Updated Feb-2024 100% Cover Real PT0-002 Exam Questions - 100% Pass Guarantee
Use Real CompTIA Dumps - 100% Free PT0-002 Exam Dumps
CompTIA PT0-002 certification exam is vendor-neutral, which means that it is not tied to any particular product, technology, or manufacturer. It makes the certification valuable as it tests the candidate's abilities to apply the concepts and practices of penetration testing regardless of the employed technologies. Moreover, it opens up various job opportunities across different industries as this certification is widely recognized worldwide.
NEW QUESTION # 101
A penetration tester created the following script to use in an engagement:
However, the tester is receiving the following error when trying to run the script:
Which of the following is the reason for the error?
- A. The sys module was not imported.
- B. The sys variable was not defined.
- C. The argv module was not imported.
- D. The argv variable was not defined.
Answer: B
NEW QUESTION # 102
A penetration tester is preparing to perform activities for a client that requires minimal disruption to company operations. Which of the following are considered passive reconnaissance tools? (Choose two.)
- A. Shodan
- B. Retina
- C. Nikto
- D. Nessus
- E. Burp Suite
- F. Wireshark
Answer: A,F
Explanation:
Explanation
Wireshark and Shodan are two tools that can be used to perform passive reconnaissance, which means collecting information from publicly available sources without interacting with the target or revealing one's identity. Wireshark is a tool that can be used to capture and analyze network traffic, such as packets, protocols, or sessions, without sending any data to the target. Shodan is a tool that can be used to search for devices or services on the internet, such as web servers, routers, cameras, or firewalls, without contacting them directly.
The other tools are not passive reconnaissance tools, but rather active reconnaissance tools, which means interacting with the target or sending data to it. Nessus and Retina are tools that can be used to perform vulnerability scanning, which involves sending probes or requests to the target and analyzing its responses for potential weaknesses. Burp Suite is a tool that can be used to perform web application testing, which involves intercepting and modifying web requests and responses between the browser and the server.
NEW QUESTION # 103
For a penetration test engagement, a security engineer decides to impersonate the IT help desk. The security engineer sends a phishing email containing an urgent request for users to change their passwords and a link to
https://example.com/index.html. The engineer has designed the attack so that once the users enter the credentials, the index.html page takes the credentials and then forwards them to another server that the security engineer is controlling. Given the following information:
Which of the following lines of code should the security engineer add to make the attack successful?
- A. window.location.= 'https://evilcorp.com'
- B. crossDomain: true
- C. geturlparameter ('username')
- D. redirectUrl = 'https://example.com'
Answer: B
NEW QUESTION # 104
A penetration tester runs the unshadow command on a machine. Which of the following tools will the tester most likely use NEXT?
- A. Cain and Abel
- B. Hydra
- C. John the Ripper
- D. Mimikatz
Answer: C
NEW QUESTION # 105
A penetration tester was brute forcing an internal web server and ran a command that produced the following output:
However, when the penetration tester tried to browse the URL http://172.16.100.10:3000/profile, a blank page was displayed.
Which of the following is the MOST likely reason for the lack of output?
- A. This URI returned a server error.
- B. The web server is using HTTPS instead of HTTP.
- C. The tester did not run sudo before the command.
- D. The HTTP port is not open on the firewall.
Answer: D
NEW QUESTION # 106
After running the enum4linux.pl command, a penetration tester received the following output:
Which of the following commands should the penetration tester run NEXT?
- A. smbclient //192.168.100.56/web -U '' -N
- B. smbspool //192.160.100.56/print$
- C. net rpc share -S 192.168.100.56 -U ''
- D. smbget //192.168.100.56/web -U ''
Answer: A
Explanation:
Explanation
A vulnerability scan is a type of assessment that helps to identify vulnerabilities in a network or system. It scans systems for potential vulnerabilities, misconfigurations, and outdated software. Based on the output from a vulnerability scan, a penetration tester can identify vulnerabilities that may be exploited to gain access to a system. In this scenario, the output from the penetration testing tool shows that 100 hosts contained findings due to improper patch management. This indicates that the vulnerability scan detected vulnerabilities that could have been prevented through proper patch management. Therefore, the most likely test performed by the penetration tester is a vulnerability scan.
NEW QUESTION # 107
Given the following script:
Which of the following BEST characterizes the function performed by lines 5 and 6?
- A. Retrieves the start-of-authority information for the zone on DNS server 10.10.10.10
- B. Loops through variable b to count the results returned for the DNS query and prints that count to screen
- C. Performs a single DNS query for www.comptia.org and prints the raw data output
- D. Prints each DNS query result already stored in variable b
Answer: D
NEW QUESTION # 108
A company hired a penetration-testing team to review the cyber-physical systems in a manufacturing plant.
The team immediately discovered the supervisory systems and PLCs are both connected to the company intranet. Which of the following assumptions, if made by the penetration-testing team, is MOST likely to be valid?
- A. PLCs will not act upon commands injected over the network.
- B. Supervisory systems will detect a malicious injection of code/commands.
- C. Controllers will not validate the origin of commands.
- D. Supervisors and controllers are on a separate virtual network by default.
Answer: C
NEW QUESTION # 109
A penetration tester discovers during a recent test that an employee in the accounting department has been making changes to a payment system and redirecting money into a personal bank account. The penetration test was immediately stopped. Which of the following would be the BEST recommendation to prevent this type of activity in the future?
- A. Enforce mandatory employee vacations
- B. Implement multifactor authentication
- C. Encrypt passwords for bank account information
- D. Install video surveillance equipment in the office
Answer: B
NEW QUESTION # 110
During a penetration test, a tester is in close proximity to a corporate mobile device belonging to a network administrator that is broadcasting Bluetooth frames.
Which of the following is an example of a Bluesnarfing attack that the penetration tester can perform?
- A. Break a connection between two Bluetooth devices.
- B. Dump the user address book on the device.
- C. Sniff and then crack the WPS PIN on an associated WiFi device.
- D. Transmit text messages to the device.
Answer: B
Explanation:
Explanation
Bluesnarfing is the unauthorized access of information from a wireless device through a Bluetooth connection, often between phones, desktops, laptops, and PDAs. This allows access to calendars, contact lists, emails and text messages, and on some phones, users can copy pictures and private videos.
NEW QUESTION # 111
Appending string values onto another string is called:
- A. conjunction
- B. compilation
- C. concatenation
- D. connection
Answer: C
Explanation:
Explanation
Concatenation is the term used to describe the process of appending string values onto another string. In Python, concatenation can be done using the + operator, such as "Hello" + "World" = "HelloWorld"4.
NEW QUESTION # 112
A security professional wants to test an IoT device by sending an invalid packet to a proprietary service listening on TCP port 3011. Which of the following would allow the security professional to easily and programmatically manipulate the TCP header length and checksum using arbitrary numbers and to observe how the proprietary service responds?
- A. Scapy
- B. tcpdump
- C. Nmap
- D. hping3
Answer: C
NEW QUESTION # 113
A penetration tester has obtained shell access to a Windows host and wants to run a specially crafted binary for later execution using the wmic.exe process call create function. Which of the following OS or filesystem mechanisms is MOST likely to support this objective?
- A. MP4 steganography
- B. Alternate data streams
- C. PsExec
- D. PowerShell modules
Answer: D
Explanation:
"Windows Management Instrumentation (WMI) is a subsystem of PowerShell that gives admins access to powerful system monitoring tools."
NEW QUESTION # 114
A penetration tester has gained access to a network device that has a previously unknown IP range on an interface. Further research determines this is an always-on VPN tunnel to a third-party supplier.
Which of the following is the BEST action for the penetration tester to take?
- A. Stop the assessment and inform the emergency contact.
- B. Utilize the tunnel as a means of pivoting to other internal devices.
- C. Scan the IP range for additional systems to exploit.
- D. Disregard the IP range, as it is out of scope.
Answer: C
NEW QUESTION # 115
A penetration tester wants to validate the effectiveness of a DLP product by attempting exfiltration of data using email attachments. Which of the following techniques should the tester select to accomplish this task?
- A. Steganography
- B. Metadata removal
- C. Encode64
- D. Encryption
Answer: A
NEW QUESTION # 116
Which of the following should a penetration tester consider FIRST when engaging in a penetration test in a cloud environment?
- A. Whether the country where the cloud service is based has any impeding laws
- B. Whether the cloud service provider allows the penetration tester to test the environment
- C. Whether the specific cloud services are being used by the application
- D. The geographical location where the cloud services are running
Answer: D
Explanation:
Section: (none)
Explanation
NEW QUESTION # 117
A consultant is reviewing the following output after reports of intermittent connectivity issues:
? (192.168.1.1) at 0a:d1:fa:b1:01:67 on en0 ifscope [ethernet]
? (192.168.1.12) at 34:a4:be:09:44:f4 on en0 ifscope [ethernet]
? (192.168.1.17) at 92:60:29:12:ac:d2 on en0 ifscope [ethernet]
? (192.168.1.34) at 88:de:a9:12:ce:fb on en0 ifscope [ethernet]
? (192.168.1.136) at 0a:d1:fa:b1:01:67 on en0 ifscope [ethernet]
? (192.168.1.255) at ff:ff:ff:ff:ff:ff on en0 ifscope [ethernet]
? (224.0.0.251) at 01:02:5e:7f:ff:fa on en0 ifscope permanent [ethernet]
? (239.255.255.250) at ff:ff:ff:ff:ff:ff on en0 ifscope permanent [ethernet] Which of the following is MOST likely to be reported by the consultant?
- A. A device on the network has poisoned the ARP cache.
- B. A device on the network has an IP address in the wrong subnet.
- C. An ARP flooding attack is using the broadcast address to perform DDoS.
- D. A multicast session was initiated using the wrong multicast group.
Answer: D
NEW QUESTION # 118
A penetration tester who is doing a company-requested assessment would like to send traffic to another system using double tagging. Which of the following techniques would BEST accomplish this goal?
- A. Tag nesting
- B. RFID cloning
- C. RFID tagging
- D. Meta tagging
Answer: A
Explanation:
since vlan hopping requires 2 vlans to be nested in a single packet. Double tagging occurs when an attacker adds and modifies tags on an Ethernet frame to allow the sending of packets through any VLAN. This attack takes advantage of how many switches process tags. Most switches will only remove the outer tag and forward the frame to all native VLAN ports. With that said, this exploit is only successful if the attacker belongs to the native VLAN of the trunk link. https://cybersecurity.att.com/blogs/security-essentials/vlan-hopping-and-mitigation
NEW QUESTION # 119
Using the output, identify potential attack vectors that should be further investigated.
Answer:
Explanation:
1: Null session enumeration
Weak SMB file permissions
Fragmentation attack
2: nmap
-sV
-p 1-1023
192.168.2.2
3: #!/usr/bin/python
export $PORTS = 21,22
for $PORT in $PORTS:
try:
s.connect((ip, port))
print("%s:%s - OPEN" % (ip, port))
except socket.timeout
print("%:%s - TIMEOUT" % (ip, port))
except socket.error as e:
print("%:%s - CLOSED" % (ip, port))
finally
s.close()
port_scan(sys.argv[1], ports)
NEW QUESTION # 120
The results of an Nmap scan are as follows:
Starting Nmap 7.80 ( https://nmap.org ) at 2021-01-24 01:10 EST
Nmap scan report for ( 10.2.1.22 )
Host is up (0.0102s latency).
Not shown: 998 filtered ports
Port State Service
80/tcp open http
|_http-title: 80F 22% RH 1009.1MB (text/html)
|_http-slowloris-check:
| VULNERABLE:
| Slowloris DoS Attack
| <..>
Device type: bridge|general purpose
Running (JUST GUESSING) : QEMU (95%)
OS CPE: cpe:/a:qemu:qemu
No exact OS matches found for host (test conditions non-ideal).
OS detection performed. Please report any incorrect results at https://nmap.org/submit/.
Nmap done: 1 IP address (1 host up) scanned in 107.45 seconds
Which of the following device types will MOST likely have a similar response? (Choose two.)
- A. Network device
- B. IoT/embedded device
- C. Print queue
- D. Public-facing web server
- E. Exposed RDP
- F. Active Directory domain controller
Answer: B,D
Explanation:
Explanation
https://www.netscout.com/what-is-ddos/slowloris-attacks
From the http-title in the output, this looks like an IoT device with RH implying Relative Humidity, that offers a web-based interface for visualizing the results.
NEW QUESTION # 121
A penetration tester is scanning a corporate lab network for potentially vulnerable services. Which of the following Nmap commands will return vulnerable ports that might be interesting to a potential attacker?
- A. nmap192.168.1.1-5-PU22-25,80
- B. nmap192.168.1.1-5-Ss22-25,80
- C. nmap192.168.1.1-5-PS22-25,80
- D. nmap192.168.1.1-5-PA22-25,80
Answer: C
NEW QUESTION # 122
......
PT0-002 Dumps PDF - PT0-002 Real Exam Questions Answers: https://www.testinsides.top/PT0-002-dumps-review.html
Realistic PT0-002 Dumps Latest Practice Tests Dumps: https://drive.google.com/open?id=1IjJLoVTZhphiBV8epSzzmPAe2sn7zmwd