PT0-003 practice questions 251–260

1. Question 251 · 335 in bank

   During a web application assessment, a penetration tester accesses the site unauthenticated and receives the following Set-Cookie on the first response: auth=yYKGORbrpabgr842ajbvrpbptaui42342 When the tester logs in, the server sends only one Set-Cookie header, and the value is exactly the same as shown above. Which of the following vulnerabilities has the tester discovered?

   • AJWT manipulation
   • BCookie poisoning
   • CSession fixation
   • DCollision attack

   Show answer

   Answer: C

   Next question

2. Question 252 · 335 in bank

   An internal penetration tester is on site assessing network access for company-owned mobile devices. Which of the following would be the best tool to identify the available networks?

   • AWireshark
   • BtheHarvester
   • CRecon-ng
   • DWiGLE.net

   Show answer

   Answer: D

   Next question

3. Question 253 · 335 in bank

   A penetration tester conducts a scan on an exposed Linux web server and gathers the following data:

   

   Additional notes: • Directory listing enabled on /admin • Apache mod_cgi enabled • No authentication required to access /cgi-bin/debug.sh • X-Powered-By: PHP/5.6.40-0+deb8u12 Which of the following is the most effective action to take?

   • ALaunch a payload using msfvenom and upload it to the /admin directory.
   • BReview the contents of /cgi-bin/debug.sh.
   • CUse NFS client tools against exposed rpcbind.
   • DAttempt a brute-force attack against OpenSSH 7.2p2.

   Show answer

   Answer: B

   Next question

4. Question 254 · 335 in bank

   A penetration tester gains access to a host with many applications that load at startup and run as SYSTEM. The penetration tester runs a command and receives the following output:

   

   Which of the following attacks will most likely allow the penetration tester to escalate privileges?

   • ACredential dumping
   • BLocal file inclusion
   • CUnquoted service path injection
   • DProcess hijacking

   Show answer

   Answer: C

   Next question

5. Question 255 · 335 in bank

   A penetration tester obtains local administrator access on a Windows system and wants to attempt lateral movement. The system exists within a Windows Workgroup environment. Which of the following actions should the tester take?

   • ACreate a malicious certificate.
   • BDump credentials from memory.
   • CCraft Kerberos tickets.
   • DList potential privilege escalation paths.

   Show answer

   Answer: B

   Next question

6. Question 256 · 335 in bank

   A penetration tester would like to collect permission details for objects within the domain. The tester has a valid AD user and access to an internal PC. Which of the following sets of steps is the best way for the tester to accomplish the desired outcome?

   • A1. Escalate privileges. 2. Execute Rubeus. 3. Run a Cypher query on Rubeus to get the results.
   • B1. Run SharpHound. 2. Install CrackMapExec. 3. Perform a CrackMapExec database query on CME to get the results.
   • C1. Run SharpHound 2. Install BloodHound. 3. Perform a Cypher query on BloodHound to get the results.
   • D1. Escalate privileges. 2. Get Windows Registry data. 3. Perform a query to get results.

   Show answer

   Answer: C

   Next question

7. Question 257 · 335 in bank

   During an engagement, a penetration tester discovers a web application vulnerability that affects multiple devices. The tester creates and runs the following script:

   

   Which of the following best describes what the tester is attempting to do?

   • AStaging payloads to make bind shells
   • BCreating a backdoor on several weak targets
   • CAdding a password for the root user on the targets
   • DGenerating SSH keys to decrypt data on each target

   Show answer

   Answer: B

   Next question

8. Question 258 · 335 in bank

   During an assessment, a penetration tester manages to get RDP access via a low-privilege user. The tester attempts to escalate privileges by running the following commands: Import-Module .\PrintNightmare.psi Invoke-Nightmare -NewUser "hacker" -NewPassword "Password123!" -DriverName "Print" The tester attempts to further enumerate the host with the new administrative privileges by using the runas command. However, the access level is still low. Which of the following actions should the penetration tester take next?

   • ALog off and log on with the hacker account.
   • BAttempt to add another user.
   • CBypass the execution policy.
   • DAdd a malicious printer driver.

   Show answer

   Answer: A

   Next question

9. Question 259 · 335 in bank

   A penetration tester attempts to obtain the preshared key for a client's wireless network. Which of the following actions will most likely aid the tester?

   • ADeploying an evil twin with a WiFi Pineapple
   • BPerforming a password spraying attack with Hydra
   • CSetting up a captive portal using SET
   • DDeauthenticating clients using aireplay-ng

   Show answer

   Answer: D

   Next question

10. Question 260 · 335 in bank

    A penetration tester conducts OSINT for a client and discovers the robots.txt file explicitly blocks a major search engine. Which of the following would most likely help the penetration tester achieve the objective?

    • AModifying the WAF
    • BUtilizing a CSRF attack
    • CChanging the robots.txt file
    • DLeveraging a competing provider

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PT0-003 practice, question 251. 335 questions available.