PT0-002 — Most Debated Topics

Community-voted ranking of 49 topics, sorted by disagreement level. Higher dispute = more test-takers disagree on the answer.

#1
Which Post-Report Activity Prevents CISO Disputing Finding Validity?
S-Grade Dispute: 53% 8 comments
#2
How should penetration testers prioritize findings in a report?
S-Grade Dispute: 50% 10 comments
#3
Which agreement did a pen tester breach by requesting a CVE without authorization?
S-Grade Dispute: 48% 12 comments
#4
Which Tool Best Detects Vulnerabilities on a Database Server?
S-Grade Dispute: 46% 7 comments
#5
Which OSSTM Testing Methodology Is Used for Worst-Condition Testing?
S-Grade Dispute: 44% 5 comments
#6
Which Nmap Command Identifies Common TCP Ports on a Target?
S-Grade Dispute: 40% 3 comments
#7
Which Nmap scan works when firewall drops SYN and URG flags?
S-Grade Dispute: 37% 5 comments
#8
Which Python Data Structure Stores Firewall Rule Configurations?
S-Grade Dispute: 37% 4 comments
#9
How to Bypass a Cloud-Hosted WAF When Testing Public APIs
S-Grade Dispute: 36% 6 comments
#10
Which Contact Should Be Notified First When a Critical System Goes Down After Hours?
S-Grade Dispute: 35% 12 comments
#11
Why Do Pen Testers Keep a Running Diary During Engagement?
S-Grade Dispute: 33% 7 comments
#12
Which Social Engineering Technique Most Likely Creates a Remote Session?
A-Grade Dispute: 33% 4 comments
#13
Which Nmap command bypasses an IPS with a 100-packet-per-minute limit?
S-Grade Dispute: 29% 16 comments
#14
How to Achieve RCE on an Uploaded PHP File?
S-Grade Dispute: 29% 5 comments
#15
Which Document Resolves Client Rejection of a Penetration Test Report?
S-Grade Dispute: 29% 3 comments
#16
Which Shell Type Works When Outbound Firewall Blocks Traffic?
S-Grade Dispute: 29% 3 comments
#17
Next Step After Capturing NTLMv2 Hashes with Responder
A-Grade Dispute: 29% 3 comments
#18
Which Remediation Reduces Risk from Outdated Firewall Configurations?
S-Grade Dispute: 25% 6 comments
#19
What Should a Tester Do After Discovering an Unauthenticated File Upload?
S-Grade Dispute: 25% 4 comments
#20
After Obtaining a Service Account Hash, Which Attack Next?
A-Grade Dispute: 25% 3 comments
#21
Which technique makes a tester appear as a trusted server on a local network?
A-Grade Dispute: 25% 3 comments
#22
What Does Hydra's -t Option Control in an SSH Brute Force Attack?
S-Grade Dispute: 23% 6 comments
#23
What technique is used when downloading fgdump.exe with certutil?
S-Grade Dispute: 22% 6 comments
#24
Which Reconnaissance Activities Have Minimal Detection Risk?
A-Grade Dispute: 22% 4 comments
#25
What Is the Next Step After Finding an EOL Vulnerable Web App During Recon?
S-Grade Dispute: 20% 5 comments
#26
What tool intercepts and modifies API HTTP responses to a mobile device?
S-Grade Dispute: 20% 6 comments
#27
What attack type is hashcat using with -a 0, a wordlist, and rules?
A-Grade Dispute: 20% 3 comments
#28
Which Wireless Attack Prevents Unintended Interruptions in a Data Center?
S-Grade Dispute: 17% 3 comments
#29
How Should a Tester Confirm Blind SQL Injection?
S-Grade Dispute: 17% 4 comments
#30
How to Retrieve Running Process Credentials in an IaaS Instance?
S-Grade Dispute: 14% 6 comments
#31
Which command downloads AccessChk to check misconfigured Windows service permissions?
S-Grade Dispute: 14% 5 comments
#32
Which Nmap Command Generates a List of Active Hosts from a Discovery Scan?
S-Grade Dispute: 11% 5 comments
#33
What Attack Targets Cloud Metadata via 169.254.169.254?
S-Grade Dispute: 0% 4 comments
#34
Why Does an Nmap Xmas Scan Returning RST Mean All Ports Are Closed?
A-Grade Dispute: 0% 3 comments
#35
Why Is Variable Initialization Critical in Java and C/C++?
A-Grade Dispute: 0% 4 comments
#36
What should a penetration tester report after Nmap reveals RC4 ciphers?
A-Grade Dispute: 0% 3 comments
#37
Which standard should a consultant use to rank web pen test findings by criticality?
A-Grade Dispute: 0% 4 comments
#38
Which tool provides Python classes for network protocols?
A-Grade Dispute: 0% 3 comments
#39
What Is the Next Step After Initial Findings Review in a Pentest Engagement?
A-Grade Dispute: 0% 3 comments
#40
Which vulnerability bypasses strict access controls to reach sensitive files?
A-Grade Dispute: 0% 4 comments
#41
Which Penetration Testing Candidate Should Be Excluded Due to Background Check?
A-Grade Dispute: 0% 4 comments
#42
Why obscure hashes in penetration testing screenshots?
A-Grade Dispute: 0% 3 comments
#43
Which Tool Brute-Forces SSH Passwords with Multiple Threads?
A-Grade Dispute: 0% 3 comments
#44
Why should old passwords be changed after switching from a fixed salt to a random salt in PBKDF2?
A-Grade Dispute: 0% 3 comments
#45
What Command Should Follow an Nmap Scan Showing an Open MSSQL Port?
A-Grade Dispute: 0% 3 comments
#46
What tool should run next after an Nmap scan to explore a host?
A-Grade Dispute: 0% 4 comments
#47
Why Would a Penetration Tester Use ProxyChains?
A-Grade Dispute: 0% 5 comments
#48
Which additional physical control enforces MFA with existing badges?
A-Grade Dispute: 0% 3 comments
#49
Which Command Enables Password Spraying Without Locking Accounts?
A-Grade Dispute: 0% 3 comments

← Back to Pt0-002 PenTest+ study guide