Get Ready to Boost your Prepare for your PT0-002 Exam with 310 Questions
Use Free PT0-002 Exam Questions that Stimulates Actual EXAM
NEW QUESTION # 35
The following output is from reconnaissance on a public-facing banking website:
Based on these results, which of the following attacks is MOST likely to succeed?
- A. A Heartbleed attack
- B. A birthday attack on 64-bit ciphers (Sweet32)
- C. An attack that breaks RC4 encryption
- D. An attack on a session ticket extension (Ticketbleed)
Answer: A
Explanation:
Explanation
Based on these results, the most likely attack to succeed is a Heartbleed attack. The Heartbleed attack is a vulnerability in the OpenSSL implementation of the TLS/SSL protocol that allows an attacker to read the memory of the server and potentially steal sensitive information, such as private keys, passwords, or session tokens. The results show that the website is using OpenSSL 1.0.1f, which is vulnerable to the Heartbleed attack1.
NEW QUESTION # 36
After running the enum4linux.pl command, a penetration tester received the following output:
Which of the following commands should the penetration tester run NEXT?
- A. smbclient //192.168.100.56/web -U '' -N
- B. smbspool //192.160.100.56/print$
- C. smbget //192.168.100.56/web -U ''
- D. net rpc share -S 192.168.100.56 -U ''
Answer: A
Explanation:
Explanation
A vulnerability scan is a type of assessment that helps to identify vulnerabilities in a network or system. It scans systems for potential vulnerabilities, misconfigurations, and outdated software. Based on the output from a vulnerability scan, a penetration tester can identify vulnerabilities that may be exploited to gain access to a system. In this scenario, the output from the penetration testing tool shows that 100 hosts contained findings due to improper patch management. This indicates that the vulnerability scan detected vulnerabilities that could have been prevented through proper patch management. Therefore, the most likely test performed by the penetration tester is a vulnerability scan.
NEW QUESTION # 37
A penetration tester runs a scan against a server and obtains the following output:
21/tcp open ftp Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 03-12-20 09:23AM 331 index.aspx
| ftp-syst:
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2012 Std
3389/tcp open ssl/ms-wbt-server
| rdp-ntlm-info:
| Target Name: WEB3
| NetBIOS_Computer_Name: WEB3
| Product_Version: 6.3.9600
|_ System_Time: 2021-01-15T11:32:06+00:00
8443/tcp open http Microsoft IIS httpd 8.5
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/8.5
|_http-title: IIS Windows Server
Which of the following command sequences should the penetration tester try NEXT?
- A. curl -X TRACE https://192.168.53.23:8443/index.aspx
- B. smbclient \\\\WEB3\\IPC$ -I 192.168.53.23 -U guest
- C. nmap --script vuln -sV 192.168.53.23
- D. ncrack -u Administrator -P 15worst_passwords.txt -p rdp 192.168.53.23
- E. ftp 192.168.53.23
Answer: E
NEW QUESTION # 38
An organization wants to identify whether a less secure protocol is being utilized on a wireless network.
Which of the following types of attacks will achieve this goal?
- A. Downgrade attack
- B. Packet sniffing
- C. Four-way handshake
- D. Protocol negotiation
Answer: A
Explanation:
Explanation
A downgrade attack is a type of attack that exploits a vulnerability in the protocol negotiation process between a client and a server to force them to use a less secure protocol than they originally intended. A downgrade attack can be used to identify whether a less secure protocol is being utilized on a wireless network by intercepting and modifying the messages exchanged during the protocol negotiation phase, such as the association request and response frames, and making the client and the server agree on a weaker protocol, such as WEP or WPA, instead of a stronger one, such as WPA2 or WPA3. A downgrade attack can also enable the attacker to perform other attacks, such as cracking the encryption keys or capturing the network traffic, more easily by taking advantage of the weaknesses of the less secure protocol. A downgrade attack can be performed by using tools such as Airgeddon, which is a multi-use bash script for Linux systems to audit wireless networks1.
NEW QUESTION # 39
A penetration tester needs to perform a test on a finance system that is PCI DSS v3.2.1 compliant. Which of the following is the MINIMUM frequency to complete the scan of the system?
- A. Monthly
- B. Annually
- C. Weekly
- D. Quarterly
Answer: D
Explanation:
https://www.pcicomplianceguide.org/faq/#25
PCI DSS requires quarterly vulnerability/penetration tests, not weekly.
NEW QUESTION # 40
During a penetration test, the domain names, IP ranges, hosts, and applications are defined in the:
- A. NDA
- B. ROE.
- C. SLA.
- D. SOW.
Answer: B
Explanation:
https://mainnerve.com/what-are-rules-of-engagement-in-pen-testing/#:~:text=The%20ROE%20includes%20the%20dates,limits%2C%20or%20out%20of%20scope.
NEW QUESTION # 41
During an assessment, a penetration tester manages to exploit an LFI vulnerability and browse the web log for a target Apache server. Which of the following steps would the penetration tester most likely try NEXT to further exploit the web server? (Choose two.)
- A. SQL injection
- B. Command injection
- C. Server-side request forgery
- D. Cross-site request forgery
- E. Cross-site scripting
- F. Log poisoning
Answer: B,F
Explanation:
Explanation
Local File Inclusion (LFI) is a web vulnerability that allows an attacker to include files on a server through the web browser. This can expose sensitive information or lead to remote code execution.
Some possible next steps that a penetration tester can try after exploiting an LFI vulnerability are:
Log poisoning: This involves injecting malicious code into the web server's log files and then including them via LFI to execute the code34.
PHP wrappers: These are special streams that can be used to manipulate files or data via LFI. For example, php://input can be used to pass arbitrary data to an LFI script, or php://filter can be used to encode or decode files5.
NEW QUESTION # 42
Which of the following tools would BEST allow a penetration tester to capture wireless handshakes to reveal a Wi-Fi password from a Windows machine?
- A. Wireshark
- B. Aircrack-ng
- C. Kismet
- D. EAPHammer
Answer: B
Explanation:
Explanation
The BEST tool to capture wireless handshakes to reveal a Wi-Fi password from a Windows machine is Aircrack-ng. Aircrack-ng is a suite of tools used to assess the security of wireless networks. It starts by capturing wireless network packets [1], then attempts to crack the network password by analyzing them [1].
Aircrack-ng supports FMS, PTW, and other attack types, and can also be used to generate keystreams for WEP and WPA-PSK encryption. It is capable of running on Windows, Linux, and Mac OS X.
The BEST tool to capture wireless handshakes to reveal a Wi-Fi password from a Windows machine is Aircrack-ng. Aircrack-ng is a suite of tools used to assess the security of wireless networks. It starts by capturing wireless network packets [1], then attempts to crack the network password by analyzing them [1].
Aircrack-ng supports FMS, PTW, and other attack types, and can also be used to generate keystreams for WEP and WPA-PSK encryption. It is capable of running on Windows, Linux, and Mac OS X.
NEW QUESTION # 43
A penetration tester was able to gain access successfully to a Windows workstation on a mobile client's laptop. Which of the following can be used to ensure the tester is able to maintain access to the system?
- A. sudo useradd -ou 0 -g 0 user
- B. wmic startup get caption,command
- C. schtasks /create /sc /ONSTART /tr C:\Temp\WindowsUpdate.exe
- D. crontab -l; echo "@reboot sleep 200 && ncat -lvp 4242 -e /bin/bash") | crontab 2>/dev/null
Answer: B
NEW QUESTION # 44
A penetration tester discovered a vulnerability that provides the ability to upload to a path via directory traversal. Some of the files that were discovered through this vulnerability are:
Which of the following is the BEST method to help an attacker gain internal access to the affected machine?
- A. Download the smb.conf file and look at configurations
- B. Edit the discovered file with one line of code for remote callback
- C. Download .pl files and look for usernames and passwords
- D. Edit the smb.conf file and upload it to the server
Answer: D
NEW QUESTION # 45
A company hired a penetration-testing team to review the cyber-physical systems in a manufacturing plant. The team immediately discovered the supervisory systems and PLCs are both connected to the company intranet. Which of the following assumptions, if made by the penetration-testing team, is MOST likely to be valid?
- A. PLCs will not act upon commands injected over the network.
- B. Supervisory systems will detect a malicious injection of code/commands.
- C. Controllers will not validate the origin of commands.
- D. Supervisors and controllers are on a separate virtual network by default.
Answer: C
NEW QUESTION # 46
In the process of active service enumeration, a penetration tester identifies an SMTP daemon running on one of the target company's servers. Which of the following actions would BEST enable the tester to perform phishing in a later stage of the assessment?
- A. Perform a reverse DNS query and match to the service banner.
- B. Attempt to brute force authentication to the service.
- C. Check for an open relay configuration.
- D. Test for RFC-defined protocol conformance.
Answer: C
Explanation:
SMTP is a protocol associated with mail servers. Therefore, for a penetration tester, an open relay configuration can be exploited to launch phishing attacks.
NEW QUESTION # 47
Which of the following documents is agreed upon by all parties associated with the penetration-testing engagement and defines the scope, contacts, costs, duration, and deliverables?
- A. MSA
- B. NDA
- C. SOW
- D. SLA
Answer: C
Explanation:
Explanation
The document that is agreed upon by all parties associated with the penetration-testing engagement and defines the scope, contacts, costs, duration, and deliverables is the SOW (Statement of Work). The SOW is a formal document that describes the objectives, expectations, and responsibilities of the penetration-testing project2. The SOW should be clear, concise, and comprehensive to avoid any ambiguity or misunderstanding.
NEW QUESTION # 48
A software company has hired a security consultant to assess the security of the company's software development practices. The consultant opts to begin reconnaissance by performing fuzzing on a software binary. Which of the following vulnerabilities is the security consultant MOST likely to identify?
- A. Weak authentication schemes
- B. Buffer overflows
- C. Non-optimized resource management
- D. Credentials stored in strings
Answer: B
Explanation:
Explanation
fuzzing introduces unexpected inputs into a system and watches to see if the system has any negative reactions to the inputs that indicate security, performance, or quality gaps or issues
NEW QUESTION # 49
Which of the following expressions in Python increase a variable val by one (Choose two.)
- A. +val
- B. ++val
- C. val++
- D. val=val++
- E. val+=1
- F. val=(val+1)
Answer: B,E
NEW QUESTION # 50
......
BEST Verified CompTIA PT0-002 Exam Questions (2024) : https://www.actual4cert.com/PT0-002-real-questions.html
Get 100% Real PT0-002 Free Online Practice Test: https://drive.google.com/open?id=1bjHhJ6HhCd-z6M_zK7dc-hCLJZ__DHuI