PT0-003 practice questions 211–220

1. Question 211 · 335 in bank

   A penetration tester uses the Intruder tool from the Burp Suite Community Edition while assessing a web application. The tester notices the test is taking too long to complete. Which of the following tools can the tester use to accelerate the test and achieve similar results?

   • ATruffleHog
   • BPostman
   • CWfuzz
   • DWPScan

   Show answer

   Answer: C

   Next question

2. Question 212 · 335 in bank

   A Chief Information Security Officer wants to automate adversarial activities from penetration tests that are relevant to the organization. Which of the following should a penetration tester do first to accomplish this task?

   • ADeploy a command-and-control server with custom profiles to facilitate execution.
   • BUse Python 3 with added testing libraries and script the relevant action to test.
   • CUtilize the PowerShell PowerView tool with custom scripting additions based on test results.
   • DImplement Atomic Red Team to chain critical TTPs and perform the test.

   Show answer

   Answer: D

   Next question

3. Question 213 · 335 in bank

   A penetration tester identifies an exposed corporate directory containing first and last names and phone numbers for employees. Which of the following attack techniques would be the most effective to pursue if the penetration tester wants to compromise user accounts?

   • ASmishing
   • BImpersonation
   • CTailgating
   • DWhaling

   Show answer

   Answer: A

   Next question

4. Question 214 · 335 in bank

   During an assessment, a penetration tester obtains access to a Microsoft SQL server using sqlmap and runs the following command: SQL> xp_cmdshell whoami /all - Which of the following is the tester trying to do?

   • AList database tables
   • BShow logged-in database users
   • CEnumerate privileges
   • DDisplay available SQL commands

   Show answer

   Answer: C

   Next question

5. Question 215 · 335 in bank

   During a security assessment of a network device, a penetration tester performs the following:

   

   Which of the following actions should the tester take to correct the vulnerability scan attempt?

   • AEnable promiscuous mode
   • BModify -Tuning to 1
   • CVerify the ports used
   • DRemove the -evasion flag

   Show answer

   Answer: C

   Next question

6. Question 216 · 335 in bank

   During an assessment, a penetration tester runs the following command from a Linux machine: GetUsersSPNs.py -dc-ip 172.16.1.1 DOMAIN.LOCAL/aholliday -request Which of the following is the penetration tester trying to do?

   • ACrack the user password for aholliday.
   • BDownload all TGS tickets for offline processing.
   • CPerform a pass-the-hash attack using the hash for aholliday.
   • DPerform password spraying.

   Show answer

   Answer: B

   Next question

7. Question 217 · 335 in bank

   A penetration tester gains low-privilege shell access to a host and discovers a world-writable script that is run regularly as root. The tester runs the following command: openssl passwd password $l$OjxLvZ85$Fdr51vn/Z4zXWsQR/Xrj . The tester then adds the following line to the world-writable script echo 'root2:$l$OjxLvZ85$Fdr51vn/Z4zXWsQR/Xrj1001:1001:,,,: /root:/bin/bash" >> /etc/passwd Which of the following should the penetration tester do to enable this exploit to work correctly?

   • AUse only a single redirect to /etc/password.
   • BGenerate the password using md5sum.
   • CLog in to the host using SSH
   • DChange the 1001 entries to 0.

   Show answer

   Answer: D

   Next question

8. Question 218 · 335 in bank

   A penetration tester successfully phishes a user and compromises a domain-joined endpoint. The tester enumerates the domain controller and discovers that Group Policy Preferences are in use. The tester also finds that the version of the domain controllers is Windows Server 2012. The tester wants to use the fastest possible method of pivoting successfully to multiple production servers joined to the domain. Which of the following is the best way to achieve this goal?

   • AScan the domain controller and locate an RCE using a Metasploit module with a reverse shell
   • BRun Hydra to password spray any dumped credentials from the initial host across subnets
   • CUse BloodHound to look for escalation paths against the AD environment
   • DFind the SYSVOL share for hashes with findstr /i and decrypt using the published key

   Show answer

   Answer: D

   Next question

9. Question 219 · 335 in bank

   A penetration tester gains access to the target network and observes a running SSH server. Which of the following techniques should the penetration tester use to obtain the version of SSH running on the target server?

   • ANetwork sniffing
   • BIP scanning
   • CBanner grabbing
   • DDNS enumeration

   Show answer

   Answer: C

   Next question

10. Question 220 · 335 in bank

    A company that uses an insecure corporate wireless network is concerned about security. Which of the following is the most likely tool a penetration tester could use to obtain initial access?

    • AResponder
    • BMetasploit
    • CNetcat
    • DNmap

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PT0-003 practice, question 211. 335 questions available.