CompTIA PT0-002 Practice Test - Questions Answers, Page 44

A penetration tester would like to crack a hash using a list of hashes and a predefined set of rules. The tester runs the following command: hashcat.exe -a 0 .\hash.txt .\rockyou.txt -r .\rules\replace.rule

Which of the following is the penetration tester using to crack the hash?

During a REST API security assessment, a penetration tester was able to sniff JSON content containing user credentials. The JSON structure was as follows:

<

transaction_id: '1234S6', content: [ {

user_id: 'mrcrowley', password: ['54321#'] b <

user_id: 'ozzy',

password: ['1112228'] ) ]

Assuming that the variable json contains the parsed JSON data, which of the following Python code snippets correctly returns the password for the user ozzy?

A vulnerability assessor is looking to establish a baseline of all IPv4 network traffic on the local VLAN without a local IP address. Which of the following Nmap command sequences would best provide this information?

An organization is using Android mobile devices but does not use MDM services. Which of the following describes an existing risk present in this scenario?

A penetration tester is conducting an assessment on a web application. Which of the following active reconnaissance techniques would be best for the tester to use to gather additional information about the application?

An employee received an email stating that a bank account was deactivated and will expire if the employee does not respond within the next 24 hours. Which of the following attacks best describes this scenario?

During a vulnerability management process that lasted several months, a security analyst found the number of vulnerabilities in a production web application consistently grew. Which of the following should the analyst do to best remediate this situation?

Which of the following types of communication should a penetration tester provide a client to document test results for PCI DSS compliance?

Which of the following identifies a condensed, high-level discussion of findings during a penetration test reporting activity?