PT0-002 Vulnerability Discovery and Analysis Practice Test 3 — 15 Questions

Question 1

A penetration tester is conducting a wireless security assessment. The target network uses WPA2-PSK. The tester has captured the four-way handshake. Which tool from the Aircrack-ng suite can be used to attempt to recover the pre-shared key by performing a dictionary attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

aircrack-ng. Aircrack-ng is the tool within the suite that performs dictionary or brute-force attacks on captured WPA/WPA2 handshakes to recover the PSK.

Answer

airtun-ng

Answer

airodump-ng

Answer

aireplay-ng

Question 2

A penetration tester is analyzing a Linux binary and wants to decompile it to understand its logic. Which open-source tool is specifically designed for reverse engineering and can generate C-like pseudocode from compiled binaries?

Accepted Answer

Ghidra. Ghidra, developed by the NSA, is a reverse engineering framework that can decompile binaries into C-like pseudocode.

Answer

IDA Pro Free

Answer

dnSpy

Answer

jadx

Question 3

A penetration tester needs to perform a dictionary attack against an SSH service. Which of the following tools is best suited for this task?

Accepted Answer

Hydra. Hydra is a versatile online brute-force tool that supports many protocols, including SSH.

Answer

CrackMapExec

Answer

John the Ripper

Answer

Hashcat

Question 4

During a penetration test, the tester wants to capture network traffic for later analysis. Which tool is most appropriate for capturing packets and saving them to a pcap file?

Accepted Answer

Wireshark. Wireshark is a network protocol analyzer capable of capturing live traffic and saving it to pcap files.

Answer

Metasploit

Answer

Burp Suite

Answer

Nmap

Question 5

A penetration tester is performing a cloud security audit of an AWS environment. Which tool is specifically designed for AWS exploitation and post-exploitation, including privilege escalation and persistence?

Accepted Answer

Pacu. Pacu is an AWS exploitation framework that provides modules for enumeration, privilege escalation, and persistence.

Answer

CrackMapExec

Answer

ScoutSuite

Answer

Prowler

Question 6

A penetration tester is reviewing a Java application for insecure deserialization vulnerabilities. Which of the following should the tester look for? (Choose TWO.)

Accepted Answer

Accepting serialized objects from user input without sanitization. Insecure deserialization vulnerabilities often arise from using ObjectInputStream without filtering and from accepting serialized data from untrusted sources.

Answer

Use of eval() functions

Answer

Hardcoded credentials in configuration files

Answer

Use of prepared statements for SQL queries

Question 7

A penetration tester is performing a wireless assessment and wants to set up an evil twin attack. Which of the following steps are necessary? (Choose THREE.)

Accepted Answer

Create a rogue access point with the same SSID as the target network. An evil twin attack involves creating a rogue access point with the same SSID as a legitimate network, deauthenticating clients, and capturing the handshake.

Answer

Configure WPA3 encryption on the rogue AP

Answer

Use Wireshark to decrypt the traffic

Question 8

A penetration tester is conducting a post-exploitation phase on a Windows target and wants to dump credentials. Which of the following tools can be used? (Choose TWO.)

Accepted Answer

secretsdump.py. Mimikatz is a well-known credential dumping tool, and secretsdump.py from Impacket can dump hashes remotely.

Answer

Nmap

Answer

Hydra

Answer

Wireshark

Question 9

A penetration tester needs to identify live hosts and open ports on a target network. Which tool is most appropriate for this task?

Accepted Answer

Nmap. Nmap is the standard tool for network discovery and port scanning.

Answer

Burp Suite

Answer

Metasploit

Answer

Wireshark

Question 10

During a web application test, a penetration tester intercepts requests between the browser and server and modifies them in real time. Which Burp Suite tool is designed for this purpose?

Accepted Answer

Proxy. Burp Proxy intercepts and allows modification of HTTP/HTTPS requests.

Answer

Repeater

Answer

Sequencer

Answer

Intruder

Question 11

After gaining initial access to a Windows system, a penetration tester wants to extract password hashes from the local SAM database. Which Impacket tool should be used?

Accepted Answer

secretsdump. Secretsdump, because it is the Impacket tool specifically designed to extract password hashes from a Windows SAM database, as well as from NTDS.dit and LSA secrets. It remotely accesses the SAM hive via the Windows registry or uses Volume Shadow Copy to dump hashes without requiring interactive login.

Answer

GetUserSPNs

Answer

psexec

Answer

wmiexec

Question 12

A penetration tester is conducting a wireless assessment and needs to capture the four-way handshake to perform offline WPA cracking. Which tool is best suited for capturing the handshake?

Accepted Answer

airodump-ng. Airodump-ng (option D) is the correct tool for capturing the four-way handshake because it passively monitors wireless traffic and can save captured packets to a file (e.g., .cap or .pcap). The four-way handshake occurs during the WPA/WPA2 authentication process between a client and an access point, and airodump-ng's ability to filter on a specific channel and BSSID allows the tester to isolate and record the handshake frames for offline cracking.

Answer

aircrack-ng

Answer

aireplay-ng

Answer

Airmon-ng

Question 13

A penetration tester needs to perform an online brute-force attack against an SSH service. Which tool is most appropriate?

Accepted Answer

Hydra. Hydra is a versatile online brute-force tool supporting many protocols including SSH.

Answer

John the Ripper

Answer

CrackMapExec

Answer

Hashcat

Question 14

During a code review, a penetration tester identifies a PHP function that executes arbitrary shell commands. Which function poses the greatest security risk if user input is not sanitized?

Accepted Answer

system. system() executes commands and returns output, allowing arbitrary command execution if input is unsanitized.

Answer

echo

Answer

strlen

Answer

array_pop

Question 15

A penetration tester is analyzing a Java application and finds the following code snippet: Object obj = ois.readObject(); where ois is an ObjectInputStream. What vulnerability is most likely present if the input is untrusted?

Accepted Answer

Insecure deserialization. Insecure deserialization occurs when readObject() is called on untrusted data, potentially leading to code execution.

Answer

SQL injection

Answer

Path traversal

Answer

Cross-site scripting