PT0-003 — questions

A penetration tester observes an employee logging in to their laptop. The penetration tester wants to gain access to information with the least intervention. Which of the following actions should the penetration tester take?

A penetration tester is evaluating a company's cybersecurity preparedness. The tester wants to acquire valid credentials using a social engineering campaign. Which of the following tools and techniques are most applicable in this scenario? (Choose two.)

Which of the following would most likely reduce the possibility of a client rejecting the final deliverable for a penetration test?

A penetration tester attempts to access a domain-joined Windows file server that requires authentication for access. Which of the following will most likely assist in gaining access?

A penetration tester is conducting an on-site review and wants to capture SSO credentials for staff in a specific department. Which of the following attack types would be most effective for this task?

A penetration tester wants to gather the names of potential phishing targets who have access to sensitive data. Which of the following would best meet this goal?

A penetration tester exports the following CSV data from a scanner. The tester wants to parse the data using Bash and input it into another tool. Which of the following will provide the intended output?

Which of the following is the most likely LOLBin to be used to perform an exfiltration on a Microsoft Windows environment?

A penetration tester tries to perform an active reconnaissance on a client's IP with Nmap and receives the following results: Which of the following is the best port for the penetration tester to investigate further without valid credentials?

During an internal engagement, a penetration tester compromises a Linux server. The tester wants to maintain persistence without creating or modifying files on the disk or startup scripts, since these are monitored by integrity tools. Which of the following techniques best meets these requirements?

During a web application assessment, a penetration tester accesses the site unauthenticated and receives the following Set-Cookie on the first response: auth=yYKGORbrpabgr842ajbvrpbptaui42342 When the tester logs in, the server sends only one Set-Cookie header, and the value is exactly the same as shown above. Which of the following vulnerabilities has the tester discovered?

An internal penetration tester is on site assessing network access for company-owned mobile devices. Which of the following would be the best tool to identify the available networks?

A penetration tester conducts a scan on an exposed Linux web server and gathers the following data: Additional notes: • Directory listing enabled on /admin • Apache mod_cgi enabled • No authentication required to access /cgi-bin/debug.sh • X-Powered-By: PHP/5.6.40-0+deb8u12 Which of the following is the most effective action to take?

A penetration tester gains access to a host with many applications that load at startup and run as SYSTEM. The penetration tester runs a command and receives the following output: Which of the following attacks will most likely allow the penetration tester to escalate privileges?

A penetration tester obtains local administrator access on a Windows system and wants to attempt lateral movement. The system exists within a Windows Workgroup environment. Which of the following actions should the tester take?

A penetration tester would like to collect permission details for objects within the domain. The tester has a valid AD user and access to an internal PC. Which of the following sets of steps is the best way for the tester to accomplish the desired outcome?

During an engagement, a penetration tester discovers a web application vulnerability that affects multiple devices. The tester creates and runs the following script: Which of the following best describes what the tester is attempting to do?

During an assessment, a penetration tester manages to get RDP access via a low-privilege user. The tester attempts to escalate privileges by running the following commands: Import-Module .\PrintNightmare.psi Invoke-Nightmare -NewUser "hacker" -NewPassword "Password123!" -DriverName "Print" The tester attempts to further enumerate the host with the new administrative privileges by using the runas command. However, the access level is still low. Which of the following actions should the penetration tester take next?

A penetration tester attempts to obtain the preshared key for a client's wireless network. Which of the following actions will most likely aid the tester?

A penetration tester conducts OSINT for a client and discovers the robots.txt file explicitly blocks a major search engine. Which of the following would most likely help the penetration tester achieve the objective?