CompTIA CompTIA PenTest+ PT1-002 Questions & Answers

• Question 81:

  A penetration tester wants to scan a target network without being detected by the client's IDS. Which of the following scans is MOST likely to avoid detection?

  A. nmap –p0 –T0 –sS 192.168.1.10

  B. nmap –sA –sV --host-timeout 60 192.168.1.10

  C. nmap –f --badsum 192.168.1.10

  D. nmap –A –n 192.168.1.10

  Correct Answer: B

• Question 82:

  A penetration tester discovers during a recent test that an employee in the accounting department has been making changes to a payment system and redirecting money into a personal bank account. The penetration test was immediately stopped. Which of the following would be the BEST recommendation to prevent this type of activity in the future?

  A. Enforce mandatory employee vacations

  B. Implement multifactor authentication

  C. Install video surveillance equipment in the office

  D. Encrypt passwords for bank account information

  Correct Answer: B

• Question 83:

  Which of the following tools provides Python classes for interacting with network protocols?

  A. Responder

  B. Impacket

  C. Empire

  D. PowerSploit

  Correct Answer: B

  Reference: https://github.com/SecureAuthCorp/impacket

• Question 84:

  A penetration tester has obtained shell access to a Windows host and wants to run a specially crafted binary for later execution using the wmic.exe process call create function. Which of the following OS or filesystem mechanisms is MOST likely to support this objective?

  A. Alternate data streams

  B. PowerShell modules

  C. MP4 steganography

  D. PsExec

  Correct Answer: D

  Reference: https://www.varonis.com/blog/wmi-windows-management-instrumentation/

• Question 85:

  A mail service company has hired a penetration tester to conduct an enumeration of all user accounts on an SMTP server to identify whether previous staff member accounts are still active. Which of the following commands should be used to accomplish the goal?

  A. VRFY and EXPN

  B. VRFY and TURN

  C. EXPN and TURN

  D. RCPT TO and VRFY

  Correct Answer: A

  Reference: https://hackerone.com/reports/193314

• Question 86:

  A software development team is concerned that a new product's 64-bit Windows binaries can be deconstructed to the underlying code. Which of the following tools can a penetration tester utilize to help the team gauge what an attacker might see in the binaries?

  A. Immunity Debugger

  B. OllyDbg

  C. GDB

  D. Drozer

  Correct Answer: B

  Reference: https://en.wikipedia.org/wiki/OllyDbg

• Question 87:

  A penetration tester is scanning a corporate lab network for potentially vulnerable services. Which of the following Nmap commands will return vulnerable ports that might be interesting to a potential attacker?

  A. nmap 192.168.1.1-5 –PU22-25,80

  B. nmap 192.168.1.1-5 –PA22-25,80

  C. nmap 192.168.1.1-5 –PS22-25,80

  D. nmap 192.168.1.1-5 –Ss22-25,80

  Correct Answer: C

• Question 88:

  A penetration tester has identified several newly released CVEs on a VoIP call manager. The scanning tool the tester used determined the possible presence of the CVEs based off the version number of the service. Which of the following methods would BEST support validation of the possible findings?

  A. Manually check the version number of the VoIP service against the CVE release

  B. Test with proof-of-concept code from an exploit database

  C. Review SIP traffic from an on-path position to look for indicators of compromise

  D. Utilize an nmap –sV scan against the service

  Correct Answer: D

  Reference: https://dokumen.pub/hacking-exposed-unified-communications-amp-voip-security-secrets-amp-solutions-2nd-edition-9780071798778-0071798773-9780071798761-0071798765.html

• Question 89:

  A penetration tester has obtained root access to a Linux-based file server and would like to maintain persistence after reboot. Which of the following techniques would BEST support this objective?

  A. Create a one-shot systemd service to establish a reverse shell.

  B. Obtain /etc/shadow and brute force the root password.

  C. Run the nc -e /bin/sh <...> command.

  D. Move laterally to create a user account on LDAP

  Correct Answer: C

• Question 90:

  A penetration tester obtained the following results after scanning a web server using the dirb utility:

  ...

  GENERATED WORDS: 4612

  ---- Scanning URL: http://10.2.10.13/ ---

  +

  http://10.2.10.13/about (CODE:200|SIZE:1520)

  +

  http://10.2.10.13/home.html (CODE:200|SIZE:214)

  +

  http://10.2.10.13/index.html (CODE:200|SIZE:214)

  +

  http://10.2.10.13/info (CODE:200|SIZE:214)

  ...

  DOWNLOADED: 4612 – FOUND: 4

  Which of the following elements is MOST likely to contain useful information for the penetration tester?

  A. index.html

  B. about

  C. info

  D. home.html

  Correct Answer: B