PT0-002 practice questions, page 15 of 22, with answer review and explanations.
Question 71
A company uses a cloud provider with shared network bandwidth to host a web application on dedicated servers. The company's contact with the cloud provider prevents any activities that would interfere with the cloud provider's other customers. When engaging with a penetration-testing company to test the application, which of the following should the company avoid?
Crawling the web application's URLs looking for vulnerabilities
Fingerprinting all the IP addresses of the application's servers
Brute forcing the application's passwords
Sending many web requests per second to test DDoS protection
Question 72
A penetration tester is cleaning up and covering tracks at the conclusion of a penetration test. Which of the following should the tester be sure to remove from the system? (Choose two.)
Spawned shells
Created user accounts
Server logs
Administrator accounts
Reboot system
ARP cache
Question 73
A software company has hired a security consultant to assess the security of the company's software development practices. The consultant opts to begin reconnaissance by performing fuzzing on a software binary. Which of the following vulnerabilities is the security consultant MOST likely to identify?
Weak authentication schemes
Credentials stored in strings
Buffer overflows
Non-optimized resource management
Question 74
A penetration tester has prepared the following phishing email for an upcoming penetration test: Which of the following is the penetration tester using MOST to influence phishing targets to click on the link?
Familiarity and likeness
Authority and urgency
Scarcity and fear
Social proof and greed
Question 75
During a penetration test, a tester is able to change values in the URL from example.com/login.php?id=5 to example.com/login.php?id=10 and gain access to a web application. Which of the following vulnerabilities has the penetration tester exploited?