CompTIA Pentest+ Certification For Dummies. Glen E. ClarkeЧитать онлайн книгу.

need to focus on when reading through this book. Take time to review each question to come up with the best answer for each question. Be sure to verify your work with the pre-assessment answers that follow, and use the chapter reference given to learn more about the topic related to the question.

Questions

1. You are performing a penetration test for a large customer. You are using Nmap to determine the ports that are open on the target systems. What phase of the penetration testing process are you currently on?

(A) Reporting and communication

(B) Attacks and exploits

(C) Planning and scoping

(D) Information gathering and vulnerability identification

2. You are preparing to perform a penetration test for a customer. What type of document does the customer typically have the penetration tester sign before the penetration test begins?

(A) Authorization letter

(B) Service-level agreement

(C) Non-disclosure agreement

(D) Master service agreement

3. Which of the following penetration tools are considered OSINT tools? (Choose two.)

(A) Nmap

(B) Recon-ng

(C) Hydra

(D) Metasploit

(E) Maltego

4. You are in the discovery phase of a penetration test and would like to do a port scan on the network, but not perform a ping operation with the port scan. What Nmap switch would you use to disable pings with the port scan?

(A) -Pn

(B) -p

(C) -sP

(D) -sT

5. You are looking to discover vulnerabilities on a group of systems that are target systems for your penetration test. What tools would you use to identify vulnerabilities in the systems? (Choose two.)

(A) OpenVAS

(B) Nessus

(C) Hydra

(D) Metasploit

(E) Nmap

6. During a penetration test you are looking to perform a MiTM attack. Which of the following tools would you use to perform the attack?

(A) Hydra

(B) Metasploit

(C) arpspoof

(D) John

7. You are performing a penetration test on a wireless network. You would like to deauthenticate the clients from the access point. What tool would you use?

(A) Aircrack-ng

(B) Aireplay-ng

(C) Airodump-ng

(D) Deauth-ng

8. While performing a penetration test on a wireless network, you decide to try to brute force the WPS pin on the wireless access point. What command would you use in Kali Linux?

(A) aircrack-ng

(B) mimikatz

(C) reaver

(D) wpscrack-ng

9. You are assessing the security of a web application running on a web server within the DMZ. Which of the following represents an example of a command injection attack?

(A) http://site/showData.php?id=1;phpinfo()

(B) http://site/purchase.aspx?redirect=confirmation.aspx

(C) http://site/prodt.php?id=5;update%20products%20set%20price=.50

(D) http://site/showData.php?dir=%3Bcat%20/etc/passwd

10. You are performing a penetration test for a customer and have exploited a system and gained a meterpreter session. What post-exploitation command was used to obtain the following output?

Admin:500:b45a8125648cbddf2c4272c:bddf2c4272cb45a8125648cGuest:501:b45a8125648cbddf2c4272c:bddf2c4272cb45a8125648ctestUser:1024:b45a8125648cbddf2c4272c:bddf2c4272cb45a8125648c

(A) hashdump

(B) hydra

(C) kill av

(D) truncate

11. You are assessing the security of a web application. What tool would you use to identify vulnerabilities on a website?

(A) SQLdict

(B) Nmap

(C) Nikto

(D) Hydra

12. You have obtained the password hash for the administrator account on a system. What tool would you use to crack the password hash?

(A) Hashdump

(B) Nmap

(C) Aircrack-ng

(D) Hashcat

13. During an authorized penetration test, you have used Nmap to locate systems on the network running RDP. What command would you use to perform password cracking using RDP traffic to the system?

(A) mimikatz

(B) hashcat

(C) hydra

(D) hashdump

14. What language was used to write the following code?

startTime = datetime.now() try: for port in range(1,1024): sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) result = sock.connect_ex((remoteSystemIP, port)) if result == 0: print "Port {}: Open".format(port) sock.close()

(A) PowerShell

(B) Python

(C) Ruby

(D) Bash

15. While performing a penetration test for a customer, you notice there is evidence of a previous security compromise on the web server. What should you do?