Online PT0-002 Dumps Help You Understand Questions Well

1. A penetration tester who is performing a physical assessment of a company’s security practices notices the company does not have any shredders inside the office building.

Which of the following techniques would be BEST to use to gain confidential information?

2. A penetration tester has gained access to a network device that has a previously unknown IP range on an interface. Further research determines this is an always-on VPN tunnel to a third-party supplier.

Which of the following is the BEST action for the penetration tester to take?

3. A penetration tester utilized Nmap to scan host 64.13.134.52 and received the following results:





Based on the output, which of the following services are MOST likely to be exploited? (Choose two.)

4. A penetration tester is starting an assessment but only has publicly available information about the target company. The client is aware of this exercise and is preparing for the test.

Which of the following describes the scope of the assessment?

5. A penetration tester uncovers access keys within an organization's source code management solution.

Which of the following would BEST address the issue? (Choose two.)

6. Deconfliction is necessary when the penetration test:

7. A penetration tester opened a shell on a laptop at a client's office but is unable to pivot because of restrictive ACLs on the wireless subnet. The tester is also aware that all laptop users have a hard-wired connection available at their desks.

Which of the following is the BEST method available to pivot and gain additional access to the network?

8. A penetration tester conducted a discovery scan that generated the following:





Which of the following commands generated the results above and will transform them into a list of active hosts for further analysis?

9. A penetration tester wants to validate the effectiveness of a DLP product by attempting exfiltration of data using email attachments.

Which of the following techniques should the tester select to accomplish this task?

10. A penetration tester is able to use a command injection vulnerability in a web application to get a reverse shell on a system.

After running a few commands, the tester runs the following:

python -c 'import pty; pty.spawn("/bin/bash")'

Which of the following actions Is the penetration tester performing?

11. Penetration tester has discovered an unknown Linux 64-bit executable binary.

Which of the following tools would be BEST to use to analyze this issue?

12. A penetration tester has extracted password hashes from the lsass.exe memory process.

Which of the following should the tester perform NEXT to pass the hash and provide persistence with the newly acquired credentials?

13. The results of an Nmap scan are as follows:

Starting Nmap 7.80 ( https://nmap.org ) at 2021-01-24 01:10 EST

Nmap scan report for ( 10.2.1.22 )

Host is up (0.0102s latency).

Not shown: 998 filtered ports

Port State Service

80/tcp open http

|_http-title: 80F 22% RH 1009.1MB (text/html)

|_http-slowloris-check:

| VULNERABLE:

| Slowloris DoS Attack

| <..>

Device type: bridge|general purpose

Running (JUST GUESSING) : QEMU (95%)

OS CPE: cpe:/a:qemu:qemu

No exact OS matches found for host (test conditions non-ideal).

OS detection performed. Please report any incorrect results at https://nmap.org/submit/. Nmap done: 1 IP address (1 host up) scanned in 107.45 seconds

Which of the following device types will MOST likely have a similar response? (Choose two.)

14. A red-team tester has been contracted to emulate the threat posed by a malicious insider on a company’s network, with the constrained objective of gaining access to sensitive personnel files. During the assessment, the red-team tester identifies an artifact indicating possible prior compromise within the target environment.

Which of the following actions should the tester take?

15. A company uses a cloud provider with shared network bandwidth to host a web application on dedicated servers. The company's contact with the cloud provider prevents any activities that would interfere with the cloud provider's other customers.

When engaging with a penetration-testing company to test the application, which of the following should the company avoid?

16. A penetration tester is testing a new API for the company's existing services and is preparing the following script:





Which of the following would the test discover?

17. A software company has hired a security consultant to assess the security of the company's software development practices. The consultant opts to begin reconnaissance by performing fuzzing on a software binary.

Which of the following vulnerabilities is the security consultant MOST likely to identify?

18. A company conducted a simulated phishing attack by sending its employees emails that included a link to a site that mimicked the corporate SSO portal. Eighty percent of the employees who received the email clicked the link and provided their corporate credentials on the fake site.

Which of the following recommendations would BEST address this situation?

19. A company hired a penetration-testing team to review the cyber-physical systems in a manufacturing plant. The team immediately discovered the supervisory systems and PLCs are both connected to the company intranet.

Which of the following assumptions, if made by the penetration-testing team, is MOST likely to be valid?

20. A company becomes concerned when the security alarms are triggered during a penetration test.

Which of the following should the company do NEXT?

21. During an engagement, a penetration tester found the following list of strings inside a file:





Which of the following is the BEST technique to determine the known plaintext of the strings?

22. A penetration tester gains access to a system and is able to migrate to a user process:





Given the output above, which of the following actions is the penetration tester performing? (Choose two.)

23. A consultant just performed a SYN scan of all the open ports on a remote host and now needs to remotely identify the type of services that are running on the host.

Which of the following is an active reconnaissance tool that would be BEST to use to accomplish this task?

24. A penetration tester analyzed a web-application log file and discovered an input that was sent to the company's web application. The input contains a string that says "WAITFOR."

Which of the following attacks is being attempted?

25. A penetration tester was able to compromise a server and escalate privileges.

Which of the following should the tester perform AFTER concluding the activities on the specified target? (Choose two.)

26. A penetration tester discovered that a client uses cloud mail as the company's email system. During the penetration test, the tester set up a fake cloud mail login page and sent all company employees an email that stated their inboxes were full and directed them to the fake login page to remedy the issue.

Which of the following BEST describes this attack?

27. A penetration tester is conducting an authorized, physical penetration test to attempt to enter a client's building during non-business hours.

Which of the following are MOST important for the penetration tester to have during the test? (Choose two.)

28. Which of the following would a company's hunt team be MOST interested in seeing in a final report?

29. A penetration tester is required to perform a vulnerability scan that reduces the likelihood of false positives and increases the true positives of the results.

Which of the following would MOST likely accomplish this goal?

30. Which of the following situations would require a penetration tester to notify the emergency contact for the engagement?

31. A penetration tester discovers that a web server within the scope of the engagement has already been compromised with a backdoor.

Which of the following should the penetration tester do NEXT?

32. A company that requires minimal disruption to its daily activities needs a penetration tester to perform information gathering around the company’s web presence.

Which of the following would the tester find MOST helpful in the initial information-gathering steps? (Choose two.)

33. A red team gained access to the internal network of a client during an engagement and used the Responder tool to capture important data.

Which of the following was captured by the testing team?

34. Which of the following can be used to store alphanumeric data that can be fed into scripts or programs as input to penetration-testing tools?

35. CORRECT TEXT

You are a penetration tester running port scans on a server.



INSTRUCTIONS

Part 1: Given the output, construct the command that was used to generate this output from the available options.

Part 2: Once the command is appropriately constructed, use the given output to identify the potential attack vectors that should be investigated further.

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

36. A penetration tester ran a ping CA command during an unknown environment test, and it returned a 128 TTL packet.

Which of the following OSs would MOST likely return a packet of this type?

37. A penetration tester needs to upload the results of a port scan to a centralized security tool.

Which of the following commands would allow the tester to save the results in an interchangeable format?

38. A penetration tester needs to access a building that is guarded by locked gates, a security team, and cameras.

Which of the following is a technique the tester can use to gain access to the IT framework without being detected?

39. A client wants a security assessment company to perform a penetration test against its hot site. The purpose of the test is to determine the effectiveness of the defenses that protect against disruptions to business continuity.

Which of the following is the MOST important action to take before starting this type of assessment?

40. Which of the following documents describes specific activities, deliverables, and schedules for a penetration tester?

41. During a penetration test, the domain names, IP ranges, hosts, and applications are defined in the:

42. Which of the following should a penetration tester consider FIRST when engaging in a penetration test in a cloud environment?

43. A company requires that all hypervisors have the latest available patches installed.

Which of the following would BEST explain the reason why this policy is in place?

44. A penetration tester conducts an Nmap scan against a target and receives the following results:





Which of the following should the tester use to redirect the scanning tools using TCP port 1080 on the target?

45. A customer adds a requirement to the scope of a penetration test that states activities can only occur during normal business hours.

Which of the following BEST describes why this would be necessary?

46. A penetration tester runs the following command on a system:

find / -user root Cperm -4000 Cprint 2>/dev/null

Which of the following is the tester trying to accomplish?

47. A penetration tester is conducting an assessment against a group of publicly available web servers and notices a number of TCP resets returning from one of the web servers.

Which of the following is MOST likely causing the TCP resets to occur during the assessment?

48. A penetration tester opened a reverse shell on a Linux web server and successfully escalated privileges to root. During the engagement, the tester noticed that another user logged in frequently as root to perform work tasks.

To avoid disrupting this user’s work, which of the following is the BEST option for the penetration tester to maintain root-level persistence on this server during the test?

49. A company has recruited a penetration tester to conduct a vulnerability scan over the network. The test is confirmed to be on a known environment.

Which of the following would be the BEST option to identify a system properly prior to performing the assessment?

50. Given the following script:





Which of the following BEST characterizes the function performed by lines 5 and 6?

51. In an unprotected network file repository, a penetration tester discovers a text file containing usernames and passwords in cleartext and a spreadsheet containing data for 50 employees, including full names, roles, and serial numbers. The tester realizes some of the passwords in the text file follow the format: .

Which of the following would be the best action for the tester to take NEXT with this information?

52. A penetration tester captured the following traffic during a web-application test:





Which of the following methods should the tester use to visualize the authorization information being transmitted?

53. A penetration tester ran the following command on a staging server:

python Cm SimpleHTTPServer 9891

Which of the following commands could be used to download a file named exploit to a target machine for execution?

54. A penetration tester completed an assessment, removed all artifacts and accounts created during the test, and presented the findings to the client.

Which of the following happens NEXT?

55. A penetration tester exploited a unique flaw on a recent penetration test of a bank. After the test was completed, the tester posted information about the exploit online along with the IP addresses of the exploited machines.

Which of the following documents could hold the penetration tester accountable for this action?

56. Which of the following is the MOST effective person to validate results from a penetration test?

57. Which of the following should a penetration tester attack to gain control of the state in the HTTP protocol after the user is logged in?

58. The delivery of a penetration test within an organization requires defining specific parameters regarding the nature and types of exercises that can be conducted and when they can be conducted.

Which of the following BEST identifies this concept?

59. A penetration tester was conducting a penetration test and discovered the network traffic was no longer reaching the client’s IP address. The tester later discovered the SOC had used sinkholing on the penetration tester’s IP address.

Which of the following BEST describes what happened?

60. CORRECT TEXT



SIMULATION

Using the output, identify potential attack vectors that should be further investigated.

61. A penetration tester receives the following results from an Nmap scan:





Which of the following OSs is the target MOST likely running?

62. Appending string values onto another string is called:

63. Which of the following tools provides Python classes for interacting with network protocols?

64. A compliance-based penetration test is primarily concerned with:

65. A penetration tester who is conducting a web-application test discovers a clickjacking vulnerability associated with a login page to financial data.

Which of the following should the tester do with this information to make this a successful exploit?

66. A penetration tester wants to identify CVEs that can be leveraged to gain execution on a Linux server that has an SSHD running.

Which of the following would BEST support this task?

67. A software development team is concerned that a new product's 64-bit Windows binaries can be deconstructed to the underlying code.

Which of the following tools can a penetration tester utilize to help the team gauge what an attacker might see in the binaries?

68. A company has hired a penetration tester to deploy and set up a rogue access point on the network.

Which of the following is the BEST tool to use to accomplish this goal?

69. A penetration tester attempted a DNS poisoning attack. After the attempt, no traffic was seen from the target machine.

Which of the following MOST likely caused the attack to fail?

70. A penetration tester has been given an assignment to attack a series of targets in the 192.168.1.0/24 range, triggering as few alarms and countermeasures as possible.

Which of the following Nmap scan syntaxes would BEST accomplish this objective?

71. After running the enum4linux.pl command, a penetration tester received the following output:





Which of the following commands should the penetration tester run NEXT?

72. Given the following code:





Which of the following data structures is systems?

73. DRAG DROP

You are a penetration tester reviewing a client’s website through a web browser.



INSTRUCTIONS

Review all components of the website through the browser to determine if vulnerabilities are present.

Remediate ONLY the highest vulnerability from either the certificate, source, or cookies.

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

74. An Nmap network scan has found five open ports with identified services.

Which of the following tools should a penetration tester use NEXT to determine if any vulnerabilities with associated exploits exist on the open ports?

75. A penetration tester who is doing a security assessment discovers that a critical vulnerability is being actively exploited by cybercriminals.

Which of the following should the tester do NEXT?

76. A final penetration test report has been submitted to the board for review and accepted. The report has three findings rated high.

Which of the following should be the NEXT step?

77. A security professional wants to test an IoT device by sending an invalid packet to a proprietary service listening on TCP port 3011.

Which of the following would allow the security professional to easily and programmatically manipulate the TCP header length and checksum using arbitrary numbers and to observe how the proprietary service responds?

78. A penetration tester, who is doing an assessment, discovers an administrator has been exfiltrating proprietary company information. The administrator offers to pay the tester to keep quiet.

Which of the following is the BEST action for the tester to take?

79. A penetration tester is testing input validation on a search form that was discovered on a website.

Which of the following characters is the BEST option to test the website for vulnerabilities?

80. A penetration tester has been hired to perform a physical penetration test to gain access to a secure room within a client’s building. Exterior reconnaissance identifies two entrances, a WiFi guest network, and multiple security cameras connected to the Internet.

Which of the following tools or techniques would BEST support additional reconnaissance?

81. A penetration tester ran the following commands on a Windows server:





Which of the following should the tester do AFTER delivering the final report?

82. Which of the following would MOST likely be included in the final report of a static application-security test that was written with a team of application developers as the intended audience?

83. A company is concerned that its cloud VM is vulnerable to a cyberattack and proprietary data may be stolen. A penetration tester determines a vulnerability does exist and exploits the vulnerability by adding a fake VM instance to the IaaS component of the client's VM.

Which of the following cloud attacks did the penetration tester MOST likely implement?

84. During a penetration-testing engagement, a consultant performs reconnaissance of a client to identify potential targets for a phishing campaign.

Which of the following would allow the consultant to retrieve email addresses for technical and billing contacts quickly, without triggering any of the client’s cybersecurity tools? (Choose two.)

85. A penetration tester is reviewing the following SOW prior to engaging with a client:

“Network diagrams, logical and physical asset inventory, and employees’ names are to be treated as client confidential. Upon completion of the engagement, the penetration tester will submit findings to the client’s Chief Information Security Officer (CISO) via encrypted protocols and subsequently dispose of all findings by erasing them in a secure manner.”

Based on the information in the SOW, which of the following behaviors would be considered unethical? (Choose two.)