During the scoping phase of an assessment, a client requested that any remote code exploits discovered during testing would be reported immediately so the vulnerability could be fixed as soon as possible. The penetration tester did not agree with this request, and after testing began, the tester discovered a vulnerability and gained internal access to the system. Additionally, this scenario led to a loss of confidential credit card data and a hole in the system. At the end of the test, the penetration tester willfully failed to report this information and left the vulnerability in place. A few months later, the client was breached and credit card data was stolen. After being notified about the breach, which of the following steps should the company take NEXT?

Investigate the penetration tester.

Deny that the vulnerability existed

Investigate the penetration tester.

Accept that the client was right.

Which of the following would assist a penetration tester the MOST when evaluating the susceptibility of top-level executives to social engineering attacks?

Scraping social media for personal details

Registering domain names that are similar to the target company's

Identifying technical contacts at the company

Crawling the company's website for company information

A penetration tester is testing a new API for the company's existing services and is preparing the following script: Which of the following would the test discover?

Listening web servers in a domain

Given the following script: Which of the following BEST characterizes the function performed by lines 5 and 6?

Prints each DNS query result already stored in variable b

Retrieves the start-of-authority information for the zone on DNS server 10.10.10.10

Performs a single DNS query for www.comptia.org and prints the raw data output

Loops through variable b to count the results returned for the DNS query and prints that count to screen

Prints each DNS query result already stored in variable b

A penetration-testing team needs to test the security of electronic records in a company's office. Per the terms of engagement, the penetration test is to be conducted after hours and should not include circumventing the alarm or performing destructive entry. During outside reconnaissance, the team sees an open door from an adjoining building. Which of the following would be allowed under the terms of the engagement?

Climbing in an open window of the adjoining building

Prying the lock open on the records room

Climbing in an open window of the adjoining building

Presenting a false employee ID to the night guard

Obstructing the motion sensors in the hallway of the records room

A penetration tester who is working remotely is conducting a penetration test using a wireless connection. Which of the following is the BEST way to provide confidentiality for the client while using this connection?

Connect to the penetration testing company's VPS using a VPN.

Configure wireless access to use a AAA server.

Use random MAC addresses on the penetration testing distribution.

Install a host-based firewall on the penetration testing distribution.

Connect to the penetration testing company's VPS using a VPN.

A penetration tester is able to use a command injection vulnerability in a web application to get a reverse shell on a system After running a few commands, the tester runs the following:python -c 'import pty; pty.spawn("/bin/bash")'Which of the following actions Is the penetration tester performing?

Writing a script for persistence

A penetration tester opened a shell on a laptop at a client's office but is unable to pivot because of restrictive ACLs on the wireless subnet. The tester is also aware that all laptop users have a hardwired connection available at their desks. Which of the following is the BEST method available to pivot and gain additional access to the network?

Span deauthentication packets to the wireless clients.

Set up a captive portal with embedded malicious code.

Capture handshakes from wireless clients to crack.

Span deauthentication packets to the wireless clients.

Set up another access point and perform an evil twin attack.

A tester who is performing a penetration test discovers an older firewall that is known to have serious vulnerabilities to remote attacks but is not part of the original list of IP addresses for the engagement. Which of the following is the BEST option for the tester to take?

Notify the client about the firewall.

Segment the firewall from the cloud.

Scan the firewall for vulnerabilities.

Notify the client about the firewall.

A client would like to have a penetration test performed that leverages a continuously updated TTPs framework and covers a wide variety of enterprise systems and networks. Which of the following methodologies should be used to BEST meet the client's expectations?

The Diamond Model of Intrusion Analysis

During a web application test, a penetration tester was able to navigate to https://company.com and view all links on the web page. After manually reviewing the pages, the tester used a web scanner to automate the search for vulnerabilities. When returning to the web application, the following message appeared in the browser: unauthorized to view this page. Which of the following BEST explains what occurred?

The SSL certificates were invalid.

The scanner crashed the system.

A red team completed an engagement and provided the following example in the report to describe how the team gained access to a web server:x' OR role LIKE '%admin%Which of the following should be recommended to remediate this vulnerability?

Secure software development life cycle

The following output is from reconnaissance on a public-facing banking website: Based on these results, which of the following attacks is MOST likely to succeed?

A birthday attack on 64-bit ciphers (Sweet32)

An attack that breaks RC4 encryption

An attack on a session ticket extension (Ticketbleed)

Which of the following types of assessments MOST likely focuses on vulnerabilities with the objective to access specific data?

An unknown-environment assessment

A penetration tester initiated the transfer of a large data set to verify a proof-of-concept attack as permitted by the ROE. The tester noticed the client's data included PII, which is out of scope, and immediately stopped the transfer. Which of the following MOST likely explains the penetration tester's decision?

The tester had the situational awareness to stop the transfer.

The tester found evidence of prior compromise within the data set.

The tester completed the assigned part of the assessment workflow.

The tester reached the end of the assessment time frame.

A penetration tester exploited a vulnerability on a server and remotely ran a payload to gain a shell.However, a connection was not established, and no errors were shown on the payload execution. The penetration tester suspected that a network device, like an IPS or next-generation firewall, was dropping the connection. Which of the following payloads are MOST likely to establish a shell successfully?

windows/x64/meterpreter/reverse_http

windows/x64/meterpreter/reverse_tcp

windows/x64/meterpreter/reverse_http

windows/x64/powershell_reverse_tcp

windows/x64/meterpreter/reverse_https

A penetration tester gives the following command to a systems administrator to execute on one of the target servers:rm -f /var/www/html/G679h32gYu.phpWhich of the following BEST explains why the penetration tester wants this command executed?

To remove a web shell after the penetration test

To trick the systems administrator into installing a rootkit

To remove a web shell after the penetration test

To delete credentials the tester created

A company provided the following network scope for a penetration test:169.137.1.0/24221.10.1.0/24149.14.1.0/24A penetration tester discovered a remote command injection on IP address 149.14.1.24 and exploited the system. Later, the tester learned that this particular IP address belongs to a third party.Which of the following stakeholders is responsible for this mistake?

The company that requested the penetration test

The penetration testing company

The subcontractor supporting the test

A penetration tester joins the assessment team in the middle of the assessment. The client has asked the team, both verbally and in the scoping document, not to test the production networks. However, the new tester is not aware of this request and proceeds to perform exploits in the production environment. Which of the following would have MOST effectively prevented this misunderstanding?

Requiring all testers to review the scoping document carefully

Prohibiting exploitation in the production environment

Requiring all testers to review the scoping document carefully

Never assessing the production networks

Prohibiting testers from joining the team during the assessment

A penetration tester attempted a DNS poisoning attack. After the attempt, no traffic was seen from the target machine. Which of the following MOST likely caused the attack to fail?

The DNS cache was not refreshed.

The DNS information was incorrect.

The DNS cache was not refreshed.

The client did not receive a trusted response.

During an assessment, a penetration tester was able to access the organization's wireless network from outside of the building using a laptop running Aircrack-ng. Which of the following should be recommended to the client to remediate this issue?

Changing to Wi-Fi equipment that supports strong encryption

A penetration tester is conducting a penetration test and discovers a vulnerability on a web server that is owned by the client. Exploiting the vulnerability allows the tester to open a reverse shell.Enumerating the server for privilege escalation, the tester discovers the following: Which of the following should the penetration tester do NEXT?

Investigate the high numbered port connections.

Close the reverse shell the tester is using.

Note this finding for inclusion in the final report.

Investigate the high numbered port connections.

Contact the client immediately.

A penetration tester successfully performed an exploit on a host and was able to hop from VLAN 100 to VLAN 200. VLAN 200 contains servers that perform financial transactions, and the penetration tester now wants the local interface of the attacker machine to have a static ARP entry in the local cache. The attacker machine has the following:IP Address: 192.168.1.63Physical Address: 60-36-dd-a6-c5-33Which of the following commands would the penetration tester MOST likely use in order to establish a static ARP entry successfully?

arp -s 192.168.1.63 60-36-DD-A6-C5-33

tcpdump -i eth01 arp and arp[6:2] == 2

arp -s 192.168.1.63 60-36-DD-A6-C5-33

ipconfig /all findstr /v 00-00-00 | findstr Physical

route add 192.168.1.63 mask 255.255.255.255.0 192.168.1.1

A security analyst needs to perform a scan for SMB port 445 over a/16 network. Which of the following commands would be the BEST option when stealth is not a concern and the task is time sensitive?

Nmap -p 445 -n -T4 -open 172.21.0.0/16

Nmap -s 445 -Pn -T5 172.21.0.0/16

Nmap -p 445 -n -T4 -open 172.21.0.0/16

Nmap -sV --script=smb* 172.21.0.0/16

Nmap -p 445 -max -sT 172. 21.0.0/16

CompTIA PT0-002 Practice Test 6 - Free Online Exam Questions 201-240

A company uses a cloud provider with shared network bandwidth to host a web application on dedicated servers. The company's contact with the cloud provider prevents any activities that would interfere with the cloud provider's other customers. When engaging with a penetration-testing company to test the application, which of the following should the company avoid?

Become a Premium Member for full access

Unlock Premium Member

CompTIA PT0-002 Practice Test 6

Question

CompTIA PT0-002 Practice Tests

Practice Tests