CompTIA PT0-001 Online Practice Questions and Exam Preparation

CompTIA PT0-001 Online Questions & Answers

• Question 21:

  A penetration test was performed by an on-staff junior technician. During the test, the technician discovered the web application could disclose an SQL table with user account and password information. Which of the following is the MOST effective way to notify management of this finding and its importance?

  A. Document the findings with an executive summary, recommendations, and screenshots of the web application disclosure.
  B. Connect to the SQL server using this information and change the password to one or two non-critical accounts to demonstrate a proof--of-concept to management.
  C. Notify the development team of the discovery and suggest that input validation be implemented with a professional penetration testing company.
  D. Request that management create an RFP to begin a formal engagement with a professional penetration testing company.
  A. Document the findings with an executive summary, recommendations, and screenshots of the web application disclosure.

• Question 22:

  A penetration tester wants to launch a graphic console window from a remotely compromised host with IP 10.0.0.20 and display the terminal on the local computer with IP 192.168.1.10. Which of the following would accomplish this task?

  A. From the remote computer, run the following commands:Export IHOST 192.168.1.10:0.0 xhost+ Terminal
  B. From the local computer, run the following command ssh -L4444 : 127.0.01:6000 -% [email protected] xterm
  C. From the local computer, run the following command ssh -r6000 : 127.0.01:4444 -p 6000 [email protected] "xhost+; xterm"
  D. From the local computer, run the following command: nc -l -p 6000 Then, from the remote computer, run the following command: xterm | nc 192.168.1.10 6000
  D. From the local computer, run the following command: nc -l -p 6000 Then, from the remote computer, run the following command: xterm | nc 192.168.1.10 6000

• Question 23:

  A penetration tester is planning to conduct a distributed dictionary attack on a government domain against the login portal. The tester will leverage multiple proxies to mask the origin IPs of the attack. Which of the following threat actors will be emulated?

  A. APT
  B. Hacktivist
  C. Script kiddie
  D. Insider threat
  A. APT

• Question 24:

  A penetration tester needs to provide the code used to exploit a DNS server in the final report. In which of the following parts of the report should the penetration tester place the code?

  A. Executive summary
  B. Remediation
  C. Conclusion
  D. Technical summary
  A. Executive summary

• Question 25:

  During the information gathering phase of a network penetration test for the corp.local domain, which of the following commands would provide a list of domain controllers?

  A. nslookup -type=srv _ldap._tcp.dc._msdcs.corp.local
  B. nmap -sV -p 389 - -script=ldap-rootdse corp.local
  C. net group "Domain Controllers" /domain
  D. gpresult /d corp.local /r "Domain Controllers"
  A. nslookup -type=srv _ldap._tcp.dc._msdcs.corp.local

• Question 26:

  A tester identifies an XSS attack vector during a penetration test. Which of the following flags should the tester recommend to prevent a JavaScript payload from accessing the cookie?

  A. Secure
  B. Domain
  C. Max-Age
  D. HttpOnly
  D. HttpOnly

• Question 27:

  A penetration tester has performed a pivot to a new Linux device on a different network. The tester writes the following command:

  for m in {1..254..1};do ping -c 1 192.168.101.$m; done

  Which of the following BEST describes the result of running this command?

  A. Port scan
  B. Service enumeration
  C. Live host identification
  D. Denial of service
  C. Live host identification

• Question 28:

  A consultant is identifying versions of Windows operating systems on a network Which of the following Nmap commands should the consultant run?

  A. nmap -T4 -v -sU -iL /tmp/list.txt -Pn --script smb-system-info
  B. nmap -T4 -v -iL /tmp/list .txt -Pn --script smb-os-disccvery
  C. nmap -T4 -v -6 -iL /tmp/liat.txt -Pn --script smb-os-discovery -p 135-139
  D. nmap -T4 -v --script smb-system-info 192.163.1.0/24
  B. nmap -T4 -v -iL /tmp/list .txt -Pn --script smb-os-disccvery

• Question 29:

  A tester has determined that null sessions are enabled on a domain controller. Which of the following attacks can be performed to leverage this vulnerability?

  A. RID cycling to enumerate users and groups
  B. Pass the hash to relay credentials
  C. Password brute forcing to log into the host
  D. Session hijacking to impersonate a system account
  D. Session hijacking to impersonate a system account

• Question 30:

  A penetration tester is performing a code review against a web application Given the following URL and source code:

  

  Which of the following vulnerabilities is present in the code above?

  A. SQL injection
  B. Cross-site scripting
  C. Command injection
  D. LDAP injection
  C. Command injection