PT0-002 Vulnerability Discovery and Analysis Practice Test 3 — 15 Questions

Question 1

Which tool would be best for capturing and analyzing network packets to troubleshoot a web application?

Accepted Answer

Wireshark. Wireshark is the correct tool because it is designed specifically for deep packet inspection, allowing you to capture live network traffic and analyze individual packets at multiple OSI layers. For troubleshooting a web application, you can filter HTTP/HTTPS requests and responses, examine TCP handshakes, and identify latency or payload issues, which is essential for diagnosing performance or functional problems.

Answer

Nmap

Answer

Burp Suite

Answer

Aircrack-ng

Question 2

A penetration tester wants to exploit a Windows system using a known vulnerability and gain a meterpreter session. Which tool is most appropriate?

Accepted Answer

Metasploit Framework. Metasploit Framework (B) is the most appropriate tool because it provides a comprehensive exploit development and execution environment, including pre-built modules for known Windows vulnerabilities and seamless integration with Meterpreter payloads. Unlike the other options, Metasploit is specifically designed to deliver a Meterpreter session after exploitation, handling payload generation, staging, and post-exploitation tasks natively.

Answer

CrackMapExec

Answer

Impacket

Answer

Hydra

Question 3

During a source code review of a PHP application, the tester finds the following line: $query = "SELECT * FROM users WHERE username = '" . $_POST['username'] . "'"; Which vulnerability is present?

Accepted Answer

SQL injection. Concatenating user input directly into an SQL query without sanitization leads to SQL injection.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Command injection

Question 4

A tester needs to perform an online brute-force attack against an SSH service. Which tool is most suitable?

Accepted Answer

Hydra. Hydra is a fast online brute-force tool that supports many protocols including SSH.

Answer

Hashcat

Answer

John the Ripper

Answer

Aircrack-ng

Question 5

A penetration tester has been given a target IP address and needs to quickly determine which services are running on the target. Which Nmap option should the tester use to perform a SYN scan with service version detection and default NSE scripts?

Accepted Answer

nmap -sS -sV -sC 192.168.1.10. The -sS flag initiates a SYN stealth scan, -sV enables service version detection by probing open ports to determine application and version information, and -sC runs the default set of NSE scripts for common enumeration tasks. Together, these three options fulfill the requirement to quickly identify running services with version details and additional script-based reconnaissance, all while using a half-open TCP scan to minimize log generation.

Answer

nmap -sT -sV -sC 192.168.1.10

Answer

nmap -A 192.168.1.10

Answer

nmap -sS -O 192.168.1.10

Question 6

During a web application penetration test, the tester captures a login request in Burp Suite and wants to automate a brute-force attack against the password field. Which Burp Suite tool is specifically designed for this purpose?

Accepted Answer

Intruder. Intruder is the correct tool because it is specifically designed for automated customized attacks, including brute-force attacks, against web application parameters. It allows the tester to define a payload position (e.g., the password field in a login request) and iterate through a list of candidate passwords, automatically resending the request with each payload value and analyzing the responses.

Answer

Scanner

Answer

Sequencer

Answer

Repeater

Question 7

A penetration tester needs to perform a Kerberoasting attack against a Windows Active Directory environment. Which tool from the Impacket suite should the tester use to request service tickets and extract TGS hashes for offline cracking?

Accepted Answer

GetUserSPNs.py. GetUserSPNs.py in the Impacket suite is used to find and request service principal names (SPNs) and retrieve TGS hashes for Kerberoasting.

Answer

wmiexec.py

Answer

secretsdump.py

Answer

psexec.py

Question 8

A penetration tester is conducting a wireless security assessment. The target network uses WPA2-PSK. The tester has captured the four-way handshake. Which tool from the Aircrack-ng suite can be used to attempt to recover the pre-shared key by performing a dictionary attack?

Accepted Answer

aircrack-ng. Aircrack-ng is the tool within the suite that performs dictionary or brute-force attacks on captured WPA/WPA2 handshakes to recover the PSK.

Answer

airtun-ng

Answer

airodump-ng

Answer

aireplay-ng

Question 9

During code review, a penetration tester identifies the following line in a PHP web application: $sql = "SELECT * FROM users WHERE username='" . $_GET['user'] . "'"; Which type of vulnerability is most likely present?

Accepted Answer

SQL injection. Direct concatenation of user input into an SQL query without sanitization results in SQL injection vulnerability.

Answer

Insecure deserialization

Answer

Command injection

Answer

Cross-site scripting (XSS)

Question 10

A penetration tester is analyzing a Linux binary and wants to decompile it to understand its logic. Which open-source tool is specifically designed for reverse engineering and can generate C-like pseudocode from compiled binaries?

Accepted Answer

Ghidra. Ghidra, developed by the NSA, is a reverse engineering framework that can decompile binaries into C-like pseudocode.

Answer

IDA Pro Free

Answer

dnSpy

Answer

jadx

Question 11

A penetration tester needs to perform a dictionary attack against an SSH service. Which of the following tools is best suited for this task?

Accepted Answer

Hydra. Hydra is a versatile online brute-force tool that supports many protocols, including SSH.

Answer

CrackMapExec

Answer

John the Ripper

Answer

Hashcat

Question 12

During a penetration test, the tester wants to capture network traffic for later analysis. Which tool is most appropriate for capturing packets and saving them to a pcap file?

Accepted Answer

Wireshark. Wireshark is a network protocol analyzer capable of capturing live traffic and saving it to pcap files.

Answer

Metasploit

Answer

Burp Suite

Answer

Nmap

Question 13

A penetration tester has obtained a set of NTLM password hashes from a Windows domain controller. The tester wants to perform an offline cracking attack using GPU acceleration. Which tool is best suited for this purpose?

Accepted Answer

Hashcat. Hashcat is purpose-built for offline password cracking and is optimized for GPU acceleration via OpenCL and CUDA, supporting NTLM hashes with modes like '-m 1000'. It scales across multiple GPUs and offers rule-based, mask, and combinator attacks, making it the standard tool for high-speed offline cracking.

Answer

CrackMapExec

Answer

John the Ripper

Answer

Hydra

Question 14

A penetration tester is performing a cloud security audit of an AWS environment. Which tool is specifically designed for AWS exploitation and post-exploitation, including privilege escalation and persistence?

Accepted Answer

Pacu. Pacu is an AWS exploitation framework that provides modules for enumeration, privilege escalation, and persistence.

Answer

CrackMapExec

Answer

ScoutSuite

Answer

Prowler

Question 15

A penetration tester is writing a Python script to send a crafted TCP packet to a target. Which Python library should the tester use for low-level packet crafting and injection?

Accepted Answer

scapy. Scapy is the correct choice because it is a powerful Python library specifically designed for low-level packet crafting, manipulation, and injection. It allows the tester to construct arbitrary TCP packets at the raw socket level, control individual flags, sequence numbers, and payloads, and send them directly over the wire using Layer 2 or Layer 3 sockets. This makes it ideal for tasks like SYN flooding, TCP handshake manipulation, or custom protocol fuzzing.

Answer

requests

Answer

impacket

Answer

socket