CompTIA PT0-001 Online Practice Questions and Exam Preparation

CompTIA PT0-001 Online Questions & Answers

• Question 161:

  A penetration tester has performed a vulnerability scan of a specific host that contains a valuable database and has identified the following vulnerabilities:

  1.

  XSS

  2.

  HTTP DELETE method allowed

  3.

  SQL injection

  4.

  Vulnerable to CSRF

  To which of the following should the tester give the HIGHEST priority?

  A. SQL injection
  B. HTTP DELETE method allowed
  C. Vulnerable to CSRF
  D. XSS
  B. HTTP DELETE method allowed

• Question 162:

  A penetration tester wants to check manually if a “ghost” vulnerability exists in a system. Which of the following methods is the correct way to validate the vulnerability?

  A. Download the GHOST file to a Linux system and compilegcc -o GHOSTtest i: ./GHOST
  B. Download the GHOST file to a Windows system and compile gcc -o GHOST GHOST.ctest i: ./GHOST
  C. Download the GHOST file to a Linux system and compile gcc -o GHOST GHOST.ctest i: ./GHOST
  D. Download the GHOST file to a Windows system and compile gcc -o GHOSTtest i: ./GHOST
  C. Download the GHOST file to a Linux system and compile gcc -o GHOST GHOST.ctest i: ./GHOST

• Question 163:

  Which of the following reasons does penetration tester needs to have a customer's point-of -contact information available at all time? (Select THREE).

  A. To report indicators of compromise
  B. To report findings that cannot be exploited
  C. To report critical findings
  D. To report the latest published exploits
  E. To update payment information
  F. To report a server that becomes unresponsive
  G. To update the statement o( work
  H. To report a cracked password
  A. To report indicators of compromise
  C. To report critical findings
  F. To report a server that becomes unresponsive

• Question 164:

  Which of the following types of physical security attacks does a mantrap mitigate-?

  A. Lock picking
  B. Impersonation
  C. Shoulder surfing
  D. Tailgating
  D. Tailgating

• Question 165:

  A penetration tester was able to enter an SQL injection command into a text box and gain access to the information store on the database. Which of the following is the BEST recommendation that would mitigate the vulnerability?

  A. Randomize the credentials used to log in
  B. Install host-based intrusion detection
  C. Implement input normalization
  D. Perform system hardening
  D. Perform system hardening

• Question 166:

  A consultant is attempting to harvest credentials from unsecure network protocols in use by the organization. Which of the following commands should the consultant use?

  A. Tcmpump
  B. John
  C. Hashcat
  D. nc
  A. Tcmpump

• Question 167:

  A security consultant is trying to attack a device with a previously identified user account.

  

  Which of the following types of attacks is being executed?

  A. Credential dump attack
  B. DLL injection attack
  C. Reverse shell attack
  D. Pass the hash attack
  D. Pass the hash attack

• Question 168:

  Which of the following commands starts the Metasploit database?

  A. msfconsole
  B. workspace
  C. msfvenom
  D. db_init
  E. db_connect
  A. msfconsole

• Question 169:

  A company's corporate policies state that employees are able to scan any global network as long as it is done within working hours. Government laws prohibit unauthorized scanning. Which of the following should an employee abide by?

  A. Company policies must be followed in this situation.
  B. Laws supersede corporate policies.
  C. Industry standards regarding scanning should be followed.
  D. The employee must obtain written approval from the company's Chief Information Security Officer (CISO) prior to scanning.
  B. Laws supersede corporate policies.

• Question 170:

  Which of the following actions BEST matches a script kiddie's threat actor?

  A. Exfiltrate network diagrams to perform lateral movement
  B. Steal credit cards from the database and sell them in the deep web
  C. Install a rootkit to maintain access to the corporate network
  D. Deface the website of a company in search of retribution
  B. Steal credit cards from the database and sell them in the deep web