CompTIA PT0-001 Online Practice Questions and Exam Preparation

CompTIA PT0-001 Online Questions & Answers

• Question 81:

  A vulnerability scan report shows what appears to be evidence of a memory disclosure vulnerability on one of the target hosts. The administrator claims the system is patched and the evidence is a false positive. Which of the following is the BEST method for a tester to confirm the vulnerability exists?

  A. Manually run publicly available exploit code.
  B. Confirm via evidence of the updated version number.
  C. Run the vulnerability scanner again.
  D. Perform dynamic analysis on the vulnerable service.
  C. Run the vulnerability scanner again.

• Question 82:

  A client is asking a penetration tester to evaluate a new web application for availability. Which of the following types of attacks should the tester use?

  A. TCP SYN flood
  B. SQL injection
  C. xss D. XMAS scan
  B. SQL injection

• Question 83:

  During an internal network penetration test the tester is able to compromise a Windows system and recover the NTLM hash for a local wrltsrnAdrain account Attempting to recover the plaintext password by cracking the hash has proved to be unsuccessful, and the tester has decided to try a pass-the-hash attack to see if the credentials are reused on other in-scope systems Using the Medusa tool the tester attempts to authenticate to a list of systems, including the originally compromised host, with no success Given the output below:

  

  Which of the following Medusa commands would potentially provide better results?

  A. #medusa -h hosts.txt -U usera.txt -P hashes, txt -M smbnt. -m GROP:LOCAL -O out.txt -m PASS:HASH
  B. #medusa -H hosts.txt -U users, txt -P hashes, txt -M smbnt -m PASS:HASH -o out. txt
  C. #medusa -H hosts.txt -u WrkStnAdmin -p aa3b435b51404eeaa3b435b51404ee:4e63c1b137e274dda214154b349fe316 -M smbnt -m GROUP:DOMAIN -o out.txt
  D. #medusa -H hosts.txt -C creds.txt -M mssq1 -m GROUP: DOMAIN -o out.txt
  A. #medusa -h hosts.txt -U usera.txt -P hashes, txt -M smbnt. -m GROP:LOCAL -O out.txt -m PASS:HASH

• Question 84:

  A penetration tester has gained access to a marketing employee's device. The penetration tester wants to ensure that if the access is discovered, control of the device can be regained. Which of the following actions should the penetration tester use to maintain persistence to the device? (Select TWO.)

  A. Place an entry in HKLM\Software\Microsoft\CurrentVersion\Run to call au57d.ps1.
  B. Place an entry in C:\windows\system32\drivers\etc\hosts for 12.17.20.10 badcomptia.com.
  C. Place a script in C:\users\%username\local\appdata\roaming\temp\au57d.ps1.
  D. Create a fake service in Windows called RTAudio to execute manually.
  E. Place an entry for RTAudio in HKLM\CurrentControlSet\Services\RTAudio.
  F. Create a schedule task to call C:\windows\system32\drivers\etc\hosts.
  A. Place an entry in HKLM\Software\Microsoft\CurrentVersion\Run to call au57d.ps1.
  C. Place a script in C:\users\%username\local\appdata\roaming\temp\au57d.ps1.

• Question 85:

  A vulnerability scan is run against a domain hosing a banking application that accepts connections over MTTPS and HTTP protocols Given the following results:

  1.

  SSU3 supported

  2.

  HSTS not enforced

  3.

  Application uses weak ciphers

  4.

  Vulnerable to clickjacking

  Which of the following should be ranked with the HIGHEST risk?

  A. SSLv3 supported
  B. HSTS not enforced
  C. Application uses week ophers
  D. Vulnerable to clickjacking
  B. HSTS not enforced

• Question 86:

  Which of the following properties of the penetration testing engagement agreement will have the largest impact on observing and testing production systems at their highest loads?

  A. Creating a scope of the critical production systems
  B. Setting a schedule of testing access times
  C. Establishing a white-box testing engagement
  D. Having management sign-off on intrusive testing
  B. Setting a schedule of testing access times

• Question 87:

  A penetration tester has compromised a system and wishes to connect to a port on it from the attacking machine to control the system Which of the following commands should the tester run on the compromised system?

  A. nc looalhot 4423
  B. nc -nvlp 4423 -?/bin/bash
  C. nc 10.0.0.1 4423
  D. nc 127.0.0.1 4423 -e /bin/bash
  B. nc -nvlp 4423 -?/bin/bash

• Question 88:

  A penetration tester is preparing to conduct API testing Which of the following would be MOST helpful in preparing for this engagement?

  A. NiktO
  B. WAR
  C. W3AF
  D. Swagger
  D. Swagger

• Question 89:

  The results of a basic compliance scan show a subset of assets on a network. This data differs from what is shown on the network architecture diagram, which was supplied at the beginning of the test. Which of the following are the MOST likely causes for this difference? (Choose two.)

  A. Storage access
  B. Limited network access
  C. Misconfigured DHCP server
  D. Incorrect VLAN scanned
  E. Network access controls
  A. Storage access
  B. Limited network access

• Question 90:

  During the exploitation phase of a web application, a penetration tester finds XML files are being used to handle parameters that are sent for the server. Which of the following vulnerabilities can be exploited to try to access internal files of the affected web server using a web proxy?

  A. XSS
  B. SQL injection
  C. CSRF
  D. XXE
  B. SQL injection