PT0-002 Timed Practice Test 2 — 10 Questions

Question 1

During a web application test, a penetration tester discovers that the application exposes internal object references (e.g., user ID in a URL) and does not properly authorize access. The tester can view other users' private data by simply changing the ID parameter. Which type of vulnerability does this represent?

10 minute time limit — choose an answer to begin.

Accepted Answer

Insecure Direct Object Reference (IDOR). The vulnerability is Insecure Direct Object Reference (IDOR) because the application exposes internal object references (e.g., user ID in a URL) and fails to enforce proper authorization checks. By simply changing the ID parameter, the tester can access other users' private data without authentication or permission validation, which is the hallmark of IDOR.

Answer

Cross-Site Request Forgery (CSRF)

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)

Question 2

A penetration tester is preparing a report for a client's CISO who is not technical. The CISO needs to understand the overall risk posture and the business impact of the findings. Which section of the report should be tailored for this audience?

Accepted Answer

Executive summary. The executive summary is designed for non-technical stakeholders like a CISO to quickly grasp the overall risk posture and business impact without needing to interpret raw data or technical jargon. It synthesizes findings into high-level business risks, such as potential financial loss or regulatory exposure, rather than detailing specific vulnerabilities or exploit chains. This section ensures the audience can make informed decisions about resource allocation and risk acceptance.

Answer

Technical findings

Answer

Appendices with raw scan data

Answer

Remediation details

Question 3

During an internal penetration test, a tester compromises a server that is part of a Kubernetes cluster. The tester has access to the node's operating system but not to the cluster's administrative credentials. Which of the following techniques would most likely allow the tester to escalate privileges to cluster-admin or access sensitive resources within the cluster?

Accepted Answer

Extracting a service account token from a running container and using it to access the Kubernetes API. Service account tokens are automatically mounted into pods at /var/run/secrets/kubernetes.io/serviceaccount/token. An attacker with node-level access can extract this token from a running container's filesystem and use it to authenticate to the Kubernetes API server. Since service accounts are often granted broad permissions via RBAC bindings, this token may allow the tester to access sensitive resources or even escalate to cluster-admin if the service account has such privileges.

Answer

Exploiting a kernel vulnerability on the node to escape to the host and then compromise the Kubernetes API server

Answer

Searching for a kubeconfig file on the node that contains a cluster-admin token

Answer

Modifying a ConfigMap to inject a malicious pod that runs with elevated privileges

Question 4

A client requests a penetration test of their network and provides a list of IP addresses. During scoping, the tester notices that several IP addresses belong to a major cloud service provider. What should the tester do FIRST before including those IP addresses in the test?

Accepted Answer

Ask the client to verify ownership and obtain written authorization from the cloud provider if needed. Testing cloud provider IP addresses without explicit authorization violates the cloud provider's terms of service and could be considered unauthorized access, potentially leading to legal action. The tester must first verify that the client actually owns those IPs (e.g., via ARIN WHOIS or cloud provider documentation) and obtain written authorization from the cloud provider, as the provider's shared infrastructure means the tester's traffic could impact other tenants. This aligns with the PT0-002 scoping requirement to confirm all targets are within the authorized boundary.

Answer

Proceed with testing since the client provided the IP addresses

Answer

Exclude the cloud IP addresses from the scope without further discussion

Answer

Perform a quick port scan to determine if the IPs are responsive before deciding

Question 5

A penetration tester is analyzing a Python script that uses the 'scapy' library to craft custom network packets. The relevant code is: ```python from scapy.all import * packet = IP(dst="192.168.1.1")/TCP(dport=80, flags="S") response = sr1(packet, timeout=2) if response.haslayer(TCP): print(response.getlayer(TCP).flags) ``` What is the primary goal of this script?

Accepted Answer

To perform a SYN scan and determine if port 80 is open. The script uses Scapy to craft a TCP SYN packet (flags='S') to port 80 and sends it with sr1(), which waits for a single response. If a TCP layer is present in the reply, it prints the flags. This is the classic behavior of a SYN scan (half-open scan): it sends a SYN and analyzes the response to determine if the port is open (SYN-ACK) or closed (RST), without completing the handshake. Option B correctly identifies this as a SYN scan to check if port 80 is open.

Answer

To perform a TCP connect scan by completing the three-way handshake

Answer

To send an HTTP GET request and capture the web page

Answer

To perform a UDP scan on port 80

Question 6

A penetration tester is preparing the final report. The client's CEO needs to understand the overall risk level and the business impact of the findings. Which of the following should be included in the executive summary?

Accepted Answer

A high-level summary of the test's scope, overall risk rating, and business impact. The executive summary is designed for senior management, such as the CEO, who needs a concise overview of the penetration test's scope, overall risk rating, and business impact to make informed decisions. Detailed technical data, such as CVSS scores or exploitation commands, is inappropriate for this audience and belongs in the technical report. Option D directly addresses the requirement for a high-level, business-focused summary.

Answer

A detailed list of all vulnerabilities with CVSS scores

Answer

The exact commands and payloads used during exploitation

Answer

A quantitative risk analysis including annualized loss expectancy

Question 7

A penetration tester is analyzing a Python script used for web application testing. The script imports the 'socket' module and uses it to create a raw socket. Which of the following is the most likely purpose of the script?

Accepted Answer

Sending crafted TCP packets to perform a SYN flood. The 'socket' module in Python provides low-level networking interfaces, and creating a raw socket (using `socket.SOCK_RAW`) allows the script to craft and send custom packets at the IP layer. A SYN flood attack involves sending a high volume of TCP SYN packets with spoofed source IP addresses to exhaust a target's resources, which requires raw socket access to manipulate packet headers. Therefore, the most likely purpose of the script is sending crafted TCP packets to perform a SYN flood.

Answer

Creating a reverse shell payload

Answer

Parsing HTTP responses for header injection

Answer

Automating user-agent rotation for web requests

Question 8

A penetration tester is tasked with performing vulnerability scanning on a target organization that uses a web application firewall (WAF) and an intrusion prevention system (IPS). The tester wants to avoid being blocked while still gathering comprehensive data. Which scanning approach is most effective?

Accepted Answer

Use a slow, distributed scan from multiple IP addresses with random delays. A slow, distributed scan from multiple IP addresses with random delays is most effective because it evades rate-based detection mechanisms in WAFs and IPSs. By spreading the scan across many sources and introducing jitter, the traffic appears as normal user activity rather than a coordinated attack, allowing comprehensive data collection without triggering blocks.

Answer

Perform an aggressive scan with a high thread count to complete before the WAF adapts

Answer

Only perform passive reconnaissance and avoid active scanning

Answer

Use known WAF bypass techniques for each request

Question 9

A penetration tester has completed the test and is writing the findings section. For a critical vulnerability, the tester wants to provide a clear and actionable remediation recommendation. Which of the following is the best practice for writing this recommendation?

Accepted Answer

Provide a step-by-step guide including commands, patches, and configuration changes. A penetration test report must provide actionable remediation that the client can implement immediately. A step-by-step guide with specific commands, patch identifiers, and configuration changes ensures the client can verify and apply the fix without ambiguity, which is critical for a high-severity vulnerability.

Answer

State 'Upgrade the software to the latest version'

Answer

Recommend applying vendor-supplied patches but do not include specific versions

Answer

Suggest hiring a third-party consultant to fix the issue

Question 10

A penetration tester has physical access to a small office. The network switch is in a locked cabinet, but the tester notices the lock is broken. The switch has multiple ports, and the tester wants to connect to the internal network. The tester has a laptop with an Ethernet port. However, the tester suspects that port security is enabled on the switch ports, which would block the connection if the MAC address is not authorized. Which action should the tester take first to gain network access?

Accepted Answer

Connect to the switch's console port and attempt default credentials.. The tester has physical access to the switch and the lock is broken, allowing direct console access. If port security is enabled, plugging into a data port (Option C) would be blocked. The fastest first step is to connect to the console port and try default credentials (e.g., cisco/cisco) to gain administrative control of the switch, which can then be used to disable port security or add the tester's MAC address to the allowed list.

Answer

Perform a MAC flooding attack to fill the switch's MAC table.

Answer

Use a DHCP starvation attack to exhaust IP addresses.

Answer

Plug the laptop into an available switch port.