PT0-003 — questions

A penetration tester runs a network scan but has some issues accurately enumerating the vulnerabilities due to the following error: OS identification failed - Which of the following is most likely causing this error?

A penetration tester performs an assessment on the target company's Kubernetes cluster using kube-hunter. Which of the following types of vulnerabilities could be detected with the tool?

During a security assessment, a penetration tester wants to compromise user accounts without triggering IDS/IPS detection rules. Which of the following is the most effective way for the tester to accomplish this task?

During a penetration test, a tester attempts to pivot from one Windows 10 system to another Windows system. The penetration tester thinks a local firewall is blocking connections. Which of the following command-line utilities built into Windows is most likely to disable the firewall?

During an engagement, a penetration tester runs the following command against the host system: host -t axfr domain.com dnsl.domain.com Which of the following techniques best describes what the tester is doing?

Which of the following are valid reasons for including base, temporal, and environmental CVSS metrics in the findings section of a penetration testing report? (Choose two.)

During an assessment, a penetration tester plans to gather metadata from various online files, including pictures. Which of the following standards outlines the formats for pictures, audio, and additional tags that facilitate this type of reconnaissance?

A penetration tester needs to exploit a vulnerability in a wireless network that has weak encryption in order to perform traffic analysis and decrypt sensitive information. Which of the following techniques would best allow the penetration tester to have access to the sensitive information?

A penetration tester wants to check the security awareness of specific workers in the company with targeted attacks. Which of the following attacks should the penetration tester perform?

During a penetration test, a tester compromises a Windows computer. The tester executes the following command and receives the following output: mimikatz # privilege::debug mimikatz # lsadump::cache -Output--- lapsUser 27dh9128361tsg264592101387541j --OutputEnd-- Which of the following best describes what the tester plans to do by executing the command?

During an assessment, a penetration tester obtains an NTLM hash from a legacy Windows machine. Which of the following tools should the penetration tester use to continue the attack?

An external legal firm is conducting a penetration test of a large corporation. Which of the following would be most appropriate for the legal firm to use in the subject line of a weekly email update?

A penetration tester needs to evaluate the security of example.com and gather stealthy information using DNS. Which of the following is the best tool for the tester to use?

A penetration tester gains access to a chrooted environment and runs service --status-all on a target host. The tester reviews the following output: [ + ] cron [ + ] dhcp [ - ] tomcat [ - ] xserver [ + ] ssh The only other commands that the tester can execute are ps, nc, tcpdump, and crontab. Which of the following is the best method to maintain persistence?

A penetration tester completes a scan and sees the following output on a host: Nmap scan report for victim (10.10.10.10) Host is up (0.0001s latency) PORT STATE SERVICE - 161/udp open|filtered snmp 445/tcp open microsoft-ds 3389/tcp open microsoft-ds Running Microsoft Windows 7 - OS CPE: cpe./o.microsoft.windows_7_sp0 The tester wants to obtain shell access. Which of the following related exploits should the tester try first?

A company hires a penetration tester to test the security implementation of its wireless networks. The main goal for this assessment is to intercept and get access to sensitive data from the company's employees. Which of the following tools should the security professional use to best accomplish this task?

While conducting a reconnaissance activity, a penetration tester extracts the following information: Emails: - [email protected] - [email protected] - [email protected] Which of the following risks should the tester use to leverage an attack as the next step in the security assessment?

A penetration tester is preparing a password-spraying attack against a known list of users for the company "example." The tester is using the following list of commands: 1. pw-inspector -i $allwords | tee $pass 2. spray365.py spray -ep $plan 3. users="~/user.txt"; allwords="~/words.txt"; pass="~/passwords.txt"; plan="~/spray.plan" 4. spray365.py generate --password_file $pass --user file $user --domain "example.com" --execution_plan $plan 5. cewl -m 5 "http://www.example.com" -w $allwords Which of the following is the correct order for the list of the commands?

During a penetration testing exercise, a team decides to use a watering hole strategy. Which of the following is the most effective approach for executing this attack?

During a testing engagement, a penetration tester compromises a host and locates data for exfiltration. Which of the following are the best options to move the data without triggering a data loss prevention tool? (Choose two.)