Common Traps on Which Command Should the Administrator Use Practice Questions
- ·Separate verification commands from configuration commands.
- ·Read whether the question asks to identify, verify, fix, permit or deny.
- ·Small command keywords often change the correct answer.
Sample Questions
Practice all 13 →A penetration tester is testing a web application that uses JSON Web Tokens (JWTs) for authentication. The tester discovers that the server does not verify the JWT signature properly. The tester crafts a JWT with an arbitrary payload and sets the algorithm to 'none'. Which attack does this enable?
Explanation: The 'none' algorithm in JWT allows an attacker to forge tokens without a valid signature because the server skips signature verification. This directly leads to authentication bypass, enabling the attacker to impersonate any user. Other attack types like SQL injection, SSRF, or CSRF are not directly enabled by this JWT flaw.
A penetration tester is writing a Bash script to enumerate users from the /etc/passwd file on a compromised Linux system. Which command will efficiently print only the usernames?
Explanation: The /etc/passwd file uses a colon (:) as a field delimiter, with the username as the first field. The 'cut' command with the -d and -f options is a standard, efficient way to extract specific fields.
A penetration tester is analyzing a Python script that uses the 'paramiko' library to automate SSH key-based authentication across multiple servers. The script fails with 'AuthenticationException' for some servers that the tester is certain have the correct private key configured. Which of the following is the most likely cause of this failure?
Explanation: Paramiko's SSHClient by default checks the server's host key against the local known_hosts file. If the host key is not present or mismatched, it raises an AuthenticationException before even attempting key-based authentication. This is a security feature. The fix is to either add the host key to known_hosts or set missing_host_key_policy to AutoAddPolicy (not recommended in production).
A penetration tester is writing a Bash script to automate the extraction of password hashes from a Windows system after gaining SYSTEM-level access. The script uses 'reg.exe' to save the SAM and SYSTEM hives. Which command should the tester include in the script to export the SAM hive to a file?
Explanation: The correct command is 'reg save HKLM\SAM sam.hive'. The 'reg save' command saves a registry hive to a file. 'reg export' exports registry keys as text, not binary hives. 'reg backup' and 'reg copy' are not valid Windows commands.
A penetration tester is using theHarvester tool to gather email addresses and subdomains for a target domain. Which source is theHarvester commonly configured to use for passive reconnaissance?
Explanation: theHarvester uses search engines like Google, Bing, and Yahoo to extract email addresses and subdomains without directly contacting the target. Shodan is used for internet-connected device information, but theHarvester does not integrate with it by default. DNS zone transfer (C) is an active technique. Social media APIs (D) are not typical sources for theHarvester.
+8 more scenario questions available
Practice all Which Command Should the Administrator Use Practice QuestionsRelated Topics
Frequently asked questions
How do "Which Command Should the Administrator Use Practice Questions" appear on the real PT0-002?
Practise command-choice questions where the task is to identify the correct verification, configuration or troubleshooting command. These appear throughout the PT0-002 and require you to apply your knowledge, not just recall facts.
How many scenario questions are on the PT0-002 exam?
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the PT0-002. Practicing each scenario type ensures you're ready for any format.
Are these PT0-002 scenario practice questions free?
Yes — all scenario practice on Courseiva is completely free. Sign up for a free account to track your progress and see which scenario types you've mastered.
Ready to practice this scenario type?
Launch a full Which Command Should the Administrator Use Practice Questions session with instant scoring and detailed explanations.
Start Scenario Practice →