2025年最新のPT0-002試験問題集で最近更新された460問題 [Q82-Q97]

2025年最新のPT0-002試験問題集で最近更新された460問題

CompTIA PT0-002リアル2025年最新のブレーン問題集で模擬試験問題集

Comptia Pentest+認定試験では、倫理的ハッキングと脆弱性スキャンに関する候補者の専門知識をテストします。計画とスコーピング、情報収集と脆弱性の識別、攻撃、悪用、浸透テストツール、報告とコミュニケーションなどの重要なドメインをカバーしています。

あなたがペンテスト領域における知識、技能、専門知識を検証したい場合、CompTIA PenTest 認定（PT0-002）は、サイバーセキュリティ業界において同僚たちの中で際立つ必要なロードマップ、知識、および認識を提供することで、あなたのキャリアを新たな高みに導く絶好の機会となるでしょう。

Comptia Pentest+認定試験としても知られるComptia PT0-002は、侵入テストと脆弱性管理の実施における個人のスキルを検証するグローバルに認められた認定試験です。この試験は、侵入テストを実行し、脆弱性を特定し、セキュリティの弱点を悪用し、IT環境でのリスクの管理における候補者の知識と実践的なスキルを測定するように設計されています。この認定は、浸透テストと脆弱性の評価を専門としたいネットワークおよびセキュリティの専門家に最適です。

質問 # 82
A penetration tester has obtained shell access to a Windows host and wants to run a specially crafted binary for later execution using the wmic.exe process call create function. Which of the following OS or filesystem mechanisms is MOST likely to support this objective?

A. PsExec
B. MP4 steganography
C. PowerShell modules
D. Alternate data streams

正解：A

質問 # 83
During an engagement, a penetration tester found the following list of strings inside a file:

Which of the following is the BEST technique to determine the known plaintext of the strings?

A. Credential-stuffing attack
B. Brute-force attack
C. Rainbow table attack
D. Dictionary attack

正解：C

質問 # 84
A penetration tester is hired to test a client's systems. The client's systems are hosted by the client at its headquarters. The production environment is hosted by a private cloud-hosting company. Which of the following would be the most important for the penetration tester to determine before beginning the test?

A. Third-party asset restrictions
B. Time-of-day restrictions
C. Disallowed tests
D. Physical locations of theinfrastructure

正解：A

質問 # 85
A penetration tester conducted a discovery scan that generated the following:

Which of the following commands generated the results above and will transform them into a list of active hosts for further analysis?

A. nmap -o 192.168.0.1-254, cut -f 2
B. nmap -oG list.txt 192.168.0.1-254 , sort
C. nmap -sn 192.168.0.1-254 , grep "Nmap scan" | awk '{print S5}'
D. nmap --open 192.168.0.1-254, uniq

正解：C

解説：
the NMAP flag (-sn) which is for host discovery and returns that kind of NMAP output. And the AWK command selects column 5 ({print $5}) which obviously carries the returned IP of the host in the NMAP output.
This command will generate the results shown in the image and transform them into a list of active hosts for further analysis. The command consists of three parts:
nmap -sn 192.168.0.1-254: This part uses nmap, a network scanning tool, to perform a ping scan (-sn) on the IP range 192.168.0.1-254, which means sending ICMP echo requests to each IP address and checking if they respond.
grep "Nmap scan": This part uses grep, a text filtering tool, to search for the string "Nmap scan" in the output of the previous part and display only the matching lines. This will filter out the lines that show the start and end time of the scan and only show the lines that indicate the status of each host.
awk '{print $5}': This part uses awk, a text processing tool, to print the fifth field ($5) of each line in the output of the previous part. This will extract only the IP addresses of each host and display them as a list.
The final output will look something like this:
192.168.0.1 192.168.0.12 192.168.0.17 192.168.0.34

質問 # 86
A penetration tester has prepared the following phishing email for an upcoming penetration test:

Which of the following is the penetration tester using MOST to influence phishing targets to click on the link?

A. Familiarity and likeness
B. Scarcity and fear
C. Social proof and greed
D. Authority and urgency

正解：D

質問 # 87
When
accessing the URL http://192.168.0-1/validate/user.php, a penetration tester obtained the following output:
..d index: eid in /apache/www/validate/user.php line 12
..d index: uid in /apache/www/validate/user.php line 13
..d index: pw in /apache/www/validate/user.php line 14
..d index: acl in /apache/www/validate/user.php line 15

A. Insufficient error handling
B. Lack of code signing
C. Incorrect command syntax
D. Insecure data transmission

正解：A

解説：
The most probable cause for this output is insufficient error handling, which is a coding flaw that occurs when a program does not handle errors or exceptions properly or gracefully. Insufficient error handling can result in unwanted or unexpected behavior, such as crashes, hangs, or leaks. In this case, the output shows that the program is displaying warning messages that indicate undefined indexes in the user.php file. These messages reveal the names of the variables and the file path that are used by the program, which can expose sensitive information or clues to an attacker. The program should have implemented error handling mechanisms, such as try-catch blocks, error logging, or sanitizing output, to prevent these messages from being displayed or to handle them appropriately. The other options are not plausible causes for this output. Lack of code signing is a security flaw that occurs when a program does not have a digital signature that verifies its authenticity and integrity. Incorrect command syntax is a user error that occurs when a command is entered with wrong or missing parameters or options. Insecure data transmission is a security flaw that occurs when data is sent over a network without encryption or protection.

質問 # 88
A
penetration tester found the following valid URL while doing a manual assessment of a web application:
http://www.example.com/product.php?id=123987.
Which of the following automated tools would be best to use NEXT to try to identify a vulnerability in this URL?

A. Nikto
B. DirBuster
C. Nessus
D. SQLmap

正解：C

質問 # 89
A penetration tester developed the following script to be used during an engagement:
#!/usr/bin/python
import socket, sys
ports = [21, 22, 23, 25, 80, 139, 443, 445, 3306, 3389]
if len(sys.argv) > 1:
target = socket.gethostbyname (sys. argv [0])
else:
print ("Few arguments.")
print ("Syntax: python {} <target ip>". format (sys. argv [0]))
sys.exit ()
try:
for port in ports:
s = socket. socket (socket. AF_INET, socket. SOCK_STREAM)
s.settimeout (2)
result = s.connect_ex ((target, port) )
if result == 0:
print ("Port {} is opened". format (port) )
except KeyboardInterrupt:
print ("\nExiting ... ")
sys.exit ()
However, when the penetration tester ran the script, the tester received the following message:
socket.gaierror: [Errno -2] Name or service not known
Which of the following changes should the penetration tester implement to fix the script?

A. From:
s = socket. socket (socket. AF_INET, socket. SOCK_STREAM)
To:
s = socket.socket (socket.AF_INET, socket. SOCK_DGRAM)
B. From:
target = socket.gethostbyname (sys. argv [0])
To:
target = socket.gethostbyname (sys.argv[1])
C. From:
import socket, sys
To:
import socket
import sys
D. From:
result = s.connect_ex ((target, port) )
To:
result = s.connect ( (target, port) )

正解：B

解説：
The socket.gaierror: [Errno -2] Name or service not known is an error that occurs when the socket module cannot resolve the hostname or IP address given as an argument. In this case, the script is using sys.argv[0] as the argument for socket.gethostbyname, which is the name of the script itself, not the target IP address. The target IP address should be the first command-line argument after the script name, which is sys.argv1.
Therefore, changing the script to use sys.argv1 as the argument for socket.gethostbyname will fix the error and allow the script to scan the ports of the target IP address. References:
*The Official CompTIA PenTest+ Study Guide (Exam PT0-002), Chapter 5: Attacks and Exploits, page 262-
263.
*socket.gaierror: [Errno -2] Name or service not known | Python1
*How do I fix the error socket.gaierror: [Errno -2] Name or service not known on debian/testing?2

質問 # 90
A red-team tester has been contracted to emulate the threat posed by a malicious insider on a company's network, with the constrained objective of gaining access to sensitive personnel files. During the assessment, the red-team tester identifies an artifact indicating possible prior compromise within the target environment.
Which of the following actions should the tester take?

A. Incorporate the newly identified method of compromise into the red team's approach.
B. Halt the assessment and follow the reporting procedures as outlined in the contract.
C. Perform forensic analysis to isolate the means of compromise and determine attribution.
D. Create a detailed document of findings before continuing with the assessment.

正解：B

解説：
Halting the assessment and following the reporting procedures as outlined in the contract is the best action to take after identifying that an application being tested has already been compromised with malware. This is because continuing the assessment might interfere with an ongoing investigation or compromise evidence collection. The reporting procedures are part of the contract that specifies how to handle any critical issues or incidents during the penetration testing engagement. They should include details such as who to contact, what information to provide, and what steps to follow.

質問 # 91
When developing a shell script intended for interpretation in Bash, the interpreter /bin/bash should be explicitly specified. Which of the following character combinations should be used on the first line of the script to accomplish this goal?

A. <#
B. <$
C. #!
D. ##
E. #$

正解：C

解説：
Reference:
#!/bin/bash ---# and ! makes this line special because # is used as comment line in bash. ! is called

質問 # 92
Given the following Nmap scan command:
[root@kali ~]# nmap 192.168.0 .* -- exclude 192.168.0.101

Which of the following is the total number of servers that Nmap will attempt to scan?

A. 0
B. 1
C. 2
D. 3

正解：B

解説：
The Nmap scan command given will scan all the hosts in the 192.168.0.0/24 subnet, except for the one with the IP address 192.168.0.101. The subnet has 256 possible hosts, but one of them is excluded, so the total number of servers that Nmap will attempt to scan is 255. References:
* Nmap Commands - 17 Basic Commands for Linux Network, Section: Scan Multiple Hosts, Subsection:
Excluding Hosts from Search
* Nmap Cheat Sheet 2023: All the Commands and More, Section: Target Specification, Subsection:
-exclude

質問 # 93
A penetration tester wants to perform reconnaissance without being detected. Which of the following activities have a MINIMAL chance of detection? (Choose two.)

A. Open-source research
B. Traffic sniffing
C. A vulnerability scan
D. Port knocking
E. A ping sweep
F. An Nmap scan

正解：C、F

質問 # 94
A penetration tester is conducting a penetration test and discovers a vulnerability on a web server that is owned by the client. Exploiting the vulnerability allows the tester to open a reverse shell. Enumerating the server for privilege escalation, the tester discovers the following:

Which of the following should the penetration tester do NEXT?

A. Investigate the high numbered port connections.
B. Note this finding for inclusion in the final report.
C. Contact the client immediately.
D. Close the reverse shell the tester is using.

正解：A

解説：
The image shows the output of the netstat -antu command, which displays active internet connections for the TCP and UDP protocols. The output shows that there are four established TCP connections and two listening UDP connections on the host. The established TCP connections have high numbered ports as their local addresses, such as 49152, 49153, 49154, and 49155. These ports are in the range of ephemeral ports, which are dynamically assigned by the operating system for temporary use by applications or processes. The foreign addresses of these connections are also high numbered ports, such as 4433, 4434, 4435, and 4436. These ports are not well-known or registered ports for any common service or protocol. The combination of high numbered ports for both local and foreign addresses suggests that these connections are suspicious and may indicate a backdoor or a covert channel on the host. Therefore, the penetration tester should investigate these connections next to determine their nature and purpose. The other options are not appropriate actions for the penetration tester at this stage.

質問 # 95
A Chief Information Security Officer wants to evaluate the security of the company's e-commerce application. Which of the following tools should a penetration tester use FIRST to obtain relevant information from the application without triggering alarms?

A. DirBuster
B. w3af
C. SQLmap
D. OWASP ZAP

正解：D

質問 # 96
A company hired a penetration-testing team to review the cyber-physical systems in a manufacturing plant. The team immediately discovered the supervisory systems and PLCs are both connected to the company intranet. Which of the following assumptions, if made by the penetration-testing team, is MOST likely to be
valid?