CompTIA CompTIA Certifications PT0-002 Questions & Answers

• Question 191:

  A penetration tester breaks into a company's office building and discovers the company does not have a shredding service. Which of the following attacks should the penetration tester try next?

  A. Dumpster diving

  B. Phishing

  C. Shoulder surfing

  D. Tailgating

  Correct Answer: A

  The penetration tester should try dumpster diving next, which is an attack that involves searching through trash bins or dumpsters for discarded documents or items that may contain sensitive or useful information. Dumpster diving can reveal information such as passwords, account numbers, credit card numbers, invoices, receipts, memos, contracts, or employee records. The penetration tester can use this information to gain access to systems or networks, impersonate users or employees, or perform social engineering attacks. The other options are not likely attacks that the penetration tester should try next based on the discovery that the company does not have a shredding service. Phishing is an attack that involves sending fraudulent emails that appear to be from legitimate sources to trick users into revealing their credentials or clicking on malicious links or attachments. Shoulder surfing is an attack that involves observing or spying on users while they enter their credentials or perform other tasks on their devices. Tailgating is an attack that involves following authorized personnel into a restricted area without proper authorization or identification.

• Question 192:

  PCI DSS requires which of the following as part of the penetration-testing process?

  A. The penetration tester must have cybersecurity certifications.

  B. The network must be segmented.

  C. Only externally facing systems should be tested.

  D. The assessment must be performed during non-working hours.

  Correct Answer: B

• Question 193:

  A penetration tester wants to identify CVEs that can be leveraged to gain execution on a Linux server that has an SSHD running. Which of the following would BEST support this task?

  A. Run nmap with the –o, -p22, and –sC options set against the target

  B. Run nmap with the –sV and –p22 options set against the target

  C. Run nmap with the --script vulners option set against the target

  D. Run nmap with the –sA option set against the target

  Correct Answer: C

  Running nmap with the --script vulners option set against the target would best support the task of identifying CVEs that can be leveraged to gain execution on a Linux server that has an SSHD running, as it will use an NSE script that checks for vulnerabilities based on version information from various sources, such as CVE databases2. The --script option allows users to specify which NSE scripts to run during an Nmap scan.

• Question 194:

  Which of the following provides a matrix of common tactics and techniques used by attackers along with recommended mitigations?

  A. NIST SP 800-53

  B. OWASP Top 10

  C. MITRE ATTandCK framework

  D. PTES technical guidelines

  Correct Answer: C

  Reference: https://digitalguardian.com/blog/what-mitre-attck-framework

• Question 195:

  In an unprotected network file repository, a penetration tester discovers a text file containing usernames and passwords in cleartext and a spreadsheet containing data for 50 employees, including full names, roles, and serial numbers. The tester realizes some of the passwords in the text file follow the format: . Which of the following would be the best action for the tester to take NEXT with this information?

  A. Create a custom password dictionary as preparation for password spray testing.

  B. Recommend using a password manage/vault instead of text files to store passwords securely.

  C. Recommend configuring password complexity rules in all the systems and applications.

  D. Document the unprotected file repository as a finding in the penetration-testing report.

  Correct Answer: D

• Question 196:

  Penetration on an assessment for a client organization, a penetration tester notices numerous outdated software package versions were installed ...s-critical servers. Which of the following would best mitigate this issue?

  A. Implementation of patching and change control programs

  B. Revision of client scripts used to perform system updates

  C. Remedial training for the client's systems administrators

  D. Refrainment from patching systems until quality assurance approves

  Correct Answer: A

  The best way to mitigate this issue is to implement patching and change control programs, which are processes that involve applying updates or fixes to software packages to address vulnerabilities, bugs, or performance issues, and managing or documenting the changes made to the software packages to ensure consistency, compatibility, and security. Patching and change control programs can help prevent or reduce the risk of attacks that exploit outdated software package versions, which may contain known or unknown vulnerabilities that can compromise the security or functionality of the systems or servers. Patching and change control programs can be implemented by using tools such as WSUS, which is a tool that can manage and distribute updates for Windows systems and applications1, or Git, which is a tool that can track and control changes to source code or files2. The other options are not valid ways to mitigate this issue. Revision of client scripts used to perform system updates is not a sufficient way to mitigate this issue, as it may not address the root cause of why the software package versions are outdated, such as lack of awareness, resources, or policies. Remedial training for the client's systems administrators is not a direct way to mitigate this issue, as it may not result in immediate or effective actions to update the software package versions. Refrainment from patching systems until quality assurance approves is not a way to mitigate this issue, but rather a potential cause or barrier for why the software package versions are outdated.

• Question 197:

  When accessing the URL http://192.168.0-1/validate/user.php, a penetration tester obtained the following output:

  ..d index: eid in /apache/www/validate/user.php line 12

  ..d index: uid in /apache/www/validate/user.php line 13

  ..d index: pw in /apache/www/validate/user.php line 14

  ..d index: acl in /apache/www/validate/user.php line 15

  A. Lack of code signing

  B. Incorrect command syntax

  C. Insufficient error handling

  D. Insecure data transmission

  Correct Answer: C

  The most probable cause for this output is insufficient error handling, which is a coding flaw that occurs when a program does not handle errors or exceptions properly or gracefully. Insufficient error handling can result in unwanted or unexpected behavior, such as crashes, hangs, or leaks. In this case, the output shows that the program is displaying warning messages that indicate undefined indexes in the user.php file. These messages reveal the names of the variables and the file path that are used by the program, which can expose sensitive information or clues to an attacker. The program should have implemented error handling mechanisms, such as try-catch blocks, error logging, or sanitizing output, to prevent these messages from being displayed or to handle them appropriately. The other options are not plausible causes for this output. Lack of code signing is a security flaw that occurs when a program does not have a digital signature that verifies its authenticity and integrity. Incorrect command syntax is a user error that occurs when a command is entered with wrong or missing parameters or options. Insecure data transmission is a security flaw that occurs when data is sent over a network without encryption or protection.

• Question 198:

  Which of the following assessment methods is MOST likely to cause harm to an ICS environment?

  A. Active scanning

  B. Ping sweep

  C. Protocol reversing

  D. Packet analysis

  Correct Answer: A

• Question 199:

  A client has requested that the penetration test scan include the following UDP services:

  SNMP, NetBIOS, and DNS.

  Which of the following Nmap commands will perform the scan?

  A. nmap –vv sUV –p 53, 123-159 10.10.1.20/24 –oA udpscan

  B. nmap –vv sUV –p 53,123,161-162 10.10.1.20/24 –oA udpscan

  C. nmap –vv sUV –p 53,137-139,161-162 10.10.1.20/24 –oA udpscan

  D. nmap –vv sUV –p 53, 122-123, 160-161 10.10.1.20/24 –oA udpscan

  Correct Answer: C

• Question 200:

  A penetration tester has been hired to examine a website for flaws. During one of the time windows for testing, a network engineer notices a flood of GET requests to the web server, reducing the website's response time by 80%. The network engineer contacts the penetration tester to determine if these GET requests are part of the test. Which of the following BEST describes the purpose of checking with the penetration tester?

  A. Situational awareness

  B. Rescheduling

  C. DDoS defense

  D. Deconfliction

  Correct Answer: D

  https://redteam.guide/docs/definitions/ Deconfliction is the process of coordinating activities and communicating information to avoid interference, confusion, or conflict among different parties involved in an operation. The network engineer contacted the penetration tester to check if the GET requests were part of the test, and to avoid any potential misunderstanding or disruption of the test or the website. The other options are not related to the purpose of checking with the penetration tester.