[2025年06月18日] 最速準備で試験合格！PT0-002問題の事前予備
PT0-002のPDF問題集リアル2025最近更新された問題
質問 # 210
A mail service company has hired a penetration tester to conduct an enumeration of all user accounts on an SMTP server to identify whether previous staff member accounts are still active. Which of the following commands should be used to accomplish the goal?
- A. VRFY and TURN
- B. RCPT TO and VRFY
- C. EXPN and TURN
- D. VRFY and EXPN
正解：D
質問 # 211
During a vulnerability scanning phase, a penetration tester wants to execute an Nmap scan using custom NSE scripts stored in the following folder:
/home/user/scripts
Which of the following commands should the penetration tester use to perform this scan?
- A. nmap script /home/user/scripts
- B. nmap resume "not intrusive"
- C. nmap -load /home/user/scripts
- D. nmap script default safe
正解：A
解説：
The Nmap command in the question aims to use custom NSE scripts stored in a specific folder. The correct syntax for this option is to use the script argument followed by the path to the folder. The other commands are either invalid, use the wrong argument, or do not specify the folder path. References: Best PenTest+ certification study resources and training materials, CompTIA PenTest+ PT0-002 Cert Guide, 101 Labs - CompTIA PenTest+: Hands-on Labs for the PT0-002 Exam
質問 # 212
During an assessment, a penetration tester was able Jo get access on all target servers by attempting authentication using a service account key that was published on the intranet site as part of a standard procedure. Which of the following should the penetration tester recommend for this type of finding?
- A. Secrets management solution
- B. Password encryption
- C. Time-of-day restrictions
- D. Role-based access control
正解：A
質問 # 213
After compromising a system, a penetration tester wants more information in order to decide what actions to take next. The tester runs the following commands:
Which of the following attacks is the penetration tester most likely trying to perform?
- A. Container escape techniques
- B. Metadata service attack
- C. Resource exhaustion
- D. Credential harvesting
正解：B
解説：
The penetration tester is most likely trying to perform a metadata service attack, which is an attack that exploits a vulnerability in the metadata service of a cloud provider. The metadata service is a service that provides information about the cloud instance, such as its IP address, hostname, credentials, user data, or role permissions. The metadata service can be accessed from within the cloud instance by using a special IP address, such as 169.254.169.254 for AWS, Azure, and GCP. The commands that the penetration tester runs are curl commands, which are used to transfer data from or to a server. The curl commands are requesting data from the metadata service IP address with different paths, such as /latest/meta-data/iam/security- credentials/ and /latest/user-data/. These paths can reveal sensitive information about the cloud instance, such as its IAM role credentials or user data scripts. The penetration tester may use this information to escalate privileges, access other resources, or perform other actions on the cloud environment. The other options are not likely attacks that the penetration tester is trying to perform.
質問 # 214
A vulnerability assessor is looking to establish a baseline of all IPv4 network traffic on the local VLAN without a local IP address. Which of the following Nmap command sequences would best provide this information?
- A. sudonmap-sV-p 0-65535 0.0.0.0/0
- B. sudonmap-script=bro* -e ethO
- C. sudonmap-sV-sT -p 0-65535 -e ethO
- D. sudonmap-sF-script=* -e ethO
正解：B
解説：
The command sudo nmap -script=bro* -e ethO is the best choice for establishing a baseline of all IPv4 network traffic on the local VLAN without a local IP address. The -script=bro* specifies the use of scripts that can capture and analyze traffic, and -e ethO specifies the network interface to be used. This allows the vulnerability assessor to capture and analyze network traffic at a low level, which is essential for baseline analysis.
References:
* Nmap Scripting Engine (NSE)
* Nmap Network Interface Specification
質問 # 215
In Java and C/C++, variable initialization is critical because:
- A. the compiler will assign null to the variable, which will cause warnings and errors.
- B. the variable will not have an object type assigned to it.
- C. the unknown value, when used later, will cause unexpected behavior.
- D. the initial state of the variable creates a race condition.
正解：C
解説：
Variable initialization is the process of assigning a value to a variable at the time of declaration. In Java and C/C++, variable initialization is critical because if a variable is not initialized, it may contain a garbage value that is unpredictable and may lead to erroneous results or runtime errors when the variable is used later in the program. For example, if a variable is used in a mathematical expression or a conditional statement, the outcome may depend on the value of the variable. If the variable is not initialized, the outcome may be different each time the program is run, or the program may crash due to an invalid operation. Therefore, it is a good practice to always initialize variables before using them, or to check if they have been initialized before using them123. Reference:
* Different Ways to Initialize a Variable in C++, GeeksforGeeks article by Anshul Aggarwal
* Static variable initialization?, Stack Overflow answer by Pawet Hajdan
* A Guide to Java Initialization, Baeldung article by Eugen Paraschiv
質問 # 216
A company requires that all hypervisors have the latest available patches installed. Which of the following would BEST explain the reason why this policy is in place?
- A. To fix any misconfigurations of the hypervisor
- B. To provide protection against host OS vulnerabilities
- C. To reduce the probability of a VM escape attack
- D. To enable all features of the hypervisor
正解：C
解説：
A hypervisor is a type of virtualization software that allows multiple virtual machines (VMs) to run on a single physical host machine. If the hypervisor is compromised, an attacker could potentially gain access to all of the VMs running on that host, which could lead to a significant data breach or other security issues.
One common type of attack against hypervisors is known as a VM escape attack. In this type of attack, an attacker exploits a vulnerability in the hypervisor to break out of the VM and gain access to the host machine. From there, the attacker can potentially gain access to other VMs running on the same host.
By ensuring that all hypervisors have the latest available patches installed, the company can reduce the likelihood that a VM escape attack will be successful. Patches often include security updates and vulnerability fixes that address known issues and can help prevent attacks.
質問 # 217
A penetration tester managed to exploit a vulnerability using the following payload:
IF (1=1) WAIT FOR DELAY '0:0:15'
Which of the following actions would best mitigate this type ol attack?
- A. Parameterizing queries
- B. Encrypting passwords
- C. Sanitizing HTML
- D. Encoding output
正解：A
解説：
The payload used by the penetration tester is a type of blind SQL injection attack that delays the response of the database by 15 seconds if the condition is true. This can be used to extract information from the database by asking a series of true or false questions. To prevent this type of attack, the best practice is to use parameterized queries, which separate the user input from the SQL statement and prevent the injection of malicious code. Encrypting passwords, encoding output, and sanitizing HTML are also good security measures, but they do not directly address the SQL injection vulnerability. Reference:
The Official CompTIA PenTest+ Study Guide (Exam PT0-002), Chapter 5: Attacks and Exploits, Section 5.2: Perform Network Attacks, Subsection: SQL Injection, p. 235-237 Blind SQL Injection | OWASP Foundation, Description and Examples sections Time-Based Blind SQL Injection Attacks, Introduction and Microsoft SQL Server sections
質問 # 218
A penetration tester was brute forcing an internal web server and ran a command that produced the following output:
However, when the penetration tester tried to browse the URL http://172.16.100.10:3000/profile, a blank page was displayed.
Which of the following is the MOST likely reason for the lack of output?
- A. The tester did not run sudo before the command.
- B. The HTTP port is not open on the firewall.
- C. The web server is using HTTPS instead of HTTP.
- D. This URI returned a server error.
正解：B
質問 # 219
A penetration tester uncovers access keys within an organization's source code management solution. Which of the following would BEST address the issue? (Choose two.)
- A. Configuring multifactor authentication on the source code management system
- B. Setting up a secret management solution for all items in the source code management system
- C. Developing a secure software development life cycle process for committing code to the source code management system
- D. Creating a trigger that will prevent developers from including passwords in the source code management system
- E. Leveraging a solution to scan for other similar instances in the source code management system
- F. Implementing role-based access control on the source code management system
正解：B、C
解説：
Access keys are credentials that allow users to authenticate and authorize requests to a source code management (SCM) system, such as GitLab or AWS. Access keys should be kept secret and not exposed in plain text within the source code, as this can compromise the security and integrity of the SCM system and its data.
Some possible options for addressing the issue of access keys within an organization's SCM solution are:
* Setting up a secret management solution for all items in the SCM system: This is a tool or service that securely stores, manages, and distributes secrets such as access keys, passwords, tokens, certificates, etc. A secret management solution can help prevent secrets from being exposed in plain text within the source code or configuration files3456.
* Developing a secure software development life cycle (SDLC) process for committing code to the SCM system: This is a framework or methodology that defines how software is developed, tested, deployed, and maintained. A secure SDLC process can help ensure that best practices for security are followed throughout the software development process, such as code reviews, static analysis tools, vulnerability
* scanning tools, etc. A secure SDLC process can help detect and prevent access keys from being included in the source code before they are committed to the SCM system1.
質問 # 220
A penetration tester writes the following script:
Which of the following objectives is the tester attempting to achieve?
- A. Scan the system on the most used ports.
- B. Determine active hosts on the network.
- C. Set the TTL of ping packets for stealth.
- D. Fill the ARP table of the networked devices.
正解：B
質問 # 221
A penetration tester created the following script to use in an engagement:
However, the tester is receiving the following error when trying to run the script:
Which of the following is the reason for the error?
- A. The sys variable was not defined.
- B. The argv module was not imported.
- C. The sys module was not imported.
- D. The argv variable was not defined.
正解：C
解説：
The sys module is a built-in module in Python that provides access to system-specific parameters and functions, such as command-line arguments, standard input/output, and exit status. The sys module must be imported before it can be used in a script, otherwise an error will occur. The script uses the sys.argv variable, which is a list that contains the command-line arguments passed to the script. However, the script does not import the sys module at the beginning, which causes the error "NameError: name 'sys' is not defined". To fix this error, the script should include the statement "import sys" at the top. The other options are not valid reasons for the error.
質問 # 222
A penetration tester is looking for a vulnerability that enables attackers to open doors via a specialized TCP service that is used for a physical access control system. The service exists on more than 100 different hosts, so the tester would like to automate the assessment. Identification requires the penetration tester to:
Have a full TCP connection
Send a "hello" payload
Walt for a response
Send a string of characters longer than 16 bytes
Which of the following approaches would BEST support the objective?
- A. Employ an OpenVAS simple scan against the TCP port of the host.
- B. Perform a credentialed scan with Nessus.
- C. Create a script in the Lua language and use it with NSE.
- D. Run nmap -Pn -sV -script vuln <IP address>.
正解：C
解説：
Explanation
The Nmap Scripting Engine (NSE) is one of Nmap's most powerful and flexible features. It allows users to write (and share) simple scripts (using the Lua programming language ) to automate a wide variety of networking tasks. https://nmap.org Creating a script in the Lua language and using it with NSE would best support the objective of finding a vulnerability that enables attackers to open doors via a specialized TCP service that is used for a physical access control system. NSE (Nmap Scripting Engine) is a feature of Nmap that allows users to write and run scripts to automate tasks or perform advanced scans. Lua is a scripting language that NSE supports and can be used to create custom scripts for Nmap.
質問 # 223
A penetration tester is reviewing the security of a web application running in an laaS compute instance. Which of the following payloads should the tester send to get the running process credentials?
- A. file =.. / .. / .. /proc/self/environ
- B. file='%20or%2054365=54365 ;--
- C. file=http://169.254.169.254/latest/meta-data/
- D. file=http://192.168.
1. 78?+document.cookie
正解：C
解説：
The payload D is used to access the metadata service of the laaS compute instance, which can provide information about the running process credentials, such as the instance ID, the service account, and the SSH keys. This is a common technique for exploiting cloud-based web applications that do not properly secure their metadata service. The other payloads are not effective for this purpose, as they either try to access the cookie data (A), the environment variables (B), or perform a SQL injection attack , which are not related to the running process credentials. References:
*The Official CompTIA PenTest+ Study Guide (Exam PT0-002) eBook, Chapter 7, Lesson 7.2, Topic 7.2.3:
Perform attacks on cloud technologies
*Set up service authentication - Azure Machine Learning, Section: Managed identity
*Set up authentication - Azure Machine Learning, Section: Managed identity
*Compute Engine IAM roles and permissions - Google Cloud, Section: Service accounts
質問 # 224
During the reconnaissance phase, a penetration tester obtains the following output:
Reply from 192.168.1.23: bytes=32 time<54ms TTL=128
Reply from 192.168.1.23: bytes=32 time<53ms TTL=128
Reply from 192.168.1.23: bytes=32 time<60ms TTL=128
Reply from 192.168.1.23: bytes=32 time<51ms TTL=128
Which of the following operating systems is MOST likely installed on the host?
- A. NetBSD
- B. Windows
- C. macOS
- D. Linux
正解：B
解説：
The output shows the result of a ping command, which sends packets to a host and receives replies. The ping command can be used to determine if a host is alive and reachable on the network. One of the information that the ping command displays is the Time to Live (TTL) value, which indicates how many hops a packet can travel before it is discarded. The TTL value can also be used to guess the operating system of the host, as different operating systems have different default TTL values. In this case, the TTL value is 128, which is the default value for Windows operating systems. Linux and macOS have a default TTL value of 64, while NetBSD has a default TTL value of 255.
質問 # 225
Penetration tester is developing exploits to attack multiple versions of a common software package. The versions have different menus and )ut.. they have a common log-in screen that the exploit must use. The penetration tester develops code to perform the log-in that can be each of the exploits targeted to a specific version. Which of the following terms is used to describe this common log-in code example?
- A. Library
- B. Sub application
- C. Conditional
- D. Dictionary
正解：A
解説：
Explanation
The term that is used to describe the common log-in code example is library, which is a collection of reusable code or functions that can be imported or called by other programs or scripts. A library can help simplify or modularize the code development process by providing common or frequently used functionality that can be shared across different programs or scripts. In this case, the penetration tester develops a library of code to perform the log-in that can be imported or called by each of the exploits targeted to a specific version of the software package. The other options are not valid terms that describe the common log-in code example.
Conditional is a programming construct that executes a block of code based on a logical condition or expression, such as if-else statements. Dictionary is a data structure that stores key-value pairs, where each key is associated with a value, such as a Python dictionary. Sub application is not a standard programming term, but it may refer to an application that runs within another application, such as a web application.
質問 # 226
A penetration tester is conducting a penetration test and discovers a vulnerability on a web server that is owned by the client. Exploiting the vulnerability allows the tester to open a reverse shell. Enumerating the server for privilege escalation, the tester discovers the following:
Which of the following should the penetration tester do NEXT?
- A. Close the reverse shell the tester is using.
- B. Investigate the high numbered port connections.
- C. Note this finding for inclusion in the final report.
- D. Contact the client immediately.
正解：B
解説：
Explanation
The image shows the output of the netstat -antu command, which displays active internet connections for the TCP and UDP protocols. The output shows that there are four established TCP connections and two listening UDP connections on the host. The established TCP connections have high numbered ports as their local addresses, such as 49152, 49153, 49154, and 49155. These ports are in the range of ephemeral ports, which are dynamically assigned by the operating system for temporary use by applications or processes. The foreign addresses of these connections are also high numbered ports, such as 4433, 4434, 4435, and 4436. These ports are not well-known or registered ports for any common service or protocol. The combination of high numbered ports for both local and foreign addresses suggests that these connections are suspicious and may indicate a backdoor or a covert channel on the host. Therefore, the penetration tester should investigate these connections next to determine their nature and purpose. The other options are not appropriate actions for the penetration tester at this stage.
質問 # 227
During an assessment, a penetration tester found a suspicious script that could indicate a prior compromise.
While reading the script, the penetration tester noticed the following lines of code:
Which of the following was the script author trying to do?
- A. Disable NIC.
- B. List processes.
- C. Spawn a local shell.
- D. Change the MAC address
正解：C
解説：
The script author was trying to spawn a local shell by using the os.system() function, which executes a command in a subshell. The command being executed is "/bin/bash", which is the path to the bash shell, a common shell program on Linux systems. The script author may have wanted to spawn a local shell to gain more control or access over the compromised system, or to execute other commands that are not possible in the original shell. The other options are not plausible explanations for what the script author was trying to do.
質問 # 228
......
PT0-002問題集と練習テスト（460試験問題)：https://www.goshiken.com/CompTIA/PT0-002-mondaishu.html
リリースCompTIA PT0-002更新された問題PDF：https://drive.google.com/open?id=1PQIZSiAwiZCueHue_rm9YA9vISFRm8Im