PT0-001

PT0-001 practice questions, page 5 of 8, with answer review and explanations.

Question 21

A penetration tester is able to move laterally throughout a domain with minimal roadblocks after compromising a single workstation. Which of the following mitigation strategies would be BEST to recommend in the report? (Select THREE).

  1. Randomize local administrator credentials for each machine.
  2. Disable remote logons for local administrators.
  3. Require multifactor authentication for all logins.
  4. Increase minimum password complexity requirements.
  5. Apply additional network access control.
  6. Enable full-disk encryption on every workstation.
  7. Segment each host into its own VLAN.

Question 22

A security consultant is trying to attack a device with a previously identified user account. Which of the following types of attacks is being executed?

  1. Credential dump attack
  2. DLL injection attack
  3. Reverse shell attack
  4. Pass the hash attack

Question 23

A malicious user wants to perform an MITM attack on a computer. The computer network configuration is given below: IP: 192.168.1.20 - NETMASK: 255.255.255.0 - DEFAULT GATEWAY: 192.168.1.254 - DHCP: 192.168.1.253 - DNS: 192.168.10.10, 192.168.20.10 Which of the following commands should the malicious user execute to perform the MITM attack?

  1. arpspoof -c both -r -t 192.168.1.1 192.168.1.20
  2. arpspoof -t 192.168.1.20 192.168.1.254
  3. arpspoof -c both -t 192.168.1.20 192.168.1.253
  4. arpspoof -r -t 192.168.1.253 192.168.1.20

Question 24

A client has requested an external network penetration test for compliance purposes. During discussion between the client and the penetration tester, the client expresses unwillingness to add the penetration tester's source IP addresses to the client's IPS whitelist for the duration of the test. Which of the following is the BEST argument as to why the penetration tester's source IP addresses should be whitelisted?

  1. Whitelisting prevents a possible inadvertent DoS attack against the IPS and supporting log-monitoring systems.
  2. Penetration testing of third-party IPS systems often requires additional documentation and authorizations; potentially delaying the time-sensitive test.
  3. IPS whitelisting rules require frequent updates to stay current, constantly developing vulnerabilities and newly discovered weaknesses.
  4. Testing should focus on the discovery of possible security issues across all in-scope systems, not on determining the relative effectiveness of active defenses such as an IPS.

Question 25

An energy company contracted a security firm to perform a penetration test of a power plant, which employs ICS to manage power generation and cooling. Which of the following is a consideration unique to such an environment that must be made by the firm when preparing for the assessment?

  1. Selection of the appropriate set of security testing tools
  2. Current and load ratings of the ICS components
  3. Potential operational and safety hazards
  4. Electrical certification of hardware used in the test