PT0-002無料問題集「CompTIA PenTest+ Certification」

質問 1

Which of the following is a ROE component that provides a penetration tester with guidance on who and how to contact the necessary individuals in the event of a disaster during an engagement?

（A）SLA

（B）Communication escalation path

（C）Engagementscope

（D）SOW

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 2

Which of the following would be the most efficient way to write a Python script that interacts with a web application?

（A）Import the requests library.

（B）Write a function for requests.

（C）Use the cURL OS command.

（D）Create a class for requests.

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 3

Which of the following are the MOST important items to include in the final report for a penetration test?
(Choose two.)

（A）The vulnerability identifier

（B）The client acceptance form

（C）The tool used to find the issue

（D）The name of the person who found the flaw

（E）The CVSS score of the finding

（F）The network location of the vulnerable device

正解：A、C 解答を投票する

質問 4

A penetration tester is testing a new version of a mobile application in a sandbox environment. To intercept and decrypt the traffic between the application and the external API, the tester has created a private root CA and issued a certificate from it. Even though the tester installed the root CA into the trusted stone of the smartphone used for the tests, the application shows an error indicating a certificate mismatch and does not connect to the server. Which of the following is the MOST likely reason for the error?

（A）The tester is using an outdated version of the application

（B）TCP port 443 is not open on the firewall

（C）The API server is using SSL instead of TLS

（D）The application has the API certificate pinned.

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 5

Which of the following tools should a penetration tester use to crawl a website and build a wordlist using the data recovered to crack the password on the website?

（A）CeWL

（B）w3af

（C）Patator

（D）DirBuster

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 6

A penetration tester has established an on-path position between a target host and local network services but has not been able to establish an on-path position between the target host and the Internet. Regardless, the tester would like to subtly redirect HTTP connections to a spoofed server IP. Which of the following methods would BEST support the objective?

（A）Exploit the local DNS server and add/update the zone records with a spoofed A record.

（B）Proxy HTTP connections from the target host to that of the spoofed host.

（C）Use the Scapy utility to overwrite name resolution fields in the DNS query response.

（D）Gain access to the target host and implant malware specially crafted for this purpose.

正解：B 解答を投票する

質問 7

A penetration tester was able to compromise a server and escalate privileges. Which of the following should the tester perform AFTER concluding the activities on the specified target? (Choose two.)

（A）Delete any created credentials.

（B）Disable the running services.

（C）Reboot the target server.

（D）Remove the logs from the server.

（E）Remove any tools or scripts that were installed.

（F）Restore the server backup.

正解：A、E 解答を投票する

質問 8

Which of the following components should a penetration tester most likely include in a report at the end of an assessment?

（A）Compliance information

（B）Client interviews

（C）Metrics and measures

（D）Business policies

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 9

Which of the following assessment methods is the most likely to cause harm to an ICS environment?

（A）Active scanning

（B）Ping sweep

（C）Packet analysis

（D）Protocol reversing

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 10

A penetration tester downloaded the following Perl script that can be used to identify vulnerabilities in network switches. However, the script is not working properly.
Which of the following changes should the tester apply to make the script work as intended?

（A）Change line 2 to $ip= #€10.192.168.254#€;

（B）Remove lines 3, 5, and 6.

（C）Move all the lines below line 7 to the top of the script.

（D）Remove line 6.

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 11

A penetration tester runs a scan against a server and obtains the following output:
21/tcp open ftp Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 03-12-20 09:23AM 331 index.aspx
| ftp-syst:
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2012 Std
3389/tcp open ssl/ms-wbt-server
| rdp-ntlm-info:
| Target Name: WEB3
| NetBIOS_Computer_Name: WEB3
| Product_Version: 6.3.9600
|_ System_Time: 2021-01-15T11:32:06+00:00
8443/tcp open http Microsoft IIS httpd 8.5
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/8.5
|_http-title: IIS Windows Server
Which of the following command sequences should the penetration tester try NEXT?

（A）curl -X TRACE https://192.168.53.23:8443/index.aspx

（B）ncrack -u Administrator -P 15worst_passwords.txt -p rdp 192.168.53.23

（C）smbclient \\\\WEB3\\IPC$ -I 192.168.53.23 -U guest

（D）ftp 192.168.53.23

（E）nmap --script vuln -sV 192.168.53.23

正解：D 解答を投票する

質問 12

A penetration tester recently performed a social-engineering attack in which the tester found an employee of the target company at a local coffee shop and over time built a relationship with the employee. On the employee's birthday, the tester gave the employee an external hard drive as a gift. Which of the following social-engineering attacks was the tester utilizing?

（A）Baiting

（B）Phishing

（C）Tailgating

（D）Shoulder surfing

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 13

Which of the following tools would be BEST suited to perform a manual web application security assessment? (Choose two.)

（A）Burp Suite

（B）Nmap

（C）BeEF

（D）Nessus

（E）OWASP ZAP

（F）Hydra

正解：A、E 解答を投票する

質問 14

A penetration tester wants to find hidden information in documents available on the web at a particular domain. Which of the following should the penetration tester use?

（A）Netcraft

（B）Responder

（C）FOCA

（D）CentralOps

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 15

A penetration tester is reviewing the logs of a proxy server and discovers the following URLs:
https://test.comptia.com/profile.php?userid=1546
https://test.cpmptia.com/profile.php?userid=5482
https://test.comptia.com/profile.php?userid=3618
Which of the following types of vulnerabilities should be remediated?

（A）Weak or default configurations

（B）Insecure direct object reference

（C）Race condition

（D）Improper error handling

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

PT0-002 無料問題集「CompTIA PenTest+ Certification」

弊社を連絡する

関連リンク

トップ試験