BEST Verified CompTIA PT0-002 Exam Questions (2025)
The Best Practice Test Preparation for the PT0-002 Certification Exam
NEW QUESTION # 71
A company recently moved its software development architecture from VMs to containers. The company has asked a penetration tester to determine if the new containers are configured correctly against a DDoS attack. Which of the following should a tester perform first?
- A. Perform a vulnerability check against the hypervisor.
- B. .Scan the containers for open ports.
- C. Determine if security tokens are easily available.
- D. Test the strength of the encryption settings.
Answer: B
Explanation:
The first step that a tester should perform to determine if the new containers are configured correctly against a DDoS attack is to scan the containers for open ports. Open ports are entry points for network communication and can expose services or applications that may be vulnerable to DDoS attacks. Scanning the containers for open ports can help the tester identify which services or applications are running on the containers, and which ones may need to be secured or disabled to prevent DDoS attacks. Scanning the containers for open ports can also help the tester discover any unauthorized or malicious services or applications that may have been installed on the containers by previous attackers or compromised containers. Scanning the containers for open ports can be done by using tools such as Nmap, which can perform network scanning and enumeration by sending packets to hosts and analyzing their responses1. The other options are not the first steps that a tester should perform to determine if the new containers are configured correctly against a DDoS attack. Testing the strength of the encryption settings is not relevant to DDoS attacks, as encryption does not prevent or mitigate DDoS attacks, but rather protects data confidentiality and integrity. Determining if security tokens are easily available is not relevant to DDoS attacks, as security tokens are used for authentication and authorization, not for preventing or mitigating DDoS attacks. Performing a vulnerability check against the hypervisor is not relevant to DDoS attacks, as the hypervisor is not directly exposed to network traffic, but rather manages the virtual machines or containers that run on it.
NEW QUESTION # 72
A penetration tester is working on a scoping document with a new client. The methodology the client uses includes the following:
Pre-engagement interaction (scoping and ROE)
Intelligence gathering (reconnaissance)
Threat modeling
Vulnerability analysis
Exploitation and post exploitation
Reporting
Which of the following methodologies does the client use?
- A. PTES technical guidelines
- B. NIST SP 800-115
- C. OWASP Web Security Testing Guide
- D. OSSTMM
Answer: A
NEW QUESTION # 73
A new client hired a penetration-testing company for a month-long contract for various security assessments against the client's new service. The client is expecting to make the new service publicly available shortly after the assessment is complete and is planning to fix any findings, except for critical issues, after the service is made public. The client wants a simple report structure and does not want to receive daily findings.
Which of the following is most important for the penetration tester to define FIRST?
- A. Establish the threshold of risk to escalate to the client immediately.
- B. Establish the method of potential false positives.
- C. Establish the format required by the client.
- D. Establish the preferred day of the week for reporting.
Answer: A
NEW QUESTION # 74
A software development team is concerned that a new product's 64-bit Windows binaries can be deconstructed to the underlying code. Which of the following tools can a penetration tester utilize to help the team gauge what an attacker might see in the binaries?
- A. Drozer
- B. Immunity Debugger
- C. GDB
- D. OllyDbg
Answer: B
Explanation:
Explanation
Immunity Debugger is a tool that can be used to deconstruct 64-bit Windows binaries and see the underlying code. Immunity Debugger is a powerful debugger that integrates with Python and allows users to write their own scripts and plugins. It can be used for reverse engineering, malware analysis, vulnerability research, and exploit development
NEW QUESTION # 75
You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.
INSTRUCTIONS
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
Explanation:
1. Reflected XSS - Input sanitization (<> ...)
2. Sql Injection Stacked - Parameterized Queries
3. DOM XSS - Input Sanitization (<> ...)
4. Local File Inclusion - sandbox req
5. Command Injection - sandbox req
6. SQLi union - paramtrized queries
7. SQLi error - paramtrized queries
8. Remote File Inclusion - sandbox
9. Command Injection - input saniti $
10. URL redirect - prevent external calls
NEW QUESTION # 76
During enumeration, a red team discovered that an external web server was frequented by employees. After compromising the server, which of the following attacks would best support ------------company systems?
- A. A command injection attack
- B. A watering-hole attack
- C. A cross-site scripting attack
- D. Aside-channel attack
Answer: B
Explanation:
Explanation
The best attack that would support compromising company systems after compromising an external web server frequented by employees is a watering-hole attack, which is an attack that involves compromising a website that is visited by a specific group of users, such as employees of a target company, and injecting malicious code or content into the website that can infect or exploit the users' devices when they visit the website. A watering-hole attack can allow an attacker to compromise company systems by targeting their employees who frequent the external web server, and taking advantage of their trust or habit of visiting the website. A watering-hole attack can be performed by using tools such as BeEF, which is a tool that can hook web browsers and execute commands on them2. The other options are not likely attacks that would support compromising company systems after compromising an external web server frequented by employees. A side-channel attack is an attack that involves exploiting physical characteristics or implementation flaws of a system or device, such as power consumption, electromagnetic radiation, timing, or sound, to extract sensitive information or bypass security mechanisms. A command injection attack is an attack that exploits a vulnerability in a system or application that allows an attacker to execute arbitrary commands on the underlying OS or shell. A cross-site scripting attack is an attack that exploits a vulnerability in a web application that allows an attacker to inject malicious scripts into web pages that are viewed by other users.
NEW QUESTION # 77
A penetration tester has been hired to configure and conduct authenticated scans of all the servers on a software company's network. Which of the following accounts should the tester use to return the MOST results?
- A. Service
- B. Root user
- C. Network administrator
- D. Local administrator
Answer: A
NEW QUESTION # 78
A penetration tester has extracted password hashes from the lsass.exe memory process. Which of the following should the tester perform NEXT to pass the hash and provide persistence with the newly acquired credentials?
- A. Use a bind shell to pass the hash and WMI for persistence.
- B. Use Hashcat to pass the hash and Empire for persistence.
- C. Use Mimikatz to pass the hash and PsExec for persistence.
- D. Use Patator to pass the hash and Responder for persistence.
Answer: C
Explanation:
Mimikatz is a credential hacking tool that can be used to extract logon passwords from the LSASS process and pass them to other systems. Once the tester has the hashes, they can then use PsExec, a command-line utility from Sysinternals, to pass the hash to the remote system and authenticate with the new credentials. This provides the tester with persistence on the system, allowing them to access it even after a reboot.
"A penetration tester who has extracted password hashes from the lsass.exe memory process can use various tools to pass the hash and gain access to other systems using the same credentials. One tool commonly used for this purpose is Mimikatz, which can extract plaintext passwords from memory or provide a pass-the-hash capability. After gaining access to a system, the tester can use various tools for persistence, such as PsExec or WMI." (CompTIA PenTest+ Study Guide, p. 186)
NEW QUESTION # 79
Given the following code:
Which of the following data structures is systems?
- A. A tree
- B. A dictionary
- C. An array
- D. A tuple
Answer: B
Explanation:
A dictionary is a data structure in Python that stores key-value pairs, where each key is associated with a value. A dictionary is created by enclosing the key-value pairs in curly braces and separating them by commas.
A dictionary can be accessed by using the keys as indexes or by using methods such as keys(), values(), or items(). In the code, systems is a dictionary that has four key-value pairs, each representing an IP address and its corresponding operating system. A tuple is a data structure in Python that stores an ordered sequence of immutable values, enclosed in parentheses and separated by commas. A tree is a data structure that consists of nodes connected by edges, forming a hierarchical structure with a root node and leaf nodes. An array is a data structure that stores a collection of elements of the same type in a contiguous memory location.
NEW QUESTION # 80
During a vulnerability scanning phase, a penetration tester wants to execute an Nmap scan using custom NSE scripts stored in the following folder:
/home/user/scripts
Which of the following commands should the penetration tester use to perform this scan?
- A. nmap -load /home/user/scripts
- B. nmap resume "not intrusive"
- C. nmap script default safe
- D. nmap script /home/user/scripts
Answer: D
Explanation:
The Nmap command in the question aims to use custom NSE scripts stored in a specific folder. The correct syntax for this option is to use the script argument followed by the path to the folder. The other commands are either invalid, use the wrong argument, or do not specify the folder path. References: Best PenTest+ certification study resources and training materials, CompTIA PenTest+ PT0-002 Cert Guide, 101 Labs - CompTIA PenTest+: Hands-on Labs for the PT0-002 Exam
NEW QUESTION # 81
A penetration tester ran the following commands on a Windows server:
Which of the following should the tester do AFTER delivering the final report?
- A. Close the reverse shell connection.
- B. Delete the scheduled batch job.
- C. Downgrade the svsaccount permissions.
- D. Remove the tester-created credentials.
Answer: D
NEW QUESTION # 82
A penetration tester learned that when users request password resets, help desk analysts change users' passwords to 123change. The penetration tester decides to brute force an internet-facing webmail to check which users are still using the temporary password. The tester configures the brute-force tool to test usernames found on a text file and the... Which of the following techniques is the penetration tester using?
- A. Kerberoasting
- B. Password brute force attack
- C. Password spraying
- D. SQL injection
Answer: B
Explanation:
Explanation
The penetration tester is using a password brute force attack, which is a type of password guessing attack that involves trying many possible combinations of passwords against a single username or account. A password brute force attack can be effective when the password is known to be weak, simple, or predictable, such as a default or temporary password. In this case, the penetration tester knows that the help desk analysts change users' passwords to 123change when they request password resets, and decides to brute force the webmail with this password and a list of usernames. A password brute force attack can be done by using tools such as Hydra, which can perform parallelized login attacks against various protocols and services1. The other options are not techniques that the penetration tester is using. SQL injection is a type of attack that exploits a vulnerability in a web application that allows an attacker to execute malicious SQL statements on a database server. Password spraying is a type of password guessing attack that involves trying one or a few common passwords against many usernames or accounts. Kerberoasting is a type of attack that exploits a vulnerability in the Kerberos authentication protocol that allows an attacker to request and crack service tickets for service accounts with weak passwords.
NEW QUESTION # 83
Which of the following expressions in Python increase a variable val by one (Choose two.)
- A. val=(val+1)
- B. val+=1
- C. val++
- D. ++val
- E. +val
- F. val=val++
Answer: A,B
Explanation:
Explanation
https://pythonguides.com/increment-and-decrement-operators-in-python/
NEW QUESTION # 84
A penetration tester receives the following results from an Nmap scan:
Which of the following OSs is the target MOST likely running?
- A. Arch Linux
- B. Windows Server
- C. Ubuntu
- D. CentOS
Answer: B
NEW QUESTION # 85
A client would like to have a penetration test performed that leverages a continuously updated TTPs framework and covers a wide variety of enterprise systems and networks. Which of the following methodologies should be used to BEST meet the client's expectations?
- A. The Diamond Model of Intrusion Analysis
- B. MITRE ATT&CK framework
- C. NIST Cybersecurity Framework
- D. OWASP Top 10
Answer: B
Explanation:
The MITRE ATT&CK framework is a methodology that should be used to best meet the client's expectations. The MITRE ATT&CK framework is a knowledge base of adversary tactics, techniques, and procedures (TTPs) that are continuously updated based on real-world observations. The framework covers a wide variety of enterprise systems and networks, such as Windows, Linux, macOS, cloud, mobile, and network devices. The framework can help the penetration tester to emulate realistic threats and identify gaps in defenses.
NEW QUESTION # 86
A penetration tester has prepared the following phishing email for an upcoming penetration test:
Which of the following is the penetration tester using MOST to influence phishing targets to click on the link?
- A. Familiarity and likeness
- B. Social proof and greed
- C. Authority and urgency
- D. Scarcity and fear
Answer: C
NEW QUESTION # 87
Company.com has hired a penetration tester to conduct a phishing test. The tester wants to set up a fake log-in page and harvest credentials when target employees click on links in a phishing email. Which of the following commands would best help the tester determine which cloud email provider the log-in page needs to mimic?
- A. dig company.com A
- B. cur1 www.company.com
- C. dig company.com MX
- D. whois company.com
Answer: C
Explanation:
Explanation
The dig command is a tool that can be used to query DNS servers and obtain information about domain names, such as IP addresses, mail servers, name servers, or other records. The MX option specifies that the query is for mail exchange records, which are records that indicate the mail servers responsible for accepting email messages for a domain. Therefore, the command dig company.com MX would best help the tester determine which cloud email provider the log-in page needs to mimic by showing the mail servers for company.com. For example, if the output shows something like company-com.mail.protection.outlook.com, then it means that company.com uses Microsoft Outlook as its cloud email provider. The other commands are not as useful for determining the cloud email provider. The whois command is a tool that can be used to query domain name registration information, such as the owner, registrar, or expiration date of a domain. The curl command is a tool that can be used to transfer data from or to a server using various protocols, such as HTTP, FTP, or SMTP. The dig command with the A option specifies that the query is for address records, which are records that map domain names to IP addresses.
NEW QUESTION # 88
A penetration tester is required to perform a vulnerability scan that reduces the likelihood of false positives and increases the true positives of the results. Which of the following would MOST likely accomplish this goal?
- A. Using Nmap as the root user
- B. Using Nessus with credentials
- C. Using OWASP ZAP
- D. Using OpenVAS in default mode
Answer: B
Explanation:
Using credentials during a vulnerability scan allows the scanner to gather more detailed information about the target system, including installed software, patch levels, and configuration settings. This helps to reduce the likelihood of false positives and increase the true positives of the results. Nessus is a popular vulnerability scanner that supports credential-based scanning and can be used to accomplish this goal. OpenVAS and Nmap are also popular scanning tools, but using default mode or running as the root user alone may not provide the necessary level of detail for accurate vulnerability identification. OWASP ZAP is a web application scanner and may not be applicable for non-web-based targets.
NEW QUESTION # 89
Which of the following provides a matrix of common tactics and techniques used by attackers along with recommended mitigations?
- A. NIST SP 800-53
- B. MITRE ATT&CK framework
- C. OWASP Top 10
- D. PTES technical guidelines
Answer: B
Explanation:
Reference: https://digitalguardian.com/blog/what-mitre-attck-framework
NEW QUESTION # 90
A penetration-testing team needs to test the security of electronic records in a company's office. Per the terms of engagement, the penetration test is to be conducted after hours and should not include circumventing the alarm or performing destructive entry. During outside reconnaissance, the team sees an open door from an adjoining building. Which of the following would be allowed under the terms of the engagement?
- A. Presenting a false employee ID to the night guard
- B. Prying the lock open on the records room
- C. Obstructing the motion sensors in the hallway of the records room
- D. Climbing in an open window of the adjoining building
Answer: A
Explanation:
Explanation
"to be conducted after hours and should not include circumventing the alarm or performing destructive entry"
NEW QUESTION # 91
In the process of active service enumeration, a penetration tester identifies an SMTP daemon running on one of the target company's servers. Which of the following actions would BEST enable the tester to perform phishing in a later stage of the assessment?
- A. Perform a reverse DNS query and match to the service banner.
- B. Test for RFC-defined protocol conformance.
- C. Attempt to brute force authentication to the service.
- D. Check for an open relay configuration.
Answer: A
NEW QUESTION # 92
......
PT0-002 Exam Dumps, Practice Test Questions BUNDLE PACK: https://www.testinsides.top/PT0-002-dumps-review.html
CompTIA PenTest+ Certification PT0-002 Sample Questions Reliable: https://drive.google.com/open?id=1wk41BcBLwCIcRFdMsWmRCwUYHx_j5kMK