PT0-002 100% Guarantee Download PT0-002 Exam PDF Q&A [Oct 26, 2024]
Get PT0-002 Actual Free Exam Q&As to Prepare for Your CompTIA Certification
CompTIA PT0-002 Certification Exam is recognized globally as evidence of competency in the field of cybersecurity. Employers in different sectors of the economy value the CompTIA PT0-002 Certification as it assures them that a candidate has what it takes to effectively manage and protect their information systems. CompTIA PenTest+ Certification certification is highly sought after, and passing the exam is a great way to standout in a highly competitive job market.
CompTIA PT0-002 exam covers various security topics, including reconnaissance techniques, vulnerability identification, vulnerability exploitation, post-exploitation techniques, penetration testing tools, and reporting vulnerabilities. It also evaluates the individual's knowledge on various compliance and frameworks that communities and organization follow like General Data Protection Regulation (GDPR).
CompTIA PT0-002 (CompTIA PenTest+ Certification) Certification Exam is designed to measure the knowledge and skills of candidates when it comes to penetration testing. This is a critical aspect of information security that involves identifying and exploiting vulnerabilities in computer systems and software solutions. PT0-002 exam is ideal for individuals who want to solidify their understanding of penetration testing methodologies and practices, and who want to demonstrate their expertise in this area to potential employers.
NEW QUESTION # 204
A penetration tester is performing reconnaissance for a web application assessment. Upon investigation, the tester reviews the robots.txt file for items of interest.
INSTRUCTIONS
Select the tool the penetration tester should use for further investigation.
Select the two entries in the robots.txt file that the penetration tester should recommend for removal.
Answer:
Explanation:
Explanation:
The tool that the penetration tester should use for further investigation is WPScan. This is because WPScan is a WordPress vulnerability scanner that can detect common WordPress security issues, such as weak passwords, outdated plugins, and misconfigured settings. WPScan can also enumerate WordPress users, themes, and plugins from the robots.txt file.
The two entries in the robots.txt file that the penetration tester should recommend for removal are:
* Allow: /admin
* Allow: /wp-admin
These entries expose the WordPress admin panel, which can be a target for brute-force attacks, SQL injection, and other exploits. Removing these entries can help prevent unauthorized access to the web application's backend. Alternatively, the penetration tester can suggest renaming the admin panel to a less obvious name, or adding authentication methods such as two-factor authentication or IP whitelisting.
NEW QUESTION # 205
A penetration tester conducted a discovery scan that generated the following:
Which of the following commands generated the results above and will transform them into a list of active hosts for further analysis?
- A. nmap -sn 192.168.0.1-254 , grep "Nmap scan" | awk '{print S5}'
- B. nmap -o 192.168.0.1-254, cut -f 2
- C. nmap --open 192.168.0.1-254, uniq
- D. nmap -oG list.txt 192.168.0.1-254 , sort
Answer: A
Explanation:
the NMAP flag (-sn) which is for host discovery and returns that kind of NMAP output. And the AWK command selects column 5 ({print $5}) which obviously carries the returned IP of the host in the NMAP output.
This command will generate the results shown in the image and transform them into a list of active hosts for further analysis. The command consists of three parts:
* nmap -sn 192.168.0.1-254: This part uses nmap, a network scanning tool, to perform a ping scan (-sn) on the IP range 192.168.0.1-254, which means sending ICMP echo requests to each IP address and checking if they respond.
* grep "Nmap scan": This part uses grep, a text filtering tool, to search for the string "Nmap scan" in the output of the previous part and display only the matching lines. This will filter out the lines that show
* the start and end time of the scan and only show the lines that indicate the status of each host.
* awk '{print $5}': This part uses awk, a text processing tool, to print the fifth field ($5) of each line in the output of the previous part. This will extract only the IP addresses of each host and display them as a list.
The final output will look something like this:
192.168.0.1 192.168.0.12 192.168.0.17 192.168.0.34
NEW QUESTION # 206
Which of the following types of assessments MOST likely focuses on vulnerabilities with the objective to access specific data?
- A. A compliance-based assessment
- B. An unknown-environment assessment
- C. A known-environment assessment
- D. A red-team assessment
Answer: C
Explanation:
Explanation
A known environment test is often more complete, because testers can get to every system, service, or other target that is in scope and will have credentials and other materials that will allow them to be tested.
NEW QUESTION # 207
A penetration tester needs to perform a test on a finance system that is PCI DSS v3.2.1 compliant. Which of the following is the MINIMUM frequency to complete the scan of the system?
- A. Annually
- B. Monthly
- C. Quarterly
- D. Weekly
Answer: C
Explanation:
Quarterly is the minimum frequency to complete the scan of the system that is PCI DSS v3.2.1 compliant, according to Requirement 11.2.2 of the standard1. PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards that applies to any organization that processes, stores, or transmits credit card information. Requirement 11.2.2 states that organizations must perform internal vulnerability scans at least quarterly and after any significant change in the network.
https://www.pcicomplianceguide.org/faq/#25
PCI DSS requires quarterly vulnerability/penetration tests, not weekly.
NEW QUESTION # 208
A penetration tester will be performing a vulnerability scan as part of the penetration test on a client's website.
The tester plans to run several Nmap scripts that probe for vulnerabilities while avoiding detection. Which of the following Nmap options will the penetration tester MOST likely utilize?
- A. --script "http*vuln*"
- B. -O -A
- C. -8 -T0
- D. -sn
Answer: A
NEW QUESTION # 209
A penetration tester discovered a vulnerability that provides the ability to upload to a path via directory traversal. Some of the files that were discovered through this vulnerability are:
Which of the following is the BEST method to help an attacker gain internal access to the affected machine?
- A. Edit the discovered file with one line of code for remote callback
- B. Download .pl files and look for usernames and passwords
- C. Edit the smb.conf file and upload it to the server
- D. Download the smb.conf file and look at configurations
Answer: C
NEW QUESTION # 210
A company hired a penetration-testing team to review the cyber-physical systems in a manufacturing plant.
The team immediately discovered the supervisory systems and PLCs are both connected to the company intranet. Which of the following assumptions, if made by the penetration-testing team, is MOST likely to be valid?
- A. Supervisory systems will detect a malicious injection of code/commands.
- B. Supervisors and controllers are on a separate virtual network by default.
- C. PLCs will not act upon commands injected over the network.
- D. Controllers will not validate the origin of commands.
Answer: D
Explanation:
Explanation
PLCs are programmable logic controllers that execute logic operations on input signals from sensors and output signals to actuators. They are often connected to supervisory systems that provide human-machine interfaces and data acquisition functions. If both systems are connected to the company intranet, they are exposed to potential attacks from internal or external adversaries. A valid assumption is that controllers will not validate the origin of commands, meaning that an attacker can send malicious commands to manipulate or sabotage the industrial process. The other assumptions are not valid because they contradict the facts or common practices.
NEW QUESTION # 211
During a vulnerability scanning phase, a penetration tester wants to execute an Nmap scan using custom NSE scripts stored in the following folder:
/home/user/scripts
Which of the following commands should the penetration tester use to perform this scan?
- A. nmap -load /home/user/scripts
- B. nmap resume "not intrusive"
- C. nmap script default safe
- D. nmap script /home/user/scripts
Answer: D
Explanation:
The Nmap command in the question aims to use custom NSE scripts stored in a specific folder. The correct syntax for this option is to use the script argument followed by the path to the folder. The other commands are either invalid, use the wrong argument, or do not specify the folder path. References: Best PenTest+ certification study resources and training materials, CompTIA PenTest+ PT0-002 Cert Guide, 101 Labs - CompTIA PenTest+: Hands-on Labs for the PT0-002 Exam
NEW QUESTION # 212
A software development team is concerned that a new product's 64-bit Windows binaries can be deconstructed to the underlying code. Which of the following tools can a penetration tester utilize to help the team gauge what an attacker might see in the binaries?
- A. Drozer
- B. OllyDbg
- C. Immunity Debugger
- D. GDB
Answer: C
Explanation:
Explanation
Immunity Debugger is a tool that can be used to deconstruct 64-bit Windows binaries and see the underlying code. Immunity Debugger is a powerful debugger that integrates with Python and allows users to write their own scripts and plugins. It can be used for reverse engineering, malware analysis, vulnerability research, and exploit development
NEW QUESTION # 213
A penetration tester is cleaning up and covering tracks at the conclusion of a penetration test. Which of the following should the tester be sure to remove from the system? (Choose two.)
- A. Created user accounts
- B. Reboot system
- C. Server logs
- D. Administrator accounts
- E. ARP cache
- F. Spawned shells
Answer: A,F
Explanation:
Explanation
Removing shells: Remove any shell programs installed when performing
the pentest.
Removing tester-created credentials:
created during the pentest. This includes backdoor accounts.
Removing tools: Remove any software tools that were installed on the
customer's systems that were used to aid in the exploitation of systems.
NEW QUESTION # 214
A mail service company has hired a penetration tester to conduct an enumeration of all user accounts on an SMTP server to identify whether previous staff member accounts are still active. Which of the following commands should be used to accomplish the goal?
- A. EXPN and TURN
- B. RCPT TO and VRFY
- C. VRFY and EXPN
- D. VRFY and TURN
Answer: C
NEW QUESTION # 215
A consultant is reviewing the following output after reports of intermittent connectivity issues:
? (192.168.1.1) at 0a:d1:fa:b1:01:67 on en0 ifscope [ethernet]
? (192.168.1.12) at 34:a4:be:09:44:f4 on en0 ifscope [ethernet]
? (192.168.1.17) at 92:60:29:12:ac:d2 on en0 ifscope [ethernet]
? (192.168.1.34) at 88:de:a9:12:ce:fb on en0 ifscope [ethernet]
? (192.168.1.136) at 0a:d1:fa:b1:01:67 on en0 ifscope [ethernet]
? (192.168.1.255) at ff:ff:ff:ff:ff:ff on en0 ifscope [ethernet]
? (224.0.0.251) at 01:02:5e:7f:ff:fa on en0 ifscope permanent [ethernet]
? (239.255.255.250) at ff:ff:ff:ff:ff:ff on en0 ifscope permanent [ethernet]
Which of the following is MOST likely to be reported by the consultant?
- A. A device on the network has an IP address in the wrong subnet.
- B. A device on the network has poisoned the ARP cache.
- C. A multicast session was initiated using the wrong multicast group.
- D. An ARP flooding attack is using the broadcast address to perform DDoS.
Answer: B
Explanation:
The gateway for the network (192.168.1.1) is at 0a:d1:fa:b1:01:67, and then, another machine (192.168.1.136) also claims to be on the same MAC address. With this on the same network, intermittent connectivity will be inevitable as along as the gateway remains unreachable on the IP known by the others machines on the network, and given that the new machine claiming to be the gateway has not been configured to route traffic.
NEW QUESTION # 216
A private investigation firm is requesting a penetration test to determine the likelihood that attackers can gain access to mobile devices and then exfiltrate data from those devices. Which of the following is a social-engineering method that, if successful, would MOST likely enable both objectives?
- A. Send an SMS with a spoofed service number including a link to download a malicious application.
- B. Perform vishing on the IT help desk to gather a list of approved device IMEIs for masquerading.
- C. Infest a website that is often used by employees with malware targeted toward x86 architectures.
- D. Exploit a vulnerability in the MDM and create a new account and device profile.
Answer: A
Explanation:
Explanation
Since it doesn't indicate company owned devices, sending a text to download an application is best. And it says social-engineering so a spoofed text falls under that area.
NEW QUESTION # 217
Which of the following situations would require a penetration tester to notify the emergency contact for the engagement?
- A. The team exfiltrates PII or credit card data from the organization.
- B. The team discovers another actor on a system on the network.
- C. The team exploits a critical server within the organization.
- D. The team loses access to the network remotely.
Answer: B
NEW QUESTION # 218
When preparing for an engagement with an enterprise organization, which of the following is one of the MOST important items to develop fully prior to beginning the penetration testing activities?
- A. Clarify the statement of work.
- B. Obtain an asset inventory from the client.
- C. Interview all stakeholders.
- D. Identify all third parties involved.
Answer: A
Explanation:
Clarifying the statement of work is one of the most important items to develop fully prior to beginning the penetration testing activities, as it defines the scope, objectives, deliverables, and expectations of the engagement. The statement of work is a formal document that outlines the agreement between the penetration tester and the client and serves as a reference for both parties throughout the engagement. It should include details such as the type, duration, and frequency of testing, the target systems and networks, the authorized methods and tools, the reporting format and schedule, and any legal or ethical considerations.
NEW QUESTION # 219
After gaining access to a Linux system with a non-privileged account, a penetration tester identifies the following file:
Which of the following actions should the tester perform FIRST?
- A. Use privilege escalation.
- B. Start a reverse shell.
- C. Cover tracks.
- D. Change the file permissions.
Answer: A
Explanation:
The file .scripts/daily_log_backup.sh has permissions set to 777, meaning that anyone can read, write, or execute the file. Since it's owned by the root user and the penetration tester has access to the system with a non-privileged account, this could be a potential avenue for privilege escalation. In a penetration test, after finding such a file, the tester would likely want to explore it and see if it can be leveraged to gain higher privileges. This is often done by inserting malicious code or commands into the script if it's being executed with higher privileges, such as root in this case.
NEW QUESTION # 220
A penetration tester is attempting to discover live hosts on a subnet quickly.
Which of the following commands will perform a ping scan?
- A. nmap -sT -p- 10.12.1.0/24
- B. nmap -Pn 10.12.1.0/24
- C. nmap -sV -A 10.12.1.0/24
- D. nmap -sn 10.12.1.0/24
Answer: D
Explanation:
Reference: https://www.tecmint.com/find-live-hosts-ip-addresses-on-linux-network/
NEW QUESTION # 221
A penetration tester is conducting an Nmap scan and wants to scan for ports without establishing a connection.
The tester also wants to find version data information for services running on Projects. Which of the following Nmap commands should the tester use?
- A. ..nmap -sS -sV -F target.company.com
- B. ..nmap -sT -v -T5 target.company.com
- C. ..nmap -sU -sV -T4 -F target.company.com
- D. ..nmap -sX -sC target.company.com
Answer: A
Explanation:
The Nmap command that the tester should use to scan for ports without establishing a connection and to find version data information for services running on open ports is nmap -sS -sV -F target.company.com. This command has the following options:
* -sS performs a TCP SYN scan, which is a scan technique that sends TCP packets with the SYN flag set to the target ports and analyzes the responses. A TCP SYN scan does not establish a full TCP connection, as it only completes the first step of the three-way handshake. A TCP SYN scan can stealthily scan for open ports without alerting the target system or application.
* -sV performs version detection, which is a feature that probes open ports to determine the service and version information of the applications running on them. Version detection can provide useful information for identifying vulnerabilities or exploits that affect specific versions of services or applications.
* -F performs a fast scan, which is a scan option that only scans the 100 most common ports according to the nmap-services file. A fast scan can speed up the scan process by avoiding scanning less likely or less interesting ports.
* target.company.com specifies the domain name of the target system or network to be scanned.
The other options are not valid Nmap commands that meet the requirements of the question. Option A performs a UDP scan (-sU), which is a scan technique that sends UDP packets to the target ports and analyzes the responses. A UDP scan can scan for open ports that use UDP protocol, such as DNS, SNMP, or DHCP.
However, a UDP scan does establish a connection with the target system or application, unlike a TCP SYN scan. Option C performs a TCP connect scan (-sT), which is a scan technique that sends TCP packets with the SYN flag set to the target ports and completes the three-way handshake with an ACK packet if a SYN/ACK packet is received. A TCP connect scan can scan for open ports that use TCP protocol, such as HTTP, FTP, or SSH. However, a TCP connect scan does establish a full TCP connection with the target system or application, unlike a TCP SYN scan. Option D performs an Xmas scan (-sX), which is a scan technique that sends TCP packets with the FIN, PSH, and URG flags set to the target ports and analyzes the responses. An Xmas scan can stealthily scan for open ports without alerting the target system or application, similar to a TCP SYN scan.
However, option D does not perform version detection (-sV), which is one of the requirements of the question.
NEW QUESTION # 222
......
PT0-002 Questions Truly Valid For Your CompTIA Exam: https://www.practicetorrent.com/PT0-002-practice-exam-torrent.html
CompTIA Actual Free Exam Questions And Answers: https://drive.google.com/open?id=1pkvNG03Qpqnf_OcYpE3FvseYFzMLG4dp