Courseiva

CompTIA PenTest+ (PT0-003) (PT0-003) — Questions 1–75

185 questions total · 3pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 3

Page 2
1
MCQhard

During a penetration test, a vulnerability scanner reports a critical SQL injection vulnerability in a web application. However, manual testing shows that the parameter is not injectable due to proper parameterized queries. Which of the following is the MOST likely cause of this false positive?

A.The scanner used a payload that caused a different error unrelated to SQL injection
B.The scanner detected a stored XSS instead
C.The scanner matched a generic error message that is not specific to SQL injection
D.The scanner tested a different parameter than what was reported
AnswerC

This is the correct explanation: many scanners use simple keyword or regex matching against any page data returned after a test, so a generic database error such as 'Microsoft OLE DB Provider for SQL Server error '80040e14'' or 'supplied argument is not a valid MySQL result resource' triggers the SQL injection signature. The error may be generated by any malformed input or a natural application error, not by an actual SQLi flaw. This pattern is a classic source of false positives, especially with error-based detection that does not verify whether the payload actually altered the SQL query logic.

Why this answer

A vulnerability scanner often relies on pattern matching in HTTP responses to flag SQL injection. If the application returns a generic error message (e.g., 'An error occurred') after sending a malicious payload, the scanner may incorrectly classify it as SQL injection. However, because the application uses parameterized queries, the payload is safely handled, and the error is unrelated to SQL syntax — making this a classic false positive caused by generic error message matching.

Exam trap

The trap here is that candidates assume a scanner's SQL injection flag must be caused by an actual SQL error, when in fact scanners often rely on generic error message patterns that can be triggered by any application exception.

How to eliminate wrong answers

Option A is wrong because a payload causing a different error unrelated to SQL injection would still require the scanner to misinterpret that error as SQL injection, which is essentially the same mechanism as matching a generic error message; the core issue is the scanner's inability to distinguish error types, not the error's origin. Option B is wrong because stored XSS would manifest as injected script execution in stored content, not as an SQL injection flag from a vulnerability scanner; the scanner would need to detect script reflection or execution, not an SQL error pattern.

Full explanation →
2
MCQmedium

A penetration testing firm is hired to assess a client's network that includes both internal servers and external cloud-based services. The client wants to test only the internal network due to compliance concerns about testing cloud infrastructure. Which of the following should the penetration tester MOST strongly emphasize during the scoping meeting?

A.That cloud services are often the most vulnerable and should be included for a thorough test
B.That the test will not provide a complete risk picture without cloud components
C.That the client can always test cloud services later in a separate engagement
D.That compliance concerns are unfounded and the test should proceed anyway
AnswerB

This is the correct message because it directly addresses the inherent limitation of the assessment. Without cloud components, the test covers only a subset of the attack surface, so any conclusion about overall security posture would be premature. This communicates that on-prem findings must not be interpreted as an enterprise-wide risk assessment, and it sets expectations for follow-up work.

Why this answer

The scope of a penetration test directly determines the validity of its risk assessment. Excluding cloud services creates a significant blind spot, as the client's attack surface includes both internal servers and external cloud-based services; without testing the cloud components, the test cannot provide a complete risk picture. The penetration tester must emphasize this limitation during scoping to ensure the client understands that the final report will not reflect the full security posture of their hybrid environment.

Exam trap

The trap here is that candidates may choose Option A because it sounds technically aggressive and 'security-first,' but the PT0-002 exam tests the ability to prioritize scoping discussions based on client-defined constraints and risk communication, not on unsupported claims about vulnerability prevalence.

How to eliminate wrong answers

Option A is wrong because it makes an unsubstantiated claim that cloud services are 'often the most vulnerable,' which is not a universal truth and distracts from the core scoping issue: the client's compliance concerns, not relative vulnerability. Option C is wrong because it suggests deferring cloud testing to a separate engagement, which fails to address the immediate need for a holistic risk assessment and may lead to fragmented, less actionable results; the tester's role is to advocate for complete coverage within the current engagement's constraints.

Full explanation →
3
MCQhard

A penetration tester is attempting to exploit a buffer overflow vulnerability in a Linux binary. The binary has Data Execution Prevention (DEP) enabled but Address Space Layout Randomization (ASLR) is disabled. Which exploitation technique would be the MOST effective to achieve code execution?

A.Inject shellcode into the buffer and redirect execution to it
B.Use a ROP chain to call mprotect() to make the stack executable, then jump to shellcode
C.Perform a return-to-libc attack to call system("/bin/sh")
D.Use a heap spray to place shellcode at a known address and then trigger the overflow
AnswerC

A return-to-libc (ret2libc) attack is correct because it bypasses DEP by reusing existing executable code from the C standard library instead of injecting instructions. Since ASLR is disabled, the base address of libc and the offset of the system() function are known, so the attacker can overwrite the saved return address with the address of system() and place a pointer to the string "/bin/sh" at the appropriate stack position to be interpreted as system()'s argument. This causes the process to call system("/bin/sh") directly from executable memory, completely avoiding the non-executable stack while achieving arbitrary command execution.

Why this answer

With DEP enabled, the stack is non-executable, so injecting shellcode directly into the buffer (Option A) would fail. Since ASLR is disabled, library addresses are fixed, making a return-to-libc attack viable. Option C exploits this by overwriting the return address with the address of system() and placing the string "/bin/sh" in memory, achieving code execution without needing an executable stack.

Exam trap

The trap here is that candidates often assume DEP alone forces the use of ROP chains, but when ASLR is disabled, a simpler return-to-libc attack is more effective and directly achieves code execution without the complexity of building a ROP chain.

How to eliminate wrong answers

Option A is wrong because DEP marks the stack as non-executable, so any shellcode injected into the buffer will cause a segmentation fault when the CPU tries to execute it. Option B is wrong because while a ROP chain to call mprotect() could make the stack executable, it is more complex and unnecessary when ASLR is disabled; a simpler return-to-libc attack directly achieves code execution. Option D is wrong because heap spray is typically used to bypass ASLR by placing shellcode at a predictable heap address, but ASLR is already disabled, making this technique overcomplicated and less direct than a return-to-libc attack.

Full explanation →
4
MCQeasy

Which tool is specifically designed for scanning WordPress websites to detect vulnerabilities, such as outdated plugins, themes, and weak passwords?

A.OpenVAS
B.Nikto
C.WPScan
D.Nessus
AnswerC

WPScan is made specifically for WordPress security assessments.

Why this answer

WPScan is a dedicated WordPress security scanner that enumerates WordPress-specific vulnerabilities, including outdated plugins, themes, and weak passwords via XML-RPC brute-force testing. It uses the WordPress vulnerability database (wpvulndb.com) to match installed versions against known CVEs, making it the correct tool for this targeted task.

Exam trap

The trap here is that candidates often confuse general web vulnerability scanners (like Nikto or OpenVAS) with a CMS-specific tool, assuming any scanner can perform WordPress vulnerability detection, but only WPScan is purpose-built for WordPress enumeration and exploitation.

How to eliminate wrong answers

Option A is wrong because OpenVAS is a general-purpose vulnerability scanner that covers a wide range of systems and services, but it lacks WordPress-specific enumeration capabilities like theme/plugin version detection and password brute-forcing via XML-RPC. Option B is wrong because Nikto is a web server scanner that checks for common misconfigurations and outdated server software, but it does not perform WordPress-specific scans such as plugin vulnerability checks or user enumeration. Option D is wrong because Nessus is a comprehensive vulnerability scanner for networks and operating systems, but it is not designed for WordPress-specific scanning and does not include dedicated checks for WordPress plugin/theme versions or weak password attacks.

Full explanation →
5
MCQhard

During a web application test, a tester discovers an endpoint that fetches a URL from user input without validation. They attempt to access the AWS metadata endpoint. Which IP address is commonly used for the cloud metadata service?

A.169.254.169.254
B.10.0.0.1
C.127.0.0.1
D.192.168.1.1
AnswerA

This is the link-local address for cloud metadata.

Why this answer

AWS metadata is accessible at 169.254.169.254, a link-local address.

Full explanation →
6
MCQmedium

A client engages a penetration testing firm to evaluate the security of their internal network. During the scoping meeting, the client states that they use a network access control (NAC) solution that might block the tester's machine if it is connected to the internal network without prior authorization. Which of the following should be included in the rules of engagement to address this potential issue?

A.Include a requirement that the client disables NAC during the testing window.
B.State that the tester will not connect to the internal network and will only test externally.
C.Specify that the tester will bypass NAC as part of the test objectives.
D.Add a clause requiring the client to whitelist the tester's MAC address in the NAC policy before testing.
AnswerD

Adding a clause that requires the client to whitelist the tester's MAC address in the NAC policy before testing is the correct approach because it authorizes the specific testing device while preserving the security posture for all other devices. NAC policies typically use MAC authentication or 802.1X to enforce compliance, and a pre-whitelisted MAC allows the tester's device to avoid the quarantined or blocked state that an unknown device would receive. This should be arranged in advance to prevent connectivity delays during the test window and is a standard, low-risk practice for authorized penetration testing engagements.

Why this answer

Whitelisting the tester's MAC address in the NAC policy allows the tester's machine to connect to the internal network without being blocked, while keeping the NAC solution active for other devices. This approach preserves the real-world security posture of the client's environment and ensures the tester can perform internal network assessments as scoped. It is a standard practice in penetration testing to request MAC address whitelisting to avoid false positives from NAC enforcement.

Exam trap

The trap here is that candidates may assume disabling NAC (Option A) is the simplest solution, but the exam tests whether you understand that altering security controls during a test can invalidate the assessment's realism and that proper scoping requires minimal disruption to the client's environment.

How to eliminate wrong answers

Option A is wrong because disabling NAC entirely would alter the security posture of the client's network, potentially allowing the tester to bypass a control that would normally be present, which does not reflect a realistic attack scenario and may violate the integrity of the test. Option B is wrong because the client specifically engaged the tester to evaluate the security of their internal network, and testing only externally would fail to meet the scope and objectives of the engagement. Option C is wrong because specifying that the tester will bypass NAC as a test objective implies that the tester will attempt to circumvent the NAC solution, which is a separate attack vector and not a scoping or rules-of-engagement measure to address the potential blocking issue; it also risks disrupting the client's network or violating the rules of engagement if not explicitly authorized.

Full explanation →
7
MCQhard

A penetration tester is conducting a vulnerability scan of a web application that uses a custom API framework. The scanner reports several potential SQL injection vulnerabilities, but manual testing confirms they are false positives. The tester suspects the scanner is misinterpreting input validation. Which of the following is the most likely reason for these false positives?

A.The scanner used a payload that was blocked by a Web Application Firewall (WAF) before reaching the application
B.The application reflects the injected payload in error messages or response content, causing the scanner to think the injection succeeded
C.The scanner used outdated signatures that do not match the custom API's input validation logic
D.The application returns a generic 'Invalid input' message for all types of invalid input, confusing the scanner
AnswerB

Many scanners check if the payload appears in the response (e.g., error messages containing SQL syntax). If the application echoes back the input without executing it, the scanner may misinterpret this as a successful injection.

Why this answer

The scanner likely detected the injected payload reflected in the application's response (e.g., in an error message or echoed input), which it interpreted as successful SQL execution. In custom API frameworks, input validation may reject the payload but still reflect it back in the response, causing the scanner to flag a false positive. Manual testing confirms the injection fails, so the reflection is merely a side effect of the API's error handling, not a sign of database interaction.

Exam trap

The trap here is that candidates confuse 'reflected input' (which causes false positives) with 'stored input' or actual SQL error messages, assuming any reflection indicates a vulnerability, when in fact the scanner's heuristic is flawed for custom APIs that echo back sanitized input.

How to eliminate wrong answers

Option A is wrong because a WAF blocking the payload would typically result in a different HTTP response (e.g., 403 Forbidden or a custom block page), not a false positive; the scanner would likely report the request as blocked or fail to get a response, not misinterpret a reflection. Option C is wrong because outdated signatures would more likely cause missed vulnerabilities (false negatives) rather than false positives; the issue here is the scanner's detection logic, not signature age. Option D is wrong because a generic 'Invalid input' message would actually reduce false positives, as the scanner would not see a reflection of its payload; the problem is the opposite—the API reflects the payload, which the scanner misinterprets as success.

Full explanation →
8
MCQmedium

A penetration tester is performing passive reconnaissance on a target organization. Which of the following tools would be BEST suited to gather information about the organization's domain names, email addresses, and subdomains from publicly available sources without directly interacting with the target's systems?

A.Nmap
B.theHarvester
C.Nessus
D.Metasploit
AnswerB

theHarvester performs passive OSINT collection of emails, subdomains, and hostnames.

Why this answer

theHarvester is designed for passive OSINT gathering of emails, subdomains, IPs, etc. Maltego is also OSINT but more graph-oriented; theHarvester is specifically for email/subdomain enumeration.

Full explanation →
9
MCQeasy

A penetration tester runs the following command: nmap -sS -p 1-65535 -T4 -A -O --reason target. What is the primary purpose of the -A option in this command?

A.Enables OS detection, version detection, script scanning, and traceroute.
B.Sets the timing template to aggressive (level 4).
C.Enables aggressive scanning that is more likely to be detected by the target.
D.Performs a SYN (half-open) scan.
AnswerA

The -A flag in Nmap is a convenience option that aggregates several detection features: it enables operating system detection (-O), version detection (-sV), default script scanning (-sC), and traceroute (--traceroute) in a single command. Rather than specifying each flag individually, -A gives a comprehensive profile of the target's OS, services, and network path, making it a common choice for initial reconnaissance during a penetration test.

Why this answer

The -A option in nmap is a composite flag that enables OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (--traceroute) in a single switch. This is explicitly documented in nmap's man page and is designed to provide comprehensive reconnaissance in one command, making option A correct.

Exam trap

The trap here is that candidates confuse the 'aggressive' label of -A with nmap's timing templates (e.g., -T4 or -T5), which are actually named 'aggressive' and 'insane' in the documentation, leading them to incorrectly associate -A with scan speed or detectability rather than its true composite functionality.

How to eliminate wrong answers

Option B is wrong because the -T4 flag, not -A, sets the timing template to aggressive (level 4); -A does not control timing. Option C is wrong because while -A does enable 'aggressive' scanning in the sense of combining multiple scan types, the term 'aggressive scanning' in nmap specifically refers to timing templates (e.g., -T4 or -T5), not the -A option, and -A does not inherently make the scan more detectable than other scan combinations.

Full explanation →
10
MCQmedium

A client wants a penetration test that simulates an external threat actor with no prior access. The client provides a list of public IP ranges and domain names. Which type of test is this?

A.External black-box test.
B.Internal white-box test.
C.Gray-box test.
D.Red team exercise.
AnswerA

An external black-box penetration test is the only option that matches both constraints: the tester operates from outside the network perimeter (external) and receives no architectural diagrams, credentials, or source code (black-box). This simulates a realistic external threat actor who must rely on OSINT, port scanning, and vulnerability discovery to gain an initial foothold. The client's requirement of 'no prior access' eliminates any internal vantage point or pre-supplied knowledge, making this the correct methodology.

Why this answer

This is an external black-box test because the client provides only public IP ranges and domain names, simulating an external threat actor with no prior access. The tester has no internal knowledge or credentials, which defines a black-box approach, and the scope is limited to external-facing assets, making it external.

Exam trap

The trap here is confusing 'external' with 'black-box'—candidates may think a gray-box test is appropriate because the client provides some information, but the key is that no internal access or credentials are given, which strictly defines a black-box test.

How to eliminate wrong answers

Option B is wrong because an internal white-box test assumes the tester has full knowledge of the internal network, including credentials and architecture, which contradicts the 'no prior access' requirement. Option C is wrong because a gray-box test typically provides partial internal knowledge (e.g., credentials or network diagrams), which is not the case here as the client only gives public IP ranges and domain names.

Full explanation →
11
MCQhard

A penetration tester is performing internal reconnaissance on a network that uses IPv6. The tester wants to discover alive hosts and their IPv6 addresses without sending many packets. Which technique is most effective for this purpose?

A.Perform a full TCP SYN scan on the entire /64 subnet using Nmap with IPv6 addressing
B.Ping the IPv6 all-nodes multicast address (ff02::1) and analyze the responses to discover active hosts
C.Request the DHCPv6 server log from the network administrator to obtain a list of assigned IPv6 addresses
D.Use the `ip neighbor` command on the tester's machine to view the IPv6 neighbor cache after generating traffic
AnswerB

Sending an ICMPv6 echo request to the link-local all-nodes multicast address ff02::1 is an efficient active discovery method because every IPv6 host must join the ff02::1 group on its interface. When a host receives the multicast ping, it replies with its link-local address, allowing the tester to quickly enumerate active nodes on the segment. This technique is analogous to IPv4 broadcast ping but is more precise in IPv6, though some firewalls may suppress echo replies, and the results are limited to the local link.

Why this answer

Sending a ping to the IPv6 all-nodes multicast address (ff02::1) triggers a response from all active hosts on the local link that have IPv6 enabled, allowing the tester to discover alive hosts and their IPv6 addresses with minimal packets. This technique leverages the inherent multicast behavior of IPv6, where hosts join the all-nodes multicast group by default, making it highly efficient for reconnaissance without scanning each address individually.

Exam trap

The trap here is that candidates may overlook the efficiency of multicast-based discovery and instead choose a brute-force scan (Option A), not realizing that IPv6 subnets are far too large for exhaustive scanning, or they may mistakenly think DHCPv6 logs (Option C) are always available or reliable in IPv6 environments where SLAAC is common.

How to eliminate wrong answers

Option A is wrong because performing a full TCP SYN scan on an entire /64 subnet (2^64 addresses) is impractical and would generate an enormous number of packets, defeating the goal of discovering hosts without sending many packets; it is also inefficient and likely to be detected or blocked. Option C is wrong because requesting the DHCPv6 server log from the network administrator relies on human cooperation and may not be feasible during a penetration test, and it does not involve the tester actively discovering hosts; additionally, many IPv6 networks use stateless address autoconfiguration (SLAAC) rather than DHCPv6, so the log may not contain all active addresses.

Full explanation →
12
MCQmedium

During a penetration test, you want to perform a stealthy port scan that minimizes the chance of being logged by the target. Which Nmap option should you use?

A.-sU
B.-sV
C.-sT
D.-sS
AnswerD

SYN scan is half-open and less likely to be logged.

Why this answer

SYN scan (-sS) is considered stealthy because it does not complete the TCP handshake, reducing the likelihood of being logged compared to a full connect scan.

Full explanation →
13
MCQmedium

During code review, a penetration tester identifies the following line in a PHP web application: $sql = "SELECT * FROM users WHERE username='" . $_GET['user'] . "'"; Which type of vulnerability is most likely present?

A.SQL injection
B.Insecure deserialization
C.Command injection
D.Cross-site scripting (XSS)
AnswerA

Correct. Input is directly concatenated into an SQL query.

Why this answer

Direct concatenation of user input into an SQL query without sanitization results in SQL injection vulnerability.

Full explanation →
14
MCQmedium

A penetration tester is hired to assess a web application that integrates with a third-party payment API. The client wants the API included in the test but does not have a signed agreement with the vendor. What is the most appropriate action for the tester?

A.Ask the client to obtain a written authorization from the third-party vendor before testing the API.
B.Proceed with testing the API using anonymous techniques to avoid detection.
C.Test only the client's application logic but not the actual API endpoint.
D.Include the API in the test because the client owns the integration.
AnswerA

Testing a third-party API without explicit written authorization from the vendor violates legal boundaries such as the Computer Fraud and Abuse Act (CFAA) and the vendor's terms of service, even if the client holds API credentials. The penetration tester must ensure the scope of work includes a signed authorization from the vendor, specifying the exact systems, time window, and test types permitted, to protect both the tester and the client from liability. Without this, the engagement is technically an unauthorized intrusion, and any findings would be inadmissible or could lead to legal action against the tester.

Why this answer

Testing a third-party API without explicit written authorization from the vendor violates legal and contractual boundaries, potentially constituting unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA). The penetration tester must obtain signed authorization to ensure the test is legally defensible and within scope, as the client cannot grant permission for assets they do not own.

Exam trap

The trap here is that candidates may assume 'anonymous techniques' or 'testing only the application logic' are safe workarounds, failing to recognize that legal authorization is a non-negotiable prerequisite for any testing activity, regardless of technique or scope limitation.

How to eliminate wrong answers

Option B is wrong because using anonymous techniques to avoid detection does not circumvent the lack of legal authorization; it still constitutes unauthorized access and could lead to criminal charges or civil liability. Option C is wrong because testing only the client's application logic without the actual API endpoint would miss critical integration vulnerabilities (e.g., improper handling of API responses, insecure direct object references) and fail to meet the client's requirement to include the API in the test.

Full explanation →
15
MCQeasy

A penetration tester is tasked with discovering all publicly accessible Amazon S3 buckets that belong to a target company. Which technique is MOST effective for this purpose?

A.Scanning the target's IP ranges for open ports 443
B.Using dnsdumpster.com to find subdomains
C.Guessing bucket names based on common patterns
D.Querying Google dorks for 'site:s3.amazonaws.com [target_company]'
AnswerD

Google dorking using the site operator to search 's3.amazonaws.com' with the company name can find publicly listed bucket URLs. This is a proven passive reconnaissance technique.

Why this answer

Google dorks allow a penetration tester to search for indexed S3 bucket URLs that contain the target company's name, revealing publicly accessible buckets without direct interaction with the target's infrastructure. This technique leverages Google's crawlers to find buckets that may have been inadvertently exposed or misconfigured, making it highly effective for passive reconnaissance.

Exam trap

The trap here is that candidates may think DNS enumeration (Option B) or port scanning (Option A) are effective for discovering cloud storage resources, but these methods fail because S3 buckets are external to the target's network and are not tied to the target's DNS or IP ranges.

How to eliminate wrong answers

Option A is wrong because scanning the target's IP ranges for open port 443 (HTTPS) does not specifically identify S3 buckets; S3 buckets are hosted on Amazon's infrastructure (e.g., s3.amazonaws.com) and not on the target's own IP ranges, so this would miss buckets entirely. Option B is wrong because dnsdumpster.com is used for DNS enumeration to find subdomains, but S3 bucket names are not DNS subdomains of the target company; they are separate AWS resources with names like 'bucket-name.s3.amazonaws.com' that do not appear in the target's DNS records. Option C is wrong because guessing bucket names based on common patterns is inefficient and unreliable; while it might occasionally succeed, it is not the most effective method compared to using search engines that index actual bucket URLs.

Full explanation →
16
MCQmedium

A penetration tester is using Burp Suite to intercept and modify HTTP traffic. When browsing to an HTTPS site, the tester observes that the requests are encrypted and not being intercepted by Burp. Which configuration step is most likely missing?

A.The proxy listener is not configured to listen on the correct port
B.The Burp CA certificate has not been installed in the browser's trust store
C.The browser's proxy settings are not configured to use Burp
D.The target site is not in Burp's scope
AnswerB

Correct. Burp acts as a man-in-the-middle for HTTPS by generating a certificate for each site signed by its own CA. The browser's trust store must contain the Burp CA certificate, or it will reject the connection.

Why this answer

Burp Suite intercepts HTTPS traffic by acting as a man-in-the-middle, which requires the browser to trust Burp's self-signed CA certificate. Without installing the Burp CA certificate in the browser's trust store, the browser will refuse to establish a TLS connection through the proxy, leaving requests encrypted end-to-end and invisible to Burp.

Exam trap

The trap here is that candidates confuse proxy configuration (setting the browser to use Burp as a proxy) with TLS interception setup, assuming that simply pointing the browser at the proxy is sufficient to intercept HTTPS traffic.

How to eliminate wrong answers

Option A is wrong because the proxy listener port (typically 8080) is irrelevant to TLS interception; even if the port is correct, HTTPS traffic will still be encrypted without the CA certificate. Option C is wrong because the browser's proxy settings must be configured to route traffic through Burp, but the question states the tester is browsing and observing encrypted requests, implying proxy settings are already in place; the missing step is trust of the CA certificate.

Full explanation →
17
MCQhard

During a penetration test, you want to discover API endpoints and hidden parameters in a web application. Which tool combination is most effective for this task?

A.Wappalyzer and curl
B.WhatWeb and theHarvester
C.Gobuster and Nikto
D.Arjun and ffuf
AnswerD

Arjun is for parameter discovery; ffuf can bruteforce parameters and endpoints.

Why this answer

Arjun is specifically designed for parameter discovery, while ffuf can be used to bruteforce both directories and parameters. Together they effectively find API endpoints and parameters. gobuster is for directory/file enumeration, not specifically for parameters.

Full explanation →
18
MCQeasy

A client requests a penetration test of their web application, but they want to exclude all third-party APIs from the scope. Where should this exclusion be documented?

A.Rules of Engagement
B.Executive Summary
C.Findings Report
D.Remediation Plan
AnswerA

The Rules of Engagement (RoE) is the authoritative contract section that legally defines the testing boundaries, including authorized systems, testing windows, and explicit scope exclusions. Because it establishes the formal limits of what the penetration tester may access and perform, any out-of-scope assets or prohibited techniques must be documented here to prevent misunderstandings and legal liability. This makes the RoE the only correct location for recording scope exclusions.

Why this answer

The Rules of Engagement (ROE) document is the authoritative source for defining the scope, boundaries, and constraints of a penetration test, including explicit exclusions such as third-party APIs. This document is established during the planning and scoping phase to ensure both the client and the testing team agree on what is and is not in scope, preventing legal or operational issues. Without documenting the exclusion in the ROE, the tester might inadvertently interact with the third-party APIs, violating the agreement and potentially causing service disruptions or legal liabilities.

Exam trap

CompTIA often tests the misconception that scope exclusions belong in the final report or executive summary because candidates confuse 'what was tested' with 'what was excluded,' but the ROE is the only document that governs the testing parameters before execution begins.

How to eliminate wrong answers

Option B is wrong because the Executive Summary is a high-level overview of the test results, typically found in the final report, and is not used to document scope exclusions or operational constraints; it summarizes findings for non-technical stakeholders. Option C is wrong because the Findings Report details vulnerabilities discovered during the test and their remediation, but it does not define the scope or exclusions—those must be established before testing begins in the ROE.

Full explanation →
19
MCQmedium

A penetration tester has gained a shell on a Linux machine as a low-privileged user. The user can execute the binary 'less' with sudo privileges without a password. Which technique can the tester use to escalate privileges to root?

A.Exploit a buffer overflow in the 'less' binary.
B.Use the '!' command within 'less' to execute a shell.
C.Run 'sudo -u root bash' to switch to a root shell.
D.Modify the PATH to trick sudo into running a malicious binary.
AnswerB

Correct. The '!' command in less allows execution of shell commands. With sudo, this runs as root, granting privilege escalation.

Why this answer

The 'less' binary, when executed with sudo, retains its ability to spawn a shell via the '!' command. Since the user can run 'less' as root without a password, typing '!/bin/bash' (or simply '!bash') inside 'less' will execute a shell with root privileges, effectively escalating to root.

Exam trap

The trap here is that candidates may overlook the shell escape feature of pagers like 'less' and instead assume they need to exploit a binary vulnerability or use a generic 'sudo -u root bash' command, which fails because the sudoers rule is specific to 'less' only.

How to eliminate wrong answers

Option A is wrong because exploiting a buffer overflow in 'less' is unnecessary and impractical; the intended privilege escalation vector is the built-in '!' command, not a memory corruption vulnerability. Option C is wrong because 'sudo -u root bash' requires the user to have explicit sudo permissions for 'bash', which they do not; the sudoers entry only grants passwordless execution of 'less', not arbitrary commands.

Full explanation →
20
MCQmedium

After completing a penetration test, the tester is writing the report. The client's Chief Information Security Officer (CISO) is the primary audience and wants to understand the overall security posture and the most critical risks to the business. Which section of the report should the tester most heavily focus on for this audience?

A.Technical Findings
B.Executive Summary
C.Appendix - Vulnerability Details
D.Methodology
AnswerB

The Executive Summary provides a concise business-oriented risk overview tailored for executives like a CISO.

Why this answer

The Executive Summary is the section of a penetration test report that provides a high-level overview of the security posture, focusing on business risks and strategic recommendations. For a CISO, who needs to understand the most critical risks to the business without delving into technical details, this section is the most relevant. It translates technical vulnerabilities into business impact, aligning with the CISO's role in risk management and decision-making.

Exam trap

CompTIA often tests the distinction between audience-appropriate report sections, and the trap here is that candidates mistakenly choose Technical Findings or Appendix - Vulnerability Details because they focus on technical depth rather than the business-oriented communication required for a CISO audience.

How to eliminate wrong answers

Option A is wrong because Technical Findings contain detailed exploit steps, affected systems, and raw vulnerability data, which are too granular for a CISO who needs a business-risk perspective rather than technical specifics. Option C is wrong because the Appendix - Vulnerability Details lists raw CVSS scores, CVE IDs, and proof-of-concept code, which are operational details for remediation teams, not for executive-level risk assessment. Option D is wrong because Methodology describes the tools, techniques, and scope of the test (e.g., Nmap scans, Metasploit modules), which is procedural information that does not directly communicate business risk or overall security posture to a CISO.

Full explanation →
21
MCQmedium

A penetration tester is analyzing a Python script that uses the 'requests' library to send HTTP POST requests to a target URL with different payloads. The script also implements a retry mechanism with exponential backoff. What is the most likely purpose of this script?

A.Directory brute-forcing
B.Password spraying
C.SQL injection testing
D.Session hijacking
AnswerB

Password spraying is correct because the script sends POST requests to a single endpoint (likely a login form) with different password payloads, while the username remains constant or cycles slowly. The retry logic with exponential backoff is specifically designed to evade account lockout policies and rate limiting, allowing the attacker to try multiple passwords across accounts without triggering defenses. This behavior—iterating passwords slowly against one URL—is the signature of password spraying, which uses a few common passwords against many accounts rather than a brute-force of many passwords per account.

Why this answer

The script sends HTTP POST requests with different payloads and implements a retry mechanism with exponential backoff. This behavior is characteristic of password spraying, where an attacker attempts a small number of common passwords against many usernames to avoid account lockouts. The exponential backoff helps evade rate-limiting and intrusion detection systems by gradually increasing delays between attempts.

Exam trap

The trap here is that candidates may confuse password spraying with brute-force attacks, but the key distinction is that password spraying uses a small set of passwords across many accounts, while brute-force focuses on many passwords for a single account.

How to eliminate wrong answers

Option A is wrong because directory brute-forcing typically uses HTTP GET requests to discover hidden paths, not POST requests with payloads. Option C is wrong because SQL injection testing usually involves sending crafted payloads in GET parameters or POST data, but the retry mechanism with exponential backoff is not a standard technique for SQLi; it is more aligned with authentication bypass attempts. Option D is wrong because session hijacking involves stealing or predicting session tokens (e.g., cookies or JWTs), not sending POST requests with different payloads and retries.

Full explanation →
22
MCQeasy

A penetration tester has compromised a Linux server and gained a low-privilege shell. The tester discovers that the /etc/shadow file is readable by the tester's user. Which attack is most directly enabled by this finding?

A.Pass-the-hash
B.Password cracking offline
C.LLMNR poisoning
D.Kerberoasting
AnswerB

Reading /etc/shadow is effectively game over for the compromised account's password: the file stores salted, one-way hashes of every local user's password, and an attacker can copy those hash strings directly to a cracking tool. John the Ripper's 'unshadow' utility combines /etc/passwd and /etc/shadow entries, or Hashcat can ingest the raw hash lines, enabling dictionary, rule-based, hybrid, or brute-force attacks at billions of guesses per second on GPU hardware. Even strong passwords fall to hybrid or mask attacks if the password policy is weak, and reused credentials often appear in prior breach data. Because the hashes are fully in hand, this offline cracking approach is the primary and most practical path after obtaining /etc/shadow.

Why this answer

The /etc/shadow file contains the hashed passwords for all users on the system. If a low-privilege user can read this file, they can copy the password hashes and attempt to crack them offline using tools like John the Ripper or Hashcat. This directly enables an offline password cracking attack, as the tester can brute-force or use dictionary attacks against the hashes without needing to interact with the live system.

Exam trap

The trap here is that candidates may confuse the ability to read a password hash file with a pass-the-hash attack, but pass-the-hash is a Windows-specific technique that requires NTLM hashes and a network authentication context, not a local file read on Linux.

How to eliminate wrong answers

Option A is wrong because pass-the-hash is an attack that uses captured NTLM hashes to authenticate to Windows systems, not Linux systems; it requires a Windows environment and does not apply to reading /etc/shadow. Option C is wrong because LLMNR poisoning is a Windows-specific network attack that exploits the Link-Local Multicast Name Resolution protocol to capture NetNTLMv2 hashes, and it is not related to reading a local file on a Linux server. Option D is wrong because Kerberoasting targets Kerberos service tickets in Active Directory environments to crack service account passwords; it is a Windows domain attack and does not involve the /etc/shadow file on a Linux server.

Full explanation →
23
MCQmedium

A penetration testing firm has been hired to test the internal network of a large enterprise. During the scoping meeting, the client states that they want to include all IP ranges, including those used by the HR department's sensitive systems. The tester should recommend which of the following to minimize business impact and avoid disruption?

A.Exclude the HR department's IP range from the test
B.Perform the test during off-peak hours and provide prior notification
C.Use only passive reconnaissance techniques on the HR systems
D.Include the HR systems but require written authorization from HR management
AnswerB

Scheduling the engagement during off-peak hours, such as nights or weekends, reduces the risk of operational disruption to critical HR processes like payroll runs, benefits processing, and employee self-service transactions. Providing prior notification to HR allows their IT and security teams to review planned test activities, adjust monitoring thresholds to avoid false positives, and ensure that any system failures can be distinguished from test-induced incidents. This approach aligns with proper change management and deconfliction procedures, ensuring that valid business activities are not mistaken for intrusions while maintaining full coverage of the assigned scope.

Why this answer

Performing the test during off-peak hours and providing prior notification minimizes business impact by reducing the likelihood of disrupting critical HR operations during normal business hours. This approach aligns with the scoping requirement to include all IP ranges while allowing the client to prepare for potential service interruptions, such as those caused by active scanning techniques like TCP SYN scans or service enumeration. Prior notification ensures that HR staff can take precautions, such as backing up sensitive data or pausing batch jobs, thereby avoiding data corruption or system unavailability.

Exam trap

The trap here is that candidates often choose Option C (passive reconnaissance) thinking it avoids disruption entirely, but they overlook that passive techniques cannot fulfill the test's objective of identifying exploitable vulnerabilities, which requires active interaction with the target systems.

How to eliminate wrong answers

Option A is wrong because excluding the HR department's IP range directly contradicts the client's explicit request to include all IP ranges, including sensitive HR systems, and would leave a critical attack surface untested, potentially missing vulnerabilities like weak authentication on HR databases or exposed SMB shares. Option C is wrong because using only passive reconnaissance techniques on the HR systems is insufficient for a thorough penetration test; passive techniques (e.g., sniffing network traffic or analyzing DNS records) cannot identify active vulnerabilities such as unpatched services, default credentials, or misconfigured firewall rules that require active probing like Nmap version scans or vulnerability scanning with tools like OpenVAS.

Full explanation →
24
MCQeasy

A penetration tester has completed the technical portion of a test and is now writing the executive summary. Which of the following is most important to include in this section to effectively communicate with senior management?

A.A detailed list of all tools and commands used during the test
B.The total number of vulnerabilities found and their risk ratings, with a focus on business impact
C.Step-by-step instructions on how to reproduce the most critical vulnerability
D.The names of the penetration testers and their certifications
AnswerB

The executive summary's core purpose is to translate complex penetration test results into a concise risk picture that business leaders can act upon. Stating the total number of vulnerabilities and their risk ratings (e.g., Critical, High, Medium, Low) directly supports decisions about resource allocation, and framing those ratings with the likely business impact—such as unauthorized access to sensitive data or potential regulatory fines—makes the urgency concrete for executives.

Why this answer

The executive summary is intended for senior management, who need to understand the business impact of findings rather than technical details. Option B focuses on the total number of vulnerabilities, their risk ratings, and business impact, which directly aligns with management's decision-making needs. This ensures the report communicates risk in terms of potential financial or operational consequences, not just technical severity.

Exam trap

The trap here is that candidates mistake technical completeness for executive communication, choosing options like A or C because they focus on the tester's work rather than the audience's needs, but the exam specifically tests the distinction between technical reporting and management reporting.

How to eliminate wrong answers

Option A is wrong because a detailed list of all tools and commands used during the test is too technical for senior management; this level of detail belongs in the technical report or appendices, not the executive summary. Option C is wrong because step-by-step instructions on how to reproduce the most critical vulnerability are operational details meant for the technical team, not for high-level management who require a summary of risks and remediation priorities.

Full explanation →
25
MCQmedium

During a penetration test, a penetration tester discovers a critical vulnerability that allows unauthenticated remote code execution on a public-facing web server. According to best practices for communication during a penetration test, what should the tester do next?

A.Immediately notify the client of the critical finding and provide initial remediation steps.
B.Document the finding and inform the client only after verifying with a second tester.
C.Wait until the end of the test to include it in the final report.
D.Exploit the vulnerability to demonstrate the full impact before notifying the client.
AnswerA

Immediate notification allows the client to mitigate the risk promptly.

Why this answer

Critical findings should be communicated to the client immediately to allow them to take urgent action, even before the formal report is delivered.

Full explanation →
26
MCQeasy

During a penetration test report review, the client's IT manager asks for a 'quick reference' that lists each vulnerability, its severity, and the affected system, without detailed exploit steps. Which section of the report should the tester point to?

A.Executive summary
B.Technical findings section
C.Appendix with raw scan results
D.Remediation recommendations
AnswerB

The technical findings section is the core of a penetration test report and typically opens with a summary table that lists every identified vulnerability along with its risk severity (e.g., Critical, High, Medium, Low), affected host or asset, and a reference identifier. This table is designed for quick scanning, allowing an IT manager to immediately grasp the full scope of vulnerabilities without reading verbose raw output. The section also provides supporting technical detail, evidence, and code snippets for each finding, but the summary table alone is the perfect quick-reference artifact.

Why this answer

The technical findings section is the correct place because it provides a structured list of each vulnerability, its severity rating (e.g., CVSS score), and the affected system, while intentionally omitting detailed exploit steps. This directly satisfies the IT manager's request for a 'quick reference' without the operational risk of exposing attack procedures. The executive summary is too high-level, and the appendix with raw scan results lacks the curated, severity-ranked format needed for a quick reference.

Exam trap

The trap here is that candidates confuse the 'quick reference' request with the executive summary, assuming any summary must be in the executive section, but the executive summary lacks the per-vulnerability detail and system mapping that the technical findings section provides.

How to eliminate wrong answers

Option A is wrong because the executive summary is a high-level overview for non-technical stakeholders, focusing on business risk and strategic recommendations, not a per-vulnerability list with severity and affected systems. Option C is wrong because the appendix with raw scan results contains unprocessed, often voluminous output from tools like Nmap or Nessus, which lacks the curated, severity-ranked format and clear mapping of each vulnerability to a specific system that the IT manager needs.

Full explanation →
27
MCQhard

During a penetration test, a tester identifies that the target's network uses Private VLANs to isolate hosts. Which technique can be used to bypass this isolation and perform ARP spoofing?

A.ARP cache poisoning from the switch
B.MAC flooding
C.Double tagging
D.VLAN hopping
AnswerD

VLAN hopping is a class of Layer 2 attacks that enables an attacker on one VLAN to send frames to another VLAN against the network's design, effectively breaking VLAN and Private VLAN isolation. The two primary methods are switch spoofing, where the attacker uses DTP to negotiate a trunk, and double tagging, where two VLAN tags are used to trick the switch into forwarding the frame to a different VLAN. Since Private VLANs rely on the switch to filter inter-port traffic based on VLAN membership, successfully hopping to another VLAN bypasses those port-level controls. This makes VLAN hopping the correct answer for a technique that directly defeats Private VLAN isolation.

Why this answer

Private VLANs isolate hosts within the same VLAN by restricting traffic at the switch level. VLAN hopping (option D) allows an attacker to bypass this isolation by exploiting the switch's trunking protocol (e.g., DTP) to negotiate a trunk link, enabling the attacker to send and receive frames on multiple VLANs, including the target's community or isolated VLAN, thus facilitating ARP spoofing across the Private VLAN boundaries.

Exam trap

CompTIA often tests the distinction between VLAN hopping methods (DTP-based vs. double tagging), and the trap here is that candidates confuse double tagging with the general concept of VLAN hopping, but double tagging is not effective against Private VLANs because it relies on native VLAN misconfigurations on trunk ports, whereas DTP-based hopping directly negotiates a trunk to access all VLANs.

How to eliminate wrong answers

Option A is wrong because ARP cache poisoning from the switch is not a standard attack vector; ARP spoofing targets end hosts, not the switch's ARP cache, and switches do not maintain ARP caches for forwarding decisions in the same way routers do. Option B is wrong because MAC flooding overwhelms the switch's CAM table to force it into hub mode, which can allow sniffing within the same VLAN but does not bypass Private VLAN isolation, as Private VLANs enforce traffic restrictions at the switch level regardless of CAM table state. Option C is wrong because double tagging is a VLAN hopping technique that works by adding two 802.1Q tags to a frame, but it is effective only against trunk ports with native VLAN mismatches and does not directly bypass Private VLAN isolation, which operates on access ports with Private VLAN configuration.

Full explanation →
28
MCQmedium

During a web application test, a penetration tester discovers that the application exposes internal object references (e.g., user ID in a URL) and does not properly authorize access. The tester can view other users' private data by simply changing the ID parameter. Which type of vulnerability does this represent?

A.Cross-Site Request Forgery (CSRF)
B.Insecure Direct Object Reference (IDOR)
C.SQL Injection
D.Cross-Site Scripting (XSS)
AnswerB

Insecure Direct Object Reference occurs when an application exposes a reference to an internal implementation object—most commonly a database key or numeric ID—in a URL or form parameter, and fails to verify the authenticated subject is authorized for that object. By simply changing the user ID in the request, the tester was able to retrieve another user's profile, demonstrating a missing object-level access control check. This is a classic IDOR finding and a type of broken access control.

Why this answer

The vulnerability is Insecure Direct Object Reference (IDOR) because the application exposes internal object references (e.g., user ID in a URL) and fails to enforce proper authorization checks. By simply changing the ID parameter, the tester can access other users' private data without authentication or permission validation, which is the hallmark of IDOR.

Exam trap

CompTIA often tests IDOR by presenting a scenario where a parameter is manipulated to access another user's data, and the trap is confusing it with CSRF (which involves state-changing actions via forged requests) or SQL injection (which involves database query manipulation), rather than recognizing the core issue as missing authorization on direct object references.

How to eliminate wrong answers

Option A is wrong because Cross-Site Request Forgery (CSRF) involves tricking a user into executing unwanted actions on a web application where they are authenticated, not directly manipulating object references to access unauthorized data. Option C is wrong because SQL Injection is a code injection technique that exploits insecure database queries by inserting malicious SQL statements, not by manipulating exposed object references in URLs or parameters.

Full explanation →
29
MCQeasy

A client requests a penetration test that simulates an external attacker with no prior knowledge of the internal network. The tester is not provided with any credentials, network diagrams, or source code. Which type of test does this describe?

A.White-box test
B.Black-box test
C.Gray-box test
D.Covert test
AnswerB

A black-box test accurately simulates an external attacker with no prior knowledge, forcing the tester to perform open-source intelligence (OSINT), port scanning, and service enumeration to identify entry points. Because the client requested an 'external' test, this aligns perfectly: the tester starts from the outside with only public information and any active exploitation must be done from external network boundaries. This approach mirrors a real-world attack and minimizes bias about where vulnerabilities exist.

Why this answer

This is a black-box test because the tester simulates an external attacker with no prior knowledge of the internal network, no credentials, no network diagrams, and no source code. In black-box testing, the tester must discover all vulnerabilities from an outsider's perspective, relying solely on publicly available information and active reconnaissance techniques such as port scanning, service enumeration, and vulnerability scanning. This approach aligns with the client's requirement to mimic a real-world attacker who has zero insider knowledge.

Exam trap

The trap here is that candidates often confuse black-box testing with gray-box testing, mistakenly thinking that 'no credentials' automatically implies gray-box, but gray-box testing still provides some internal knowledge (e.g., network diagrams or low-privilege access), which is explicitly absent in this scenario.

How to eliminate wrong answers

Option A is wrong because a white-box test provides the tester with full knowledge of the internal network, including credentials, network diagrams, and source code, which contradicts the scenario where no such information is given. Option C is wrong because a gray-box test offers partial knowledge, such as limited credentials or network topology, whereas the scenario explicitly states no prior knowledge or credentials are provided.

Full explanation →
30
MCQhard

A penetration tester is analyzing a PowerShell script that uses the 'Invoke-Command' cmdlet to execute commands on remote machines, and 'Set-Service' to change service startup types. What attack is this script most likely performing?

A.Remote service modification for persistence.
B.Lateral movement via PsExec.
C.Credential dumping.
D.Data exfiltration.
AnswerA

Invoke-Command with Set-Service is a classic persistence technique: it remotely alters a service's StartType (e.g., to Automatic) or recovery actions so that a malicious payload or backdoor survives reboots. The script does not show any new service creation, but modification of an existing service's configuration is sufficient for persistence because the service will launch automatically at system startup.

Why this answer

The script uses Invoke-Command to execute commands on remote machines and Set-Service to change service startup types. This combination is commonly used to modify a service to start automatically or to create a new service that runs malicious code, establishing persistence on a remote system. The attack does not involve lateral movement via PsExec (which uses SMB and service control manager differently) nor credential dumping (which requires tools like Mimikatz or direct memory access).

Exam trap

The trap here is that candidates confuse the use of Invoke-Command (PowerShell Remoting) with PsExec, but PsExec is a distinct tool that does not use the Invoke-Command cmdlet, and the focus on service modification points to persistence rather than lateral movement or credential theft.

How to eliminate wrong answers

Option B is wrong because PsExec is a separate tool that uses SMB and the Windows Service Control Manager to execute processes remotely, not the Invoke-Command cmdlet which relies on WinRM (WS-Management). Option C is wrong because credential dumping involves extracting password hashes or plaintext credentials from memory (e.g., LSASS) or registry, not modifying service startup types with Set-Service.

Full explanation →
31
MCQmedium

A client hires a penetration testing firm to assess a web application. The client uses a third-party content delivery network (CDN) for static assets and explicitly wants to exclude the CDN infrastructure from testing. In which document should this restriction be formally documented?

A.Statement of Work (SOW)
B.Non-Disclosure Agreement (NDA)
C.Master Services Agreement (MSA)
D.Rules of Engagement (ROE)
AnswerD

The Rules of Engagement is the document that explicitly authorizes and constrains the technical execution of the assessment, including in-scope IP addresses, allowed testing times, emergency contacts, and specific exclusions like the CDN. It bridges the gap between contractual scope and the actual commands and techniques used, and it is the document the tester consults to determine exactly what may or may not be touched.

Why this answer

The Rules of Engagement (ROE) document is the correct place to formally document restrictions such as excluding the CDN infrastructure from testing. The ROE defines the scope, boundaries, and specific constraints for the penetration test, including which IP ranges, domains, or systems are off-limits. This ensures the testing team does not inadvertently target the third-party CDN, which could violate contractual agreements or cause unintended disruptions.

Exam trap

The trap here is that candidates confuse the ROE with the SOW, assuming the SOW is the catch-all document for all restrictions, but the ROE is specifically designed for operational boundaries and constraints in penetration testing engagements.

How to eliminate wrong answers

Option A is wrong because the Statement of Work (SOW) describes the high-level objectives, deliverables, and timeline of the engagement, but it does not typically contain granular operational constraints like excluding specific infrastructure components. Option B is wrong because the Non-Disclosure Agreement (NDA) is a legal contract protecting confidential information, not a document for defining testing boundaries or restrictions. Option C is wrong because the Master Services Agreement (MSA) establishes the overarching legal and business terms between parties, but it does not detail per-engagement technical limitations such as CDN exclusion.

Full explanation →
32
MCQmedium

A penetration testing firm is hired to assess a client's hybrid infrastructure with on-premises and cloud servers in multiple regions. The client specifies testing only the on-premises systems due to budget and compliance. Which of the following should the tester emphasize in the rules of engagement (ROE)?

A.Detailed network diagrams of the cloud environment
B.Explicit exclusion of all cloud-based assets
C.Approval from the cloud service provider
D.A list of all cloud API endpoints
AnswerB

The Rules of Engagement must unambiguously delineate the authorized testing surface. Explicitly excluding cloud-based assets prevents the tester from inadvertently probing systems that are outside the contracted scope, which could constitute unauthorized access and violate cloud provider terms of service or data protection regulations. This clarity also aligns expectations between the client and tester, mitigating the risk of scope creep and ensuring that any findings are confined to the intended on-premises environment.

Why this answer

The client explicitly restricted testing to on-premises systems due to budget and compliance. The rules of engagement (ROE) must clearly define the authorized scope to prevent accidental testing of cloud assets, which could violate the contract and potentially breach the cloud provider's terms of service. Option B is correct because explicitly excluding all cloud-based assets ensures the tester does not touch any cloud resources, aligning with the client's constraints.

Exam trap

The trap here is that candidates may think they need cloud provider approval or network diagrams to understand the environment, but the key is respecting the client's explicit scope limitation by excluding cloud assets in the ROE.

How to eliminate wrong answers

Option A is wrong because detailed network diagrams of the cloud environment are irrelevant and out of scope; the tester is not authorized to test cloud systems, and requesting such diagrams could imply intent to test them, violating the client's restrictions. Option C is wrong because approval from the cloud service provider is not required when the cloud assets are explicitly excluded from testing; the tester has no need to interact with the cloud provider's infrastructure, and seeking such approval could create unnecessary legal or contractual complications.

Full explanation →
33
MCQhard

During a red team exercise, the tester successfully gains access to an internal server and finds evidence of ongoing criminal activity unrelated to the client. According to best practices for handling discovered criminal activity, what should the tester do first?

A.Contact the client's emergency contact as defined in the RoE
B.Immediately inform law enforcement
C.Cease all testing and delete the evidence
D.Continue testing and document the evidence for the final report
AnswerA

Correct. The tester should follow the communication plan.

Why this answer

The tester should follow the incident response plan and contact emergency contacts; the RoE should specify procedures.

Full explanation →
34
MCQhard

During a web application test, you find a feature that allows users to export data as PDF. The PDF generation uses user input without sanitization. You inject an XML external entity that reads /etc/passwd and the content appears in the PDF. Which vulnerability is present?

A.Server-Side Request Forgery (SSRF)
B.XML External Entity (XXE)
C.Command injection
D.Cross-Site Scripting (XSS)
AnswerB

XXE uses external entities to read files.

Why this answer

XXE (XML External Entity) allows reading files via XML entities when the parser is vulnerable.

Full explanation →
35
MCQhard

A penetration tester is performing a wireless penetration test. The RoE states that testing is only allowed between 8 PM and 6 AM. At 7:30 PM, the tester begins active scanning. At 8:15 PM, a client employee calls emergency contact to report suspicious activity. According to the RoE, which of the following is the most likely reason for the call?

A.The tester used an unauthorized tool
B.The tester started testing outside the agreed time window
C.The tester targeted an out-of-scope access point
D.The tester exceeded the allowed signal strength
AnswerB

Active scanning began at 7:30 PM, before 8 PM.

Why this answer

The tester started active scanning before the allowed window (8 PM), which violated the RoE and triggered an incident.

Full explanation →
36
MCQmedium

A penetration tester is using Burp Suite to test a web application. The tester notices that the application relies on client-side JavaScript validation to restrict input. To bypass this validation and test for server-side vulnerabilities, which Burp Suite feature is MOST useful for automatically modifying requests before they are sent to the server?

A.Proxy (with Match and Replace rules)
B.Intruder
C.Repeater
D.Decoder
AnswerA

The Proxy module sits between the browser and the web server, capturing every HTTP/S request and response. Match and Replace rules allow you to define regular expression-based conditions that automatically rewrite headers, body fields, or even entire requests in real time, effectively overriding client-side restrictions such as maxlength attributes, hidden form values, or JavaScript-based checks. This means the tester can alter traffic without manual interaction, making it the correct tool for this scenario.

Why this answer

The Proxy's Match and Replace rules allow the tester to automatically modify HTTP requests in transit, such as stripping or altering client-side validation parameters (e.g., maxlength, pattern attributes) before they reach the server. This bypasses client-side JavaScript restrictions because the modifications occur after the browser's validation but before the request is forwarded to the server, enabling direct testing of server-side input handling.

Exam trap

The trap here is that candidates often confuse Intruder's ability to send many requests with automatic modification of live traffic, not realizing that Intruder requires manual payload configuration and does not intercept browser-generated requests in real-time like Proxy Match and Replace does.

How to eliminate wrong answers

Option B (Intruder) is wrong because Intruder is designed for automated brute-force attacks, fuzzing, or parameter enumeration by sending many crafted requests, but it does not automatically modify requests as they pass through a proxy; it requires manual configuration of payload positions and does not intercept live browser traffic. Option C (Repeater) is wrong because Repeater is used for manually resending and tweaking individual requests after they have been captured, but it does not automatically modify requests in real-time before they are sent to the server; it operates on already-captured requests and lacks the automatic, on-the-fly substitution capability of Match and Replace rules.

Full explanation →
37
MCQmedium

A penetration tester wants to identify all subdomains for a target domain using only public records. Which technique is most effective for this purpose?

A.Searching crt.sh (Certificate Transparency logs).
B.DNS zone transfer.
C.Using Nmap to brute-force subdomains.
D.Querying the domain's MX records.
AnswerA

Certificate Transparency logs are public, append-only ledgers that record every TLS certificate issued by a trusted CA, including the Subject Alternative Name (SAN) entries. By querying crt.sh for the target domain, you retrieve a historical list of all certificates that referenced the domain or any of its subdomains. Because this data comes from third-party CT log servers rather than the target's own infrastructure, it constitutes passive reconnaissance that generates zero direct traffic to the target.

Why this answer

Certificate Transparency logs, accessible via crt.sh, are a public record of all SSL/TLS certificates issued for a domain. Since certificates often include Subject Alternative Names (SANs) listing subdomains, querying crt.sh reveals subdomains without any interaction with the target's infrastructure. This technique is passive, requires no authorization, and leverages mandatory logging per RFC 6962, making it highly effective for enumeration from public records.

Exam trap

The trap here is that candidates confuse 'public records' with 'active DNS queries' and choose DNS zone transfer (B) or brute-forcing (C), failing to recognize that Certificate Transparency logs are the only passive, public-record-based option listed.

How to eliminate wrong answers

Option B is wrong because DNS zone transfer (AXFR) is not a public record technique; it requires explicit server configuration to allow transfers, and modern DNS servers almost always restrict it to authorized secondary nameservers, making it a high-risk, active technique that rarely succeeds against hardened targets. Option C is wrong because using Nmap to brute-force subdomains is an active scanning technique that generates network traffic to the target's DNS servers, which is not 'using only public records' and can be detected or blocked, unlike passive methods.

Full explanation →
38
MCQmedium

A penetration tester has gained initial access to a Linux server through a vulnerable web application. The server has a restrictive outbound firewall that only allows traffic on ports 80, 443, and 53. The tester wants to establish a reverse shell that is likely to bypass the firewall. Which of the following techniques would be most effective?

A.Use a reverse shell listener on TCP port 3389 and connect from the target
B.Use a bind shell on the target's port 4444 and connect directly
C.Use a reverse shell over DNS by encoding commands in DNS queries
D.Use a reverse shell on TCP port 8080 and hope it is not blocked
AnswerC

A DNS reverse shell works by encoding command output and input inside DNS queries and responses, using tools like dnscat2 or iodine. Because UDP/TCP port 53 is typically allowed outbound for name resolution, this tunnel bypasses the firewall's egress restrictions without raising immediate alarms. The DNS protocol is often not deeply inspected by firewalls, allowing the attacker to encapsulate arbitrary data in query names and response records. This makes it a reliable and stealthy method when the only allowed ports are 80, 443, and 53.

Why this answer

DNS traffic on port 53 is typically allowed through restrictive outbound firewalls, and encoding reverse shell commands within DNS queries allows the tester to tunnel traffic over DNS, bypassing the firewall's port restrictions. Tools like dnscat2 or iodine can encapsulate TCP data in DNS requests, making the reverse shell appear as legitimate DNS traffic.

Exam trap

The trap here is that candidates may assume a reverse shell on a non-standard port (like 3389) will work because it's a common service port, but the firewall's explicit allow list (80, 443, 53) makes any other port blocked, and DNS tunneling is the only technique that leverages an allowed protocol for covert communication.

How to eliminate wrong answers

Option A is wrong because TCP port 3389 is used for RDP (Remote Desktop Protocol), which is not a standard outbound port allowed by the firewall (only ports 80, 443, and 53 are allowed), and even if it were, a reverse shell listener on that port would still be blocked by the firewall. Option B is wrong because a bind shell opens a listening port on the target (port 4444), but the restrictive outbound firewall does not block inbound connections; the issue is that the tester cannot initiate a direct connection to the target from outside due to the firewall's outbound rules, and the bind shell requires the tester to connect to the target, which is not possible if the target is behind NAT or has no direct route.

Full explanation →
39
MCQhard

A penetration tester has gained a foothold on a Linux server through a vulnerable web application. The server has an outbound firewall that blocks all traffic except DNS queries (UDP 53). The tester needs to establish a reverse shell to maintain access. Which technique is most likely to succeed?

A.Use a bind shell on a high TCP port and connect from the tester's machine
B.Encode the payload in Base64 and use DNS tunneling to execute commands
C.Attempt a reverse shell over HTTP using TCP port 80
D.Use SSH reverse port forwarding to the tester's server on port 443
AnswerB

DNS tunneling exploits the firewall's allowance for DNS queries by encapsulating command-and-control data within DNS request and response messages. Base64 encoding converts the binary payload into ASCII characters that fit within DNS label constraints, allowing tools like dnscat2 or iodine to establish a bidirectional reverse shell over UDP 53. Because the firewall only permits DNS egress, the server can send queries to the tester's authoritative name server, and the responses carry commands and output, bypassing the TCP egress restriction entirely.

Why this answer

DNS tunneling encapsulates non-DNS traffic (e.g., command output) within DNS query and response packets, which are allowed through the firewall on UDP port 53. This technique bypasses the outbound firewall restriction by making the malicious traffic appear as legitimate DNS queries, enabling the tester to execute commands and exfiltrate data without triggering network-level blocks.

Exam trap

The trap here is that candidates assume a reverse shell over HTTP (TCP 80) will work because HTTP is commonly allowed, but the question explicitly states the firewall blocks all traffic except DNS queries (UDP 53), making TCP-based reverse shells fail regardless of the port.

How to eliminate wrong answers

Option A is wrong because a bind shell opens a listening port on the target server, but the outbound firewall blocks all traffic except DNS queries, so the tester cannot initiate a connection from their machine to the target's high TCP port; the firewall would drop the inbound connection attempt. Option C is wrong because a reverse shell over HTTP using TCP port 80 would require the target server to initiate an outbound TCP connection, but the firewall blocks all outbound traffic except UDP 53, so the TCP SYN packet would be dropped by the firewall.

Full explanation →
40
MCQhard

A penetration tester is using a vulnerability scanner to assess an internal network. The scanner reports a critical vulnerability in a custom web application, but manual verification shows the application is not vulnerable. Which of the following is the MOST likely cause of this false positive?

A.The scanner used an outdated vulnerability database that does not match the application's patches
B.The scanner identified the application version from the HTTP response header, but the vulnerability was already patched in that version
C.The scanner detected a vulnerable library used by the application, but the application's implementation does not expose the vulnerable code path
D.The scanner performed an exploit attempt that succeeded on a different service on the same host
AnswerC

This is the classic false-positive scenario: a scanner identifies a third-party library (such as a JavaScript framework or open-source component) by its version string and matches it against known CVEs, but it cannot determine whether the application's code ever calls the vulnerable function or passes attacker-controlled data into it. Even when a library has a security flaw, if the custom application either implements the code path safely or never exposes it, the finding is not actually exploitable. A penetration tester must manually trace the application's logic and confirm reachability before reporting a confirmed vulnerability.

Why this answer

Vulnerability scanners often identify libraries or components with known CVEs, but they cannot determine whether the application's code actually invokes the vulnerable functions. In this case, the scanner flagged a library with a known vulnerability, but the custom web application's implementation does not expose the vulnerable code path, resulting in a false positive. This is a common limitation of static or version-based detection versus dynamic, context-aware analysis.

Exam trap

The trap here is that candidates often assume a scanner's version-based detection is definitive, overlooking the fact that a vulnerable library may be present but not actively used in a way that exposes the vulnerability.

How to eliminate wrong answers

Option A is wrong because an outdated vulnerability database would more likely cause false negatives (missing real vulnerabilities) rather than false positives; a false positive typically arises from over-aggressive or version-based detection, not from missing patches. Option B is wrong because if the vulnerability was already patched in that version, the scanner should not report it based on the HTTP response header; this scenario would indicate a scanner misconfiguration or a bug, not a typical false positive cause, and the question specifies the application is not vulnerable, not that it was patched.

Full explanation →
41
MCQmedium

A client requests a penetration test of a new mobile application that is still in development and only accessible on a test server behind the corporate VPN. The tester should include which of the following in the scope?

A.The production servers hosting the app when it goes live
B.Only the test server and the mobile application client
C.The corporate VPN infrastructure
D.All third-party APIs used by the application
AnswerB

These are the actual targets of the test and should be scoped.

Why this answer

The scope of a penetration test for an application still in development should be limited to the test server and the mobile application client. This ensures the assessment focuses on the application's security posture without including production systems that are not yet live or the corporate VPN infrastructure, which is typically out of scope unless explicitly requested. The tester should only evaluate the components directly relevant to the application's functionality and security during development.

Exam trap

The trap here is that candidates may mistakenly include the corporate VPN infrastructure or production servers, thinking they are necessary for a comprehensive test, but the scope must be strictly limited to the components specified by the client to avoid unauthorized testing and scope creep.

How to eliminate wrong answers

Option A is wrong because including production servers that are not yet live or accessible during the test would extend the scope beyond the client's request, potentially introducing risks to systems that are not part of the current development phase. Option C is wrong because the corporate VPN infrastructure is a network component that provides access to the test server, but it is not part of the mobile application itself; testing it would require separate authorization and is outside the scope of an application-focused penetration test.

Full explanation →
42
MCQeasy

A client requests a penetration test of their production environment that includes critical financial transaction systems. The client is concerned about potential service disruptions. Which of the following should the tester include in the Rules of Engagement to address this concern?

A.The tester will only use passive reconnaissance techniques
B.A 'stop loss' condition that requires immediate termination of testing if system metrics exceed defined thresholds
C.Exclude all financial transaction systems from the scope of testing
D.The client must provide a service level agreement (SLA) to the tester
AnswerB

A stop-loss condition is a predefined threshold on system metrics (e.g., CPU utilization, memory consumption, request latency, or error rate) that, when exceeded, triggers immediate termination of all active testing. In a production environment, exploit payloads, credential-stuffing loops, or vulnerability scanners can inadvertently cause a self-inflicted denial of service by exhausting connection pools, filling disk queues, or saturating bandwidth. Defining these thresholds in the rules of engagement gives the tester a clear, objective tripwire to protect availability before damage occurs, while still allowing aggressive testing up to that limit.

Why this answer

A 'stop loss' condition is a standard mechanism in Rules of Engagement (RoE) that defines specific system metrics (e.g., CPU utilization > 90%, memory usage > 80%, or transaction latency > 500ms) which, when exceeded, require immediate termination of testing. This directly addresses the client's concern about service disruptions in the production environment by providing a safety threshold that prevents the penetration test from causing performance degradation or outages in critical financial transaction systems.

Exam trap

The trap here is that candidates may confuse 'scope exclusion' (Option C) with a valid risk mitigation strategy, but the PT0-002 exam expects testers to include controls like stop-loss conditions to enable safe testing of in-scope critical systems rather than excluding them.

How to eliminate wrong answers

Option A is wrong because passive reconnaissance techniques (e.g., OSINT, traffic sniffing without injection) are insufficient for a full penetration test of financial transaction systems; they cannot validate active vulnerabilities like SQL injection or authentication bypass, and the client's concern about disruption is not addressed by limiting to passive techniques since active testing is still needed for meaningful security assessment. Option C is wrong because excluding all financial transaction systems from scope would render the penetration test ineffective for the client's primary concern—these systems are the critical assets that need testing; the goal is to test them safely, not to avoid them entirely.

Full explanation →
43
MCQeasy

A penetration tester has physical access to a small office. The network switch is in a locked cabinet, but the tester notices the lock is broken. The switch has multiple ports, and the tester wants to connect to the internal network. The tester has a laptop with an Ethernet port. However, the tester suspects that port security is enabled on the switch ports, which would block the connection if the MAC address is not authorized. Which action should the tester take first to gain network access?

A.Perform a MAC flooding attack to fill the switch's MAC table.
B.Use a DHCP starvation attack to exhaust IP addresses.
C.Plug the laptop into an available switch port.
D.Connect to the switch's console port and attempt default credentials.
AnswerD

Connecting to the switch's console port provides direct, out-of-band management access that bypasses all network-based security controls, including port security and 802.1X. If the default credentials (e.g., cisco/cisco, admin/admin, or blank passwords) have not been changed, the tester can log in to the management interface and alter the configuration. From there, they could disable port security, add their laptop's MAC address as authorized, create a VLAN hopping rule, or even capture traffic — effectively gaining full control over the switch and, by extension, network access. Default credentials are extremely common on legacy or poorly maintained equipment, making this a high-probability attack vector when physical access is available.

Why this answer

The tester has physical access to the switch and the lock is broken, allowing direct console access. If port security is enabled, plugging into a data port (Option C) would be blocked. The fastest first step is to connect to the console port and try default credentials (e.g., cisco/cisco) to gain administrative control of the switch, which can then be used to disable port security or add the tester's MAC address to the allowed list.

Exam trap

The trap here is that candidates assume physical access to a switch port means they can simply plug in (Option C), but Cisco exams emphasize that port security is a common Layer 2 control that must be bypassed via management access first, not by attacking the data plane.

How to eliminate wrong answers

Option A is wrong because a MAC flooding attack aims to overflow the switch's CAM table, forcing it into hub mode (flooding traffic out all ports), but it does not bypass port security—the tester's own MAC would still be unauthorized and the port would be err-disabled or blocked. Option B is wrong because a DHCP starvation attack exhausts the DHCP pool to cause a denial of service or force clients to use a rogue DHCP server; it does not grant the tester network access through a port-secured switch port. Option C is wrong because if port security is enabled with MAC address filtering, plugging directly into an available port will trigger a security violation (e.g., shutdown, restrict, or protect mode), blocking the tester's connection immediately.

Full explanation →
44
MCQeasy

A client requests a penetration test of their network and provides a list of IP addresses. During scoping, the tester notices that several IP addresses belong to a major cloud service provider. What should the tester do FIRST before including those IP addresses in the test?

A.Proceed with testing since the client provided the IP addresses
B.Ask the client to verify ownership and obtain written authorization from the cloud provider if needed
C.Exclude the cloud IP addresses from the scope without further discussion
D.Perform a quick port scan to determine if the IPs are responsive before deciding
AnswerB

The correct approach is to treat cloud-hosted assets as potentially owned or operated by a third party, even if the client claims they belong to their organization. The tester should request documentation proving ownership, such as cloud account identifiers, virtual network/subnet details, or a letter from the cloud provider explicitly authorizing penetration testing of the specified IP ranges. Written authorization from both the client and, when necessary, the cloud provider protects the tester against legal action, ensures the provider's security monitoring does not flag the activity as malicious, and keeps the test within the boundaries of the provider's testing policies (e.g., AWS's penetration testing policy, Azure's security testing guidelines).

Why this answer

Testing cloud provider IP addresses without explicit authorization violates the cloud provider's terms of service and could be considered unauthorized access, potentially leading to legal action. The tester must first verify that the client actually owns those IPs (e.g., via ARIN WHOIS or cloud provider documentation) and obtain written authorization from the cloud provider, as the provider's shared infrastructure means the tester's traffic could impact other tenants. This aligns with the PT0-002 scoping requirement to confirm all targets are within the authorized boundary.

Exam trap

CompTIA often tests the misconception that a client-provided IP list is sufficient authorization, but the trap here is that cloud IPs require additional verification and written permission from the provider due to multi-tenant risks and legal boundaries.

How to eliminate wrong answers

Option A is wrong because proceeding with testing solely based on the client's list ignores the critical step of verifying ownership and authorization, risking violation of laws like the Computer Fraud and Abuse Act (CFAA) and cloud provider policies. Option C is wrong because excluding cloud IPs without discussion may omit legitimate client-owned resources (e.g., a VPC or dedicated host) that should be tested, and the tester must first clarify ownership rather than making assumptions.

Full explanation →
45
Multi-Selectmedium

During a web application penetration test, a tester identifies a SQL injection vulnerability. Which TWO techniques could be used to extract data from the database? (Select TWO.)

Select 2 answers
A.Command injection
B.XXE injection
C.Blind time-based SQL injection
D.Reflected XSS
E.UNION-based SQL injection
AnswersC, E

Time-based blind uses delays to infer data.

Why this answer

UNION-based and blind time-based are common SQL injection techniques for data extraction.

Full explanation →
46
MCQmedium

A client wants a penetration test that simulates a disgruntled employee with access to the internal network but no administrative privileges. The client provides a standard user account on the domain. The tester discovers that the account has local administrator rights on a critical file server. Which step should the tester take according to typical Rules of Engagement?

A.Continue testing with the elevated privileges because they were provided
B.Use the privileges to escalate to domain admin and test further
C.Pause testing and inform the client of the unexpected privilege level for guidance
D.Revert to a lower-privileged account provided by the client
AnswerC

Pausing testing and informing the client is the only correct action because the tester must never assume that an unexpected privilege level is intended by the client. The rules of engagement define the exact boundaries of the test, and any deviation—whether the privilege is a misconfiguration, a leftover from a previous admin, or a deliberate invitation—must be clarified in writing before proceeding. This communication allows the client to either amend the scope to authorize the elevated access or provide a new low-privileged account, ensuring that the test remains legally valid and that findings are relevant to the original threat model.

Why this answer

The Rules of Engagement (RoE) require the tester to operate within the agreed scope and privilege level. Discovering that the provided standard user account has unexpected local administrator rights on a critical file server represents a scope change that could invalidate the test's assumptions and potentially cause unintended damage. The tester must pause and inform the client to obtain explicit guidance before proceeding with elevated privileges.

Exam trap

The trap here is that candidates assume any discovered privilege is fair game to use, ignoring the RoE's requirement to stay within the authorized scope and the ethical obligation to seek client guidance when unexpected access is found.

How to eliminate wrong answers

Option A is wrong because continuing to test with the elevated privileges violates the RoE scope, which specified a standard user account with no administrative privileges; using unapproved privileges can lead to unauthorized access and legal issues. Option B is wrong because using local admin rights to escalate to domain admin exceeds the agreed scope and could compromise the entire domain without client consent, which is a breach of ethical hacking principles and the test's authorization.

Full explanation →
47
MCQmedium

A penetration testing firm is scoping a test for a client that uses a hybrid infrastructure with both on-premises servers and cloud-based services (IaaS). The client specifies that only the cloud environment should be tested this year. Which concept is MOST important for the tester to discuss during the scoping meeting to avoid testing out-of-scope assets?

A.The shared responsibility model between the client and the cloud provider
B.The need to test on-premises systems as well to get a complete picture
C.The potential for false positives in cloud vulnerability scanners
D.The cost of third-party cloud penetration testing tools
AnswerA

The shared responsibility model defines the exact line between provider-managed infrastructure (physical hosts, hypervisor, network fabric) and client-controlled configurations (identity policies, data, application setup). Scoping must map the test exclusively to the client's side of that boundary—for example, testing IAM roles, S3 bucket policies, and security-group rules—while explicitly excluding provider components unless written authorization is obtained. Defining that boundary first prevents wasted effort, avoids accidental disruption of managed services, and keeps the engagement legally and contractually safe.

Why this answer

The shared responsibility model defines which security controls and operational tasks are managed by the cloud provider versus the client. In a scoping meeting, understanding this model is critical because the penetration tester must only target the client's side of the responsibility boundary (e.g., guest OS, applications, and IaaS configurations) and avoid testing the provider's underlying infrastructure, which is out-of-scope. Without this discussion, the tester could inadvertently probe the provider's hypervisor or physical network, violating the scope agreement and potentially causing legal or contractual issues.

Exam trap

The trap here is that candidates may focus on technical testing concerns like false positives or scope expansion, rather than recognizing that the shared responsibility model is the foundational scoping concept that prevents testing the cloud provider's infrastructure.

How to eliminate wrong answers

Option B is wrong because the client explicitly specified that only the cloud environment should be tested this year; insisting on testing on-premises systems would directly violate the scope and is not a scoping discussion point but a scope expansion request. Option C is wrong because false positives in cloud vulnerability scanners are a technical testing concern, not a scoping issue; the most important discussion for avoiding out-of-scope assets is defining the boundary of responsibility, not the accuracy of tools.

Full explanation →
48
MCQmedium

A penetration tester has gained access to a Windows workstation and extracted NTLM password hashes. The tester wants to move laterally to a server that authenticates using NTLM. The tester does not have the plaintext passwords. Which technique is MOST appropriate to authenticate to the server using the captured hashes?

A.Pass-the-hash
B.Brute force
C.Rainbow tables
D.Keylogging
AnswerA

Pass-the-hash (PtH) is the optimal technique because the tester can extract the NTLM hash from the compromised workstation's memory (e.g., via Mimikatz) and use it to authenticate directly to remote services like SMB, RDP, or LDAP that accept NTLM authentication. This bypasses the need to crack the hash or know the plaintext password, allowing immediate lateral movement. PtH tools such as impacket's psexec.py or mimikatz's sekurlsa::pth facilitate this attack.

Why this answer

Pass-the-hash (PtH) is the correct technique because it allows the tester to authenticate to the remote server using the captured NTLM hash directly, without needing the plaintext password. NTLM authentication uses a challenge-response protocol where the hash itself is the secret; by presenting the hash in the response, the tester can impersonate the user. This is a well-known lateral movement technique in Windows environments, often executed with tools like Mimikatz (sekurlsa::pth) or Impacket's wmiexec.py.

Exam trap

The trap here is that candidates may think they need the plaintext password for authentication and choose brute force or rainbow tables, not realizing that NTLM authentication accepts the hash directly in the challenge-response exchange, making pass-the-hash the most efficient lateral movement technique.

How to eliminate wrong answers

Option B (Brute force) is wrong because brute force attempts to guess the plaintext password by trying many combinations, which is computationally expensive and time-consuming; the tester already has the hash and does not need the plaintext for NTLM authentication. Option C (Rainbow tables) is wrong because rainbow tables are precomputed tables used to reverse a hash into a plaintext password, which is unnecessary here since the hash itself can be used directly for authentication via pass-the-hash; additionally, rainbow tables are ineffective against salted hashes or modern NTLM hashes without significant precomputation.

Full explanation →
49
MCQhard

A penetration test is being conducted for a healthcare organization subject to HIPAA. The tester is given access to a production system that contains electronic protected health information (ePHI). Which of the following should be included in the rules of engagement to ensure compliance?

A.A clause requiring encryption of all test data at rest and in transit.
B.A business associate agreement (BAA) signed between the client and the testing firm.
C.A detailed data handling and destruction procedure within the rules of engagement.
D.A restriction to only test in non-production environments.
AnswerC

Given the healthcare context and HIPAA's Security Rule, the RoE must specify controls for the entire lifecycle of ePHI encountered during the test—including collection limits, encryption, access restrictions, storage locations, and a verifiable destruction method such as cryptographic wipe or physical shredding after assessment. This is the only option that directly addresses the unique regulatory requirement for protecting ePHI and ensuring no residual sensitive data remains. A detailed procedure ensures testers know exactly what to do if they encounter live PHI, including logging, minimizing exposure, and confirming removal.

Why this answer

HIPAA requires covered entities to ensure the confidentiality, integrity, and availability of ePHI, which includes proper disposal of data after testing. A detailed data handling and destruction procedure within the rules of engagement (RoE) ensures that test data containing ePHI is securely wiped or destroyed in compliance with 45 CFR § 164.310(d)(2)(i) and NIST SP 800-88 guidelines. Without this clause, the tester might leave residual ePHI on production systems, violating HIPAA's security rule.

Exam trap

The trap here is that candidates confuse a BAA (a separate legal requirement) with a clause that must be included in the rules of engagement, or they assume encryption is a mandatory RoE clause when HIPAA treats it as addressable and not a procedural scope item.

How to eliminate wrong answers

Option A is wrong because while encryption of test data at rest and in transit is a good security practice, it is not a specific HIPAA compliance requirement that must be included in the rules of engagement; HIPAA mandates encryption as an addressable implementation specification under 45 CFR § 164.312(a)(2)(iv), but the RoE focuses on scope and handling procedures, not technical controls. Option B is wrong because a Business Associate Agreement (BAA) is a legal contract between the covered entity and the business associate (the testing firm) that must be signed before any ePHI access, but it is not part of the rules of engagement document; the BAA is a separate prerequisite, not a clause within the RoE.

Full explanation →
50
MCQmedium

A penetration tester has captured NTLM hashes from a compromised machine and wants to move laterally to a server that requires NTLM authentication. The tester does not have the plaintext password. Which attack technique is MOST appropriate for authenticating using the captured hashes?

A.Brute force the password from the hash
B.Pass-the-hash
C.NTLM relay
D.Kerberoasting
AnswerB

Pass-the-hash (PtH) exploits the fact that NTLM challenge-response authentication relies on the NTLM hash as the secret, not the plaintext password. By using the captured hash (e.g., from 'pwdump' or Mimikatz's 'sekurlsa::logonpasswords') in an SMB authentication handshake, the attacker can impersonate the compromised user on remote systems. This allows lateral movement across the domain without ever knowing the password, making it a preferred post-exploitation technique.

Why this answer

Pass-the-hash (PtH) is the most appropriate technique because it allows the tester to authenticate to the target server using the captured NTLM hash directly, without needing the plaintext password. NTLM authentication uses the hash as a secret, so the hash can be passed to the server in the challenge-response handshake. This is a well-known lateral movement technique in Windows environments.

Exam trap

CompTIA often tests the distinction between pass-the-hash and NTLM relay, where candidates confuse the need for an active relay target versus simply using a captured hash to authenticate directly.

How to eliminate wrong answers

Option A is wrong because brute-forcing the password from the hash is computationally expensive and time-consuming, especially for strong passwords, and is not the most efficient method for immediate lateral movement. Option C is wrong because NTLM relay involves intercepting and forwarding an authentication attempt from a client to a server, not using a pre-captured hash to authenticate directly; it requires an active connection from another machine.

Full explanation →
51
MCQeasy

A penetration tester is conducting passive reconnaissance on a target organization. The tester wants to identify the technologies and frameworks used by the target's web application without making any requests to the target's servers. Which resource is BEST suited for this task?

A.Nmap service scan with -sV
B.Shodan.io
C.BuiltWith.com
D.Wappalyzer browser extension
AnswerC

BuiltWith.com is a passive reconnaissance service that maintains an extensive database of technology profiles harvested from public websites, DNS records, certificate transparency logs, and historical crawl data. By querying BuiltWith, a tester identifies the frameworks, libraries, and analytics tools a target website uses without sending a single packet to the target's servers. Because the information is aggregated from existing public sources, BuiltWith fully satisfies the requirement of passive, non-intrusive intelligence gathering.

Why this answer

BuiltWith.com is a passive reconnaissance resource that profiles web application technologies by analyzing publicly available data, such as JavaScript libraries, web frameworks, and analytics tools, without sending any requests to the target's servers. It aggregates information from various public sources and historical data, making it ideal for identifying technologies without direct interaction.

Exam trap

The trap here is that candidates often confuse Shodan.io's passive-looking interface with true passive reconnaissance, not realizing that Shodan's data is derived from active scanning, while BuiltWith.com relies on non-intrusive public data aggregation.

How to eliminate wrong answers

Option A is wrong because Nmap's -sV flag performs an active service scan that sends probes to the target's servers to determine service versions, which violates the passive reconnaissance requirement. Option B is wrong because Shodan.io is a search engine for internet-connected devices and services, but it primarily relies on active scanning data from its own crawlers and may not provide detailed web application technology stacks like frameworks or libraries without making requests to the target.

Full explanation →
52
MCQmedium

During a penetration test of a large e-commerce platform, the client requests additional testing on a newly discovered microservice mid-engagement. The scope defined in the rules of engagement (ROE) explicitly lists all target systems. What should the penetration tester do FIRST?

A.Add the microservice to the test and include it in the final report as an unadvertised finding
B.Decline the request because the microservice was not part of the original scope
C.Inform the client that a scope amendment is needed and pause testing on the microservice until it is approved
D.Test the microservice only if it is using the same technology stack as other targets
AnswerC

This is the required professional response because the authorization to test is defined by the signed RoE or statement of work, and any new system falls outside that legal boundary. Pausing testing on the microservice until a formal scope amendment is approved protects both parties from legal exposure and ensures that any findings are defensible and actionable. The amendment process typically involves updating the contract with the new IP address/domain, explicit testing rules, and client sign-off, after which testing can resume safely.

Why this answer

The rules of engagement (ROE) are a legally binding document that defines the scope of testing. Adding a new microservice mid-engagement without an approved scope amendment violates the ROE and could lead to legal or contractual issues. The penetration tester must first pause testing on the microservice and formally request a scope amendment to ensure all activities remain authorized.

Exam trap

The trap here is that candidates may confuse 'professional flexibility' (Option A) with proper scope management, or think that declining outright (Option B) is safer, when the correct answer requires following formal change control procedures to maintain legal and ethical boundaries.

How to eliminate wrong answers

Option A is wrong because adding the microservice without amending the ROE constitutes unauthorized testing, which could breach the contract and expose the tester to liability; the final report should only include findings from authorized targets. Option B is wrong because outright declining the request without offering a path forward (scope amendment) is unprofessional and fails to address the client's evolving needs; the correct procedure is to pause testing and seek formal approval, not simply refuse.

Full explanation →
53
MCQmedium

A penetration tester is using a vulnerability scanner to assess a web application. The scanner reports a 'SQL Injection' finding with a high confidence level. However, manual verification of the same payload does not trigger the vulnerability in a browser. Which of the following is the most likely reason for this discrepancy?

A.The scanner used a different HTTP method than the one used in manual testing
B.The scanner's payloads were URL-encoded differently
C.The vulnerability exists only in the scanner's simulated environment
D.The scanner might have generated a false positive due to a misinterpretation of the server's response
AnswerD

Automated vulnerability scanners frequently produce false positives because they rely on heuristic response pattern matching rather than full semantic analysis. For example, a scanner may see the injected payload reflected in the HTML body and flag it as cross-site scripting without checking whether the reflection occurs in a safe, encoded context that prevents execution. Manual testing, which examines the actual response context and confirms exploitability, revealed that the server is not actually vulnerable. This discrepancy is a classic demonstration of why every scanner finding must be verified manually before being reported.

Why this answer

The most likely reason is that the scanner generated a false positive due to a misinterpretation of the server's response. Vulnerability scanners often infer SQL injection based on response patterns (e.g., database error messages, timing differences) that may not actually be exploitable. Manual verification in a browser failed because the payload did not produce a true SQL error or data leak, confirming the scanner's alert was incorrect.

Exam trap

CompTIA often tests the concept that automated scanners can produce false positives due to response misinterpretation, and candidates mistakenly choose option C (simulated environment) because they confuse the scanner's internal test logic with an actual isolated environment.

How to eliminate wrong answers

Option A is wrong because HTTP method differences (e.g., GET vs POST) could cause the scanner to test a different endpoint, but the question states the same payload was used; if the scanner used a different method, manual testing with the same method would still match. Option B is wrong because URL encoding differences (e.g., %27 vs ') would be normalized by the browser or server; manual testing typically uses the same encoding as the scanner's output. Option C is wrong because the scanner does not create a simulated environment; it sends real HTTP requests to the live web application, so the vulnerability cannot exist only in a simulated environment.

Full explanation →
54
MCQmedium

A penetration tester has captured a WPA2 handshake. Which tool from the Aircrack-ng suite is used to crack the pre-shared key?

A.airmon-ng
B.airodump-ng
C.aireplay-ng
D.aircrack-ng
AnswerD

Correct: cracks WEP and WPA keys from captured handshakes.

Why this answer

Aircrack-ng (option D) is the tool in the Aircrack-ng suite specifically designed to crack WPA2 pre-shared keys (PSK) by performing an offline dictionary or brute-force attack against the captured four-way handshake. It uses the handshake data (specifically the EAPOL frames) to derive the Pairwise Master Key (PMK) and verify it against candidate passphrases, making it the correct choice for this task.

Exam trap

The trap here is that candidates often confuse the tool that captures the handshake (airodump-ng) or the tool that forces the handshake (aireplay-ng) with the tool that actually performs the cryptographic cracking (aircrack-ng), leading them to select a wrong option.

How to eliminate wrong answers

Option A (airmon-ng) is wrong because it is used to enable or disable monitor mode on wireless interfaces, not to crack captured handshakes. Option B (airodump-ng) is wrong because it captures packets and handshakes but does not perform any cracking; it only outputs the handshake for later use. Option C (aireplay-ng) is wrong because it injects packets (e.g., deauthentication frames) to force a client to reconnect and generate a handshake, but it does not crack the PSK.

Full explanation →
55
MCQeasy

In a web application test, you find a parameter that directly references internal object IDs (e.g., user_id=123) and changing the ID allows access to another user's data. This vulnerability is known as:

A.Insecure Direct Object Reference (IDOR)
B.Cross-site scripting (XSS)
C.SQL injection
D.Cross-site request forgery (CSRF)
AnswerA

IDOR allows unauthorized access to objects by modifying reference values.

Why this answer

IDOR (Insecure Direct Object Reference) occurs when an application exposes internal object references without proper access control checks.

Full explanation →
56
MCQeasy

A penetration tester is planning a social engineering campaign against a corporation. The goal is to trick the CEO into revealing sensitive information. Which type of attack should the tester use?

A.Vishing
B.Spear phishing
C.Pharming
D.Whaling
AnswerD

Whaling is the established term for a spear-phishing attack aimed at high-level executives such as a CEO, CFO, or other senior officers. The attacker crafts pretexts like legal subpoenas, urgent board communications, or financial transaction requests that exploit the executive's authority, busy schedule, and access to critical systems or funds. In a pen-test scenario targeting a CEO, whaling is the correct label because it names both the technique and the specific victim class.

Why this answer

Whaling is a targeted form of phishing that specifically focuses on high-profile individuals, such as the CEO. In this scenario, the goal is to trick the CEO into revealing sensitive information, making whaling the correct choice because it is designed to impersonate trusted entities or create urgent scenarios to deceive senior executives.

Exam trap

CompTIA often tests the distinction between spear phishing and whaling, where the trap is that candidates choose spear phishing because it is a broader term, but the question's focus on a CEO specifically requires the more precise 'whaling' classification.

How to eliminate wrong answers

Option A is wrong because vishing (voice phishing) uses phone calls or voice messages, not email or other digital messages, and while it could target a CEO, the question implies a digital attack vector. Option B is wrong because spear phishing targets specific individuals or groups but is not exclusively reserved for high-level executives like a CEO; whaling is the more precise term for targeting C-suite personnel. Option C is wrong because pharming redirects users from legitimate websites to fraudulent ones by exploiting DNS vulnerabilities or local host file manipulation, and it does not involve directly tricking an individual via email or messaging.

Full explanation →
57
MCQmedium

A penetration tester writes a Python script to test an API for vulnerabilities. The script sends requests with multiple payloads and checks if the response contains an error message indicating a potential injection. Which of the following code snippets would BEST reduce false positives by verifying that the injected parameter is processed?

A.Check if the response status code is 500 for each payload
B.Compare the response time of the injected request to a baseline without injection
C.Check if the response contains a specific error message that is only triggered when the injection is successful
D.Compare the response of the injected request to the response of a benign request with the same parameter structure
AnswerD

Differential analysis compares the entire HTTP response—status, headers, body length, and content—of a benign request against an injected request that differs only in the payload. This isolates the variable of interest, so any observed difference that correlates with the payload confirms the parameter is processed. It is inherently robust to environmental noise and is the core technique used by modern DAST scanners to validate injection findings.

Why this answer

Comparing the response of an injected request to a benign request with the same parameter structure directly confirms that the injected parameter was processed and caused a different application behavior, thereby reducing false positives. This technique, often called differential analysis, isolates the effect of the injection from normal variations in the API response, such as dynamic content or session tokens. It is more reliable than checking for specific error messages or status codes, which may be suppressed or generic.

Exam trap

The trap here is that candidates often choose Option C because they assume error messages are reliable indicators of injection success, but in practice, modern APIs suppress detailed errors and may return the same generic error for both benign and malicious inputs, making differential analysis a more robust approach.

How to eliminate wrong answers

Option A is wrong because a 500 status code indicates a server error but does not confirm that the injected parameter was processed; it could be triggered by malformed requests, resource exhaustion, or unrelated bugs, leading to false positives. Option B is wrong because comparing response time can detect time-based injections (e.g., SQLi with SLEEP), but it is not a general method for verifying that the injected parameter is processed; many injections do not cause measurable time differences, and network latency can introduce false positives. Option C is wrong because checking for a specific error message assumes the application exposes detailed error information, which is often disabled in production; moreover, the same error message might appear for benign inputs or other issues, causing false positives or negatives.

Full explanation →
58
MCQeasy

A tester is performing an SQL injection attack on a login form. The tester inputs a single quote (') and receives a database error. The application returns different responses for true and false conditions. Which type of SQL injection is most likely occurring?

A.Time-based SQL injection
B.UNION-based SQL injection
C.Error-based SQL injection
D.Blind SQL injection
AnswerD

Blind SQL injection uses conditional responses to infer information.

Why this answer

Blind SQL injection occurs when no error messages are shown, but the application behaves differently based on true/false conditions. Error-based injection shows database errors. UNION-based requires visible output.

Time-based uses delays.

Full explanation →
59
MCQeasy

A penetration tester wants to quickly identify the listening services on a target Linux server without performing a full port scan. The tester has obtained an unauthenticated shell as a low-privileged user. Which built-in command is most likely available on a modern Linux distribution to list all listening TCP sockets?

A.netstat -tlnp
B.ss -tlnp
C.lsof -i
D.ifconfig -a
AnswerB

ss is the standard socket statistics utility in iproute2 and is almost always preinstalled on current Linux systems. The flags -t (TCP), -l (listening), -n (numeric), and -p (process) together precisely list listening TCP ports with numeric addresses and, when permitted, the owning process/PID. Because ss reads kernel socket information via netlink, it returns live results instantly and is the modern replacement for netstat.

Why this answer

`ss -tlnp` is the modern replacement for `netstat` on Linux distributions that have deprecated `netstat` (e.g., RHEL 7+, Ubuntu 16.04+). It uses the `netlink` interface to read socket information directly from the kernel, making it faster and more reliable than parsing `/proc/net/tcp`. The flags `-t` (TCP), `-l` (listening), `-n` (numeric addresses/ports), and `-p` (show process) precisely list all listening TCP sockets without requiring root privileges for basic socket listing.

Exam trap

The trap here is that candidates assume `netstat` is universally available on Linux, but the PT0-002 exam tests awareness of modern tooling deprecation, where `ss` is the default built-in command on distributions like CentOS 7+ and Ubuntu 16.04+.

How to eliminate wrong answers

Option A is wrong because `netstat -tlnp` is not guaranteed to be available on modern Linux distributions; it is often deprecated or requires installation of the `net-tools` package, which is not installed by default on many minimal or containerized environments. Option C is wrong because `lsof -i` is not a built-in command on most Linux distributions; it must be installed separately via the `lsof` package, and it does not filter exclusively to listening TCP sockets without additional flags like `-sTCP:LISTEN`.

Full explanation →
60
MCQmedium

A client is planning a penetration test of their internal network but refuses to provide network diagrams or access to a staging environment. The tester is concerned about causing a denial of service (DoS) on critical systems. Which clause should be included in the rules of engagement to mitigate this risk?

A.A clause requiring the client to provide a complete list of in-scope IP addresses.
B.A waiver stating that any service disruption is the client's responsibility.
C.A rate-limiting clause that restricts scan speed and concurrent connections.
D.An exclusion list for systems that should not be tested.
AnswerC

A rate-limiting clause operationalizes a technical control by constraining packets per second, concurrent connections, or tool-specific throttling such as Nmap's `--max-rate`, `--max-parallelism`, or timing templates. This directly reduces the risk of resource exhaustion on stateful devices like firewalls, load balancers, and application servers that have limited session tables or timeouts. Because the tester often lacks full visibility into the client's device capacities, a conservative rate limit keeps scan traffic within a safe tolerance and prevents self-inflicted DoS, even when network details are unknown.

Why this answer

A rate-limiting clause directly addresses the risk of causing a denial of service (DoS) by controlling the speed and concurrency of the penetration test. By restricting scan rates (e.g., using tools like Nmap with `--max-rate` or `--min-hostgroup`) and limiting concurrent connections, the tester can prevent overwhelming critical systems, even without network diagrams or a staging environment. This clause mitigates the risk without requiring the client to provide additional information or shifting liability.

Exam trap

The trap here is that candidates may choose Option A (list of IPs) thinking it reduces risk by narrowing scope, but they overlook that aggressive scanning of even a small IP list can still cause DoS, while rate-limiting directly controls the traffic intensity.

How to eliminate wrong answers

Option A is wrong because requiring a complete list of in-scope IP addresses does not prevent DoS; it only clarifies the target scope, but the tester could still cause a DoS by scanning those IPs too aggressively. Option B is wrong because a waiver stating that any service disruption is the client's responsibility does not mitigate the risk; it merely transfers liability, which is unethical and may violate the testing agreement, and does not prevent the actual DoS from occurring.

Full explanation →
61
MCQmedium

A penetration tester has obtained a set of NTLM password hashes from a Windows domain controller. The tester wants to perform an offline cracking attack using GPU acceleration. Which tool is best suited for this purpose?

A.Hashcat
B.CrackMapExec
C.John the Ripper
D.Hydra
AnswerA

Correct. Hashcat is optimized for GPU-accelerated cracking.

Why this answer

Hashcat is a powerful password cracker that supports GPU acceleration and can crack NTLM hashes efficiently.

Full explanation →
62
MCQeasy

A penetration tester is writing the executive summary for the final report. The CEO needs to understand the overall risk level and the business impact of the findings. Which of the following should be included in the executive summary?

A.A high-level overview of the most critical vulnerabilities and their potential business impact.
B.Detailed exploit steps with screenshots.
C.A list of all CVSS scores without context.
D.The exact commands used during testing.
AnswerA

This matches the purpose of the executive summary: concise, business-focused information that allows leadership to make informed decisions without needing technical expertise.

Why this answer

The executive summary is intended for non-technical stakeholders like the CEO, who need to grasp the overall risk posture and business implications without technical jargon. Option A provides a high-level overview of critical vulnerabilities and their potential business impact, directly addressing the CEO's need to understand risk level and business impact, which aligns with the PT0-002 objective for effective reporting and communication.

Exam trap

The trap here is that candidates often confuse the executive summary with a technical summary, choosing options with detailed exploit steps or raw CVSS scores, forgetting that the CEO needs a business-focused, non-technical overview of risk and impact.

How to eliminate wrong answers

Option B is wrong because detailed exploit steps with screenshots are too technical and granular for an executive summary; they belong in the technical findings section of the report, not in a high-level overview for a CEO. Option C is wrong because listing all CVSS scores without context fails to convey the business impact or risk level; CVSS scores alone do not explain how vulnerabilities affect business operations, compliance, or strategic goals, which is essential for executive decision-making.

Full explanation →
63
MCQmedium

A penetration tester is analyzing a Python script used for web application testing. The script imports the 'socket' module and uses it to create a raw socket. Which of the following is the most likely purpose of the script?

A.Creating a reverse shell payload
B.Sending crafted TCP packets to perform a SYN flood
C.Parsing HTTP responses for header injection
D.Automating user-agent rotation for web requests
AnswerB

Raw sockets expose the IP and TCP headers to the application, enabling the attacker to craft arbitrary TCP packets with custom flags such as SYN, spoof source IP addresses, and bypass the kernel's TCP state machine. In a SYN flood, the attacker repeatedly sends SYN packets but never completes the handshake, exhausting the target's SYN backlog queue and denying service to legitimate clients. This requires socket.socket(AF_INET, SOCK_RAW, IPPROTO_TCP) plus IP_HDRINCL, capabilities that normal stream sockets (SOCK_STREAM) cannot offer.

Why this answer

The 'socket' module in Python provides low-level networking interfaces, and creating a raw socket (using `socket.SOCK_RAW`) allows the script to craft and send custom packets at the IP layer. A SYN flood attack involves sending a high volume of TCP SYN packets with spoofed source IP addresses to exhaust a target's resources, which requires raw socket access to manipulate packet headers. Therefore, the most likely purpose of the script is sending crafted TCP packets to perform a SYN flood.

Exam trap

The trap here is that candidates may associate the 'socket' module only with standard TCP/UDP connections (like reverse shells) and overlook that raw sockets are specifically required for crafting custom packets in attacks like SYN floods, which operate at a lower network layer.

How to eliminate wrong answers

Option A is wrong because creating a reverse shell payload typically involves establishing a TCP connection (using `socket.SOCK_STREAM`) to a remote host, not raw sockets, and often uses higher-level libraries like `subprocess` or `pty` for shell interaction. Option C is wrong because parsing HTTP responses for header injection is an application-layer task that can be done with libraries like `requests` or `http.client`, and does not require raw socket manipulation at the network layer.

Full explanation →
64
Multi-Selectmedium

A penetration tester has captured network traffic and wants to analyze it using Wireshark. Which two actions can the tester perform to focus on specific types of communication? (Choose TWO.)

Select 2 answers
A.Use the Conversations window
B.Decrypt SSL/TLS traffic
C.Apply a display filter
D.Run a port scan
E.Generate a report with Nmap
AnswersA, C

Conversations show traffic between specific endpoints.

Why this answer

Display filters filter packets based on criteria, and conversation analysis groups traffic between endpoints.

Full explanation →
65
Multi-Selecthard

During a penetration test, a tester successfully exploits a web application and gains a foothold. The tester needs to pivot to an internal network segment that is not directly accessible. Which THREE tools can the tester use to create a SOCKS proxy or tunnel for pivoting?

Select 3 answers
A.Chisel
B.Netcat
C.Nmap
D.Ligolo-ng
E.SSH with -D flag
AnswersA, D, E

Chisel is a fast TCP/UDP tunnel over HTTP.

Why this answer

SSH dynamic port forwarding (-D), chisel, and ligolo-ng are all tools for creating SOCKS proxies or tunnels for pivoting.

Full explanation →
66
MCQeasy

A penetration tester is preparing the executive summary for a report. Which of the following metrics would be MOST valuable to include for non-technical stakeholders to understand the overall security posture?

A.A list of all tools used during the penetration test
B.The total number of vulnerabilities discovered and their average CVSS score
C.The number of critical and high-risk findings along with the average time to exploit them
D.A detailed step-by-step exploitation walkthrough of one critical vulnerability
AnswerC

The number of critical and high-risk findings, paired with the average time to exploit them, directly conveys the organization's most urgent exposures in a business-relevant way. This metric tells executives how many vulnerabilities pose an immediate threat and how quickly an attacker could leverage them, which is more actionable than raw severity scores. It frames the summary around exposure and remediation urgency, allowing leadership to prioritize resources and track risk reduction.

Why this answer

Non-technical stakeholders (e.g., executives) need a high-level, risk-focused summary that communicates the severity and urgency of findings. The number of critical/high-risk findings directly indicates the most dangerous exposures, and the average time to exploit them conveys how quickly an attacker could compromise the environment. This metric translates technical risk into business impact, which is the core goal of an executive summary.

Exam trap

The trap here is that candidates often choose Option B (total vulnerabilities and average CVSS score) because CVSS is a familiar metric, but the exam tests the understanding that non-technical stakeholders need actionable, prioritized risk data (critical/high count and exploit time) rather than a statistically averaged score that can obscure severe findings.

How to eliminate wrong answers

Option A is wrong because listing all tools used (e.g., Nmap, Burp Suite, Metasploit) provides no insight into the security posture; it is operational detail irrelevant to non-technical stakeholders. Option B is wrong because the total number of vulnerabilities and their average CVSS score can be misleading—a low average CVSS score may hide many critical findings, and non-technical stakeholders need prioritization, not a diluted average. Option D is wrong because a detailed step-by-step exploitation walkthrough is too technical and granular for an executive summary; it belongs in the technical report, not in a high-level communication for non-technical readers.

Full explanation →
67
MCQmedium

A penetration tester uses Hashcat to crack NTLM hashes captured during a pass-the-hash attack. Which Hashcat mode should the tester use for NTLM hashes?

A.-m 0
B.-m 13100
C.-m 1000
D.-m 22000
AnswerC

Mode 1000 is for NTLM.

Why this answer

Hashcat mode -m 1000 is for NTLM hashes. Other modes correspond to different hash types.

Full explanation →
68
MCQmedium

A penetration testing firm is hired to perform a test on a multinational company that has offices in Europe and North America. The client wants to test all systems including those in the European office, which is subject to GDPR. Which of the following is the MOST important legal consideration to include in the rules of engagement?

A.A limitation of liability clause
B.Data protection and privacy clauses addressing handling of personal data
C.A non-disclosure agreement
D.A schedule of testing hours
AnswerB

This directly addresses GDPR requirements, specifying how personal data will be protected during the penetration test.

Why this answer

The engagement involves testing systems in a European office subject to GDPR, which imposes strict requirements on the processing and protection of personal data. The rules of engagement must include data protection and privacy clauses to define how the penetration tester will handle any personal data encountered during the test, ensuring compliance with GDPR Article 5 (lawfulness, fairness, transparency) and Article 32 (security of processing). Without these clauses, the tester could inadvertently violate GDPR by collecting or storing personal data without a lawful basis, exposing both the client and the testing firm to significant fines.

Exam trap

The trap here is that candidates often choose a non-disclosure agreement (NDA) as the most important legal consideration, confusing general confidentiality with the specific data protection obligations required by GDPR, which are distinct and more prescriptive.

How to eliminate wrong answers

Option A is wrong because a limitation of liability clause is a standard contractual provision that caps financial damages, but it does not address the specific GDPR compliance requirements for handling personal data during the test. Option C is wrong because a non-disclosure agreement (NDA) protects confidentiality of the test results and client information, but it does not define how personal data must be processed, stored, or deleted under GDPR. Option D is wrong because a schedule of testing hours is an operational consideration that avoids business disruption, but it has no direct relevance to GDPR's data protection obligations.

Full explanation →
69
MCQhard

A penetration tester wants to identify the web server software and version used by a target organization without sending any packets to the target's infrastructure. Which of the following techniques is most effective for this purpose?

A.Use Shodan to search for the target's IP address or domain and review the gathered banners.
B.Perform a DNS zone transfer to obtain internal server information.
C.Use netcat to connect to port 80 and read the HTTP banner.
D.Use nmap -sV with a delayed scan to avoid detection.
AnswerA

Shodan is a search engine for internet-connected devices that continuously crawls the web and stores service banners, including HTTP Server headers, from historical scans. Querying Shodan by the target's IP address or domain is a purely passive reconnaissance technique because it retrieves already-collected data without sending a single packet to the target. This makes it ideal for stealthy initial fingerprinting, as it reveals the web server software and version without any risk of detection or direct interaction.

Why this answer

Shodan is a search engine that continuously scans the internet and stores service banners from various ports. By querying the target's IP address or domain, the penetration tester can retrieve previously collected HTTP headers and other service banners without sending any packets to the target, thus achieving passive reconnaissance.

Exam trap

The trap here is that candidates often confuse passive reconnaissance with low-and-slow active scanning, mistakenly believing that techniques like delayed nmap scans or netcat connections are passive when they still generate detectable network traffic.

How to eliminate wrong answers

Option B is wrong because a DNS zone transfer is an active query that sends a request to the target's DNS server, and it typically reveals internal hostnames, not web server software or version banners. Option C is wrong because using netcat to connect to port 80 sends a TCP SYN packet to the target, which is an active technique that generates network traffic and can be detected. Option D is wrong because nmap -sV performs active service version detection by sending probes to open ports, even with a delayed scan, it still transmits packets to the target infrastructure.

Full explanation →
70
MCQmedium

After a penetration test, the client's development team requests that the report include specific, actionable remediation steps for each vulnerability. Where in the report should this information be placed?

A.In the executive summary to emphasize the need for fixing vulnerabilities
B.In the appendix as a separate remediation checklist
C.Within the technical report section, under each vulnerability finding
D.In a separate document attached to the report to avoid cluttering the main report
AnswerC

This is the correct placement because professional penetration test reporting conventions, such as those in PTES and OWASP guidance, require remediation instructions to be embedded within each finding. Each vulnerability finding should include a clear remediation subsection—often with specific code examples, configuration changes, or patches—immediately following the evidence and impact. This inline approach ensures the development team sees the problem and the fix together, reducing ambiguity and preventing loss of context, and it also makes the report a single, self-contained reference for the entire remediation process.

Why this answer

The correct placement for specific, actionable remediation steps is within the technical report section under each vulnerability finding. This aligns with industry best practices (e.g., PTES, OWASP) where each finding includes a description, risk rating, and a dedicated remediation subsection, ensuring developers have immediate context and clear steps without cross-referencing other sections.

Exam trap

The trap here is that candidates may think the executive summary or appendix is sufficient for remediation details, but the exam specifically tests that actionable steps must be embedded within each finding to ensure clear ownership and immediate applicability for the development team.

How to eliminate wrong answers

Option A is wrong because the executive summary is a high-level overview for management, not a place for detailed technical remediation steps; it should focus on business risk and strategic recommendations, not per-vulnerability fixes. Option B is wrong because placing remediation steps only in an appendix separates them from the vulnerability context, forcing developers to flip back and forth, which reduces clarity and increases the risk of misapplication. Option D is wrong because a separate document can be lost or overlooked, and the PT0-002 exam expects remediation to be integrated into the main report for traceability and completeness, not hidden in an attachment.

Full explanation →
71
MCQhard

A penetration tester has exploited a web application and found that the server has an outbound firewall that restricts all outbound traffic except for DNS queries (UDP 53). The tester has a reverse shell payload that connects back on TCP 443. Which technique can the tester use to exfiltrate data or establish a channel?

A.Use netcat to send data over TCP 53
B.Use an SSH tunnel over UDP 53
C.Use dnscat2 or other DNS tunneling tool
D.Use a bind shell listening on TCP 443 internally
AnswerC

DNS tunneling tools like dnscat2, iodine, and dns2tcp encode arbitrary data inside DNS queries and responses, which are allowed outbound on UDP/53 by the firewall. The tester controls an authoritative DNS server for a domain, so every DNS query from the compromised host to that domain carries a payload and the responses carry instructions, establishing a command-and-control channel that blends in with normal DNS traffic.

Why this answer

DNS tunneling tools like dnscat2 encode data within DNS queries and responses, allowing the tester to bypass outbound firewall restrictions that only permit UDP 53 traffic. Since the reverse shell payload uses TCP 443, which is blocked, DNS tunneling provides an alternative covert channel that encapsulates the communication within legitimate DNS lookups, effectively exfiltrating data or establishing a command-and-control channel over the allowed protocol.

Exam trap

The trap here is that candidates may assume any protocol can be tunneled over UDP 53 simply by changing the port, but DNS tunneling requires specialized tools that encapsulate data within DNS message formats, not just raw TCP or SSH over UDP.

How to eliminate wrong answers

Option A is wrong because netcat cannot send data over TCP 53 when the outbound firewall only allows UDP 53; TCP 53 is a different protocol and would be blocked. Option B is wrong because SSH tunnels operate over TCP, not UDP, and UDP 53 is used for DNS queries, not SSH; attempting an SSH tunnel over UDP 53 would fail as SSH does not natively support UDP transport. Option D is wrong because a bind shell listening on TCP 443 internally requires the tester to initiate an inbound connection to that port, but the outbound firewall does not restrict inbound traffic; however, the tester is behind the firewall and needs an outbound channel, and a bind shell does not solve the outbound restriction problem.

Full explanation →
72
MCQeasy

A penetration tester gains access to a web application that uses a MongoDB backend. The tester discovers that the search functionality directly interpolates user input into a NoSQL query without sanitization. Which technique should the tester use to extract data from the database?

A.SQL injection
B.NoSQL injection
C.LDAP injection
D.Command injection
AnswerB

NoSQL injection is the correct technique because MongoDB directly interpolates user-supplied input into its query objects. By submitting input such as username[$ne]=null or password[$gt]=, an attacker can inject MongoDB query operators that alter the intended logic, often bypassing authentication or extracting data. More dangerous is the $where operator, which can execute arbitrary JavaScript expressions, making injection possible without SQL syntax.

Why this answer

The application uses MongoDB, a NoSQL database, and the search functionality directly interpolates user input into a NoSQL query without sanitization. This allows the tester to inject MongoDB operators (e.g., $ne, $regex, $gt) to manipulate the query logic and extract data, which is the core of NoSQL injection. Unlike SQL injection, this technique targets MongoDB's query syntax, such as JSON-based operators, to bypass authentication or retrieve records.

Exam trap

The trap here is that candidates see 'injection' and default to SQL injection (Option A) without recognizing that the backend is MongoDB, a NoSQL database, which requires a different injection technique using JSON operators rather than SQL syntax.

How to eliminate wrong answers

Option A is wrong because SQL injection targets relational databases using SQL syntax (e.g., SELECT, UNION), but MongoDB uses a document-based query language with JSON-like operators, not SQL. Option C is wrong because LDAP injection exploits Lightweight Directory Access Protocol queries (e.g., LDAP filters) to manipulate directory services, not NoSQL databases like MongoDB. Option D is wrong because command injection targets operating system commands (e.g., shell commands) via system calls, not database queries, and the vulnerability here is in the database query layer, not the OS.

Full explanation →
73
MCQeasy

A penetration tester wants to perform a pass-the-hash attack against a Windows system. Which tool can be used to authenticate using the NTLM hash instead of a password?

A.Responder
B.Hashcat
C.CrackMapExec
D.John the Ripper
AnswerC

CrackMapExec can use NTLM hashes for authentication via pass-the-hash.

Why this answer

CrackMapExec supports pass-the-hash authentication with NTLM hashes.

Full explanation →
74
MCQeasy

A penetration tester wants to quickly identify which of the top 100 common ports are open on a target system, while minimizing network traffic and scan time. Which Nmap command is most appropriate?

A.nmap -p- target
B.nmap -T5 -F target
C.nmap -sn target
D.nmap -sV target
AnswerB

The -T5 flag applies the 'insane' timing template, which aggressively reduces timeouts and increases probe parallelism to maximize scanning speed. The -F flag limits the scan to the top 100 most commonly open ports (per Nmap's services database), ensuring that only high-probability targets are probed. Together, these options provide the fastest method to discover which of the top ports are listening, which matches the penetration tester's objective.

Why this answer

The `-T5` flag sets the fastest timing template (insane), which reduces delays and speeds up the scan, while the `-F` flag (fast mode) limits scanning to only the top 100 most common ports as defined in Nmap's nmap-services file. This combination minimizes network traffic and scan time while quickly identifying open ports among the top 100, aligning with the goal of efficiency.

Exam trap

The trap here is that candidates often confuse `-F` with `-p-` or assume `-T5` alone is sufficient, failing to recognize that `-F` is the specific flag that restricts the scan to the top 100 ports, while `-T5` only accelerates the timing without changing the port list.

How to eliminate wrong answers

Option A is wrong because `-p-` scans all 65535 TCP ports, which generates maximum traffic and takes the longest time, directly contradicting the requirement to minimize network traffic and scan time. Option C is wrong because `-sn` performs a ping sweep (host discovery) using ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests; it does not scan any ports for open/closed status, so it cannot identify open ports. Option D is wrong because `-sV` enables version detection, which probes open ports to determine service versions, but it does not limit the port range to the top 100; without `-F`, it scans the default 1000 ports, and the version probing adds significant traffic and time, making it inefficient for the stated goal.

Full explanation →
75
MCQmedium

A penetration tester is analyzing a Python script that uses the Impacket library to perform an SMB relay attack. The script is failing to capture NTLM hashes from target machines. Which part of the script is MOST likely misconfigured?

A.The target IP address
B.The listener IP address
C.The SMB version negotiation
D.The authentication method (NTLMv1 vs NTLMv2)
AnswerB

The listener IP defines the interface on which the malicious SMB server awaits the victim's connection and must be set to an address owned by the attacker and routable from the victim's network. If it is misconfigured, the victim's SMB client cannot establish the TCP session, so no NTLM handshake occurs and no hash is ever transmitted. Correctly setting this IP is therefore the primary requirement for hash capture.

Why this answer

In an SMB relay attack using Impacket, the listener IP address must be set to the attacker's IP address where the relayed authentication is received. If the listener IP is misconfigured (e.g., set to the target's IP or left as localhost), the relay server will not receive the forwarded NTLM hashes, causing the capture to fail. This is a common configuration error when using Impacket's 'smbrelayx' or similar scripts.

Exam trap

The trap here is that candidates often confuse the listener IP with the target IP, assuming the script needs the target's IP to capture hashes, when in fact the listener IP must be the attacker's own IP to receive the relayed authentication.

How to eliminate wrong answers

Option A is wrong because the target IP address is typically the machine being attacked or relayed to, and while it must be correct for the relay to reach the intended service, an incorrect target IP would cause the relay to fail at a different stage (e.g., connection refused), not specifically prevent hash capture. Option C is wrong because SMB version negotiation is handled automatically by Impacket's SMB connection; misconfiguring it might cause a connection failure but would not prevent hash capture if the relay is set up correctly. Option D is wrong because the authentication method (NTLMv1 vs NTLMv2) affects the hash format captured, but both can be relayed; the script's failure to capture hashes is not due to the NTLM version but rather the relay listener not receiving the authentication attempt.

Full explanation →

Page 1 of 3

Page 2

All pages

123

Practice PT0-003 by domain

Target a specific domain to shore up weak areas.

Post-exploitation and Lateral MovementVulnerability Discovery and AnalysisEngagement ManagementReconnaissance and EnumerationAttacks and Exploits
See all domains with question counts →