PT0-003無料問題集「CompTIA PenTest+」

質問 1

In a file stored in an unprotected source code repository, a penetration tester discovers the following line of code:
sshpass -p donotchange ssh [email protected]
Which of the following should the tester attempt to do next to take advantage of this information? (Select two).

（A）Run a password-spraying attack with Hydra against all the SSH servers.

（B）Use Nmap to identify all the SSH systems active on the network.

（C）Take a screen capture of the source code repository for documentation purposes.

（D）Use an external exploit through Metasploit to compromise host 192.168.6.14.

（E）Confirm whether the server 192.168.6.14 is up by sending ICMP probes.

（F）Investigate to find whether other files containing embedded passwords are in the code repository.

正解：C、F 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 2

A penetration tester established an initial compromise on a host. The tester wants to pivot to other targets and set up an appropriate relay. The tester needs to enumerate through the compromised host as a relay from the tester's machine. Which of the following commands should the tester use to do this task from the tester's host?

（A）attacker_host$ nc -nlp 8000 | nc -n <target_cidr> attacker_host$ nmap -sT 127.0.0.1 8000

（B）attacker_host$ mknod backpipe p attacker_host$ nc -l -p 8000 | 0<backpipe | nc <target_cidr> 80 | tee backpipe

（C）attacker_host$ nmap -sT <target_cidr> | nc -n <compromised_host> 22

（D）attacker_host$ proxychains nmap -sT <target_cidr>

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 3

A penetration tester performs an assessment on the target company's Kubernetes cluster using kube-hunter. Which of the following types of vulnerabilities could be detected with the tool?

（A）Application deployment issues in Kubernetes

（B）Network configuration errors in Kubernetes services

（C）Security vulnerabilities specific to Docker containers

（D）Weaknesses and misconfigurations in the Kubernetes cluster

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 4

A penetration tester needs to confirm the version number of a client's web application server. Which of the following techniques should the penetration tester use?

（A）Directory brute forcing

（B）Banner grabbing

（C）SSL certificate inspection

（D）URL spidering

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 5

During a security assessment, a penetration tester gains access to an internal server and manipulates some data to hide its presence. Which of the following is the best way for the penetration tester to hide the activities performed?

（A）Alter the log permissions.

（B）Clear the Windows event logs.

（C）Reduce the log retention settings.

（D）Modify the system time.

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 6

A penetration tester runs a vulnerability scan that identifies several issues across numerous customer hosts. The executive report outlines the following information:
Server High-severity vulnerabilities
1. Development sandbox server 32
2. Back office file transfer server 51
3. Perimeter network web server 14
4. Developer QA server 92
The client is concerned about the availability of its consumer-facing production application. Which of the following hosts should the penetration tester select for additional manual testing?

（A）Server 3

（B）Server 2

（C）Server 4

（D）Server 1

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 7

Which of the following OT protocols sends information in cleartext?

（A）DNP3

（B）PROFINET

（C）TTEthernet

（D）Modbus

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 8

In a cloud environment, a security team discovers that an attacker accessed confidential information that was used to configure virtual machines during their initialization. Through which of the following features could this information have been accessed?

（A）Virtual private cloud

（B）Block storage

（C）Metadata services

（D）IAM

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 9

A penetration tester is working on an engagement in which a main objective is to collect confidential information that could be used to exfiltrate data and perform a ransomware attack. During the engagement, the tester is able to obtain an internal foothold on the target network. Which of the following is the next task the tester should complete to accomplish the objective?

（A）Perform credential dumping.

（B）Initiate a social engineering campaign.

（C）Share enumeration.

（D）Compromise an endpoint.

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 10

During a security audit, a penetration tester wants to run a process to gather information about a target network's domain structure and associated IP addresses. Which of the following tools should the tester use?

（A）Dnsenum

（B）Nmap

（C）Wireshark

（D）Netcat

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

PT0-003 無料問題集「CompTIA PenTest+」

弊社を連絡する

関連リンク

トップ試験