Top Tips Of Regenerate PT0-002 Latest Exam

NEW QUESTION 1
Which of the following tools would be MOST useful in collecting vendor and other security-relevant information for IoT devices to support passive reconnaissance?

• A. Shodan
• B. Nmap
• C. WebScarab-NG
• D. Nessus

Answer: B

NEW QUESTION 2
Which of the following describe the GREATEST concerns about using third-party open-source libraries in application code? (Choose two.)

• A. The libraries may be vulnerable
• B. The licensing of software is ambiguous
• C. The libraries’ code bases could be read by anyone
• D. The provenance of code is unknown
• E. The libraries may be unsupported
• F. The libraries may break the application

Answer: AC

NEW QUESTION 3
When preparing for an engagement with an enterprise organization, which of the following is one of the MOST important items to develop fully prior to beginning the penetration testing activities?

• A. Clarify the statement of work.
• B. Obtain an asset inventory from the client.
• C. Interview all stakeholders.
• D. Identify all third parties involved.

Answer: A

NEW QUESTION 4
A penetration tester ran a ping –A command during an unknown environment test, and it returned a 128 TTL packet. Which of the following OSs would MOST likely return a packet of this type?

• A. Windows
• B. Apple
• C. Linux
• D. Android

Answer: A

NEW QUESTION 5
You are a penetration tester reviewing a client’s website through a web browser. INSTRUCTIONS
Review all components of the website through the browser to determine if vulnerabilities are present. Remediate ONLY the highest vulnerability from either the certificate, source, or cookies.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

• A. Yes
• B. Not Mastered

Answer: A

NEW QUESTION 6
Which of the following are the MOST important items to include in the final report for a penetration test?
(Choose two.)

• A. The CVSS score of the finding
• B. The network location of the vulnerable device
• C. The vulnerability identifier
• D. The client acceptance form
• E. The name of the person who found the flaw
• F. The tool used to find the issue

Answer: CF

NEW QUESTION 7
A company is concerned that its cloud VM is vulnerable to a cyberattack and proprietary data may be stolen. A penetration tester determines a vulnerability does exist and exploits the vulnerability by adding a fake VM instance to the IaaS component of the client's VM. Which of the following cloud attacks did the penetration tester MOST likely implement?

• A. Direct-to-origin
• B. Cross-site scripting
• C. Malware injection
• D. Credential harvesting

Answer: A

NEW QUESTION 8
A company hired a penetration-testing team to review the cyber-physical systems in a manufacturing plant. The team immediately discovered the supervisory systems and PLCs are both connected to the company intranet. Which of the following assumptions, if made by the penetration-testing team, is MOST likely to be valid?

• A. PLCs will not act upon commands injected over the network.
• B. Supervisors and controllers are on a separate virtual network by default.
• C. Controllers will not validate the origin of commands.
• D. Supervisory systems will detect a malicious injection of code/commands.

Answer: C

NEW QUESTION 9
A penetration tester is testing a web application that is hosted by a public cloud provider. The tester is able to query the provider’s metadata and get the credentials used by the instance to authenticate itself. Which of the following vulnerabilities has the tester exploited?

• A. Cross-site request forgery
• B. Server-side request forgery
• C. Remote file inclusion
• D. Local file inclusion

Answer: B

NEW QUESTION 10
A penetration tester conducts an Nmap scan against a target and receives the following results:

Which of the following should the tester use to redirect the scanning tools using TCP port 1080 on the target?

• A. Nessus
• B. ProxyChains
• C. OWASPZAP
• D. Empire

Answer: B

NEW QUESTION 11
A client wants a security assessment company to perform a penetration test against its hot site. The purpose of the test is to determine the effectiveness of the defenses that protect against disruptions to business continuity. Which of the following is the MOST important action to take before starting this type of assessment?

• A. Ensure the client has signed the SOW.
• B. Verify the client has granted network access to the hot site.
• C. Determine if the failover environment relies on resources not owned by the client.
• D. Establish communication and escalation procedures with the client.

Answer: A

NEW QUESTION 12
A security professional wants to test an IoT device by sending an invalid packet to a proprietary service listening on TCP port 3011. Which of the following would allow the security professional to easily and programmatically manipulate the TCP header length and checksum using arbitrary numbers and to observe how the proprietary service responds?

• A. Nmap
• B. tcpdump
• C. Scapy
• D. hping3

Answer: C

Explanation:
https://0xbharath.github.io/art-of-packet-crafting-with-scapy/scapy/creating_packets/index.html

NEW QUESTION 13
In an unprotected network file repository, a penetration tester discovers a text file containing usernames and passwords in cleartext and a spreadsheet containing data for 50 employees, including full names, roles, and serial numbers. The tester realizes some of the passwords in the text file follow the format: <name- serial_number>. Which of the following would be the best action for the tester to take NEXT with this information?

• A. Create a custom password dictionary as preparation for password spray testing.
• B. Recommend using a password manage/vault instead of text files to store passwords securely.
• C. Recommend configuring password complexity rules in all the systems and applications.
• D. Document the unprotected file repository as a finding in the penetration-testing report.

Answer: D

NEW QUESTION 14
Which of the following types of information should be included when writing the remediation section of a penetration test report to be viewed by the systems administrator and technical staff?

• A. A quick description of the vulnerability and a high-level control to fix it
• B. Information regarding the business impact if compromised
• C. The executive summary and information regarding the testing company
• D. The rules of engagement from the assessment

Answer: B

NEW QUESTION 15
A penetration tester gains access to a system and establishes persistence, and then runs the following commands:
cat /dev/null > temp
touch –r .bash_history temp mv temp .bash_history
Which of the following actions is the tester MOST likely performing?

• A. Redirecting Bash history to /dev/null
• B. Making a copy of the user's Bash history for further enumeration
• C. Covering tracks by clearing the Bash history
• D. Making decoy files on the system to confuse incident responders

Answer: C

NEW QUESTION 16
A penetration tester has established an on-path attack position and must now specially craft a DNS query response to be sent back to a target host. Which of the following utilities would BEST support this objective?

• A. Socat
• B. tcpdump
• C. Scapy
• D. dig

Answer: A

NEW QUESTION 17
A penetration tester has been given eight business hours to gain access to a client’s financial system. Which of the following techniques will have the highest likelihood of success?

• A. Attempting to tailgate an employee going into the client's workplace
• B. Dropping a malicious USB key with the company’s logo in the parking lot
• C. Using a brute-force attack against the external perimeter to gain a foothold
• D. Performing spear phishing against employees by posing as senior management

Answer: C

NEW QUESTION 18
Penetration-testing activities have concluded, and the initial findings have been reviewed with the client. Which of the following best describes the NEXT step in the engagement?

• A. Acceptance by the client and sign-off on the final report
• B. Scheduling of follow-up actions and retesting
• C. Attestation of findings and delivery of the report
• D. Review of the lessons learned during the engagement

Answer: A

NEW QUESTION 19
The results of an Nmap scan are as follows:
Starting Nmap 7.80 ( https://nmap.org ) at 2021-01-24 01:10 EST Nmap scan report for ( 10.2.1.22 )
Host is up (0.0102s latency). Not shown: 998 filtered ports Port State Service
80/tcp open http
|_http-title: 80F 22% RH 1009.1MB (text/html)
|_http-slowloris-check:
| VULNERABLE:
| Slowloris DoS Attack
| <..>
Device type: bridge|general purpose
Running (JUST GUESSING) : QEMU (95%)
OS CPE: cpe:/a:qemu:qemu
No exact OS matches found for host (test conditions non-ideal).
OS detection performed. Please report any incorrect results at https://nmap.org/submit/. Nmap done: 1 IP address (1 host up) scanned in 107.45 seconds
Which of the following device types will MOST likely have a similar response? (Choose two.)

• A. Network device
• B. Public-facing web server
• C. Active Directory domain controller
• D. IoT/embedded device
• E. Exposed RDP
• F. Print queue

Answer: AB

NEW QUESTION 20
A penetration tester who is conducting a web-application test discovers a clickjacking vulnerability associated with a login page to financial data. Which of the following should the tester do with this information to make this a successful exploit?

• A. Perform XSS.
• B. Conduct a watering-hole attack.
• C. Use BeEF.
• D. Use browser autopwn.

Answer: A

NEW QUESTION 21
......