PT0-002 Timed Practice Test 1 — 10 Questions

Question 1

A penetration tester has completed the test and is preparing the final report. The client asks the tester to include a section that describes the scope, methodology, and tools used. In which section should this information be placed?

10 minute time limit — choose an answer to begin.

Accepted Answer

Appendices. Appendices are the appropriate place for supplementary information such as scope, methodology, and tools used.

Answer

Remediation section

Answer

Technical findings

Answer

Executive summary

Question 2

Which SQL injection technique involves injecting a query that causes a delay in response, allowing the attacker to infer information based on response time?

Accepted Answer

Blind time-based SQL injection. Blind time-based SQL injection uses delays (e.g., WAITFOR DELAY) to infer true/false conditions.

Answer

Error-based SQL injection

Answer

UNION-based SQL injection

Answer

Boolean-blind SQL injection

Question 3

During the reconnaissance phase, a penetration tester wants to identify subdomains of a target domain without making direct requests to the target's own DNS servers. Which technique would be BEST for this purpose?

Accepted Answer

Using search engines and public certificate transparency logs. Search engines (e.g., Google dorking) and public certificate transparency logs (e.g., crt.sh) allow a tester to discover subdomains by querying aggregated historical DNS and TLS certificate data, without sending any queries to the target's authoritative DNS servers. This passive reconnaissance technique avoids alerting the target's infrastructure and complies with the requirement of no direct requests to the target's DNS servers.

Answer

Using the 'nslookup' command interactively

Answer

Performing a zone transfer

Answer

Using the 'host' command

Question 4

A tester wants to enumerate SMB shares and execute commands remotely on a Windows target using captured credentials. Which tool is most appropriate?

Accepted Answer

CrackMapExec. CrackMapExec is a versatile tool for SMB enumeration, command execution, and lateral movement with credentials.

Answer

Hashcat

Answer

Responder

Answer

Bettercap

Question 5

A penetration tester has gained access to a Linux server and wants to move laterally to a Windows server. The tester captured a hash of a domain user. Which tool can be used to authenticate to the Windows server using the hash?

Accepted Answer

evil-winrm. evil-winrm supports pass-the-hash authentication over WinRM, allowing lateral movement.

Answer

Ligolo-ng

Answer

SSH

Answer

Chisel

Question 6

You are conducting a penetration test and need to identify subdomains of a target domain using a passive approach that does not generate traffic to the target's servers. Which technique should you use?

Accepted Answer

Certificate transparency logs. Certificate transparency logs (e.g., crt.sh) are public logs of SSL/TLS certificates, often containing subdomain names. Querying them is passive and does not interact with the target.

Answer

DNS cache snooping

Answer

Subdomain bruteforce with gobuster

Answer

DNS zone transfer

Question 7

A penetration tester wants to discover email addresses associated with a target domain (example.com) without sending any network packets to the target's systems. Which technique is BEST suited for this?

Accepted Answer

Google dorking. Google dorking uses advanced search operators (e.g., site:example.com intext:@example.com) to index publicly available information from Google's cached pages, allowing discovery of email addresses without sending any packets to the target's infrastructure. This passive reconnaissance technique relies solely on pre-existing search engine data, making it ideal for avoiding direct interaction with the target.

Answer

DNS brute forcing

Answer

WHOIS lookup

Answer

SMB enumeration

Question 8

A penetration tester is compiling the final report. The client's compliance officer requires a section that maps each finding to specific regulatory requirements (e.g., PCI DSS, HIPAA). Which section of the report is best suited for this mapping?

Accepted Answer

Compliance Mapping. The Compliance Mapping section is specifically designed to cross-reference each technical finding with relevant regulatory frameworks such as PCI DSS, HIPAA, or GDPR. This allows the compliance officer to quickly verify that all required controls are addressed and that the report meets audit or legal standards. The other sections focus on summarizing or detailing technical issues, not on mapping findings to specific regulations.

Answer

Executive Summary

Answer

Technical Findings

Answer

Appendices

Question 9

A penetration tester discovers a critical vulnerability during an assessment. According to best practices, when should the tester communicate this finding to the client?

Accepted Answer

Immediately upon discovery. Critical findings should be reported immediately to allow the client to take urgent action.

Answer

Only in the final report

Answer

After the test is complete

Answer

At the next scheduled status meeting

Question 10

In a Python script for a penetration test, you need to craft a custom TCP packet with specific flags. Which library is best suited for low-level packet manipulation?

Accepted Answer

scapy. Scapy allows crafting, sending, and sniffing network packets at a low level, supporting custom TCP flags.

Answer

requests

Answer

socket

Answer

impacket