PT0-003 practice questions 231–240

1. Question 231 · 335 in bank

   A penetration tester wants to automatically enumerate all ciphers permitted on TLS/SSL configurations across a client's internet-facing and internal web servers. Which of the following tools or frameworks best supports this objective?

   • ANmap Scripting Engine
   • BShodan
   • CImpacket
   • DNetcat
   • EBurp Suite

   Show answer

   Answer: A

   Next question

2. Question 232 · 335 in bank

   A penetration tester gains initial access to a system and gets ready to perform additional reconnaissance. The tester cannot use Nmap on the system they used to gain initial access. The tester develops the following script to scan a network range:

   

   The tester wants to modify the current script so multiple ports can be scanned. The tester enters a comma-separated list of ports in the port variable. Which of the following should the tester do next to provide the desired functionality?

   • ADuplicate the $socket code block and modify $port for each new port variable.
   • BAdd a new Foreach loop directly beneath the other Foreach loop and enclose with {...}.
   • CAdd $p in $port to the initial Foreach loop directly following the $range variable.
   • DAdd $(Each ($p in $port) on the line before $socket and enclose with {....}.

   Show answer

   Answer: B

   Next question

3. Question 233 · 335 in bank

   After obtaining a reverse shell, a penetration tester identifies a locally cloned Git repository that contains thousands of files and directories on a Windows machine. The tester suspects there could be sensitive information related to "ProjectX." Which of the following commands should the tester use in a script to identify potential files to produce the best results?

   • Agc * | select "ProjectX"
   • Bdir /R | findstr "ProjectX"
   • CGet-ChildItem * | Select-String "ProjectX"
   • Dgci -Path . -Recurse | Select-String -Pattern "ProjectX"

   Show answer

   Answer: D

   Next question

4. Question 234 · 335 in bank

   During an engagement, a penetration tester receives a list of target systems and wants to enumerate them for possible vulnerabilities. The tester finds the following script on the internet:

   

   After running the script, the tester runs the following command:

   

   Which of the following should the tester do next?

   • AReplace line 4 with the following: api = "/api/v2/getToken/data/id/None"
   • BInsert the following line before line 6 target = target.split(" ")[0]
   • CInsert the following line before line 7: url = url.lstrip('http://')
   • DReplace line 7 with the following response = requests.posts(url, api)

   Show answer

   Answer: B

   Next question

5. Question 235 · 335 in bank

   During a penetration test, the tester wants to obtain public information that could be used to compromise the organization's cloud infrastructure. Which of the following is the most effective resource for the tester to use for this purpose?

   • ASensitive documents on a public cloud
   • BOpen ports on the cloud infrastructure
   • CRepositories with secret keys
   • DSSL certificates on websites

   Show answer

   Answer: C

   Next question

6. Question 236 · 335 in bank

   A tester obtains access to an application server via a Java vulnerability and must maintain persistence. The server has a file integrity monitoring control enabled, and the tester cannot disable it. Which of the following actions should the tester take to establish persistence?

   • ADeploy a rootkit.
   • BDrop a beacon.
   • CStart a web shell.
   • DSchedule a task.

   Show answer

   Answer: D

   Next question

7. Question 237 · 335 in bank

   A penetration tester performs the following scan:

   

   The tester then manually uses snmpwalk against port 161 and receives valid SNMP responses. Which of the following best explains the scan result for port 161?

   • AThe SNMP daemon delayed its response beyond Nmap's UDP scan timeout.
   • BNmap marked the port as open|filtered because no response was received.
   • CThe scanned host applied rate limiting to its responses to prevent UDP fingerprinting.
   • DThe Nmap scan lacked root privileges, which reduced packet inspection accuracy.

   Show answer

   Answer: B

   Next question

8. Question 238 · 335 in bank

   Which of the following components of a penetration test report most directly contributes to prioritizing remediations?

   • AProof of concept
   • BRisk scoring
   • CAttack narrative
   • DExecutive summary

   Show answer

   Answer: B

   Next question

9. Question 239 · 335 in bank

   A penetration tester must gain entry to a client's office building without raising attention. Which of the following should be the tester's first step?

   • AInteracting with security employees to clone a badge
   • BTrying to enter the back door after hours on a weekend
   • CCollecting building blueprints to run a site survey
   • DConducting surveillance of the office to understand foot traffic

   Show answer

   Answer: D

   Next question

10. Question 240 · 335 in bank

    A penetration tester poses as a member of a company's human resources department. The tester wants to obtain credentials by sending an email containing a link that redirects to a fake website. Which of the following commands is the best way to determine whether the email is flagged as malicious?

    • AResolve-DnsName -Name company.com -Type A
    • Bdig axfr company.com @spf.company.com
    • Cnslookup -q=txt _dmarc.company.com
    • Ddig MX company.com

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PT0-003 practice, question 231. 335 questions available.