PT0-002 Vulnerability Discovery and Analysis Practice Test 4 — 15 Questions

Question 1

A penetration tester needs to enumerate Active Directory users and groups from a Windows domain. Which PowerShell tool is specifically designed for AD enumeration and is commonly used in post-exploitation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

PowerView. PowerView (option D) is a PowerShell tool specifically designed for Active Directory enumeration, providing functions to query users, groups, computers, and permissions via LDAP. It is widely used in post-exploitation because it runs in-memory, avoids writing to disk, and integrates seamlessly with PowerShell's pipeline for stealthy reconnaissance.

Answer

Invoke-Mimikatz

Answer

Nmap

Answer

CrackMapExec

Question 2

A penetration tester is reviewing a Java application for insecure deserialization vulnerabilities. Which of the following should the tester look for? (Choose TWO.)

Accepted Answer

Accepting serialized objects from user input without sanitization. Insecure deserialization vulnerabilities often arise from using ObjectInputStream without filtering and from accepting serialized data from untrusted sources.

Answer

Use of eval() functions

Answer

Hardcoded credentials in configuration files

Answer

Use of prepared statements for SQL queries

Question 3

A penetration tester is performing a wireless assessment and wants to set up an evil twin attack. Which of the following steps are necessary? (Choose THREE.)

Accepted Answer

Create a rogue access point with the same SSID as the target network. An evil twin attack involves creating a rogue access point with the same SSID as a legitimate network, deauthenticating clients, and capturing the handshake.

Answer

Configure WPA3 encryption on the rogue AP

Answer

Use Wireshark to decrypt the traffic

Question 4

A penetration tester is conducting a post-exploitation phase on a Windows target and wants to dump credentials. Which of the following tools can be used? (Choose TWO.)

Accepted Answer

secretsdump.py. Mimikatz is a well-known credential dumping tool, and secretsdump.py from Impacket can dump hashes remotely.

Answer

Nmap

Answer

Hydra

Answer

Wireshark

Question 5

A penetration tester needs to identify live hosts and open ports on a target network. Which tool is most appropriate for this task?

Accepted Answer

Nmap. Nmap is the standard tool for network discovery and port scanning.

Answer

Burp Suite

Answer

Metasploit

Answer

Wireshark

Question 6

During a web application test, a penetration tester intercepts requests between the browser and server and modifies them in real time. Which Burp Suite tool is designed for this purpose?

Accepted Answer

Proxy. Burp Proxy intercepts and allows modification of HTTP/HTTPS requests.

Answer

Repeater

Answer

Sequencer

Answer

Intruder

Question 7

After gaining initial access to a Windows system, a penetration tester wants to extract password hashes from the local SAM database. Which Impacket tool should be used?

Accepted Answer

secretsdump. Secretsdump, because it is the Impacket tool specifically designed to extract password hashes from a Windows SAM database, as well as from NTDS.dit and LSA secrets. It remotely accesses the SAM hive via the Windows registry or uses Volume Shadow Copy to dump hashes without requiring interactive login.

Answer

GetUserSPNs

Answer

psexec

Answer

wmiexec

Question 8

A penetration tester is conducting a wireless assessment and needs to capture the four-way handshake to perform offline WPA cracking. Which tool is best suited for capturing the handshake?

Accepted Answer

airodump-ng. Airodump-ng (option D) is the correct tool for capturing the four-way handshake because it passively monitors wireless traffic and can save captured packets to a file (e.g., .cap or .pcap). The four-way handshake occurs during the WPA/WPA2 authentication process between a client and an access point, and airodump-ng's ability to filter on a specific channel and BSSID allows the tester to isolate and record the handshake frames for offline cracking.

Answer

aircrack-ng

Answer

aireplay-ng

Answer

Airmon-ng

Question 9

A penetration tester needs to perform an online brute-force attack against an SSH service. Which tool is most appropriate?

Accepted Answer

Hydra. Hydra is a versatile online brute-force tool supporting many protocols including SSH.

Answer

John the Ripper

Answer

CrackMapExec

Answer

Hashcat

Question 10

During a code review, a penetration tester identifies a PHP function that executes arbitrary shell commands. Which function poses the greatest security risk if user input is not sanitized?

Accepted Answer

system. system() executes commands and returns output, allowing arbitrary command execution if input is unsanitized.

Answer

echo

Answer

strlen

Answer

array_pop

Question 11

A penetration tester is analyzing a Java application and finds the following code snippet: Object obj = ois.readObject(); where ois is an ObjectInputStream. What vulnerability is most likely present if the input is untrusted?

Accepted Answer

Insecure deserialization. Insecure deserialization occurs when readObject() is called on untrusted data, potentially leading to code execution.

Answer

SQL injection

Answer

Path traversal

Answer

Cross-site scripting

Question 12

A penetration tester has captured network traffic and wants to analyze it using Wireshark. Which two actions can the tester perform to focus on specific types of communication? (Choose TWO.)

Accepted Answer

Use the Conversations window. Option A is correct because Wireshark's Conversations window (Statistics > Conversations) groups captured packets by protocol and endpoint pairs (Ethernet, IPv4, IPv6, TCP, UDP), letting the tester quickly identify and isolate specific communication flows between hosts. Option C is correct because display filters (e.g., tcp.port == 443, ip.addr == 10.0.0.5, http) narrow the visible packet list to only the traffic matching specified protocol fields, which is the primary way to focus on particular types of communication. Option B is not appropriate here because decrypting SSL/TLS requires possessing the private key or session keys and is not a filtering/focusing action Wireshark performs on its own. Option D is incorrect because a port scan is an active reconnaissance technique that generates new traffic rather than analyzing the already-captured traffic. Option E is incorrect because Nmap is a separate scanning tool and does not produce Wireshark analysis reports.

Answer

Decrypt SSL/TLS traffic

Answer

Run a port scan

Answer

Generate a report with Nmap

Question 13

During a penetration test, a tester needs to perform a deauthentication attack to force a client to reconnect and capture the WPA handshake. Which two tools from the Aircrack-ng suite are required? (Choose TWO.)

Accepted Answer

aireplay-ng. Airodump-ng captures the handshake, and aireplay-ng sends deauth packets.

Answer

airmon-ng

Answer

aircrack-ng

Answer

airolib-ng

Question 14

A penetration tester is reverse-engineering a .NET binary to understand its authentication logic. Which three tools are suitable for decompiling .NET assemblies? (Choose THREE.)

Accepted Answer

dotPeek. dnSpy, ILSpy, and JetBrains dotPeek are decompilers for .NET. Ghidra is for native code, jadx for Android APK.

Answer

jadx

Answer

Ghidra

Question 15

A penetration tester is writing a Bash script to automate scanning of multiple subnets with Nmap and parse the output. Which three features are commonly used in such a script? (Choose THREE.)

Accepted Answer

Nmap XML output (-oX). Option B (Nmap XML output -oX) is correct because -oX writes scan results to a machine-readable XML file, which a Bash script can then parse reliably with tools like grep, awk, or xmllint. Option C (For loop) is correct because a Bash for loop iterates over a list of subnets or target ranges, invoking Nmap once per subnet to automate the scanning process. Option D (grep) is correct because grep filters the Nmap output (or XML file) for specific patterns such as open ports or host states, enabling the script to extract and act on relevant results. Option A (PowerShell cmdlets) does not belong because cmdlets are PowerShell constructs, not Bash features, and would not run natively in a Bash script. Option E (PySerial) does not belong because PySerial is a Python library for serial-port communication, unrelated to Nmap scanning or Bash scripting.

Answer

PowerShell cmdlets

Answer

PySerial