[May-2024] PT0-002 Dumps are Available for Instant Access using DumpsTorrent
PT0-002 Dumps 2024 - New CompTIA PT0-002 Exam Questions
CompTIA PenTest+ certification exam is recommended for individuals who have experience in information security, networking, and vulnerability management. PT0-002 exam is ideal for professionals like security analysts, penetration testers, ethical hackers, network security engineers, and information security managers. CompTIA PenTest+ Certification certification validates their knowledge and skillset, which can help them advance their careers and increase their earning potential. Obtaining the CompTIA PenTest+ certification can open doors to a wide range of job opportunities in various industries, including finance, healthcare, and government agencies.
NEW QUESTION # 90
During an assessment, a penetration tester was able to access the organization's wireless network from outside of the building using a laptop running Aircrack-ng. Which of the following should be recommended to the client to remediate this issue?
- A. Using WEP encryption
- B. Changing to Wi-Fi equipment that supports strong encryption
- C. Using directional antennae
- D. Disabling Wi-Fi
Answer: B
Explanation:
Explanation
If a penetration tester was able to access the organization's wireless network from outside of the building using Aircrack-ng, then it means that the wireless network was not secured with strong encryption or authentication methods. Aircrack-ng is a tool that can crack weak wireless encryption schemes such as WEP or WPA-PSK using various techniques such as packet capture, injection, replay, and brute force. To remediate this issue, the client should change to Wi-Fi equipment that supports strong encryption such as WPA2 or WPA3, which are more resistant to cracking attacks. Using directional antennae may reduce the signal range of the wireless network, but it would not prevent an attacker who is within range from cracking the encryption.
Using WEP encryption is not a good recommendation, as WEP is known to be insecure and vulnerable to Aircrack-ng attacks. Disabling Wi-Fi may eliminate the risk of wireless attacks, but it would also eliminate the benefits of wireless connectivity for the organization.
NEW QUESTION # 91
The results of an Nmap scan are as follows:
Starting Nmap 7.80 ( https://nmap.org ) at 2021-01-24 01:10 EST
Nmap scan report for ( 10.2.1.22 )
Host is up (0.0102s latency).
Not shown: 998 filtered ports
Port State Service
80/tcp open http
|_http-title: 80F 22% RH 1009.1MB (text/html)
|_http-slowloris-check:
| VULNERABLE:
| Slowloris DoS Attack
| <..>
Device type: bridge|general purpose
Running (JUST GUESSING) : QEMU (95%)
OS CPE: cpe:/a:qemu:qemu
No exact OS matches found for host (test conditions non-ideal).
OS detection performed. Please report any incorrect results at https://nmap.org/submit/.
Nmap done: 1 IP address (1 host up) scanned in 107.45 seconds
Which of the following device types will MOST likely have a similar response? (Choose two.)
- A. Active Directory domain controller
- B. Public-facing web server
- C. Network device
- D. Exposed RDP
- E. Print queue
- F. IoT/embedded device
Answer: B,F
Explanation:
Explanation
https://www.netscout.com/what-is-ddos/slowloris-attacks
From the http-title in the output, this looks like an IoT device with RH implying Relative Humidity, that offers a web-based interface for visualizing the results.
NEW QUESTION # 92
A penetration tester has obtained shell access to a Windows host and wants to run a specially crafted binary for later execution using the wmic.exe process call create function. Which of the following OS or filesystem mechanisms is MOST likely to support this objective?
- A. PsExec
- B. MP4 steganography
- C. PowerShell modules
- D. Alternate data streams
Answer: A
NEW QUESTION # 93
A penetration tester discovered a vulnerability that provides the ability to upload to a path via directory traversal. Some of the files that were discovered through this vulnerability are:
Which of the following is the BEST method to help an attacker gain internal access to the affected machine?
- A. Edit the discovered file with one line of code for remote callback
- B. Download the smb.conf file and look at configurations
- C. Download .pl files and look for usernames and passwords
- D. Edit the smb.conf file and upload it to the server
Answer: D
NEW QUESTION # 94
A penetration tester discovers during a recent test that an employee in the accounting department has been making changes to a payment system and redirecting money into a personal bank account. The penetration test was immediately stopped. Which of the following would be the BEST recommendation to prevent this type of activity in the future?
- A. Encrypt passwords for bank account information
- B. Install video surveillance equipment in the office
- C. Implement multifactor authentication
- D. Enforce mandatory employee vacations
Answer: D
Explanation:
Explanation
If the employee already works in the accounting department, MFA will not stop their actions because they'll already have access by virtue of their job.
Enforcing mandatory employee vacations is the best recommendation to prevent this type of activity in the future, as it will make it harder for an employee to conceal fraudulent transactions or unauthorized changes to a payment system. Mandatory employee vacations are a form of internal control that requires employees to take time off from work periodically and have their duties performed by someone else. This can help detect errors, irregularities, or frauds committed by employees who might otherwise have exclusive access or control over certain processes or systems.
NEW QUESTION # 95
A penetration tester is scanning a corporate lab network for potentially vulnerable services. Which of the following Nmap commands will return vulnerable ports that might be interesting to a potential attacker?
- A. nmap192.168.1.1-5-PS22-25,80
- B. nmap192.168.1.1-5-PU22-25,80
- C. nmap192.168.1.1-5-PA22-25,80
- D. nmap192.168.1.1-5-Ss22-25,80
Answer: A
NEW QUESTION # 96
During an assessment, a penetration tester manages to exploit an LFI vulnerability and browse the web log for a target Apache server. Which of the following steps would the penetration tester most likely try NEXT to further exploit the web server? (Choose two.)
- A. Log poisoning
- B. SQL injection
- C. Cross-site scripting
- D. Server-side request forgery
- E. Cross-site request forgery
- F. Command injection
Answer: A,F
Explanation:
Explanation
Local File Inclusion (LFI) is a web vulnerability that allows an attacker to include files on a server through the web browser. This can expose sensitive information or lead to remote code execution.
Some possible next steps that a penetration tester can try after exploiting an LFI vulnerability are:
* Log poisoning: This involves injecting malicious code into the web server's log files and then including them via LFI to execute the code
* PHP wrappers: These are special streams that can be used to manipulate files or data via LFI. For example, php://input can be used to pass arbitrary data to an LFI script, or php://filter can be used to encode or decode files5.
NEW QUESTION # 97
A penetration tester discovered a code repository and noticed passwords were hashed before they were stored in the database with the following code? salt = '123' hash = hashlib.pbkdf2_hmac('sha256', plaintext, salt,
10000) The tester recommended the code be updated to the following salt = os.urandom(32) hash = hashlib.pbkdf2_hmac('sha256', plaintext, salt, 10000) Which of the following steps should the penetration tester recommend?
- A. Changing passwords that were created before this code update
- B. Rehashing all old passwords with the new code
- C. Keeping hashes created by both methods for compatibility
- D. Replacing the SHA-256 algorithm to something more secure
Answer: A
Explanation:
The penetration tester recommended the code be updated to use a random salt instead of a fixed salt for hashing passwords. A salt is a random value that is added to the plaintext password before hashing it, to prevent attacks such as rainbow tables or dictionary attacks that rely on precomputed hashes of common or weak passwords. A random salt ensures that each password hash is unique and unpredictable, even if two users have the same password. However, changing the salt does not affect the existing hashes that were created with the old salt, which may still be vulnerable to attacks. Therefore, the penetration tester should recommend changing passwords that were created before this code update, so that they can be hashed with the new salt and be more secure. The other options are not valid steps that the penetration tester should recommend. Keeping hashes created by both methods for compatibility would defeat the purpose of updating the code, as it would leave some hashes vulnerable to attacks. Rehashing all old passwords with the new code would not work, as it would require knowing the plaintext passwords, which are not stored in the database. Replacing the SHA-256 algorithm to something more secure is not necessary, as SHA-256 is a secure and widely used hashing algorithm that has no known vulnerabilities or collisions.
NEW QUESTION # 98
A penetration tester wants to identify CVEs that can be leveraged to gain execution on a Linux server that has an SSHD running. Which of the following would BEST support this task?
- A. Run nmap with the -sA option set against the target
- B. Run nmap with the -o, -p22, and -sC options set against the target
- C. Run nmap with the -sV and -p22 options set against the target
- D. Run nmap with the --script vulners option set against the target
Answer: A
NEW QUESTION # 99
The following line-numbered Python code snippet is being used in reconnaissance:
Which of the following line numbers from the script MOST likely contributed to the script triggering a "probable port scan" alert in the organization's IDS?
- A. Line 02
- B. Line 01
- C. Line 07
- D. Line 08
Answer: B
NEW QUESTION # 100
A penetration tester finds a PHP script used by a web application in an unprotected internal source code repository. After reviewing the code, the tester identifies the following:
Which of the following tools will help the tester prepare an attack for this scenario?
- A. Nmap and OWASP ZAP
- B. Hydra and crunch
- C. Burp Suite and DIRB
- D. Netcat and cURL
Answer: C
NEW QUESTION # 101
A penetration tester has established an on-path attack position and must now specially craft a DNS query response to be sent back to a target host. Which of the following utilities would BEST support this objective?
- A. Scapy
- B. dig
- C. Socat
- D. tcpdump
Answer: C
NEW QUESTION # 102
An Nmap scan of a network switch reveals the following:
Which of the following technical controls will most likely be the FIRST recommendation for this device?
- A. System-hardening techniques
- B. Network segmentation
- C. Multifactor authentication
- D. Encrypted passwords
Answer: A
NEW QUESTION # 103
A penetration tester successfully performed an exploit on a host and was able to hop from VLAN 100 to VLAN 200. VLAN 200 contains servers that perform financial transactions, and the penetration tester now wants the local interface of the attacker machine to have a static ARP entry in the local cache. The attacker machine has the following:
IP Address: 192.168.1.63
Physical Address: 60-36-dd-a6-c5-33
Which of the following commands would the penetration tester MOST likely use in order to establish a static ARP entry successfully?
- A. tcpdump -i eth01 arp and arp[6:2] == 2
- B. arp -s 192.168.1.63 60-36-DD-A6-C5-33
- C. ipconfig /all findstr /v 00-00-00 | findstr Physical
- D. route add 192.168.1.63 mask 255.255.255.255.0 192.168.1.1
Answer: B
Explanation:
The arp command is used to manipulate or display the Address Resolution Protocol (ARP) cache, which is a table that maps IP addresses to physical addresses (MAC addresses) on a network. The -s option is used to add a static ARP entry to the cache, which means that it will not expire or be overwritten by dynamic ARP entries. The syntax for adding a static ARP entry is arp -s <IP address> <physical address>. Therefore, the command arp -s 192.168.1.63 60-36-DD-A6-C5-33 would add a static ARP entry for the IP address 192.168.1.63 and the physical address 60-36-DD-A6-C5-33 to the local cache of the attacker machine. This would allow the attacker machine to communicate with the target machine without relying on ARP requests or replies. The other commands are not valid or useful for establishing a static ARP entry.
NEW QUESTION # 104
A penetration tester is testing a new API for the company's existing services and is preparing the following script:
Which of the following would the test discover?
- A. Default web configurations
- B. Open web ports on a host
- C. Supported HTTP methods
- D. Listening web servers in a domain
Answer: C
Explanation:
The script is using the requests library to send an OPTIONS request to the API endpoint, which returns a list of supported HTTP methods for that resource. This can help the penetration tester to identify potential attack vectors or vulnerabilities based on the methods allowed.
NEW QUESTION # 105
In Python socket programming, SOCK_DGRAM type is:
- A. connectionless.
- B. matrixed.
- C. reliable.
- D. slower.
Answer: A
Explanation:
Connectionless due to the Datagram portion mentioned so that would mean its using UDP.
NEW QUESTION # 106
During an assessment, a penetration tester found a suspicious script that could indicate a prior compromise. While reading the script, the penetration tester noticed the following lines of code:
Which of the following was the script author trying to do?
- A. Change the MAC address
- B. List processes.
- C. Disable NIC.
- D. Spawn a local shell.
Answer: D
Explanation:
The script author was trying to spawn a local shell by using the os.system() function, which executes a command in a subshell. The command being executed is "/bin/bash", which is the path to the bash shell, a common shell program on Linux systems. The script author may have wanted to spawn a local shell to gain more control or access over the compromised system, or to execute other commands that are not possible in the original shell. The other options are not plausible explanations for what the script author was trying to do.
NEW QUESTION # 107
A penetration tester who is doing a company-requested assessment would like to send traffic to another system using double tagging. Which of the following techniques would BEST accomplish this goal?
- A. RFID cloning
- B. RFID tagging
- C. Meta tagging
- D. Tag nesting
Answer: D
Explanation:
since vlan hopping requires 2 vlans to be nested in a single packet. Double tagging occurs when an attacker adds and modifies tags on an Ethernet frame to allow the sending of packets through any VLAN. This attack takes advantage of how many switches process tags. Most switches will only remove the outer tag and forward the frame to all native VLAN ports. With that said, this exploit is only successful if the attacker belongs to the native VLAN of the trunk link.https://cybersecurity.att.com/blogs/security-essentials/vlan-hopping-and-mitigation Tag nesting is a technique that involves inserting two VLAN tags into an Ethernet frame to bypass VLAN hopping prevention mechanisms. The first tag is stripped by the first switch, and the second tag is processed by the second switch, allowing the frame to reach a different VLAN than intended. RFID cloning is a technique that involves copying the data from an RFID tag to another tag or device. RFID tagging is a technique that involves attaching an RFID tag to an object or person for identification or tracking purposes.
Meta tagging is a technique that involves adding metadata to web pages or files for search engine optimization or classification purposes.
NEW QUESTION # 108
A penetration tester needs to access a building that is guarded by locked gates, a security team, and cameras. Which of the following is a technique the tester can use to gain access to the IT framework without being detected?
- A. Pick a lock.
- B. Impersonate a package delivery worker.
- C. Disable the cameras remotely.
- D. Send a phishing email.
Answer: B
NEW QUESTION # 109
A security analyst needs to perform a scan for SMB port 445 over a/16 network. Which of the following commands would be the BEST option when stealth is not a concern and the task is time sensitive?
- A. Nmap -s 445 -Pn -T5 172.21.0.0/16
- B. Nmap -p 445 -max -sT 172. 21.0.0/16
- C. Nmap -p 445 -n -T4 -open 172.21.0.0/16
- D. Nmap -sV --script=smb* 172.21.0.0/16
Answer: D
Explanation:
Explanation
The best option when stealth is not a concern and the task is time sensitive is to use the command: Nmap -sV
--script=smb* 172.21.0.0/16. This command will use version detection and SMB scripts to scan for port 445 on the given IP range. The -sV option will cause Nmap to detect the version of services running on the ports, which is helpful for identifying vulnerabilities, and the --script=smb* option will cause Nmap to run all of the SMB related scripts. The -T4 option can be used to speed up the scan, as it increases the timing probes.
NEW QUESTION # 110
Penetration on an assessment for a client organization, a penetration tester notices numerous outdated software package versions were installed ...s-critical servers. Which of the following would best mitigate this issue?
- A. Remedial training for the client's systems administrators
- B. Revision of client scripts used to perform system updates
- C. Refrainment from patching systems until quality assurance approves
- D. Implementation of patching and change control programs
Answer: D
Explanation:
Explanation
The best way to mitigate this issue is to implement patching and change control programs, which are processes that involve applying updates or fixes to software packages to address vulnerabilities, bugs, or performance issues, and managing or documenting the changes made to the software packages to ensure consistency, compatibility, and security. Patching and change control programs can help prevent or reduce the risk of attacks that exploit outdated software package versions, which may contain known or unknown vulnerabilities that can compromise the security or functionality of the systems or servers. Patching and change control programs can be implemented by using tools such as WSUS, which is a tool that can manage and distribute updates for Windows systems and applications1, or Git, which is a tool that can track and control changes to source code or files2. The other options are not valid ways to mitigate this issue. Revision of client scripts used to perform system updates is not a sufficient way to mitigate this issue, as it may not address the root cause of why the software package versions are outdated, such as lack of awareness, resources, or policies. Remedial training for the client's systems administrators is not a direct way to mitigate this issue, as it may not result in immediate or effective actions to update the software package versions. Refrainment from patching systems until quality assurance approves is not a way to mitigate this issue, but rather a potential cause or barrier for why the software package versions are outdated.
NEW QUESTION # 111
A software development team is concerned that a new product's 64-bit Windows binaries can be deconstructed to the underlying code. Which of the following tools can a penetration tester utilize to help the team gauge what an attacker might see in the binaries?
- A. Drozer
- B. GDB
- C. OllyDbg
- D. Immunity Debugger
Answer: D
Explanation:
Explanation
Immunity Debugger is a tool that can be used to deconstruct 64-bit Windows binaries and see the underlying code. Immunity Debugger is a powerful debugger that integrates with Python and allows users to write their own scripts and plugins. It can be used for reverse engineering, malware analysis, vulnerability research, and exploit development
NEW QUESTION # 112
The following output is from reconnaissance on a public-facing banking website:
Based on these results, which of the following attacks is MOST likely to succeed?
- A. A birthday attack on 64-bit ciphers (Sweet32)
- B. An attack that breaks RC4 encryption
- C. An attack on a session ticket extension (Ticketbleed)
- D. A Heartbleed attack
Answer: D
Explanation:
Based on these results, the most likely attack to succeed is a Heartbleed attack. The Heartbleed attack is a vulnerability in the OpenSSL implementation of the TLS/SSL protocol that allows an attacker to read the memory of the server and potentially steal sensitive information, such as private keys, passwords, or session tokens. The results show that the website is using OpenSSL 1.0.1f, which is vulnerable to the Heartbleed attack1.
NEW QUESTION # 113
A penetration tester is reviewing the following SOW prior to engaging with a client:
"Network diagrams, logical and physical asset inventory, and employees' names are to be treated as client confidential. Upon completion of the engagement, the penetration tester will submit findings to the client's Chief Information Security Officer (CISO) via encrypted protocols and subsequently dispose of all findings by erasing them in a secure manner." Based on the information in the SOW, which of the following behaviors would be considered unethical?
(Choose two.)
- A. Utilizing proprietary penetration-testing tools that are not available to the public or to the client for auditing and inspection
- B. Retaining the SOW within the penetration tester's company for future use so the sales team can plan future engagements
- C. Using a software-based erase tool to wipe the client's findings from the penetration tester's laptop
- D. Utilizing public-key cryptography to ensure findings are delivered to the CISO upon completion of the engagement
- E. Seeking help with the engagement in underground hacker forums by sharing the client's public IP address
- F. Failing to share with the client critical vulnerabilities that exist within the client architecture to appease the client's senior leadership team
Answer: E,F
NEW QUESTION # 114
......
CompTIA PT0-002 Pentest+ certification exam tests individuals' ability to identify potential cybersecurity risks, analyze their impact, and execute penetration testing procedures to the highest standards. CompTIA PenTest+ Certification certification is a validation of an individual's ability to perform cybersecurity-related tasks in the field, and comprehensive knowledge of the latest tools and methodologies used in vulnerability and penetration testing. Passing PT0-002 certification signifies an individual's mastery of the techniques and processes necessary to become a skilled penetration tester who can support organizations in developing their security defenses against cyber threats.
CompTIA PT0-002 Exam Practice Test Questions: https://www.dumpstorrent.com/PT0-002-exam-dumps-torrent.html
Free PT0-002 Braindumps Download Updated: https://drive.google.com/open?id=1bGUevu8AghIi_MqNVBvBe5lYGp_9-4Wb