CompTIA CompTIA Certifications PT0-002 Questions & Answers

• Question 391:

  A penetration tester was hired to test Wi-Fi equipment. Which of the following tools should be used to gather information about the wireless network?

  A. Kismet

  B. Burp Suite

  C. BeEF

  D. WHOIS

  Correct Answer: A

  Kismet is a well-known tool used in penetration testing for wireless network detection, packet sniffing, and intrusion detection. It is particularly useful for gathering information about Wi-Fi networks as it can detect hidden networks and capture network packets. This capability allows penetration testers to analyze the wireless environment, identify potential vulnerabilities, and assess the security posture of the Wi-Fi equipment being tested. Unlike the other tools listed, Kismet is specifically designed for wireless network analysis, making it the ideal choice for this task.

• Question 392:

  A penetration tester is conducting an assessment for an e-commerce company and successfully copies the user database to the local machine. After a closer review, the penetration tester identifies several high- profile celebrities who have active user accounts with the online service. Which of the following is the most appropriate next step?

  A. Contact the high-profile celebrities.

  B. Delete the high-profile accounts.

  C. Immediately contact the client.

  D. Record the findings in the penetration test report.

  Correct Answer: C

  Upon discovering sensitive information, such as high-profile celebrities' user accounts, the most appropriate and ethical next step is to immediately contact the client. This allows the client to take necessary actions to secure the data and mitigate any potential risks. It is important for a penetration tester to maintain confidentiality and integrity, and directly contacting the celebrities (option A), deleting the accounts (option B), or merely recording the findings without immediate notification (option D) would not be appropriate professional responses.

• Question 393:

  A penetration tester issues the following command after obtaining a low-privilege reverse shell: wmic service get name,pathname,startmode

  Which of the following is the most likely reason the penetration tester ran this command?

  A. To search for passwords in the service directory

  B. To list scheduled tasks that may be exploitable

  C. To register a service to run as System

  D. To find services that have unquoted service paths

  Correct Answer: D

  The command wmic service get name,pathname,startmode is used by penetration testers to enumerate services and their configurations, specifically looking for services with unquoted paths. If a service's path contains spaces and is not enclosed in quotes, it can be exploited by placing a malicious executable along the path, leading to privilege escalation. For example, if the service path is C:\Program Files\My Service\service.exe and is unquoted, an attacker could place a malicious Program.exe in C:\, which would then be executed with the same privileges as the service when the service starts. Identifying such services allows penetration testers to highlight potential security risks that could be exploited for privilege escalation.

• Question 394:

  Which of the following tools can a penetration tester use to brute force a user password over SSH using multiple threads?

  A. CeWL

  B. John the Ripper

  C. Hashcat

  D. Hydra

  Correct Answer: D

  Hydra is a powerful tool for conducting brute-force attacks against various protocols, including SSH. It is capable of using multiple threads to perform concurrent attempts, significantly increasing the efficiency of the attack. This capability makes Hydra particularly suited for brute-forcing user passwords over SSH, as it can quickly try numerous combinations of usernames and passwords. The tool's ability to support a wide range of protocols, its flexibility in handling different authentication mechanisms, and its efficiency in managing multiple simultaneous connections make it a go-to choice for penetration testers looking to test the strength of passwords in a target system's SSH service.

• Question 395:

  For an engagement, a penetration tester is required to use only local operating system tools for file transfer. Which of the following options should the penetration tester consider?

  A. Netcat

  B. WinSCP

  C. Filezilla

  D. Netstat

  Correct Answer: A

  Netcat is a versatile networking utility which reads and writes data across network connections, using the TCP/IP protocol. It's included in many Linux distributions and is available for Windows as well. Since the requirement is to use only local operating system tools for file transfer, Netcat is a suitable option because it can easily be scripted or used directly from the command line to send and receive files, making it a powerful tool for file transfers in a penetration testing context. Options B and C, WinSCP and Filezilla, are not typically considered local operating system tools as they are third-party applications that need to be installed. Option D, Netstat, is a network utility that displays network connections, routing tables, and a number of network interface and network protocol statistics, and is not used for file transfers.

• Question 396:

  A penetration tester is working to enumerate the PLC devices on the 10.88.88.76/24 network. Which of the following commands should the tester use to achieve the objective in a way that minimizes the risk of affecting the PLCs?

  A. nmap --script=s7-info -p 102 10.88.88.76/24 -T3

  B. nmap --script=wsdd-discover -p 3702 -sUlO.88.88.76/24

  C. nmap --script=iax2-version -p 4569 -sU -V 10.88.88.76/24 -T2

  D. nmap --script=xll-access -p 6000-6009 10.88.88.76/24

  Correct Answer: A

  The nmap command with the --script=s7-info is specifically designed to interact with Siemens S7 PLCs, which are common industrial control systems. The -p 102 specifies the port associated with Siemens S7 communications. The -T3 timing option is chosen to minimize the risk of impacting the PLCs by not being overly aggressive in the scan timing, which is important in operational technology environments where PLCs can be sensitive to high network traffic. The other options listed do not specifically target PLC devices or use appropriate timing to minimize risk.

• Question 397:

  A penetration testing firm performs an assessment every six months for the same customer. While performing network scanning for the latest assessment, the penetration tester observes that several of the target hosts appear to be residential connections associated with a major television and ISP in the area. Which of the following is the most likely reason for the observation?

  A. The penetration tester misconfigured the network scanner.

  B. The network scanning tooling is not functioning properly.

  C. The IP ranges changed ownership.

  D. The network scanning activity is being blocked by a firewall.

  Correct Answer: C

  When a penetration tester notices several target hosts appearing to be residential connections associated with a major television and ISP, it's likely that the IP ranges initially assigned to the target organization have changed ownership and are now allocated to the ISP for residential use. This can happen due to reallocation of IP addresses by regional internet registries. Misconfiguration of the scanner (option A), malfunctioning of scanning tools (option B), or firewall blocking (option D) would not typically result in the discovery of residential connections in place of expected organizational targets.

• Question 398:

  A penetration tester is performing an assessment for an application that is used by large organizations operating in the heavily regulated financial services industry. The penetration tester observes that the default Admin User account is enabled and appears to be used several times a day by unfamiliar IP addresses. Which of the following is the most appropriate way to remediate this issue?

  A. Increase password complexity.

  B. Implement system hardening.

  C. Restrict simultaneous user log-ins.

  D. Require local network access.

  Correct Answer: D

  Requiring local network access for the default Admin User account is a targeted measure to prevent unauthorized access from unfamiliar IP addresses, particularly those originating from outside the organization's network. This approach ensures that only devices physically connected to or authenticated within the local network can attempt to use the Admin User account, significantly reducing the risk of external attacks. Increasing password complexity and restricting simultaneous log-ins are good practices but do not directly address the issue of access from unfamiliar IPs. System hardening is broader and not specifically focused on the Admin User account issue.

• Question 399:

  Which of the following would be the most efficient way to write a Python script that interacts with a web application?

  A. Create a class for requests.

  B. Write a function for requests.

  C. Import the requests library.

  D. Use the cURL OS command.

  Correct Answer: C

  The most efficient way to write a Python script that interacts with web applications is to import the requests library. The requests library is a Python HTTP library that simplifies making HTTP requests to web servers, which is essential for interacting with web applications. It allows you to easily send HTTP/1.1 requests, without the need for manually adding query strings to your URLs, or form-encode your POST data. Options A and B involve creating a class or function for requests, which could be more time-consuming and less efficient than using a well-established library like requests. Option D, using the cURL OS command, is less efficient in a Python script since it involves calling an external command rather than using a native Python library.

• Question 400:

  Which of the following best explains why communication is a vital phase of a penetration test?

  A. To discuss situational awareness

  B. To build rapport with the emergency contact

  C. To explain the data destruction process

  D. To ensure the likelihood of future assessments

  Correct Answer: A

  Communication is a vital phase of a penetration test to ensure all parties involved are aware of the test's progress, findings, and any potential impact on business operations. Discussing situational awareness involves sharing real-time insights about the security posture, any vulnerabilities found, and potential risks. This enables the organization to make informed decisions, mitigate risks promptly, and ensure the test aligns with business objectives and constraints.