Free PT0-003 sample questions

Correct answer: Scapy

Correct answer: The tester is creating a threat model.

Correct answer: SCA

Correct answer: Disable the use of external entities.

Correct answer: Use the SSRF vulnerability to send a crafted request to the Kubelet API's `/run` endpoint to execute a command in a new privileged pod on the node.

The most effective escalation path is to abuse the anonymously accessible Kubelet API. The `/run` endpoint of this API can be used to execute commands within pods or even create new pods on the worker node. By sending a crafted POST request via the SSRF vulnerability to `http:// :10250/run/ / / `, the tester can execute commands. To achieve full node compromise, the tester can instruct the Kubelet to create a new, privileged pod with the host's root filesystem mounted (e.g., using `hostPath`). This allows the tester to escape the container sandbox and gain a root shell directly on the worker node. This technique is highly effective as it abuses a common Kubernetes misconfiguration (anonymous Kubelet auth) and doesn't rely on less reliable kernel exploits or limited IAM permissions.

Correct answer: Adversarial evasion attack

The tester is attempting an adversarial evasion attack. This type of attack involves creating a malicious input (an adversarial example) by making small, often imperceptible, perturbations to a legitimate input. The goal is to cause a deployed and trained machine learning model to misclassify it during the inference phase. In this scenario, the tester would modify the image of the unauthorized person in a specific way to trick the AI model into classifying it as an authorized employee. This is a black-box attack, as the tester interacts with the model's API to observe outputs and iteratively craft the malicious input without needing access to the model's internal workings. Data poisoning occurs during training, while model inversion and membership inference aim to extract information about the model or its data.

Correct answer: Software Composition Analysis (SCA)

Software Composition Analysis (SCA) is the specific methodology designed to identify and manage vulnerabilities in third-party and open-source components. SCA tools scan an application's dependencies (e.g., from `package.json`, `requirements.txt`, or container layers) and compare them against a database of known vulnerabilities (CVEs). This allows the CI/CD pipeline to automatically detect and flag insecure dependencies. SAST analyzes first-party source code for coding flaws, DAST tests the running application from the outside, and IAST works at runtime, but only SCA focuses specifically on the security of the software supply chain and third-party libraries.

Correct answers: Finding a JSONP endpoint on the application's own domain (`self`) and using it to execute a callback.; Finding a vulnerable JavaScript file on `trusted.cdn.com` that allows code execution via a callback or prototype pollution.

Since `script-src` allows `'self'`, any script loaded from the application's own origin is trusted. A JSONP endpoint on the same domain that reflects user input in a callback function (e.g., `/api/jsonp?callback=alert(1)`) can be abused to execute arbitrary JavaScript. The injected payload would be ` `, which is permitted by the CSP.

The CSP explicitly trusts scripts from `https://trusted.cdn.com`. If any JavaScript library hosted on this CDN has a vulnerability (such as an insecure callback, DOM-based XSS sink, or a gadget for prototype pollution), it can be used as a vector to execute arbitrary code. The attacker's payload would call the vulnerable function from the trusted library.

Correct answer: Immediately cease all testing activities and notify the client using the pre-defined emergency escalation path.

Discovering an active compromise by a real threat actor changes the engagement from a test to a live incident. The consultant's primary responsibility is to immediately stop all testing activities to avoid interfering with forensic evidence or alerting the attacker. The next step is to contact the client via the designated emergency escalation path, which should be defined in the rules of engagement. This allows the client to initiate their incident response plan immediately. Continuing the test or attempting containment could corrupt evidence and is outside the scope of a standard penetration test.

Correct answer: Check the folder permissions for `C:\Program Files\Custom App\` using `icacls`.

An unquoted service path vulnerability is only exploitable if the user has write permissions in one of the directories in the path. The service path `C:\Program Files\Custom App\service.exe` will cause Windows to look for `C:\Program.exe`, then `C:\Program Files\Custom.exe`, and finally the correct path. The MOST critical validation step is to check if the current user (or a low-privileged user) can write a malicious executable into `C:\` or `C:\Program Files\`. The `icacls` command is used to check the Access Control Lists (ACLs) on these folders. If write permissions exist, the tester can place a malicious `Custom.exe` in `C:\Program Files\` to achieve privilege escalation when the service restarts. Without write permissions, the vulnerability is not exploitable.