PT0-003 — questions

A penetration tester is investigating a buffer overflow on the myfile binary. The tester wants to send a payload to help identify the exact offset to inject the memory address to take control of the buffer. Which of the following would allow the penetration tester to quickly identify the offset?

A penetration tester is attempting to exfiltrate sensitive data from a client environment without alerting the client’s blue team. Which of the following exfiltration methods most likely remain undetected?

A penetration tester reviews the following output: Which of the following most likely describes the function of this system?

During a penetration test for a client that has a diverse infrastructure, the tester scans the network using Nmap and observes the following output: Which of the following would most likely be the target device?

A tester compromises a shared host that is manually audited every week due to the absence of a SIEM. Which of the following is the best way to reduce the chances of being detected?

A penetration tester wants to verify whether passwords from a leaked password list can be used to access an SSH server as a legitimate user. Which of the following is the most appropriate tool for this task?

A penetration tester discovers a deprecated directory in which files are accessible to anyone. Which of the following would most likely assist the penetration tester in finding sensitive information without raising suspicion?

A penetration tester gains initial access to a Windows workstation on a client’s network. The tester wants to determine the next target but does not want to install software on the workstation. Which of the following is the best tool to list potential targets?

A penetration tester completes an authenticated vulnerability scan of a host and receives the following results: Which of the following is most likely to cause stability when a session is created on a target machine?

A penetration tester uses the Intruder tool from the Burp Suite Community Edition while assessing a web application. The tester notices the test is taking too long to complete. Which of the following tools can the tester use to accelerate the test and achieve similar results?

A penetration tester is ready to add shellcode for a specific remote executable exploit. The tester is trying to prevent the payload from being blocked by anti-malware that is running on the target. Which of the following commands should the tester use to obtain shell access?

A Chief Information Security Officer wants to automate adversarial activities from penetration tests that are relevant to the organization. Which of the following should a penetration tester do first to accomplish this task?

A penetration tester identifies an exposed corporate directory containing first and last names and phone numbers for employees. Which of the following attack techniques would be the most effective to pursue if the penetration tester wants to compromise user accounts?

During an assessment, a penetration tester obtains access to a Microsoft SQL server using sqlmap and runs the following command: SQL> xp_cmdshell whoami /all - Which of the following is the tester trying to do?

During a security assessment of a network device, a penetration tester performs the following: Which of the following actions should the tester take to correct the vulnerability scan attempt?

During an assessment, a penetration tester runs the following command from a Linux machine: GetUsersSPNs.py -dc-ip 172.16.1.1 DOMAIN.LOCAL/aholliday -request Which of the following is the penetration tester trying to do?

A penetration tester gains low-privilege shell access to a host and discovers a world-writable script that is run regularly as root. The tester runs the following command: openssl passwd password $l$OjxLvZ85$Fdr51vn/Z4zXWsQR/Xrj . The tester then adds the following line to the world-writable script echo 'root2:$l$OjxLvZ85$Fdr51vn/Z4zXWsQR/Xrj1001:1001:,,,: /root:/bin/bash" >> /etc/passwd Which of the following should the penetration tester do to enable this exploit to work correctly?

A penetration tester successfully phishes a user and compromises a domain-joined endpoint. The tester enumerates the domain controller and discovers that Group Policy Preferences are in use. The tester also finds that the version of the domain controllers is Windows Server 2012. The tester wants to use the fastest possible method of pivoting successfully to multiple production servers joined to the domain. Which of the following is the best way to achieve this goal?

A penetration tester gains access to the target network and observes a running SSH server. Which of the following techniques should the penetration tester use to obtain the version of SSH running on the target server?

A company that uses an insecure corporate wireless network is concerned about security. Which of the following is the most likely tool a penetration tester could use to obtain initial access?