CompTIA PT0-001 Study Guides 2021

NEW QUESTION 1
While prioritizing findings and recommendations for an executive summary, which of the following considerations would De MOST valuable to the client?

• A. Levels of difficulty to explogt identified vulnerabilities
• B. Time taken to accomplish each step
• C. Risk tolerance of the organization
• D. Availability of patches and remediations

Answer: C

NEW QUESTION 2
A tester has determined that null sessions are enabled on a domain controller. Which of the following attacks can be performed to leverage this vulnerability?

• A. RID cycling to enumerate users and groups
• B. Pass the hash to relay credentials
• C. Password brute forcing to log into the host
• D. Session hijacking to impersonate a system account

Answer: C

NEW QUESTION 3
A penetration tester is utilizing social media to gather information about employees at a company. The tester has created a list of popular words used in employee profile s. For which of the following types of attack would this information be used?

• A. Explogt chaining
• B. Session hijacking
• C. Dictionary
• D. Karma

Answer: B

NEW QUESTION 4
After a recent penetration test, a company has a finding regarding the use of dictionary and seasonal passwords by its employees. Which of the following is the BEST control to remediate the use of common dictionary terms?

• A. Expand the password length from seven to 14 characters
• B. Implement password history restrictions
• C. Configure password filters
• D. Disable the accounts after five incorrect attempts
• E. Decrease the password expiration window

Answer: A

NEW QUESTION 5
A penetration tester is preparing to conduct API testing Which of the following would be MOST helpful in preparing for this engagement?

• A. NiktO
• B. WAR
• C. W3AF
• D. Swagger

Answer: A

NEW QUESTION 6
A penetration tester locates a few unquoted service paths during an engagement. Which of the following can the tester attempt to do with these?

• A. Attempt to crack the service account passwords.
• B. Attempt DLL hijacking attacks.
• C. Attempt to locate weak file and folder permissions.
• D. Attempt privilege escalation attack

Answer: D

NEW QUESTION 7
Which of Ihe following commands would allow a penetration tester to access a private network from the Internet in Metasplogt?

• A. set rhost 192.168.1.10
• B. run autoroute -a 192.168.1.0/24
• C. db_nm«p -iL /tmp/privatehoots . txt
• D. use auxiliary/servet/aocka^a

Answer: D

NEW QUESTION 8
A tester has captured a NetNTLMv2 hash using Responder Which of the following commands will allow the tester to crack the hash using a mask attack?

• A. hashcat -m 5600 -r rulea/beat64.rule hash.txt wordliat.txt
• B. hashcax -m 5€00 hash.txt
• C. hashc&t -m 5600 -a 3 haah.txt ?a?a?a?a?a?a?a?a
• D. hashcat -m 5600 -o reaulta.txt hash.txt wordliat.txt

Answer: A

NEW QUESTION 9
When performing compliance-based assessments, which of the following is the MOST important Key consideration?

• A. Additional rate
• B. Company policy
• C. Impact tolerance
• D. Industry type

Answer: A

NEW QUESTION 10
A penetration tester runs the following from a compromised box 'python -c -import pty;Pty.sPawn( "/bin/bash").' Which of the following actions is the tester taking?

• A. Removing the Bash history
• B. Upgrading the shell
• C. Creating a sandbox
• D. Capturing credentials

Answer: A

NEW QUESTION 11
An assessor begins an internal security test of the Windows domain internal. comptia. net. The assessor is given network access via DHCP, but is not given any network maps or target IP addresses. Which of the following commands can the assessor use to find any likely Windows domain controllers?

• A. Option A
• B. Option B
• C. Option C
• D. Option D

Answer: A

NEW QUESTION 12
The results of a basic compliance scan show a subset of assets on a network. This data differs from what is shown on the network architecture diagram, which was supplied at the beginning of the test. Which of the following are the MOST likely causes for this difference? (Select TWO)

• A. Storage access
• B. Limited network access
• C. Misconfigured DHCP server
• D. Incorrect credentials
• E. Network access controls

Answer: A

NEW QUESTION 13
DRAG DROP
Place each of the following passwords in order of complexity from least complex (1) to most complex (4), based on the character sets represented Each password may be used only once

Answer:

Explanation:
Zverlory
Zverl0ry
zv3rlory
Zv3r!0ry

NEW QUESTION 14
Which of the following reasons does penetration tester needs to have a customer's point-of -contact information available at all time? (Select THREE).

• A. To report indicators of compromise
• B. To report findings that cannot be explogted
• C. To report critical findings
• D. To report the latest published explogts
• E. To update payment information
• F. To report a server that becomes unresponsive
• G. To update the statement o( work
• H. To report a cracked password

Answer: DEF

NEW QUESTION 15
A penetration tester has compromised a host. Which of the following would be the correct syntax to create a Netcat listener on the device?

• A. nc -lvp 4444 /bin/bash
• B. nc -vp 4444 /bin/bash
• C. nc -p 4444 /bin/bash
• D. nc -lp 4444 -e /bin/bash

Answer: D

NEW QUESTION 16
During an internal network penetration test, a tester recovers the NTLM password hash tor a user known to have full administrator privileges on a number of target systems Efforts to crack the hash and recover the plaintext password have been unsuccessful Which of the following would be the BEST target for continued explogtation efforts?

• A. Operating system Windows 7 Open ports: 23, 161
• B. Operating system Windows Server 2021 Open ports: 53, 5900
• C. Operating system Windows 8 1Open ports 445, 3389
• D. Operating system Windows 8 Open ports 514, 3389

Answer: C

NEW QUESTION 17
Which of the following is the reason why a penetration tester would run the chkconfig --del servicename command at the end of an engagement?

• A. To remove the persistence
• B. To enable penitence
• C. To report persistence
• D. To check for persistence

Answer: A

NEW QUESTION 18
A penetration tester is required to perform OSINT on staff at a target company after completing the infrastructure aspect. Which of the following would be the BEST step for the penetration tester to take?

• A. Obtain staff information by calling the company and using social engineering techniques.
• B. Visit the client and use impersonation to obtain information from staff.
• C. Send spoofed emails to staff to see if staff will respond with sensitive information.
• D. Search the Internet for information on staff such as social networking site

Answer: C