CompTIA CompTIA PenTest+ PT0-001 Questions & Answers

• Question 21:

  A penetration tester runs a script that queries the domain controller for user service principal names. Which of the following techniques is MOST likely being attempted?

  A. LSASS credential extraction

  B. Cpassword

  C. Cleartext credentials in LDAP

  D. Kerberoasting

  Correct Answer: D

  Reference: https://attack.stealthbits.com/cracking-kerberos-tgs-tickets-using-kerberoasting

• Question 22:

  Which of the following is the BEST way to deploy vulnerability scanners with many networks segmented by firewalls with active IPS rules?

  A. Deploy a single scanner inside each network segment.

  B. Deploy many scanners inside one segment and allow any rules.

  C. Deploy one internal scanner and one external scanner.

  D. Deploy one internal scanner with heavy server resources.

  Correct Answer: A

• Question 23:

  A penetration tester identifies prebuilt exploit code containing Windows imports for VirtualAllocEx and LoadLibraryA functions. Which of the following techniques is the exploit code using?

  A. DLL hijacking

  B. DLL sideloading

  C. DLL injection

  D. DLL function hooking

  Correct Answer: A

  Reference: https://trustfoundry.net/what-is-dll-hijacking/

• Question 24:

  A penetration tester is required to exploit a WPS implementation weakness. Which of the following tools will perform the attack?

  A. Karma

  B. Kismet

  C. Pixie

  D. NetStumbler

  Correct Answer: D

  Reference: https://en.wikipedia.org/wiki/NetStumbler

• Question 25:

  A static code analysis report of a web application can be leveraged to identify:

  A. business logic flaws.

  B. insufficient input sanitization.

  C. session fixation issues.

  D. client-side data storage.

  E. clickjacking.

  Correct Answer: E

  Reference: https://dzone.com/refcardz/getting-started-with-static-code-analysis

• Question 26:

  During the exploitation phase of a web application, a penetration tester finds XML files are being used to handle parameters that are sent for the server. Which of the following vulnerabilities can be exploited to try to access internal files of the affected web server using a web proxy?

  A. XSS

  B. SQL injection

  C. CSRF

  D. XXE

  Correct Answer: B

  Reference: https://www.sqlshack.com/sql-injection-what-is-it-causes-and-exploits/

• Question 27:

  A penetration tester needs to use Nmap to scan a host with a very low speed so the WAF or IPS/IDS is not triggered. Which of the following command-line parameters should be added to the Nmap command?

  A. -t 5

  B. -sP 10

  C. -sV

  D. -t 1

  Correct Answer: D

  Reference: https://nmap.org/docs/nmap-mindmap.pdf

• Question 28:

  A tester identifies an XSS attack vector during a penetration test. Which of the following flags should the tester recommend to prevent a JavaScript payload from accessing the cookie?

  A. Secure

  B. Domain

  C. Max-Age

  D. HttpOnly

  Correct Answer: D

  Reference: https://securityboulevard.com/2020/08/the-httponly-flag-protecting-cookies-against-xss/

• Question 29:

  A penetration tester is attempting to scan a legacy web application using the scanner's default scan settings. The scans continually result in the application becoming unresponsive. Which of the following can help to alleviate this issue?

  A. Packet shaping

  B. Flow control

  C. Bandwidth limits

  D. Query throttling

  Correct Answer: A

• Question 30:

  A client gives a penetration tester a /8 network range to scan during a week-long engagement. Which of the following tools would BEST complete this task quickly?

  A. Massscan

  B. Nmap

  C. Angry IP scanner

  D. Unicorn scan

  Correct Answer: A

  Reference: https://github.com/robertdavidgraham/masscan