PT0-002試験無料問題集（460題）「CompTIA PenTest+ Certification 認定」

出題：1

A company is concerned that its cloud service provider is not adequately protecting the VMs housing its software development. The VMs are housed in a datacenter with other companies sharing physical resources. Which of the following attack types is MOST concerning to the company?

A. Session riding

B. Side channel

C. Cybersquatting

D. Data flooding

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：2

ion tester is attempting to get more people from a target company to download and run an executable. Which of the following would be the.. :tive way for the tester to achieve this objective?

A. Saving the file in a common folder with a name that encourages people to click it

B. Dropping USB flash drives around the company campus with the file on it

C. Attaching the file in a phishing SMS that warns users to execute the file or they will be locked out of their accounts

D. Sending a pretext email from the IT department before sending the download instructions later

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：3

A tester who is performing a penetration test discovers an older firewall that is known to have serious vulnerabilities to remote attacks but is not part of the original list of IP addresses for the engagement. Which of the
following is the BEST option for the tester to take?

A. Scan the firewall for vulnerabilities.

B. Apply patches to the firewall.

C. Segment the firewall from the cloud.

D. Notify the client about the firewall.

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：4

Penetration tester who was exclusively authorized to conduct a physical assessment noticed there were no cameras pointed at the dumpster for company. The penetration tester returned at night and collected garbage that contained receipts for recently purchased networking :. The models of equipment purchased are vulnerable to attack. Which of the following is the most likely next step for the penetration?

A. Scan the equipment and verify the findings.

B. Verify the discovered information is correct with the manufacturer.

C. Alert the target company of the discovered information.

D. Return to the dumpster for more information.

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：5

Which of the following is the BEST resource for obtaining payloads against specific network infrastructure products?

A. Shodan

B. Retina

C. Exploit-DB

D. Metasploit

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：6

During the reconnaissance phase, a penetration tester obtains the following output:
Reply from 192.168.1.23: bytes=32 time<54ms TTL=128
Reply from 192.168.1.23: bytes=32 time<53ms TTL=128
Reply from 192.168.1.23: bytes=32 time<60ms TTL=128
Reply from 192.168.1.23: bytes=32 time<51ms TTL=128
Which of the following operating systems is MOST likely installed on the host?

A. Windows

B. NetBSD

C. Linux

D. macOS

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：7

During an assessment, a penetration tester was able to access the organization's wireless network from outside of the building using a laptop running Aircrack-ng. Which of the following should be recommended to the client to remediate this issue?

A. Using WEP encryption

B. Configure to stop broadcasting the SSID

C. Disabling Wi-Fi

D. Using directional antennas

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：8

Which of the following web-application security risks are part of the OWASP Top 10 v2017? (Choose two.)

A. Buffer overflows

B. Cross-site scripting

C. Injection flaws

D. Ransomware attacks

E. Zero-day attacks

F. Race-condition attacks

正解：B,C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：9

A penetration tester finds a PHP script used by a web application in an unprotected internal source code repository. After reviewing the code, the tester identifies the following:

Which of the following tools will help the tester prepare an attack for this scenario?

A. Nmap and OWASP ZAP

B. Burp Suite and DIRB

C. Netcat and cURL

D. Hydra and crunch

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

PT0-002試験無料問題集「CompTIA PenTest+ Certification 認定」