Free PT0-003 practice test: 30 questions with answers

Sudo rules, SUID binaries and privileged scheduled jobs are common paths from a low-privilege shell to root. Hostnames, log deletion and renamed directories do not provide escalation paths and can damage evidence.

Offline cracking of authorized hashes measures password strength without locking accounts or leaking data. Public posting, live brute force and emailing hashes are unsafe or disruptive.

Pass-the-ticket and Golden Ticket attacks abuse Kerberos trust by reusing or forging tickets using stolen key material. SQL injection, CSRF and clickjacking target web applications rather than Kerberos.

Server-side validation, storage outside the web root and scanning remove the root causes that allow code execution. Trust-based guidance and warnings do not stop an attacker, and removing the feature without fixing root causes leaves similar flaws.

A supportive debrief turns the test into training and protects the employee, and reporting the result keeps the program constructive. Public shaming, sharing recordings and repeated harassment are inappropriate.

Testing access point configuration within scope shows whether unauthorized clients can connect. Jamming, testing outside the scope and changing passwords without permission are either illegal or unauthorized.

Passive reconnaissance uses public records such as certificate transparency logs and DNS data, which avoids touching the target. Port scans, brute force and exploitation all interact directly with target systems.

A host discovery sweep quickly identifies responsive hosts, which narrows deeper scanning. Full UDP scans across all ports are slow for discovery, manual inspection is impractical, and brute forcing is intrusive and unnecessary at this stage.

Safe verification confirms whether the issue is real, which reduces false positives in the report. Reporting unverified findings as confirmed is inaccurate, and denial-of-service testing is disruptive and out of scope for verification.

Burp Suite is a proxy that intercepts, inspects and modifies web traffic for testing. Nmap is for scanning, Wireshark captures traffic for analysis, and Hydra performs credential attacks.

Enumeration tools query SMB and RPC services to list shares and accounts that the network exposes, within the authorized scope. Spam, rootkits and cable removal are unrelated or harmful.

Unvalidated special characters that reach the backend or appear unencoded in output point to injection or cross-site scripting risks. Colors, load speed and footers are unrelated to input validation.

The rules of engagement set scope, exclusions, timing and escalation contacts, which defines what the tester may touch. A résumé, a brochure and a calendar do not define authorization boundaries.

Testing a third party needs its permission under the provider's terms, and the client must have authority over what is tested. A trial account, logos and maintenance windows do not establish authorization.

Stopping, documenting and escalating through the agreed contact respects the scope while making the client aware. Continuing exploitation, publishing and deleting data each exceed authority or destroy evidence.

Written authorization gives legal permission, and emergency contacts ensure critical issues reach the right people quickly. The other items do not affect authorization or safe escalation.

Explicit exclusions protect safety-critical systems, and the test should cover only approved segments. Industrial control systems can fail under aggressive scanning, so assuming safety or scanning them is dangerous.

Scope size, complexity and objectives drive effort and time. Personal schedules, logos and résumés do not affect how much testing is needed.

Concatenating untrusted input into SQL allows injection, which parameterized queries prevent. Indentation, name length and comment language are style issues, not security findings.

SAST tools analyze source code for insecure patterns, which speeds up identifying candidates for manual verification. Password managers, printer drivers and defragmenters are unrelated.

Reviewing and lab-testing the script and confirming the target list keeps the activity within scope and prevents accidental damage. Scanning the internet, hiding activity and disabling error handling all increase risk.

String extraction and reverse engineering tools reveal hardcoded secrets in binaries. Spreadsheets, video editors and calendars do not analyze compiled code.

Salted, slow password hashing functions resist offline cracking, while fast unsalted hashes are easy to attack at scale. Plain text, longer usernames and removing requirements all weaken security.

Software composition analysis compares dependency versions with known vulnerability data, which identifies risky components. Line counts, fonts and commit counts do not reveal known vulnerabilities.

Severity with justification, affected assets and remediation guidance let the client prioritize and fix issues. Exploit names alone, unrelated tool improvements and blanket security claims do not help remediation.

Altering or deleting logs destroys evidence and undermines audit trails. The appropriate response is to preserve logs and focus on remediation and reporting.

Encryption, restricted access and secure deletion after the agreed retention period protect client data. Unencrypted public storage, indefinite personal copies and unattended media expose it.

Reproduction steps and validation criteria let the client confirm the issue and check the fix. Personal opinions, past jobs and laptop inventories do not help verification.

Reporting an out-of-scope observation with a recommendation respects authorization while still informing the client. Further testing exceeds scope, omitting it hides risk, and public disclosure without notice harms the client.

Retesting and documenting verification provides evidence that the fix works. Removing findings or marking them fixed without evidence hides the remediation history.