A penetration tester is developing the rules of engagement for a potential client. Which of the following would most likely be specified in the rules of engagement?
Answer(s): A
The correct answer is A: Testing window. The rules of engagement (RoE) for a penetration test are a detailed document outlining the scope, limitations, and constraints of the assessment. A critical component of the RoE is the testing window , which specifies the exact dates and times during which the penetration testing activities are authorized to occur. This is crucial for several reasons: it minimizes disruption to the client's business operations, allows the client to monitor the testing, and provides a clear timeline for both the penetration testing team and the client's security team. The testing window helps prevent unexpected system outages or conflicts with scheduled maintenance.Option B, Terms of Service, is typically a legal agreement between a service provider and its customers, not directly relevant to a specific penetration test engagement. Option C, Authorization letter, while important, serves as proof that the penetration testers have permission to conduct the assessment but is not as comprehensive as the RoE. Option D, Shared responsibilities, might be alluded to within the RoE, but the testing window is a distinct and fundamental element that must be clearly defined.The testing window is directly related to risk management and operational considerations. A well-defined testing window helps ensure that the penetration test is conducted safely and effectively, minimizing potential negative impacts.For more information on penetration testing rules of engagement, you can refer to resources from organizations like SANS Institute and NIST:SANS Institute: https://www.sans.org/ NIST (National Institute of Standards and Technology): https://www.nist.gov/ (Specifically look for NIST Special Publication 800-115)
A penetration tester has found a web application that is running on a cloud virtual machine instance. Vulnerability scans show a potential SSRF for the same application URL path with an injectable parameter. Which of the following commands should the tester run to successfully test for secrets exposure exploitabilty?
A is correct because it targets the well-known internal IP address of the AWS EC2 metadata service, which can expose sensitive information about the cloud instance.Reasoning : In an SSRF (Server-Side Request Forgery) vulnerability, the attacker manipulates the server to send requests to internal services that are typically inaccessible from the outside. The AWS metadata service, accessible via the IP address 169.254.169.254 , contains sensitive data such as instance credentials, which can be exploited if the web application improperly validates user input. This makes option A a valid command to test the potential for secrets exposure.Evaluation of other options :B: curl '?param= http://127.0.0.1/etc/passwd ' : This attempts to access the local filesystem of the server itself. However, unless the web application processes file paths directly and improperly, it's unlikely to return the /etc/passwd file, making it less relevant for cloud-specific exploits compared to option A.C: curl '?param=alert(1 /' : This is an attempt at Cross-Site Scripting (XSS), which does not pertain to SSRF. Although it suggests the application might be vulnerable to XSS, it does not help in discovering secrets in the context of SSRF.D: curl ?param= http://127.0.0.1/ : Similar to option B, this command targets the local host but does not specify an endpoint that would typically expose sensitive data. Without a specific path, it is less likely to yield useful information in a cloud context.In summary, A effectively exploits the SSRF vulnerability to request sensitive metadata, while the other options either misdirect the attempt or fall outside the scope of local metadata exposure.References:https://aws.amazon.com/premiumsupport/knowledge-center/ec2-retrieve-instance-metadata/ https://portswigger.net/web-security/ssrf https://owasp.org/www-community/attacks/Server_Side_Request_Forgery_SSRF
References:https://aws.amazon.com/premiumsupport/knowledge-center/ec2-retrieve-instance-metadata/ https://portswigger.net/web-security/ssrf https://owasp.org/www-community/attacks/Server_Side_Request_Forgery_SSRF
A tester obtains access to an endpoint subnet and wants to move laterally in the network. Given the following output:Which of the following command and attack methods is the most appropriate for reducing the chances of being detected?
A: responder -I eth0 -dwv + ntlmrelayx.py -smb2support -tf <target> - Responder: captures NTLM hashes on the network. - ntlmrelayx: relays those captured credentials directly to SMB (because signing is off). - This avoids brute force or noisy exploits. - It’s stealthier → lower chance of detection. B. msf > use exploit/windows/smb/ms17_010_psexec - That’s EternalBlue (MS17-010) exploit → very noisy. - Could crash system or trigger IDS/IPS alerts. - Not stealthy, not the “most appropriate.” C. hydra -L administrator -P /path/to/passwdlist smb://<target> - Password brute-forcing → extremely noisy. - Likely to trigger account lockouts & detection. D. nmap --script smb-brute.nse -p 445 <target> - Also brute force, but with Nmap NSE. -Still noisy, still bad for stealth.
A penetration tester is authorized to perform a DoS attack against a host on a network. Given the following input:Which of the following attack types is most likely being used in the test?
Answer(s): D
SYN flood: This attack exploits the TCP three-way handshake process. The attacker sends a high volume of SYN packets (the first step in establishing a TCP connection) but never responds to the server's SYN-ACK packets. The target server keeps resources open for each "half-open" connection, which eventually exhausts its resources and prevents it from handling legitimate traffic.
Which of the following describes the process of determining why a vulnerability scanner is not providing results?
The correct answer is A. Root cause analysis .Root cause analysis (RCA) is a systematic process for identifying the fundamental reasons behind a problem or event. In this scenario, the problem is that the vulnerability scanner isn't providing expected results. RCA involves investigating the different aspects of the vulnerability scanning process to understand why it's failing. This might involve examining the scanner's configuration, network connectivity, target scope, credentials, software updates, and system logs. By methodically eliminating possible causes, you can pinpoint the core issue preventing the scanner from functioning correctly.Secure distribution (B) refers to the safe and reliable delivery of software or updates, not the diagnosis of problems. Peer review (C) is a process of having colleagues examine work for quality and accuracy, and while helpful in general security practices, it doesn't directly address troubleshooting scanner issues. Goal reprioritization (D) involves adjusting priorities, which is not relevant to identifying the source of a technical malfunction.Therefore, RCA is the most appropriate choice because it is a problem-solving technique focused on identifying the underlying cause of a problem and not just the symptoms. Applying RCA principles can help you find whether the vulnerability scanner issue stems from misconfiguration, insufficient permissions, network problems, or other related reasons.Further reading:Root Cause Analysis: https://www.qualitymag.com/blogs/14-quality-blog/post/95750-root-cause-analysis Root Cause Analysis Explained: https://asq.org/quality-resources/root-cause-analysis
A penetration tester runs a vulnerability scan that identifies several issues across numerous customer hosts. The executive report outlines the following information:The client is concerned about the availabilty of its consumer-facing production application. Which of the following hosts should the penetration tester select for additional manual testing?
Answer(s): C
A: Server 1 (Development sandbox) - Not production-facing, mainly used for development. - Doesn’t impact consumer-facing availability. B. Server 2 (Back office file transfer) - Internal function, not customer-facing. C. Server 3 (Perimeter network web server) - Likely serves the consumer-facing application. - Even with fewer vulnerabilities, these may directly impact availability and security. - Should be prioritized for manual testing to confirm critical risks. D. Server 4 (Developer QA server) - High number of vulnerabilities, but QA server does not directly affect production.
A penetration tester attempts to run an automated web-application scanner against a target URL. The tester validates that the web page is accessible from a different device. The tester analyzes the following HTTP request header logging output:Which of the following actions should the tester take to get the scans to work properly?
The web server likely has basic bot/automation detection. - It is filtering or blocking requests from unknown or “script” User-Agents. - This is not a network or scanner speed issue — it’s about how the requests appear. ______ A. Modify the scanner to slow down the scan - Slowing down won’t help; the blocking is based on User-Agent, not rate. B. Change the source IP with a VPN - IP is not the problem here; requests from other devices (likely different IPs) already work. C. Modify the scanner to only use HTTP GET requests - POST requests are necessary for login testing. - Also, the GET request with python User-Agent was blocked, so GET alone won’t fix it. D. Modify the scanner user agent - The logs show Mozilla/5.0 works. - By changing the scanner’s User-Agent to mimic a browser, it will bypass the simple filter and scan successfully.
During an assessment, a penetration tester runs the following command: setspn.exe -Q */* Which of the following attacks is the penetration tester preparing for?
The correct answer is C. Kerberoasting.The command setspn.exe -Q / is used to query Service Principal Names (SPNs) in an Active Directory environment. SPNs are unique identifiers for services running under specific accounts. Kerberoasting is an attack where a malicious actor attempts to retrieve Kerberos tickets associated with these services. The attacker then attempts to crack the password associated with the service account offline.The command executed by the penetration tester is preparing to identify potential targets for Kerberoasting. By querying all SPNs, the tester can discover service accounts that are used throughout the domain. Once identified, Kerberos tickets for those services can be requested. The captured Kerberos tickets can then be cracked offline using password cracking tools, which reveal the plaintext password of the service account. Compromising a service account often allows for privileged access or lateral movement within the network. LDAP injection involves exploiting vulnerabilities in LDAP queries, pass-the-hash involves reusing stolen password hashes, and a dictionary attack focuses on guessing passwords directly, not on exploiting Kerberos tickets. The command shown explicitly targets SPNs for Kerberoasting pre-attack reconnaissance.Here are some authoritative links for further research:Microsoft Documentation on Setspn: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/setspn Kerberoasting Attack Explained: https://attack.mitre.org/techniques/T1558/003/ Black Hat Presentation on Kerberoasting: https://www.blackhat.com/docs/us-17/thursday/us-17-Robbins-An-ACE-Up-The-Sleeve-Privilege-Escalation-Via-ACL-Inheritance.pdf (Although focused on ACEs, it also touches on Kerberoasting contextually)
Share your comments for CompTIA PT0-002 exam with other users:
56 question correct answer a,b
looking forward to the real exam