PT0-003 Practice Test

PT0-003 Practice Test practice questions, page 3 of 14, with answer review and explanations.

Question 11

A tester gains initial access to a server and needs to enumerate all corporate domain DNS records. Which of the following commands should the tester use?

  1. dig +short A AAAA local.domain
  2. nslookup local.domain
  3. dig afxr @local.dns.server
  4. nslookup -server local.dns.server local.domain *

Question 12

A penetration tester is performing network reconnaissance. The tester wants to gather information about the network without causing detection mechanisms to flag the reconnaissance activities. Which of the following techniques should the tester use?

  1. Sniffing
  2. Banner grabbing
  3. TCP/UDP scanning
  4. Ping sweeps

Question 13

A penetration tester reviews a SAST vulnerability scan report. The following lines of code have been reported as vulnerable: Which of the following is the best method to remediate this vulnerability?

  1. Implementing a logging framework
  2. Removing the five code lines reported with issues
  3. Initiating a secure coding-awareness program with all the developers
  4. Documenting the vulnerability as a false positive

Question 14

During a security assessment, a penetration tester uses a tool to capture plaintext log-in credentials on the communication between a user and an authentication system. The tester wants to use this information for further unauthorized access. Which of the following tools is the tester using?

  1. Burp Suite
  2. Wireshark
  3. Zed Attack Proxy
  4. Metasploit

Question 15

A penetration tester established an initial compromise on a host. The tester wants to pivot to other targets and set up an appropriate relay. The tester needs to enumerate through the compromised host as a relay from the tester's machine. Which of the following commands should the tester use to do this task from the tester's host?

  1. attacker_host$ nmap -sT <target_cidr> | nc -n <compromised_host> 22
  2. attacker_host$ mknod backpipe p attacker_host$ nc -l -p 8000 | 0 <backpipe | nc <target_cidr> 80 | tee backpipe
  3. attacker_host$ nc -nlp 8000 | nc -n <target_cidr> attacker_host$ nmap -sT 127.0.0.1 8000
  4. attacker_host$ proxychains nmap -sT <target_cidr>