CompTIA PT0-001 Online Practice Questions and Exam Preparation

CompTIA PT0-001 Online Questions & Answers

• Question 281:

  A penetration tester has SSH access to a Linux server that is exposed to the internet and has access to a corporate internal network. This server, with IP address 200.111.111.9, only has port TCP 22 externally opened. The penetration tester also discovered the internal IP address 192.168.1.5 from a Windows server. Which of the following steps should the penetration tester follow to open an RDP connection to this Windows server and to try to log on?

  A. Connect to the Linux server using # ssh 200.111.111.9, establish an RDP connection to the 192.168.1.5 address.
  B. Connect to the Windows server using # ssh -L 3389:200.111.111.9:22 192.168.1.5.
  C. Connect to the Linux server using # ssh -L 3389:192.168.1.5:3389 200 .111.111.9; RDP to localhost address, port 3389.
  D. Connect to the Windows server using # ssh -L 22:200.111.111.9:3389 192.168.1.5.
  A. Connect to the Linux server using # ssh 200.111.111.9, establish an RDP connection to the 192.168.1.5 address.

• Question 282:

  A penetration tester generates a report for a host-based vulnerability management agent that is running on a production web server to gather a list of running processes. The tester receives the following information.

  

  Which of the following processes MOST likely demonstrates a lack of best practices?

  A. apache2
  B. dbus-daemon
  C. systemd
  D. urlgrabber-ext
  B. dbus-daemon

• Question 283:

  Which of the following BEST protects against a rainbow table attack?

  A. Increased password complexity
  B. Symmetric encryption
  C. Cryptographic salting
  D. Hardened OS configurations
  A. Increased password complexity

• Question 284:

  An attacker performed a MITM attack against a mobile application. The attacker is attempting to manipulate the application's network traffic via a proxy tool. The attacker only sees limited traffic as cleartext. The application log files indicate secure SSL/TLS connections are failing. Which of the following is MOST likely preventing proxying of all traffic?

  A. Misconfigured routes
  B. Certificate pinning
  C. Strong cipher suites
  D. Closed ports
  B. Certificate pinning

• Question 285:

  A penetration tester entered the following information into the browser URL:

  https://www.example.com/login.php?file=../../../../../../../etc/passwd

  The server responded with the data contained in the server's sensitive data file. Which of the following types of vulnerabilities is MOST likely being exploited?

  A. Weak credentials
  B. Race conditions
  C. Directory traversal
  D. Command injection
  C. Directory traversal

• Question 286:

  During an internal network penetration test, a tester recovers the NTLM password hash tor a user known to have full administrator privileges on a number of target systems Efforts to crack the hash and recover the plaintext password have been unsuccessful Which of the following would be the BEST target for continued exploitation efforts?

  A. Operating system Windows 7 Open ports: 23, 161
  B. Operating system Windows Server 2016 Open ports: 53, 5900
  C. Operating system Windows 8 1 Open ports 445, 3389
  D. Operating system Windows 8 Open ports 514, 3389
  C. Operating system Windows 8 1 Open ports 445, 3389

• Question 287:

  A penetration tester has obtained access to an IP network subnet that contains ICS equipment intercommunication. Which of the following attacks is MOST likely to succeed in creating a physical effect?

  A. DNS cache poisoning
  B. Record and replay
  C. Supervisory server SMB
  D. Blind SQL injection
  A. DNS cache poisoning

• Question 288:

  Defining exactly what is to be tested and the results to be generated from the test will help prevent?

  A. testing scope creep
  B. scheduling conflicts
  C. impact on production
  D. disclosure of information.
  A. testing scope creep

• Question 289:

  A software development team recently migrated to new application software on the on- premises environment Penetration test findings show that multiple vulnerabilities exist If a penetration tester does not have access to a live or test environment, a test might be better to create the same environment on the VM Which of the following is MOST important for confirmation?

  A. Unsecure service and protocol configuration
  B. Running SMB and SMTP service
  C. Weak password complexity and user account
  D. Misconfiguration
  A. Unsecure service and protocol configuration

• Question 290:

  A security analyst has uncovered a suspicious request in the logs for a web application. Given the following URL:

  http:www.company-site.com/about.php?i=_V_V_V_V_VetcVpasswd

  Which of the following attack types is MOST likely to be the vulnerability?

  A. Directory traversal
  B. Cross-site scripting
  C. Remote file inclusion
  D. User enumeration
  B. Cross-site scripting