PT0-002 Tools and Code Analysis Practice Test 6 — 15 Questions

Question 1

A tester runs a Python script to perform a directory traversal attack. The output shows: 'Error: 403 Forbidden'. What is the most likely cause?

Accepted Answer

The web server is patched against traversal attacks. Option A is correct because a 403 error indicates the server is blocking the request, likely due to proper input validation. Option B is wrong because if the file doesn't exist, a 404 would occur. Option C is wrong because the request is syntactically correct. Option D is wrong because authentication is not shown; the error is forbidden, not unauthorized.

Answer

The script lacks authentication

Answer

The file does not exist

Answer

The request is malformed

Question 2

A tester uses OllyDbg to step through a binary. The EAX register contains 0x00401234. What does this represent?

Accepted Answer

A memory address. Option A is correct because EAX holds a memory address (0x00401234 is a typical address in a process). Option B is wrong because an ASCII character would be a small value. Option C is wrong because file handles are usually small integers or pointers. Option D is wrong because system call numbers are typically small integers.

Answer

A system call number

Answer

A file handle

Answer

An ASCII character

Question 3

A penetration tester needs to enumerate active hosts and open ports on a network segment with minimal network traffic. Which tool should the tester use?

Accepted Answer

Nmap. Nmap with -sn (ping scan) is designed for host discovery using minimal network traffic. Hydra is for password cracking, Metasploit is an exploitation framework, and Nikto is a web server scanner.

Answer

Metasploit

Answer

Nikto

Answer

Hydra

Question 4

During a web application test, a penetration tester discovers that the server returns verbose error messages containing full file paths. Which type of attack is directly facilitated by this information disclosure?

Accepted Answer

Path traversal. Verbose error messages revealing file paths can enable path traversal attacks, as the attacker learns the directory structure. SQL injection may be facilitated by database error messages, but file paths are specific to path traversal.

Answer

SQL injection

Answer

CSRF

Answer

Cross-site scripting

Question 5

A penetration tester is analyzing a malicious script found on a compromised Linux server. The script uses obfuscation techniques including base64 encoding and variable substitution. Which tool or method is most effective for deobfuscating the script to understand its functionality?

Accepted Answer

Run the script with 'bash -x' in a sandbox. For deobfuscating shell scripts, running the script in a sandboxed environment with static analysis (e.g., using 'set -x' or a debugger) is most effective. IDA Pro is for binary analysis, Wireshark for network packets, and Nmap for scanning.

Answer

Use a Python emulator like Unicorn

Answer

Analyze packet captures with Wireshark

Answer

Disassemble with IDA Pro

Question 6

A penetration tester wants to perform a slow and stealthy port scan to avoid intrusion detection systems. Which Nmap option should be used?

Accepted Answer

-T0. The -T0 option sets the timing template to Paranoid, which is extremely slow and avoids IDS detection. -O is for OS detection, -sV for version detection, and -A for aggressive scan.

Answer

-O

Answer

-A

Answer

-sV

Question 7

During a penetration test, a tester needs to capture and analyze the traffic between a client and a server over an encrypted HTTPS connection. The tester has access to the server's private key. Which technique or tool should the tester employ?

Accepted Answer

Import the private key into Wireshark and enable TLS decryption. Using Wireshark with the server's private key allows decryption of TLS traffic by configuring the SSL/TLS protocol with the private key in the preferences. Burp Suite requires a CA certificate and proxy setup, but without client-side changes, it's less direct. TCPDump alone cannot decrypt. OpenSSL can be used to decrypt a captured session if the handshake is captured, but Wireshark is the standard tool for analysis.

Answer

Use Nmap's ssl-enum-ciphers script

Answer

Use Burp Suite with a proxy

Answer

Capture packets with TCPDump and analyze with OpenSSL

Question 8

A penetration tester is assessing a custom web application that uses JSON Web Tokens (JWT) for authentication. The tester suspects the token may be using a weak secret. Which tool is best suited to attempt cracking the JWT secret?

Accepted Answer

Hashcat. Hashcat is a powerful password cracking tool that can crack JWT secrets using dictionary or brute-force attacks. John the Ripper is similar but hashcat is generally faster and more GPU-optimized. DirBuster is for directory discovery, sqlmap for SQL injection, and Burp Suite Intruder can be used but is less efficient for offline cracking.

Answer

DirBuster

Answer

Burp Suite Intruder

Answer

sqlmap

Question 9

A penetration tester wants to quickly identify known vulnerabilities in a web application without triggering many alarms. Which tool should the tester use?

Accepted Answer

Nikto. Nikto is a web server scanner that performs checks for known vulnerabilities with minimal noise. SQLmap is for SQL injection only, OpenVAS is a comprehensive vulnerability scanner that may be noisy, and Metasploit is for exploitation.

Answer

SQLmap

Answer

Metasploit

Answer

OpenVAS

Question 10

During a penetration test, a tester needs to perform a man-in-the-middle (MITM) attack on a local network to capture credentials. Which tool should the tester use to ARP spoof and intercept traffic?

Accepted Answer

Ettercap. Ettercap is a comprehensive MITM tool that supports ARP spoofing, sniffing, and injection. Wireshark is for packet analysis, not active spoofing. TCPDump is for packet capture only. Nmap can be used for discovery but not MITM.

Answer

Wireshark

Answer

Nmap

Answer

TCPDump

Question 11

A penetration tester is analyzing a password hash obtained from a Windows domain controller. The hash format is $NT$70676e... and the tester wants to crack it using a rule-based attack. Which tool is best suited for this task?

Accepted Answer

John the Ripper. John the Ripper is a classic password cracker that supports NTLM hashes and rule-based attacks. Hashcat is also capable but typically requires specifying the hash mode; John is more straightforward for initial cracking. Hydra is for online cracking, not offline hash cracking. Cain & Abel is outdated and less efficient.

Answer

Cain & Abel

Answer

Hydra

Answer

Nikto

Question 12

Which TWO of the following are valid uses of the 'socat' tool during a penetration test? (Select TWO.)

Accepted Answer

Forwarding TCP ports to pivot through a compromised host. Socat can be used to create a reverse shell (option A) and to forward ports (option D). It is not typically used for HTTP content discovery (B) or file extraction (C); those are better done with curl or wget. It can also be used for MITM but option E is incorrect as socat does not inherently perform MITM.

Answer

Extracting files from an FTP server

Answer

Performing a man-in-the-middle attack on HTTPS

Answer

Brute-forcing HTTP form authentication

Question 13

Which TWO of the following are benefits of using a fuzzing tool during the code analysis phase of a penetration test? (Select TWO.)

Accepted Answer

Identifies input validation vulnerabilities. Fuzzing can discover input validation flaws (A) and reveal crashes or error conditions (D). It does not directly perform static code analysis (B) or validate authentication (C). It may help find buffer overflows, but that is a subset of input validation issues.

Answer

Replaces the need for static code analysis

Answer

Validates authentication mechanisms

Answer

Guarantees 100% code coverage

Question 14

Which THREE of the following are common elements found in a Burp Suite project file? (Select THREE.)

Accepted Answer

Target scope definitions. Burp Suite project files store target scope (A), proxy history (C), and intrusion attack definitions (E). Active scan rules (B) are predefined but not stored per project; session handling rules (D) are stored in project options.

Answer

Session handling rules

Answer

Active scan insertion points

Question 15

Based on the exhibit, which additional Nmap command should the tester run to gather the most useful information for a web application test?

Accepted Answer

nmap -sV 192.168.1.10. The -sV option performs version detection on open ports, revealing software versions on HTTP/HTTPS and the proxy. -O is OS detection, -sC runs default scripts (useful but version first), and -A does both. However, -sV is the most direct for web app testing as it identifies application versions, which is crucial for vulnerability research.

Answer

nmap -A 192.168.1.10

Answer

nmap -O 192.168.1.10

Answer

nmap -sC 192.168.1.10

PT0-002 Tools and Code Analysis Practice Test 6 — 15 Questions

Exhibit

PT0-002 Tools and Code Analysis Practice Test 6 — 15 Questions

Exhibit