an attacker can control the `user_input` string, they can inject arbitrary Python code, leading to remote code execution (RCE). This is a classic dangerous function in Python that should never be used with untrusted input.

Answer

input('Enter name:')

Answer

open(filename, 'r')

Answer

subprocess.run(['ls'])

Question 15

A tester needs to enumerate Windows domain users and groups from a compromised system. Which PowerShell script would be most useful?

Accepted Answer

PowerView. PowerView is a PowerShell tool specifically designed for Windows domain enumeration, allowing testers to query Active Directory for users, groups, computers, and permissions via LDAP. It leverages the Active Directory Services Interface (ADSI) to gather detailed information without requiring additional privileges beyond those already obtained on the compromised system.

Answer

Invoke-Mimikatz

Answer

Prowler

Answer

ScoutSuite