CompTIA PT0-001 Online Practice Questions and Exam Preparation

CompTIA PT0-001 Online Questions & Answers

• Question 51:

  Joe, an attacker, intends to transfer funds discreetly from a victim's account to his own. Which of the following URLs can he use to accomplish this attack?

  A. https://testbank.com/BankingApp/ACH.aspx?CustID=435345andaccountType=Fandaction-ACHTransferandsenderID=654846andnotify=Falseandcreditaccount='OR 1=1 AND select username from testbank.custinfo where username like `Joe'andamount=200
  B. https://testbank.com/BankingApp/ACH.aspx?CustID=435345andaccountType=Fandaction-ACHTransferandsenderID=654846andnotify=Falseandcreditaccount='OR 1=1 AND select username from testbank.custinfo where username like `Joe' andamount=200
  C. https://testbank.com/BankingApp/ACH.aspx?CustID=435345andaccountType=Fandaction-ACHTransferandsenderID=654846andnotify=Trueandcreditaccount='OR 1=1 AND select username from testbank.custinfo where username like `Joe' andamount=200
  D. https://testbank.com/BankingApp/ACH.aspx?CustID=435345andaccountType=Fandaction-ACHTransferandsenderID=654846andnotify=Trueandcreditaccount='AND 1=1 AND select username from testbank.custinfo where username like `Joe' andamount=200
  B. https://testbank.com/BankingApp/ACH.aspx?CustID=435345andaccountType=Fandaction-ACHTransferandsenderID=654846andnotify=Falseandcreditaccount='OR 1=1 AND select username from testbank.custinfo where username like `Joe' andamount=200

• Question 52:

  DRAG DROP

  Instructions:

  Analyze the code segments to determine which sections are needed to complete a port scanning script.

  Drag the appropriate elements into the correct locations to complete the script.

  If at any time you would like to bring back the initial state of the simulation, please click the reset all button.

  During a penetration test, you gain access to a system with a limited user interface. This machine appears to have access to an isolated network that you would like to port scan.

  Select and Place:

  

  

• Question 53:

  A penetration tester, who is not on the client's network. is using Nmap to scan the network for hosts that are in scope. The penetration tester is not receiving any response on the command:

  nmap 100.100/1/0-125

  Which of the following commands would be BEST to return results?

  A. nmap -Pn -sT 100.100.1.0-125
  B. nmap -sF -p 100.100.1.0-125
  C. nmap -sV -oA output 100.100.10-125
  D. nmap 100.100.1.0-125 -T4
  A. nmap -Pn -sT 100.100.1.0-125

• Question 54:

  An energy company contracted a security firm to perform a penetration test of a power plant, which employs ICS to manage power generation and cooling. Which of the following is a consideration unique to such an environment that must be made by the firm when preparing for the assessment?

  A. Selection of the appropriate set of security testing tools
  B. Current and load ratings of the ICS components
  C. Potential operational and safety hazards
  D. Electrical certification of hardware used in the test
  A. Selection of the appropriate set of security testing tools

• Question 55:

  DRAG DROP

  A technician is reviewing the following report. Given this information, identify which vulnerability can be definitively confirmed to be a false positive by dragging the “false positive” token to the “Confirmed” column for each vulnerability that is a false positive.

  Select and Place:

  

  

• Question 56:

  A penetration tester is attempting to open a socket in a bash script but receives errors when running it. The current state of the relevant line in the script is as follows:

  

  Which of the following lines of code would correct the issue upon substitution?

  A. open 0/dev/tcp/${HOST}:${PORT}
  B. exec 0
  C. exec 0
  D. exec 3/dev/tcp/${HOST}/${PORT}
  E. open 3
  F. open 3
  C. exec 0

• Question 57:

  A tester was able to retrieve domain users' hashes. Which of the following tools can be used to uncover the users' passwords? (Choose two.)

  A. Hydra
  B. Mimikatz
  C. Hashcat
  D. John the Ripper
  E. PSExec
  F. Nessus
  B. Mimikatz
  E. PSExec

• Question 58:

  A penetration tester has a full shell to a domain controller and wants to discover any user account that has not authenticated to the domain in 21 days. Which of the following commands would BEST accomplish this?

  A. dsrm -users "DN=compony.com; OU=hq CN=usera"
  B. dsuser -name -account -limit 3
  C. dsquery uaer -inactive 3
  D. dsquery -o -rein -limit 21
  D. dsquery -o -rein -limit 21

• Question 59:

  A MITM attack is being planned. The first step is to get information flowing through a controlled device. Which of the following should be used to accomplish this?

  A. Repeating
  B. War driving
  C. Evil twin
  D. Bluejacking
  E. Replay attack
  C. Evil twin

• Question 60:

  At the information gathering stage, a penetration tester is trying to passively identify the technology running on a client's website. Which of the following approached should the penetration tester take?

  A. Run a spider scan in Burp Suite.
  B. Use web aggregators such as BuiltWith and Netcraft
  C. Run a web scraper and pull the website's content.
  D. Use Nmap to fingerprint the website's technology.
  A. Run a spider scan in Burp Suite.