検証済みのPT0-002試験問題集PDF [2025年最新] 成功の秘訣はここにある
ベストを体験せよ！PT0-002試験問題トレーニングを提供していますGoShiken
質問 # 61
A consultant is reviewing the following output after reports of intermittent connectivity issues:
? (192.168.1.1) at 0a:d1:fa:b1:01:67 on en0 ifscope [ethernet]
? (192.168.1.12) at 34:a4:be:09:44:f4 on en0 ifscope [ethernet]
? (192.168.1.17) at 92:60:29:12:ac:d2 on en0 ifscope [ethernet]
? (192.168.1.34) at 88:de:a9:12:ce:fb on en0 ifscope [ethernet]
? (192.168.1.136) at 0a:d1:fa:b1:01:67 on en0 ifscope [ethernet]
? (192.168.1.255) at ff:ff:ff:ff:ff:ff on en0 ifscope [ethernet]
? (224.0.0.251) at 01:02:5e:7f:ff:fa on en0 ifscope permanent [ethernet]
? (239.255.255.250) at ff:ff:ff:ff:ff:ff on en0 ifscope permanent [ethernet] Which of the following is MOST likely to be reported by the consultant?
- A. A device on the network has an IP address in the wrong subnet.
- B. A device on the network has poisoned the ARP cache.
- C. An ARP flooding attack is using the broadcast address to perform DDoS.
- D. A multicast session was initiated using the wrong multicast group.
正解：B
解説：
The gateway for the network (192.168.1.1) is at 0a:d1:fa:b1:01:67, and then, another machine (192.168.1.136) also claims to be on the same MAC address. With this on the same network, intermittent connectivity will be inevitable as along as the gateway remains unreachable on the IP known by the others machines on the network, and given that the new machine claiming to be the gateway has not been configured to route traffic.
質問 # 62
A penetration tester is testing a web application that is hosted by a public cloud provider. The tester is able to query the provider's metadata and get the credentials used by the instance to authenticate itself. Which of the following vulnerabilities has the tester exploited?
- A. Cross-site request forgery
- B. Server-side request forgery
- C. Local file inclusion
- D. Remote file inclusion
正解：B
解説：
Explanation
Server-side request forgery (SSRF) is the vulnerability that the tester exploited by querying the provider's metadata and getting the credentials used by the instance to authenticate itself. SSRF is a type of attack that abuses a web application to make requests to other resources or services on behalf of the web server. This can allow an attacker to access internal or external resources that are otherwise inaccessible or protected. In this case, the tester was able to access the metadata service of the cloud provider, which contains sensitive information about the instance, such as credentials, IP addresses, roles, etc.
質問 # 63
A penetration tester discovers that a web server within the scope of the engagement has already been compromised with a backdoor. Which of the following should the penetration tester do NEXT?
- A. Inform the customer immediately about the backdoor
- B. Continue the engagement and include the backdoor finding in the final report
- C. Forensically acquire the backdoor Trojan and perform attribution
- D. Utilize the backdoor in support of the engagement
正解：B
質問 # 64
A penetration tester is conducting an assessment on 192.168.1.112. Given the following output:
[ATTEMPT] target 192.168.1.112 - login "root" - pass "abcde"
[ATTEMPT] target 192.168.1.112 - login "root" - pass "edcfg"
[ATTEMPT] target 192.168.1.112 - login "root" - pass "qazsw"
[ATTEMPT] target 192.168.1.112 - login "root" - pass "tyuio"
Which of the following is the penetration tester conducting?
- A. Brute force
- B. Port scan
- C. Credential stuffing
- D. DoS attack
正解：A
質問 # 65
During an assessment, a penetration tester was able to access the organization's wireless network from outside of the building using a laptop running Aircrack-ng. Which of the following should be recommended to the client to remediate this issue?
- A. Changing to Wi-Fi equipment that supports strong encryption
- B. Using directional antennae
- C. Using WEP encryption
- D. Disabling Wi-Fi
正解：A
解説：
If a penetration tester was able to access the organization's wireless network from outside of the building using Aircrack-ng, then it means that the wireless network was not secured with strong encryption or authentication methods. Aircrack-ng is a tool that can crack weak wireless encryption schemes such as WEP or WPA-PSK using various techniques such as packet capture, injection, replay, and brute force. To remediate this issue, the client should change to Wi-Fi equipment that supports strong encryption such as WPA2 or WPA3, which are more resistant to cracking attacks. Using directional antennae may reduce the signal range of the wireless network, but it would not prevent an attacker who is within range from cracking the encryption. Using WEP encryption is not a good recommendation, as WEP is known to be insecure and vulnerable to Aircrack-ng attacks. Disabling Wi-Fi may eliminate the risk of wireless attacks, but it would also eliminate the benefits of wireless connectivity for the organization.
質問 # 66
A penetration tester received a 16-bit network block that was scoped for an assessment. During the assessment, the tester realized no hosts were active in the provided block of IPs and reported this to the company. The company then provided an updated block of IPs to the tester. Which of the following would be the most appropriate NEXT step?
- A. Scan the 8-bit block to map additional missed hosts.
- B. Update the ROE with new signatures. Most Voted
- C. Terminate the contract.
- D. Continue the assessment.
正解：B
質問 # 67
A penetration tester finds a PHP script used by a web application in an unprotected internal source code repository. After reviewing the code, the tester identifies the following:
Which of the following tools will help the tester prepare an attack for this scenario?
- A. Netcat and cURL
- B. Hydra and crunch
- C. Nmap and OWASP ZAP
- D. Burp Suite and DIRB
正解：A
解説：
Netcat and cURL are tools that will help the tester prepare an attack for this scenario, as they can be used to establish a TCP connection, send payloads, and receive responses from the target web server. Netcat is a versatile tool that can create TCP or UDP connections and transfer data between hosts. cURL is a tool that can transfer data using various protocols, such as HTTP, FTP, SMTP, etc. The tester can use these tools to exploit the PHP script that executes shell commands with the value of the "item" variable.
質問 # 68
A penetration tester writes the following script:
Which of the following objectives is the tester attempting to achieve?
- A. Set the TTL of ping packets for stealth.
- B. Determine active hosts on the network.
- C. Scan the system on the most used ports.
- D. Fill the ARP table of the networked devices.
正解：B
解説：
The tester is attempting to determine active hosts on the network by writing a script that pings a range of IP addresses. Ping is a network utility that sends ICMP echo request packets to a host and waits for ICMP echo reply packets. Ping can be used to test whether a host is reachable or not by measuring its response time. The script uses a for loop to iterate over a range of IP addresses from 192.168.1.1 to 192.168.1.254 and pings each one using the ping command with -c 1 option, which specifies one packet per address.
質問 # 69
A penetration tester is required to perform a vulnerability scan that reduces the likelihood of false positives and increases the true positives of the results. Which of the following would MOST likely accomplish this goal?
- A. Using OpenVAS in default mode
- B. Using Nmap as the root user
- C. Using OWASP ZAP
- D. Using Nessus with credentials
正解：D
解説：
Explanation
Using credentials during a vulnerability scan allows the scanner to gather more detailed information about the target system, including installed software, patch levels, and configuration settings. This helps to reduce the likelihood of false positives and increase the true positives of the results. Nessus is a popular vulnerability scanner that supports credential-based scanning and can be used to accomplish this goal. OpenVAS and Nmap are also popular scanning tools, but using default mode or running as the root user alone may not provide the necessary level of detail for accurate vulnerability identification. OWASP ZAP is a web application scanner and may not be applicable for non-web-based targets.
質問 # 70
A penetration tester executes the following Nmap command and obtains the following output:
Which of the following commands would best help the penetration tester discover an exploitable service?
A)
B)
C)
D)
- A. nmap -p 3306 -- script "http*vuln*" remotehost
- B. nmap --ocript=omb-brute.noe remotehoat
- C. nmap -v -p 25 -- soript smtp-enum-users remotehost
- D. nmap -v -- script=mysql-info.nse remotehost
正解：D
解説：
The Nmap command in the question scans all ports on the remote host and identifies the services and versions running on them. The output shows that port 3306 is open and running MariaDB, which is a fork of MySQL.
Therefore, the best command to discover an exploitable service would be to use the mysql-info.nse script, which gathers information about the MySQL server, such as the version, user accounts, databases, and configuration variables. The other commands are either misspelled, irrelevant, or too broad for the task. References: Best PenTest+ certification study resources and training materials, CompTIA PenTest+ PT0-
002 Cert Guide, 101 Labs - CompTIA PenTest+: Hands-on Labs for the PT0-002 Exam
質問 # 71
A company becomes concerned when the security alarms are triggered during a penetration test. Which of the following should the company do NEXT?
- A. Halt the penetration test.
- B. Deconflict with the penetration tester.
- C. Contact law enforcement.
- D. Assume the alert is from the penetration test.
正解：B
解説：
Explanation
Deconflicting with the penetration tester is the best thing to do next after the security alarms are triggered during a penetration test, as it will help determine whether the alarm was caused by the tester's activity or by an actual threat. Deconflicting is the process of communicating and coordinating with other parties involved in a penetration testing engagement, such as security teams, network administrators, or emergency contacts, to avoid confusion or interference.
質問 # 72
Which type of phishing attack involves sending fraudulent emails to trick recipients into providing sensitive information?
- A. Email phishing
- B. Whaling
- C. Spear phishing
- D. Tailgating
正解：A
解説：
Email phishing involves sending fraudulent emails that appear legitimate to trick the recipient into providing sensitive information. This question describes a generic phishing attempt, as it targets a broad audience with urgent claims. This relates to CompTIA Pentest+ objectives under social engineering and phishing techniques.
質問 # 73
A penetration tester writes the following script:
Which of the following objectives is the tester attempting to achieve?
- A. Set the TTL of ping packets for stealth.
- B. Determine active hosts on the network.
- C. Scan the system on the most used ports.
- D. Fill the ARP table of the networked devices.
正解：B
解説：
The tester is attempting to determine active hosts on the network by writing a script that pings a range of IP addresses. Ping is a network utility that sends ICMP echo request packets to a host and waits for ICMP echo reply packets. Ping can be used to test whether a host is reachable or not by measuring its response time. The script uses a for loop to iterate over a range of IP addresses from 192.168.1.1 to 192.168.1.254 and pings each one using the ping command with -c 1 option, which specifies one packet per address.
質問 # 74
A penetration tester is testing input validation on a search form that was discovered on a website. Which of the following characters is the BEST option to test the website for vulnerabilities?
- A. Comma
- B. Single quote
- C. Double dash
- D. Semicolon
正解：B
質問 # 75
During an assessment, a penetration tester found a suspicious script that could indicate a prior compromise.
While reading the script, the penetration tester noticed the following lines of code:
Which of the following was the script author trying to do?
- A. Change the MAC address
- B. Spawn a local shell.
- C. List processes.
- D. Disable NIC.
正解：B
解説：
The script author was trying to spawn a local shell by using the os.system() function, which executes a command in a subshell. The command being executed is "/bin/bash", which is the path to the bash shell, a common shell program on Linux systems. The script author may have wanted to spawn a local shell to gain more control or access over the compromised system, or to execute other commands that are not possible in the original shell. The other options are not plausible explanations for what the script author was trying to do.
質問 # 76
A penetration tester was brute forcing an internal web server and ran a command that produced the following output:
However, when the penetration tester tried to browse the URL http://172.16.100.10:3000/profile, a blank page was displayed.
Which of the following is the MOST likely reason for the lack of output?
- A. The tester did not run sudo before the command.
- B. The web server is using HTTPS instead of HTTP.
- C. This URI returned a server error.
- D. The HTTP port is not open on the firewall.
正解：D
質問 # 77
In a standard engagement, a post-report document is provided outside of the report. This document:
* Does not contain specific findings
* Exposes vulnerabilities
* Can be shared publicly with outside parties that do not have an in-depth understanding about the client's network
Which of the following documents is described?
- A. Findings report
- B. Attestation letter
- C. Executive summary
- D. Non-disclosure agreement
正解：B
質問 # 78
A client wants a security assessment company to perform a penetration test against its hot site. The purpose of the test is to determine the effectiveness of the defenses that protect against disruptions to business continuity.
Which of the following is the MOST important action to take before starting this type of assessment?
- A. Ensure the client has signed the SOW.
- B. Verify the client has granted network access to the hot site.
- C. Determine if the failover environment relies on resources not owned by the client.
- D. Establish communication and escalation procedures with the client.
正解：A
解説：
The statement of work (SOW) is a document that defines the scope, objectives, deliverables, and timeline of a penetration testing engagement. It is important to have the client sign the SOW before starting the assessment to avoid any legal or contractual issues.
質問 # 79
A company requires that all hypervisors have the latest available patches installed. Which of the following would BEST explain the reason why this policy is in place?
- A. To fix any misconfigurations of the hypervisor
- B. To provide protection against host OS vulnerabilities
- C. To reduce the probability of a VM escape attack
- D. To enable all features of the hypervisor
正解：C
解説：
Explanation
A hypervisor is a type of virtualization software that allows multiple virtual machines (VMs) to run on a single physical host machine. If the hypervisor is compromised, an attacker could potentially gain access to all of the VMs running on that host, which could lead to a significant data breach or other security issues.
One common type of attack against hypervisors is known as a VM escape attack. In this type of attack, an attacker exploits a vulnerability in the hypervisor to break out of the VM and gain access to the host machine.
From there, the attacker can potentially gain access to other VMs running on the same host.
By ensuring that all hypervisors have the latest available patches installed, the company can reduce the likelihood that a VM escape attack will be successful. Patches often include security updates and vulnerability fixes that address known issues and can help prevent attacks.
質問 # 80
A penetration tester downloaded a Java application file from a compromised web server and identifies how to invoke it by looking at the following log:
Which of the following is the order of steps the penetration tester needs to follow to validate whether the Java application uses encryption over sockets?
- A. Run an application vulnerability scan and then identify the TCP ports used by the application.
- B. Run the application attached to a debugger and then review the application's log.
- C. Disassemble the binary code and then identify the break points.
- D. Start a packet capture with Wireshark and then run the application.
正解：D
質問 # 81
A penetration-testing team is conducting a physical penetration test to gain entry to a building. Which of the following is the reason why the penetration testers should carry copies of the engagement documents with them?
- A. As backup in case the original documents are lost
- B. To guide them through the building entrances
- C. To validate the billing information with the client
- D. As proof in case they are discovered
正解：D
解説：
The penetration testers should carry copies of the engagement documents with them as proof in case they are discovered by security guards, employees, or law enforcement officials. The engagement documents should include the scope, objectives, authorization, and contact information of the penetration testing team and the client. This will help avoid any legal or ethical issues that may arise from trespassing, breaking and entering, or unauthorized access. The other options are not valid reasons for carrying the engagement documents with them.
質問 # 82
A penetration tester ran a ping -A command during an unknown environment test, and it returned a 128 TTL packet. Which of the following OSs would MOST likely return a packet of this type?
- A. Apple
- B. Linux
- C. Windows
- D. Android
正解：C
解説：
The ping -A command sends an ICMP echo request with a specified TTL value and displays the response.
The TTL value indicates how many hops the packet can traverse before being discarded. Different OSs have different default TTL values for their packets. Windows uses 128, Apple uses 64, Linux uses 64 or 255, and Android uses 64. Therefore, a packet with a TTL of 128 is most likely from a Windows OS.
質問 # 83
User credentials were captured from a database during an assessment and cracked using rainbow tables. Based on the ease of compromise, which of the following algorithms was MOST likely used to store the passwords in the database?
- A. SHA-1
- B. PBKDF2
- C. bcrypt
- D. MD5
正解：D
質問 # 84
A penetration tester gains access to a system and is able to migrate to a user process:
Given the output above, which of the following actions is the penetration tester performing? (Choose two.)
- A. Mapping a share to a remote system
- B. Adding an additional IP address on the compromised system
- C. Building a scheduled task for execution
- D. Redirecting output from a file to a remote system
- E. Executing a file on the remote system
- F. Setting up a reverse shell from a remote system
- G. Creating a new process on all domain systems
正解：A、E
解説：
WMIC.exe is a built-in Microsoft program that allows command-line access to the Windows Management Instrumentation. Using this tool, administrators can query the operating system for detailed information about installed hardware and Windows settings, run management tasks, and even execute other programs or commands.
質問 # 85
A penetration tester conducts an Nmap scan against a target and receives the following results:
Which of the following should the tester use to redirect the scanning tools using TCP port 1080 on the target?
- A. ProxyChains
- B. Nessus
- C. OWASPZAP
- D. Empire
正解：A
解説：
Reference: https://www.codeproject.com/Tips/634228/How-to-Use-Proxychains-Forwarding-Ports
質問 # 86
......
CompTIA PenTest 試験（PT0-002）は、侵入テストにおける技術的な知識とスキルを検証するために設計された、世界的に認知された認定資格です。この試験は、攻撃型サイバーセキュリティのテスト、脆弱性管理、および分析技術について中級から上級レベルの専門知識を持つサイバーセキュリティ専門家向けに意図されています。この試験は、計画と範囲の設定、情報収集と脆弱性の特定、攻撃と悪用、レポートとコミュニケーションの5つのドメインをカバーしています。
最新の100%合格保証付きの素晴らしいPT0-002試験問題PDF：https://www.goshiken.com/CompTIA/PT0-002-mondaishu.html
練習サンプルと問題集と秘訣には2025年最新のPT0-002有効なテスト問題集：https://drive.google.com/open?id=1kg-4rFnVWTPFVCuLb6kQYE4k_2mQAjNj