PT0-002 — Frequently Asked Questions

What a dumb question again, CompTIA want us to be confused about whether or not this is a physical pentest by saying "routine pentest of a physical data centre". Wtf does that mean? Is it a physical pentest? If so, then the answer is biometric control, and the 5 year old firewall configuration is th

B. file=../../../proc/self/environ: This payload attempts to traverse directories and access the /proc/self/environ file, which contains environment variables of the current process. These variables can include sensitive information such as credentials. Explanation: A. file=http://192.168.1.78?+docu

Wrong password || right password = Wrong password OR right password. The "right password" command should only execute if the wrong password command doesn't execute during that loop iteration, therefore its an OR operation ||

B is the answer. C is wrong.. --max-rate is per SEC, not Min. Thus, setting --max-rate 60 is 60 per sec or 3,600 per min.

it socks being one of the first to comments u dont get the opinion of the others C. NDA (Non-Disclosure Agreement) The penetration tester most likely breached the NDA (Non-Disclosure Agreement) by requesting a CVE number without express authorization. NDA agreements typically prohibit the disclosure

I'm confused, as always. I would say D, but perhaps for a company is not acceptable to has an end-of-life application running, so the team should tell immediately to them. What do you think?

Explanation: -sn disables port scanning and performs host discovery only. grep "Nmap scan" filters the output to lines containing the phrase “Nmap scan.” awk '{print $5}' extracts the fifth field (IP addresses) from the filtered lines1. This provides a list of active hosts.

B. Burp Suite. From the Sybex PT0-002 Study guide. Burpsuite is also listed in the mobile section of Pentest+ outline.

What's the point of having an emergency contact if you're not going to contact them when there's an emergency? If not this then what would be constitute contacting the emergency contact?

This command uses certutil, a command-line utility that can be used to manage certificates in Windows, to download a file from a specified URL. In this context, the file being downloaded is accesschk64.exe, a utility from Sysinternals that can be used to check for misconfigured service permissions.

The technique described is LOLBin, Living-off-the-land binary. If the pentester was just executing the fgdump.exe then yes it would be privilege escalation, but all they are doing is downloading the file in this command.

'id' should be a string as it is in option B. These all also contain a typo - "url-'http...." should be "url='http...."

Reversal is worse case compared to known as in reversal the the environment is known AND the target will never be informed of how and when the test will be conducted. Problem is its not in the book but you have to read the OSSTM v3 manual, the pdf link is in the book but the link is dead. If you sea

Using multiple IPs may bypass basic IP-based blocking, but it does not bypass the WAF itself, which still inspects traffic for malicious patterns. The API may not be being DOS'ed, it could just be being exploited, in that case the WAF will still block all exploit attempts no matter what IP it comes

-t run TASKS number of connects in parallel per target (default: 16) -T run TASKS connects in parallel overall (for -M, default: 64)

C is the correct answer. Attestation before Client acceptance.

B. To monitor lessons learned A penetration testing diary helps track what worked, what didn't, and any unexpected behaviors. This can later be used in the Lessons Learned report. To facilitate post engagement cleanup, the steps taken will be recorded more formally, to avoid any problems if the test

If the question was asking about the webserver and not the database server, then it's a toss up between Burp Suite, Nessus and Nikto, all of these will help in detecting webserver vulnerabilities. That leaves only SQLMap for if its a database server they are referring to. Because of how hard it is t

I am going D. A pentester doesn't care what the businesses goals are and that doesn't affect the criticality of the vulnerabilities.

I'm going C here. Here's why: A: -sY will use the SCTP protocol and will not give reliable results on the list of TCP ports you are scanning for. B: -sS will obviously not work because it replies on the SYN for its scan. C: -sA while this will not return if the ports are open or not, you will be abl

A. Metadata service attack: By accessing the metadata service, the tester can retrieve sensitive information about the instance, including IAM roles and credentials, network configurations, and other details that can be exploited further. • B. Container escape techniques: This is related to breaking

The -sX option specifies a Xmas scan, which sends packets with the FIN, PSH, and URG flags set. The target’s response to such a scan provides information about the state of the ports. When the penetration tester reviews the packet capture in Wireshark and notices that the target responds with an RST

A. If a variable in C/C++ is not initialized, it contains whatever value happens to be at that memory location. Using this uninitialized variable can lead to unpredictable and incorrect program behavior. In Java, local variables must be initialized before use, but instance variables are automaticall

nmap command indicate that the server is using several ciphers, all of which include the RC4 algorithm. RC4 is considered insecure and has known vulnerabilities. Therefore, the penetration tester should include the following in the report: A. Old, insecure ciphers are in use: The use of RC4 is consi

After performing a web penetration test, using the OWASP (Open Web Application Security Project) standards or methodologies would be the best choice for ranking the findings by criticality. OWASP is renowned for its comprehensive documentation and guidelines on web application security, including th

B. Impacket: Impacket is a collection of Python classes for working with network protocols. It allows for the creation and manipulation of network packets and provides a variety of tools and utilities for network interaction, making it the correct choice. A. Responder: This is a tool used for LLMNR,

C. This technique involves pretending to be a high-ranking executive (e.g., CEO, CFO) to manipulate employees into performing actions such as installing remote access software or providing sensitive information. This is highly likely to lead to a remote session if employees are convinced of the impe

The next step in the engagement after reviewing initial findings with the client is to attest the findings and deliver the report. This report provides a detailed account of vulnerabilities, risks, and recommended actions. It serves as a crucial communication tool for stakeholders and guides subsequ

Port knocking can certainly be detected, if you don't have the right combination of ports to knock you will make a lot of noise trying to guess it. The question doesn't state that we know the sequence, even if we did, this is not passive.

C. Notify the primary contact immediately: This is the most appropriate action. The primary contact needs to be informed about this significant security risk as soon as possible so that they can take immediate action to mitigate the risk. • A. Continue the assessment and mark the finding as critical