Get Ready to Pass the PT0-002 exam with CompTIA Latest Practice Exam
Get Prepared for Your PT0-002 Exam With Actual CompTIA Study Guide!
NEW QUESTION # 23
A penetration tester has gained access to a network device that has a previously unknown IP range on an interface. Further research determines this is an always-on VPN tunnel to a third-party supplier.
Which of the following is the BEST action for the penetration tester to take?
- A. Disregard the IP range, as it is out of scope.
- B. Scan the IP range for additional systems to exploit.
- C. Stop the assessment and inform the emergency contact.
- D. Utilize the tunnel as a means of pivoting to other internal devices.
Answer: B
NEW QUESTION # 24
A penetration tester discovers that a web server within the scope of the engagement has already been compromised with a backdoor. Which of the following should the penetration tester do NEXT?
- A. Forensically acquire the backdoor Trojan and perform attribution
- B. Inform the customer immediately about the backdoor
- C. Utilize the backdoor in support of the engagement
- D. Continue the engagement and include the backdoor finding in the final report
Answer: D
NEW QUESTION # 25
A penetration tester recently completed a review of the security of a core network device within a corporate environment. The key findings are as follows:
* The following request was intercepted going to the network device:
GET /login HTTP/1.1
Host: 10.50.100.16
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0 Accept-Language: en-US,en;q=0.5 Connection: keep-alive Authorization: Basic WU9VUilOQU1FOnNlY3JldHBhc3N3b3jk
* Network management interfaces are available on the production network.
* An Nmap scan returned the following:
Which of the following would be BEST to add to the recommendations section of the final report? (Choose two.)
- A. Disable HTTP/301 redirect configuration.
- B. Implement a better method for authentication.
- C. Create an out-of-band network for management.
- D. Eliminate network management and control interfaces.
- E. Disable or upgrade SSH daemon.
- F. Enforce enhanced password complexity requirements.
Answer: B,C
Explanation:
Explanation
The key findings indicate that the network device is vulnerable to several attacks, such as sniffing, brute-forcing, or exploiting the SSH daemon. To prevent these attacks, the best recommendations are to create an out-of-band network for management, which means a separate network that is not accessible from the production network, and to implement a better method for authentication, such as SSH keys or certificates.
The other options are not as effective or relevant.
NEW QUESTION # 26
A penetration tester has obtained shell access to a Windows host and wants to run a specially crafted binary for later execution using the wmic.exe process call create function. Which of the following OS or filesystem mechanisms is MOST likely to support this objective?
- A. MP4 steganography
- B. Alternate data streams
- C. PsExec
- D. PowerShell modules
Answer: B
Explanation:
Explanation
Alternate data streams (ADS) are a feature of the NTFS file system that allows storing additional data in a file without affecting its size, name, or functionality. ADS can be used to hide or embed data or executable code in a file, such as a specially crafted binary for later execution. ADS can be created or accessed using various tools or commands, such as the command prompt, PowerShell, or Sysinternals12. For example, the following command can create an ADS named secret.exe in a file named test.txt and run it using wmic.exe process call create function: type secret.exe > test.txt:secret.exe & wmic process call create "cmd.exe /c test.txt:secret.exe"
NEW QUESTION # 27
A penetration tester wants to validate the effectiveness of a DLP product by attempting exfiltration of data using email attachments. Which of the following techniques should the tester select to accomplish this task?
- A. Steganography
- B. Metadata removal
- C. Encryption
- D. Encode64
Answer: A
NEW QUESTION # 28
Which of the following can be used to store alphanumeric data that can be fed into scripts or programs as input to penetration-testing tools?
- A. Symlink
- B. For-loop
- C. Catalog
- D. Dictionary
- E. Directory
Answer: D
NEW QUESTION # 29
A penetration tester downloaded a Java application file from a compromised web server and identifies how to invoke it by looking at the following log:
Which of the following is the order of steps the penetration tester needs to follow to validate whether the Java application uses encryption over sockets?
- A. Disassemble the binary code and then identify the break points.
- B. Run an application vulnerability scan and then identify the TCP ports used by the application.
- C. Start a packet capture with Wireshark and then run the application.
- D. Run the application attached to a debugger and then review the application's log.
Answer: C
NEW QUESTION # 30
You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.
INSTRUCTIONS
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
NEW QUESTION # 31
After gaining access to a Linux system with a non-privileged account, a penetration tester identifies the following file:
Which of the following actions should the tester perform FIRST?
- A. Start a reverse shell.
- B. Use privilege escalation.
- C. Change the file permissions.
- D. Cover tracks.
Answer: B
Explanation:
Explanation
The file .scripts/daily_log_backup.sh has permissions set to 777, meaning that anyone can read, write, or execute the file. Since it's owned by the root user and the penetration tester has access to the system with a non-privileged account, this could be a potential avenue for privilege escalation. In a penetration test, after finding such a file, the tester would likely want to explore it and see if it can be leveraged to gain higher privileges. This is often done by inserting malicious code or commands into the script if it's being executed with higher privileges, such as root in this case.
NEW QUESTION # 32
A penetration tester needs to perform a vulnerability scan against a web server. Which of the following tools is the tester MOST likely to choose?
- A. Cain and Abel
- B. Nmap
- C. Nikto
- D. Ethercap
Answer: C
Explanation:
https://hackertarget.com/nikto-website-scanner/
NEW QUESTION # 33
A penetration tester received a .pcap file to look for credentials to use in an engagement.
Which of the following tools should the tester utilize to open and read the .pcap file?
- A. Nmap
- B. Wireshark
- C. Netcat
- D. Metasploit
Answer: B
NEW QUESTION # 34
A penetration tester wants to identify CVEs that can be leveraged to gain execution on a Linux server that has an SSHD running. Which of the following would BEST support this task?
- A. Run nmap with the --script vulners option set against the target
- B. Run nmap with the -sA option set against the target
- C. Run nmap with the -o, -p22, and -sC options set against the target
- D. Run nmap with the -sV and -p22 options set against the target
Answer: D
NEW QUESTION # 35
A penetration tester is able to use a command injection vulnerability in a web application to get a reverse shell on a system After running a few commands, the tester runs the following:
python -c 'import pty; pty.spawn("/bin/bash")'
Which of the following actions Is the penetration tester performing?
- A. Privilege escalation
- B. Building a bind shell
- C. Upgrading the shell
- D. Writing a script for persistence
Answer: C
Explanation:
Explanation
The penetration tester is performing an action called upgrading the shell, which means improving the functionality and interactivity of the shell. By running the python command, the penetration tester is spawning a new bash shell that has features such as tab completion, command history, and job control. This can help the penetration tester to execute commands more easily and efficiently.
NEW QUESTION # 36
You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.
INSTRUCTIONS
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
Explanation
1. Reflected XSS - Input sanitization (<> ...)
2. Sql Injection Stacked - Parameterized Queries
3. DOM XSS - Input Sanitization (<> ...)
4. Local File Inclusion - sandbox req
5. Command Injection - sandbox req
6. SQLi union - paramtrized queries
7. SQLi error - paramtrized queries
8. Remote File Inclusion - sandbox
9. Command Injection - input saniti $
10. URL redirect - prevent external calls
NEW QUESTION # 37
A penetration tester ran an Nmap scan on an Internet-facing network device with the -F option and found a few open ports. To further enumerate, the tester ran another scan using the following command:
nmap -O -A -sS -p- 100.100.100.50
Nmap returned that all 65,535 ports were filtered. Which of the following MOST likely occurred on the second scan?
- A. The scan returned ICMP echo replies.
- B. The penetration tester used unsupported flags.
- C. The edge network device was disconnected.
- D. A firewall or IPS blocked the scan.
Answer: D
NEW QUESTION # 38
A red team completed an engagement and provided the following example in the report to describe how the team gained access to a web server:
x' OR role LIKE '%admin%
Which of the following should be recommended to remediate this vulnerability?
- A. Encrypted communications
- B. Multifactor authentication
- C. Parameterized queries
- D. Secure software development life cycle
Answer: C
NEW QUESTION # 39
Penetration-testing activities have concluded, and the initial findings have been reviewed with the client. Which of the following best describes the NEXT step in the engagement?
- A. Attestation of findings and delivery of the report
- B. Review of the lessons learned during the engagement
- C. Acceptance by the client and sign-off on the final report
- D. Scheduling of follow-up actions and retesting
Answer: A
NEW QUESTION # 40
Which of the following tools should a penetration tester use to crawl a website and build a wordlist using the data recovered to crack the password on the website?
- A. w3af
- B. DirBuster
- C. Patator
- D. CeWL
Answer: D
Explanation:
Explanation
CeWL, the Custom Word List Generator, is a Ruby application that allows you to spider a website based on a URL and depth setting and then generate a wordlist from the files and web pages it finds. Running CeWL against a target organization's sites can help generate a custom word list, but you will typically want to add words manually based on your own OSINT gathering efforts.
https://esgeeks.com/como-utilizar-cewl/
NEW QUESTION # 41
During an internal penetration test against a company, a penetration tester was able to navigate to another part of the network and locate a folder containing customer information such as addresses, phone numbers, and credit card numbers. To be PCI compliant, which of the following should the company have implemented to BEST protect this data?
- A. System hardening
- B. Intrusion detection
- C. Vulnerability scanning
- D. Network segmentation
Answer: D
NEW QUESTION # 42
During a penetration test, a tester is able to change values in the URL from example.com/login.php?id=5 to example.com/login.php?id=10 and gain access to a web application. Which of the following vulnerabilities has the penetration tester exploited?
- A. Cross-site scripting
- B. Broken authentication
- C. Command injection
- D. Direct object reference
Answer: D
Explanation:
Explanation
Insecure direct object reference (IDOR) is a vulnerability where the developer of the application does not implement authorization features to verify that someone accessing data on the site is allowed to access that data.
NEW QUESTION # 43
When
accessing the URL http://192.168.0-1/validate/user.php, a penetration tester obtained the following output:
..d index: eid in /apache/www/validate/user.php line 12
..d index: uid in /apache/www/validate/user.php line 13
..d index: pw in /apache/www/validate/user.php line 14
..d index: acl in /apache/www/validate/user.php line 15
- A. Incorrect command syntax
- B. Insecure data transmission
- C. Insufficient error handling
- D. Lack of code signing
Answer: C
Explanation:
Explanation
The most probable cause for this output is insufficient error handling, which is a coding flaw that occurs when a program does not handle errors or exceptions properly or gracefully. Insufficient error handling can result in unwanted or unexpected behavior, such as crashes, hangs, or leaks. In this case, the output shows that the program is displaying warning messages that indicate undefined indexes in the user.php file. These messages reveal the names of the variables and the file path that are used by the program, which can expose sensitive information or clues to an attacker. The program should have implemented error handling mechanisms, such as try-catch blocks, error logging, or sanitizing output, to prevent these messages from being displayed or to handle them appropriately. The other options are not plausible causes for this output. Lack of code signing is a security flaw that occurs when a program does not have a digital signature that verifies its authenticity and integrity. Incorrect command syntax is a user error that occurs when a command is entered with wrong or missing parameters or options. Insecure data transmission is a security flaw that occurs when data is sent over a network without encryption or protection.
NEW QUESTION # 44
SIMULATION
Using the output, identify potential attack vectors that should be further investigated.
Answer:
Explanation:
See explanation below.
Explanation
1: Null session enumeration
Weak SMB file permissions
Fragmentation attack
2: nmap
-sV
-p 1-1023
192.168.2.2
3: #!/usr/bin/python
export $PORTS = 21,22
for $PORT in $PORTS:
try:
s.connect((ip, port))
print("%s:%s - OPEN" % (ip, port))
except socket.timeout
print("%:%s - TIMEOUT" % (ip, port))
except socket.error as e:
print("%:%s - CLOSED" % (ip, port))
finally
s.close()
port_scan(sys.argv[1], ports)
NEW QUESTION # 45
During a penetration test, you gain access to a system with a limited user interface. This machine appears to have access to an isolated network that you would like to port scan.
INSTRUCTIONS
Analyze the code segments to determine which sections are needed to complete a port scanning script.
Drag the appropriate elements into the correct locations to complete the script.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
NEW QUESTION # 46
A company hired a penetration tester to do a social-engineering test against its employees. Although the tester did not find any employees' phone numbers on the company's website, the tester has learned the complete phone catalog was published there a few months ago.
In which of the following places should the penetration tester look FIRST for the employees' numbers?
- A. Web archive
- B. GitHub
- C. File metadata
- D. Underground forums
Answer: A
NEW QUESTION # 47
......
Pass Your Next PT0-002 Certification Exam Easily & Hassle Free: https://certkiller.passleader.top/CompTIA/PT0-002-exam-braindumps.html