Skip to main content

PT0-002 Real Exam Questions

CompTIA PenTest+

455 questions available · Page 1 of 46

Updated Exam DumpsVerified AnswersPass Guarantee

Get Complete Exam Dumps
Question 1 Single choice

The results of an Nmap scan are as follows:

Which of the following would be the BEST conclusion about this device?

  1. A

    This device may be vulnerable to the Heartbleed bug due to the way transactions over TCP/22 handle heartbeat extension packets, allowing attackers to obtain sensitive information from process memory.

  2. B

    This device is most likely a gateway with in-band management services.

  3. C

    This device is most likely a proxy server forwarding requests over TCP/443.

  4. D

    This device may be vulnerable to remote code execution because of a butter overflow vulnerability in the method used to extract DNS names from packets prior to DNSSEC validation.

Show answer and explanation

Correct answer: B

Explanation

The heart bleed bug is an open ssl bug which does not affect SSH
Ref:
https://www.sos-berlin.com/en/news-heartbleed-bug-does-not-affect-jobscheduler-or-ssh

Question 2 Multiple choice

A physical penetration tester needs to get inside an organization's office and collect sensitive information without acting suspiciously or being noticed by the security guards. The tester has observed that the company's ticket gate does not scan the badges, and employees leave their badges on the table while going to the restroom.

Which of the following techniques can the tester use to gain physical access to the office? (Choose two.)

  1. A

    Shoulder surfing

  2. B

    Call spoofing

  3. C

    Badge stealing

  4. D

    Tailgating

  5. E

    Dumpster diving

  6. F

    Email phishing

Show answer and explanation

Correct answers: C, D

Question 3 Single choice

A company hired a penetration-testing team to review the cyber-physical systems in a manufacturing plant.
The team immediately discovered the supervisory systems and PLCs are both connected to the company intranet.

Which of the following assumptions, if made by the penetration-testing team, is MOST likely to be valid?

  1. A

    PLCs will not act upon commands injected over the network.

  2. B

    Supervisors and controllers are on a separate virtual network by default.

  3. C

    Controllers will not validate the origin of commands.

  4. D

    Supervisory systems will detect a malicious injection of code/commands.

Show answer and explanation

Correct answer: C

Explanation

PLCs are programmable logic controllers that execute logic operations on input signals from sensors and output signals to actuators. They are often connected to supervisory systems that provide human-machine interfaces and data acquisition functions. If both systems are connected to the company intranet, they are exposed to potential attacks from internal or external adversaries. A valid assumption is that controllers will not validate the origin of commands, meaning that an attacker can send malicious commands to manipulate or sabotage the industrial process. The other assumptions are not valid because they contradict the facts or common practices.

Question 4 Single choice

A penetration tester is examining a Class C network to identify active systems quickly.

Which of the following commands should the penetration tester use?

  1. A

    nmap sn 192.168.0.1/16

  2. B

    nmap sn 192.168.0.1-254

  3. C

    nmap sn 192.168.0.1 192.168.0.1.254

  4. D

    nmap sN 192.168.0.0/24

Show answer and explanation

Correct answer: B

Question 5 Single choice

A company is concerned that its cloud VM is vulnerable to a cyberattack and proprietary data may be stolen. A penetration tester determines a vulnerability does exist and exploits the vulnerability by adding a fake VM instance to the IaaS component of the client's VM.

Which of the following cloud attacks did the penetration tester MOST likely implement?

  1. A

    Direct-to-origin

  2. B

    Cross-site scripting

  3. C

    Malware injection

  4. D

    Credential harvesting

Show answer and explanation

Correct answer: C

Explanation

Malware injection is the most likely cloud attack that the penetration tester implemented, as it involves adding a fake VM instance to the IaaS component of the client's VM. Malware injection is a type of attack that exploits vulnerabilities in cloud services or applications to inject malicious code or data into them. The injected malware can then compromise or control the cloud resources or data.

Question 6 Single choice

Which of the following types of assessments MOST likely focuses on vulnerabilities with the objective to access specific data?

  1. A

    An unknown-environment assessment

  2. B

    A known-environment assessment

  3. C

    A red-team assessment

  4. D

    A compliance-based assessment

Show answer and explanation

Correct answer: C

Explanation

A red-team assessment is a type of penetration testing that simulates a real-world attack scenario with the goal of accessing specific data or systems. A red-team assessment is different from an unknown-environment assessment, which does not have a predefined objective and focuses on discovering as much information as possible about the target. A known-environment assessment is a type of penetration testing that involves cooperation and communication with the target organization, and may not focus on specific data or systems. A compliance-based assessment is a type of penetration testing that aims to meet certain regulatory or industry standards, and may not focus on specific data or systems.

Question 7 Single choice

A penetration tester captured the following traffic during a web-application test:

Which of the following methods should the tester use to visualize the authorization information being transmitted?

  1. A

    Decode the authorization header using UTF-8.

  2. B

    Decrypt the authorization header using bcrypt.

  3. C

    Decode the authorization header using Base64.

  4. D

    Decrypt the authorization header using AES.

Show answer and explanation

Correct answer: C

Question 8 Single choice

In Python socket programming, SOCK_DGRAM type is:

  1. A

    reliable.

  2. B

    matrixed.

  3. C

    connectionless.

  4. D

    slower.

Show answer and explanation

Correct answer: C

Explanation

In Python socket programming, SOCK_DGRAM type is connectionless. This means that the socket does not establish a reliable connection between the sender and the receiver, and does not guarantee that the packets will arrive in order or without errors. SOCK_DGRAM type is used for UDP (User Datagram Protocol) sockets, which are faster and simpler than TCP (Transmission Control Protocol) sockets.

Question 9 Single choice

A penetration tester discovered a vulnerability that provides the ability to upload to a path via directory traversal. Some of the files that were discovered through this vulnerability are:

Which of the following is the BEST method to help an attacker gain internal access to the affected machine?

  1. A

    Edit the discovered file with one line of code for remote callback

  2. B

    Download .pl files and look for usernames and passwords

  3. C

    Edit the smb.conf file and upload it to the server

  4. D

    Download the smb.conf file and look at configurations

Show answer and explanation

Correct answer: C

Question 10 Single choice

A penetration tester is working to enumerate the PLC devices on the 10.88.88.76/24 network.

Which of the following commands should the tester use to achieve the objective in a way that minimizes the risk of affecting the PLCs?

  1. A

    nmap --script=s7-info -p 102 10.88.88.76/24 -T3

  2. B

    nmap --script=wsdd-discover -p 3702 -sUlO.88.88.76/24

  3. C

    nmap --script=iax2-version -p 4569 -sU -V 10.88.88.76/24 -T2

  4. D

    nmap --script=xll-access -p 6000-6009 10.88.88.76/24

Show answer and explanation

Correct answer: A

Explanation

The nmap command with the --script=s7-info is specifically designed to interact with Siemens S7 PLCs, which are common industrial control systems. The -p 102 specifies the port associated with Siemens S7 communications. The -T3 timing option is chosen to minimize the risk of impacting the PLCs by not being overly aggressive in the scan timing, which is important in operational technology environments where PLCs can be sensitive to high network traffic. The other options listed do not specifically target PLC devices or use appropriate timing to minimize risk.