PT0-002 Tools and Code Analysis Practice Test 3 — 15 Questions

Question 1

A penetration tester has been given a target IP address and needs to quickly determine which services are running on the target. Which Nmap option should the tester use to perform a SYN scan with service version detection and default NSE scripts?

Accepted Answer

nmap -sS -sV -sC 192.168.1.10. Option A is correct because the -sS flag initiates a SYN stealth scan, -sV enables service version detection by probing open ports to determine application and version information, and -sC runs the default set of NSE scripts for common enumeration tasks. Together, these three options fulfill the requirement to quickly identify running services with version details and additional script-based reconnaissance, all while using a half-open TCP scan to minimize log generation.

Answer

nmap -sT -sV -sC 192.168.1.10

Answer

nmap -A 192.168.1.10

Answer

nmap -sS -O 192.168.1.10

Question 2

During a web application penetration test, the tester captures a login request in Burp Suite and wants to automate a brute-force attack against the password field. Which Burp Suite tool is specifically designed for this purpose?

Accepted Answer

Intruder. Intruder is the correct tool because it is specifically designed for automated customized attacks, including brute-force attacks, against web application parameters. It allows the tester to define a payload position (e.g., the password field in a login request) and iterate through a list of candidate passwords, automatically resending the request with each payload value and analyzing the responses.

Answer

Scanner

Answer

Sequencer

Answer

Repeater

Question 3

A penetration tester needs to perform a Kerberoasting attack against a Windows Active Directory environment. Which tool from the Impacket suite should the tester use to request service tickets and extract TGS hashes for offline cracking?

Accepted Answer

GetUserSPNs.py. GetUserSPNs.py in the Impacket suite is used to find and request service principal names (SPNs) and retrieve TGS hashes for Kerberoasting.

Answer

wmiexec.py

Answer

secretsdump.py

Answer

psexec.py

Question 4

A penetration tester is conducting a wireless security assessment. The target network uses WPA2-PSK. The tester has captured the four-way handshake. Which tool from the Aircrack-ng suite can be used to attempt to recover the pre-shared key by performing a dictionary attack?

Accepted Answer

aircrack-ng. Aircrack-ng is the tool within the suite that performs dictionary or brute-force attacks on captured WPA/WPA2 handshakes to recover the PSK.

Answer

airtun-ng

Answer

airodump-ng

Answer

aireplay-ng

Question 5

During code review, a penetration tester identifies the following line in a PHP web application: $sql = "SELECT * FROM users WHERE username='" . $_GET['user'] . "'"; Which type of vulnerability is most likely present?

Accepted Answer

SQL injection. Direct concatenation of user input into an SQL query without sanitization results in SQL injection vulnerability.

Answer

Insecure deserialization

Answer

Command injection

Answer

Cross-site scripting (XSS)

Question 6

A penetration tester is analyzing a Linux binary and wants to decompile it to understand its logic. Which open-source tool is specifically designed for reverse engineering and can generate C-like pseudocode from compiled binaries?

Accepted Answer

Ghidra. Ghidra, developed by the NSA, is a reverse engineering framework that can decompile binaries into C-like pseudocode.

Answer

IDA Pro Free

Answer

dnSpy

Answer

jadx

Question 7

A penetration tester needs to perform a dictionary attack against an SSH service. Which of the following tools is best suited for this task?

Accepted Answer

Hydra. Hydra is a versatile online brute-force tool that supports many protocols, including SSH.

Answer

CrackMapExec

Answer

John the Ripper

Answer

Hashcat

Question 8

During a penetration test, the tester wants to capture network traffic for later analysis. Which tool is most appropriate for capturing packets and saving them to a pcap file?

Accepted Answer

Wireshark. Wireshark is a network protocol analyzer capable of capturing live traffic and saving it to pcap files.

Answer

Metasploit

Answer

Burp Suite

Answer

Nmap

Question 9

A penetration tester has obtained a set of NTLM password hashes from a Windows domain controller. The tester wants to perform an offline cracking attack using GPU acceleration. Which tool is best suited for this purpose?

Accepted Answer

Hashcat. Hashcat is a powerful password cracker that supports GPU acceleration and can crack NTLM hashes efficiently.

Answer

CrackMapExec

Answer

John the Ripper

Answer

Hydra

Question 10

A penetration tester is performing a cloud security audit of an AWS environment. Which tool is specifically designed for AWS exploitation and post-exploitation, including privilege escalation and persistence?

Accepted Answer

Pacu. Pacu is an AWS exploitation framework that provides modules for enumeration, privilege escalation, and persistence.

Answer

CrackMapExec

Answer

ScoutSuite

Answer

Prowler

Question 11

A penetration tester is writing a Python script to send a crafted TCP packet to a target. Which Python library should the tester use for low-level packet crafting and injection?

Accepted Answer

scapy. Scapy is the correct choice because it is a powerful Python library specifically designed for low-level packet crafting, manipulation, and injection. It allows the tester to construct arbitrary TCP packets at the raw socket level, control individual flags, sequence numbers, and payloads, and send them directly over the wire using Layer 2 or Layer 3 sockets. This makes it ideal for tasks like SYN flooding, TCP handshake manipulation, or custom protocol fuzzing.

Answer

requests

Answer

impacket

Answer

socket

Question 12

A penetration tester needs to enumerate Active Directory users and groups from a Windows domain. Which PowerShell tool is specifically designed for AD enumeration and is commonly used in post-exploitation?

Accepted Answer

PowerView. PowerView (option D) is a PowerShell tool specifically designed for Active Directory enumeration, providing functions to query users, groups, computers, and permissions via LDAP. It is widely used in post-exploitation because it runs in-memory, avoids writing to disk, and integrates seamlessly with PowerShell's pipeline for stealthy reconnaissance.

Answer

Invoke-Mimikatz

Answer

Nmap

Answer

CrackMapExec

Question 13

A penetration tester is reviewing a Java application for insecure deserialization vulnerabilities. Which of the following should the tester look for? (Choose TWO.)

Accepted Answer

Accepting serialized objects from user input without sanitization. Insecure deserialization vulnerabilities often arise from using ObjectInputStream without filtering and from accepting serialized data from untrusted sources.

Answer

Use of eval() functions

Answer

Hardcoded credentials in configuration files

Answer

Use of prepared statements for SQL queries

Question 14

A penetration tester is performing a wireless assessment and wants to set up an evil twin attack. Which of the following steps are necessary? (Choose THREE.)

Accepted Answer

Create a rogue access point with the same SSID as the target network. An evil twin attack involves creating a rogue access point with the same SSID as a legitimate network, deauthenticating clients, and capturing the handshake.

Answer

Configure WPA3 encryption on the rogue AP

Answer

Use Wireshark to decrypt the traffic

Question 15

A penetration tester is conducting a post-exploitation phase on a Windows target and wants to dump credentials. Which of the following tools can be used? (Choose TWO.)

Accepted Answer

secretsdump.py. Mimikatz is a well-known credential dumping tool, and secretsdump.py from Impacket can dump hashes remotely.

Answer

Nmap

Answer

Hydra

Answer

Wireshark