Courseiva
← PT0-002
Full test
Question 287 of 509
Attacks and Exploits →hardMultiple ChoiceObjective-mapped

Quick Answer

The correct technique is to modify the PATH environment variable to point to a malicious script with the same name as the command called by the binary. This works because the SUID binary executes a system command using a relative path without sanitizing user input, so when the binary runs, the operating system searches the directories listed in the PATH variable in order, allowing an attacker to place a malicious script in a directory that appears earlier in the PATH than the legitimate system directory. On the CompTIA PenTest+ PT0-002 exam, this scenario tests your understanding of privilege escalation through environment manipulation, often appearing as a trap where testers mistakenly look for buffer overflows or symlink attacks instead. A common memory tip is “PATH before system” — remember that the PATH variable is searched before the system’s default binary locations, so if you can control the order, you control the execution.

PT0-002 Attacks and Exploits Practice Question

This PT0-002 practice question tests your understanding of attacks and exploits. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: pATH hijacking exploits SUID binaries using relative paths.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A penetration tester has gained a low-privileged shell on a Linux server and discovers a binary with the SUID bit set owned by root. The binary executes a system command using a relative path without sanitizing user input. Which of the following techniques would the tester MOST likely use to escalate privileges?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

  • Clue: "most likely"

    Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

Question 1hardmultiple choice
Read the full NAT/PAT explanation →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Modify the PATH environment variable to point to a malicious script with the same name as the command called by the binary

Option B is correct because the SUID binary executes a system command using a relative path without sanitizing user input. By modifying the PATH environment variable to include a directory containing a malicious script with the same name as the command, the tester can cause the binary to execute the attacker-controlled script instead of the intended system command, thereby escalating privileges to root when the SUID binary runs.

Key principle: PATH hijacking exploits SUID binaries using relative paths.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Exploit a kernel vulnerability to gain root

    Why it's wrong here

    While kernel exploits can escalate privileges, they are more complex and less reliable than exploiting an SUID misconfiguration.

  • ✓

    Modify the PATH environment variable to point to a malicious script with the same name as the command called by the binary

    Why this is correct

    PATH hijacking leverages the SUID binary's use of a relative path; by placing a malicious executable earlier in PATH, the binary executes it with root privileges.

    Clue confirmation

    The clue word "most likely" in the question point toward this answer.

    Related concept

    PATH hijacking exploits SUID binaries using relative paths.

  • ✗

    Impersonate the root user using sudo

    Why it's wrong here

    The tester is not in the sudoers file and does not have the root password, so sudo cannot be used.

  • ✗

    Preload a shared library using LD_PRELOAD

    Why it's wrong here

    LD_PRELOAD is not effective for SUID binaries as Linux systems disable it for security reasons.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates may think kernel exploitation (Option A) is always the go-to for privilege escalation, but the question specifically describes a misconfigured SUID binary with a relative path and unsanitized input, making PATH hijacking the most direct and likely technique.

Detailed technical explanation

How to think about this question

The PATH hijacking attack works because the SUID binary runs with root privileges but inherits the user's environment variables, including PATH. When the binary calls a command like 'ls' or 'cp' using a relative path, the shell searches the directories in PATH in order; by placing a malicious script in a directory listed earlier in PATH (e.g., /tmp), the attacker's script executes instead. In real-world scenarios, this is often combined with techniques like creating a script that spawns a root shell or copies /bin/bash to a writable location with SUID set.

KKey Concepts to Remember

  • PATH hijacking exploits SUID binaries using relative paths.
  • The PATH environment variable dictates command search order.
  • Malicious executables are placed in a directory early in the PATH.
  • SUID binaries execute the malicious code with their owner's privileges.

TExam Day Tips

  • Watch for words such as best, first, most likely and least administrative effort.
  • Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

PATH hijacking exploits SUID binaries using relative paths.

Real-world example

How this comes up in practice

A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.

What to study next

Got this wrong? Here's your next step.

Review pATH hijacking exploits SUID binaries using relative paths., then practise related PT0-002 questions on the same topic to reinforce the concept.

Related practice questions

Related PT0-002 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Planning and Scoping practice questions

Practise PT0-002 questions linked to Planning and Scoping.

Information Gathering and Vulnerability Scanning practice questions

Practise PT0-002 questions linked to Information Gathering and Vulnerability Scanning.

Attacks and Exploits practice questions

Practise PT0-002 questions linked to Attacks and Exploits.

Reporting and Communication practice questions

Practise PT0-002 questions linked to Reporting and Communication.

Tools and Code Analysis practice questions

Practise PT0-002 questions linked to Tools and Code Analysis.

PT0-002 fundamentals practice questions

Practise PT0-002 questions linked to PT0-002 fundamentals.

PT0-002 scenario practice questions

Practise PT0-002 questions linked to PT0-002 scenario.

PT0-002 troubleshooting practice questions

Practise PT0-002 questions linked to PT0-002 troubleshooting.

Practice this exam

Start a free PT0-002 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions20 questions30 questions50 questionsTimed 30
PT0-002 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this PT0-002 question test?

Attacks and Exploits — This question tests Attacks and Exploits — PATH hijacking exploits SUID binaries using relative paths..

What is the correct answer to this question?

The correct answer is: Modify the PATH environment variable to point to a malicious script with the same name as the command called by the binary — Option B is correct because the SUID binary executes a system command using a relative path without sanitizing user input. By modifying the PATH environment variable to include a directory containing a malicious script with the same name as the command, the tester can cause the binary to execute the attacker-controlled script instead of the intended system command, thereby escalating privileges to root when the SUID binary runs.

What should I do if I get this PT0-002 question wrong?

Review pATH hijacking exploits SUID binaries using relative paths., then practise related PT0-002 questions on the same topic to reinforce the concept.

Are there clue words in this question I should notice?

Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

What is the key concept behind this question?

PATH hijacking exploits SUID binaries using relative paths.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Last reviewed: Jun 11, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

Sign in to join the discussion.

This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.