A security engineer is trying to bypass a network IPS that isolates the source when the scan exceeds 100 packets per minute. The scope of the scan is to identify web servers in the 10.0.0.0/16 subnet.Which of the following commands should the engineer use to achieve the objective in the least amount of time?

nmap -T4 -p 80 10.0.0.0/16 -- max-rate 60

nmap -T3 -p 80 10.0.0.0/16 -- max-hostgroup 100

nmap -T4 -p 80 10.0.0.0/16 -- max-rate 60

nmap -T5 -p 80 10.0.0.0/16 -- min-rate 80

During a vulnerability scan a penetration tester enters the following Nmap command against all of the non-Windows clients:nmap -sX -T4 -p 21-25, 67, 80, 139, 8080 192.168.11.191The penetration tester reviews the packet capture in Wireshark and notices that the target responds with an RST packet flag set for all of the targeted ports. Which of the following does this information most likely indicate?

All of the ports in the target range are closed.

Nmap needs more time to scan the ports in the target range.

The ports in the target range cannot be scanned because they are common UDP ports.

All of the ports in the target range are open

A penetration tester is testing a company's public API and discovers that specific input allows the execution of arbitrary commands on the base operating system. Which of the following actions should the penetration tester take next?

Include the findings in the final report.

Document which commands can be executed.

Use this feature to further compromise the server.

A penetration tester is performing a vulnerability scan on a large ATM network. One of the organization's requirements is that the scan does not affect legitimate clients' usage of the ATMs. Which of the following should the tester do to best meet the company's vulnerability scan requirements?

Use Nmap's -T2 switch to run a slower scan and with less resources.

Run the scans using multiple machines.

Run the scans only during lunch hours.

Use Nmap's -host-timeout switch to skip unresponsive targets.

A penetration tester has been provided with only the public domain name and must enumerate additional information for the public-facing assets.INSTRUCTIONSSelect the appropriate answer(s), given the output from each section.Output 1

See all the solutions below in Explanation

A penetration tester observes an application enforcing strict access controls. Which of the following would allow the tester to bypass these controls and successfully access the organization's sensitive files?

Insecure direct object references

A penetration tester is reviewing the security of a web application running in an laaS compute instance. Which of the following payloads should the tester send to get the running process credentials?

file=http://169.254.169.254/latest/meta-data/

file=http://192.168. 1. 78?+document.cookie

file =.. / .. / .. /proc/self/environ

file=http://169.254.169.254/latest/meta-data/

A security firm is discussing the results of a penetration test with a client. Based on the findings, the client wants to focus the remaining time on a critical network segment. Which of the following best describes the action taking place?

Reprioritizing the goals/objectives

Maximizing the likelihood of finding vulnerabilities

Reprioritizing the goals/objectives

Eliminating the potential for false positives

Reducing the risk to the client environment

A penetration tester wrote the following script on a compromised system:#!/bin/bashnetwork='10.100.100'ports='22 23 80 443'for x in {1 .. 254};do (nc -zv $network.$x $ports );doneWhich of the following would explain using this script instead of another tool?

The configuration required the penetration tester to not utilize additional files.

The typical tools could not be used against Windows systems.

The configuration required the penetration tester to not utilize additional files.

The Bash script will provide more thorough output.

The penetration tester wanted to persist this script to run on reboot.

During a client engagement, a penetration tester runs the following Nmap command and obtains the following output:nmap -sV -- script ssl-enum-ciphers -p 443 remotehost| TLS_ECDHE_ECDSA_WITH_RC4_128_SHA| TLS_ECDHE_RSA_WITH_RC4_128_SHATLS_RSA_WITH_RC4_128_SHA (rsa 2048)TLS_RSA_WITH_RC4_128_MD5 (rsa 2048)Which of the following should the penetration tester include in the report?

Old, insecure ciphers are in use.

The 3DES algorithm should be deprecated.

2,048-bit symmetric keys are incompatible with MD5.

This server should be upgraded to TLS 1.2.

A client asks a penetration tester to retest its network a week after the scheduled maintenance window. Which of the following is the client attempting to do?

Test the efficacy of the remediation effort.

Determine if the tester was proficient.

Test a new non-public-facing server for vulnerabilities.

Determine if the initial report is complete.

Test the efficacy of the remediation effort.

Which of the following documents would be the most helpful in determining who is at fault for a temporary outage that occurred during a penetration test?

Assessment scope and methodologies

As part of an active reconnaissance, a penetration tester intercepts and analyzes network traffic, including API requests and responses. Which of the following can be gained by capturing and examining the API traffic?

Identifying the token/authentication detail

Assessing the performance of the network's API communication

Identifying the token/authentication detail

Enumerating all users of the application

Extracting confidential user data from the intercepted API responses

During a vulnerability scan a penetration tester enters the following Nmap command against all of the non-Windows clients:nmap -sX -T4 -p 21-25, 67, 80, 139, 8080 192.168.11.191The penetration tester reviews the packet capture in Wireshark and notices that the target responds with an RST packet flag set for all of the targeted ports. Which of the following does this information most likely indicate?

All of the ports in the target range are closed.

Nmap needs more time to scan the ports in the target range.

The ports in the target range cannot be scanned because they are common UDP ports.

All of the ports in the target range are open.

A penetration tester is trying to bypass an active response tool that blocks IP addresses that have more than 100 connections per minute. Which of the following commands would allow the tester to finish the test without being blocked?

nmap -p 22,25, 80, 3389 -T2 10.0.0.15 -Pn

nmap -T5 -p 1-65535 -A 10.0.0.15

Which of the following members of a client organization are most likely authorized to provide a signed authorization letter prior to the start date of a penetration test?

The executive management team and legal personnel

Organizational security personnel

A security analyst is conducting an unknown environment test from 192.168.3.3. The analyst wants to limit observation of the penetration tester's activities and lower the probability of detection by intrusion protection and detection systems. Which of the following Nmap commands should the analyst use to achieve this objective?

nmap -scanflags SYNFIN 192.168.5.5

In Java and C/C++, variable initialization is critical because:

the unknown value, when used later, will cause unexpected behavior.

the compiler will assign null to the variable, which will cause warnings and errors.

the initial state of the variable creates a race condition.

the variable will not have an object type assigned to it.

A penetration tester fuzzes an internal server looking for hidden services and applications and obtains the following output: Which of the following is the most likely explanation for the output?

The admin, test, and db directories redirect to the log-in page.

The tester does not have credentials to access the server-status page.

The admin directory cannot be fuzzed because it is forbidden.

The admin, test, and db directories redirect to the log-in page.

The robots.txt file has six entries in it.

A penetration tester wants to find the password for any account in the domain without locking any of the accounts. Which of the following commands should the tester use?

cme smb 192.168.0.0/24 -u /userList.txt -p /passwordList.txt

enum4linux -u userl -p /passwordList.txt 192.168.0.1

enum4linux -u userl -p Passwordl 192.168.0.1

cme smb 192.168.0.0/24 -u /userList.txt -p /passwordList.txt

cme smb 192.168.0.0/24 -u /userList.txt -p Summer123

During a client engagement, a penetration tester runs the following Nmap command and obtains the following output:nmap -sV -- script ssl-enum-ciphers -p 443 remotehost| TLS_ECDHE_ECDSA_WITH_RC4_128_SHA| TLS_ECDHE_RSA_WITH_RC4_128_SHA| TLS_RSA_WITH_RC4_128_SHA (rsa 2048)TLS_RSA_WITH_RC4_128_MD5 (rsa 2048)Which of the following should the penetration tester include in the report?

Old, insecure ciphers are in use.

The 3DES algorithm should be deprecated.

2,048-bit symmetric keys are incompatible with MD5.

This server should be upgraded to TLS 1.2.

Which of the following is the most common vulnerability associated with loT devices that are directly connected to the internet?

The existence of default passwords

CompTIA PT0-002 Practice Test 9 - Free Online Exam Questions 321-360

A penetration tester runs the following command:

nmap -p- -A 10.0.1.10

Given the execution of this command, which of the following quantities of ports will Nmap scan?

Become a Premium Member for full access

Unlock Premium Member

CompTIA PT0-002 Practice Test 9

Question

CompTIA PT0-002 Practice Tests

Practice Tests