PT0-002

PT0-002 practice questions, page 9 of 22, with answer review and explanations.

Question 41

A penetration tester has been given an assignment to attack a series of targets in the 192.168.1.0/24 range, triggering as few alarms and countermeasures as possible. Which of the following Nmap scan syntaxes would BEST accomplish this objective?

  1. nmap -sT -vvv -O 192.168.1.2/24 -PO
  2. nmap -sV 192.168.1.2/24 -PO
  3. nmap -sA -v -O 192.168.1.2/24
  4. nmap -sS -O 192.168.1.2/24 -T1

Question 42

A penetration tester has gained access to a network device that has a previously unknown IP range on an interface. Further research determines this is an always-on VPN tunnel to a third-party supplier. Which of the following is the BEST action for the penetration tester to take?

  1. Utilize the tunnel as a means of pivoting to other internal devices.
  2. Disregard the IP range, as it is out of scope.
  3. Stop the assessment and inform the emergency contact.
  4. Scan the IP range for additional systems to exploit.

Question 43

A penetration tester recently performed a social-engineering attack in which the tester found an employee of the target company at a local coffee shop and over time built a relationship with the employee. On the employee's birthday, the tester gave the employee an external hard drive as a gift. Which of the following social-engineering attacks was the tester utilizing?

  1. Phishing
  2. Tailgating
  3. Baiting
  4. Shoulder surfing

Question 44

A security company has been contracted to perform a scoped insider-threat assessment to try to gain access to the human resources server that houses PII and salary data. The penetration testers have been given an internal network starting position. Which of the following actions, if performed, would be ethical within the scope of the assessment?

  1. Exploiting a configuration weakness in the SQL database
  2. Intercepting outbound TLS traffic
  3. Gaining access to hosts by injecting malware into the enterprise-wide update server
  4. Leveraging a vulnerability on the internal CA to issue fraudulent client certificates
  5. Establishing and maintaining persistence on the domain controller

Question 45

A penetration tester is able to capture the NTLM challenge-response traffic between a client and a server. Which of the following can be done with the pcap to gain access to the server?

  1. Perform vertical privilege escalation.
  2. Replay the captured traffic to the server to recreate the session.
  3. Use John the Ripper to crack the password.
  4. Utilize a pass-the-hash attack.