[2025年01月05日] 無料ダウンロードCompTIA PT0-003リアル試験問題 [Q11-Q28]

[2025年01月05日] 無料ダウンロードCompTIA PT0-003リアル試験問題

あなたを合格させる試験には100%確認済みPT0-003試験問題

質問 # 11
A penetration tester needs to evaluate the order in which the next systems will be selected for testing. Given the following output:

Which of the following targets should the tester select next?

A. hrdatabase
B. fileserver
C. legaldatabase
D. financesite

正解：B

解説：
Evaluation Criteria:
CVSS (Common Vulnerability Scoring System): Indicates the severity of vulnerabilities, with higher scores representing more critical vulnerabilities.
EPSS (Exploit Prediction Scoring System): Estimates the likelihood of a vulnerability being exploited in the wild.
Analysis:
hrdatabase: CVSS = 9.9, EPSS = 0.50
financesite: CVSS = 8.0, EPSS = 0.01
legaldatabase: CVSS = 8.2, EPSS = 0.60
fileserver: CVSS = 7.6, EPSS = 0.90
Selection Justification:
fileserver has the highest EPSS score of 0.90, indicating a high likelihood of exploitation despite having a slightly lower CVSS score compared to other targets.
This makes it a critical target for immediate testing to mitigate potential exploitation risks.
Pentest Reference:
Risk Prioritization: Balancing between severity (CVSS) and exploitability (EPSS) is crucial for effective vulnerability management.
Risk Assessment: Evaluating both the impact and the likelihood of exploitation helps in making informed decisions about testing priorities.
By selecting the fileserver, the penetration tester focuses on a target that is highly likely to be exploited, addressing the most immediate risk based on the given scores.
Top of Form
Bottom of Form

質問 # 12
A penetration tester is trying to restrict searches on Google to a specific domain. Which of the following commands should the penetration tester consider?

A. link:
B. intitle:
C. site:
D. inurl:

正解：C

解説：
The site: command can be used to restrict searches on Google to a specific domain. For example, site:company.com will return only results from the company.com domain. This can help the penetration tester to find information or pages related to the target domain.

質問 # 13
A penetration tester will be performing a vulnerability scan as part of the penetration test on a client's website. The tester plans to run several Nmap scripts that probe for vulnerabilities while avoiding detection.
Which of the following Nmap options will the penetration tester MOST likely utilize?

A. --script "http*vuln*"
B. -sn
C. -O -A
D. -8 -T0

正解：A

解説：
Nmap is a tool that can perform network scanning and enumeration by sending packets to hosts and analyzing their responses. The command Nmap -p 445 -n -T4 --open 172.21.0.0/16 would scan for SMB port
445 over a /16 network with the following options:
-p 445 specifies the port number to scan.
-n disables DNS resolution, which can speed up the scan by avoiding unnecessary queries.
-T4 sets the timing template to aggressive, which increases the speed of the scan by sending packets faster and waiting less for responses.
-open only shows hosts that have open ports, which can reduce the output and focus on relevant results. The other commands are not optimal for scanning SMB port 445 over a /16 network when stealth is not a concern and the task is time sensitive.

質問 # 14
A penetration tester gains access to a domain server and wants to enumerate the systems within the domain. Which of the following tools would provide the best oversight of domains?

A. Nmap
B. Wireshark
C. Responder
D. Netcat

正解：A

解説：
Installation:
Nmap can be installed on various operating systems. For example, on a Debian-based system:
sudo apt-get install nmap
Basic Network Scanning:
To scan a range of IP addresses in the network:
nmap -sP 192.168.1.0/24
Service and Version Detection:
To scan for open ports and detect the service versions running on a specific host:
nmap -sV 192.168.1.10
Enumerating Domain Systems:
Use Nmap with additional scripts to enumerate domain systems. For example, using the --script option:
nmap -p 445 --script=smb-enum-domains 192.168.1.10
Advanced Scanning Options:
Stealth Scan: Use the -sS option to perform a stealth scan:
nmap -sS 192.168.1.10
Aggressive Scan: Use the -A option to enable OS detection, version detection, script scanning, and traceroute:
nmap -A 192.168.1.10
Real-World Example:
A penetration tester uses Nmap to enumerate the systems within a domain by scanning the network for live hosts and identifying the services running on each host. This information helps in identifying potential vulnerabilities and entry points for further exploitation.
Reference from Pentesting Literature:
In "Penetration Testing - A Hands-on Introduction to Hacking," Nmap is extensively discussed for various stages of the penetration testing process, from reconnaissance to vulnerability assessment.
HTB write-ups often illustrate the use of Nmap for network enumeration and discovering potential attack vectors.
Reference:
Penetration Testing - A Hands-on Introduction to Hacking
HTB Official Writeups

質問 # 15
A penetration tester is getting ready to conduct a vulnerability scan as part of the testing process. The tester will evaluate an environment that consists of a container orchestration cluster. Which of the following tools should the tester use to evaluate the cluster?

A. Kube-hunter
B. Trivy
C. Nessus
D. Grype

正解：A

解説：
Evaluating a container orchestration cluster, such as Kubernetes, requires specialized tools designed to assess the security and configuration of container environments. Here's an analysis of each tool and why Kube-hunter is the best choice:
Trivy (Option A):
Explanation:
Capabilities: While effective at scanning container images for vulnerabilities, it is not specifically designed to assess the security of a container orchestration cluster itself.
Nessus (Option B):
Capabilities: It is not tailored for container orchestration environments and may miss specific issues related to Kubernetes or other orchestration systems.
Grype (Option C):
Capabilities: Similar to Trivy, it focuses on identifying vulnerabilities in container images rather than assessing the overall security posture of a container orchestration cluster.
Kube-hunter (answer: D):
Capabilities: It scans the Kubernetes cluster for a wide range of security issues, including misconfigurations and vulnerabilities specific to Kubernetes environments.
Reference:
Conclusion: Kube-hunter is the most appropriate tool for evaluating a container orchestration cluster, such as Kubernetes, due to its specialized focus on identifying security vulnerabilities and misconfigurations specific to such environments.

質問 # 16
The output from a penetration testing tool shows 100 hosts contained findings due to improper patch management. Which of the following did the penetration tester perform?

A. A vulnerability scan
B. A packet capture
C. An Nmap scan
D. A WHOIS lookup

正解：A

解説：
A vulnerability scan is a type of penetration testing tool that is used to scan a network for vulnerabilities. A vulnerability scan can detect misconfigurations, missing patches, and other security issues that could be exploited by attackers. In this case, the output shows that 100 hosts had findings due to improper patch management, which means that the tester performed a vulnerability scan.

質問 # 17
A penetration tester wants to test a list of common passwords against the SSH daemon on a network device.
Which of the following tools would be BEST to use for this purpose?

A. John the Ripper
B. Patator
C. Hashcat
D. Mimikatz

正解：B

解説：
https://www.kali.org/tools/patator/

質問 # 18
Which of the following is the most common vulnerability associated with loT devices that are directly connected to the internet?

A. Susceptibility to DDoS attacks
B. Inability to network
C. The existence of default passwords
D. Unsupported operating systems

正解：C

解説：
IoT devices are often shipped with default passwords, which are easily discoverable and widely known.
Many users fail to change these default credentials, leaving the devices vulnerable to unauthorized access.
This issue is one of the most common vulnerabilities associated with IoT devices connected directly to the internet. Attackers can exploit these default passwords to gain control over the devices, potentially leading to a range of malicious activities, including the recruitment of the devices into botnets for Distributed Denial of Service (DDoS) attacks, data breaches, or other cybercriminal activities.

質問 # 19
A penetration tester gains access to a system and establishes persistence, and then runs the following commands:
cat /dev/null > temp
touch -r .bash_history temp
mv temp .bash_history
Which of the following actions is the tester MOST likely performing?

A. Making decoy files on the system to confuse incident responders
B. Covering tracks by clearing the Bash history
C. Redirecting Bash history to /dev/null
D. Making a copy of the user's Bash history for further enumeration

正解：B

解説：
The commands are used to clear the Bash history file of the current user, which records the commands entered in the terminal. The first command redirects /dev/null (a special file that discards any data written to it) to temp, which creates an empty file named temp. The second command changes the timestamp of temp to match that of .bash_history (the hidden file that stores the Bash history). The third command renames temp to
.bash_history, which overwrites the original file with an empty one. This effectively erases any trace of the commands executed by the user.
Reference: https://null-byte.wonderhowto.com/how-to/clear-logs-bash-history-hacked-linux-systems-cover- your-tracks-remain-undetected-0244768/

質問 # 20
Which of the following tools would be the best to use to intercept an HTTP response at an API, change its content, and forward it back to the origin mobile device?

A. Android SDK Tools
B. Drozer
C. Burp Suite
D. MobSF

正解：C

解説：
Burp Suite is a web application security testing tool that can intercept, modify, and forward HTTP requests and responses. It can be used to manipulate the data sent between an API and a mobile device, such as changing the content of the response before it reaches the device. Drozer is a framework for Android security assessment, but it does not intercept HTTP traffic. Android SDK Tools are a set of tools for developing Android applications, but they do not have the functionality to intercept and modify HTTP responses. MobSF is a mobile security framework that can perform static and dynamic analysis of Android and iOS applications, but it does not have the capability to intercept and change HTTP responses at an API level. References: The Official CompTIA PenTest+ Study Guide (Exam PT0-002), Chapter 8: Application Testing1; The Official CompTIA PenTest+ Student Guide (Exam PT0-002), Lesson 8: Application Testing2; Burp Suite Documentation3

質問 # 21
During a penetration testing engagement, a tester targets the internet-facing services used by the client. Which of the following describes the type of assessment that should be considered in this scope of work?

A. Mobile
B. External
C. Web
D. Segmentation

正解：B

解説：
An external assessment focuses on testing the security of internet-facing services. Here's why option C is correct:
External Assessment: It involves evaluating the security posture of services exposed to the internet, such as web servers, mail servers, and other public-facing infrastructure. The goal is to identify vulnerabilities that could be exploited by attackers from outside the organization's network.
Segmentation: This type of assessment focuses on ensuring that different parts of a network are appropriately segmented to limit the spread of attacks. It's more relevant to internal network architecture.
Mobile: This assessment targets mobile applications and devices, not general internet-facing services.
Web: While web assessments focus on web applications, the scope of an external assessment is broader and includes all types of internet-facing services.
Reference from Pentest:
Horizontall HTB: Highlights the importance of assessing external services to identify vulnerabilities that could be exploited from outside the network.
Luke HTB: Demonstrates the process of evaluating public-facing services to ensure their security.
Conclusion:
Option C, External, is the most appropriate type of assessment for targeting internet-facing services used by the client.

質問 # 22
A penetration tester captured the following traffic during a web-application test:

Which of the following methods should the tester use to visualize the authorization information being transmitted?

A. Decrypt the authorization header using bcrypt.
B. Decode the authorization header using Base64.
C. Decode the authorization header using UTF-8.
D. Decrypt the authorization header using AES.

正解：B

質問 # 23
A mail service company has hired a penetration tester to conduct an enumeration of all user accounts on an SMTP server to identify whether previous staff member accounts are still active. Which of the following commands should be used to accomplish the goal?

A. RCPT TO and VRFY
B. VRFY and TURN
C. EXPN and TURN
D. VRFY and EXPN

正解：D

解説：
The VRFY and EXPN commands can be used to enumerate user accounts on an SMTP server, as they are used to verify the existence of users or mailing lists. VRFY (verify) asks the server to confirm that a given user name or address is valid. EXPN (expand) asks the server to expand a mailing list into its individual members. These commands can be used by a penetration tester to identify valid user names or e-mail addresses on the target SMTP server.
Reference: https://hackerone.com/reports/193314

質問 # 24
Which of the following commands will allow a penetration tester to permit a shell script to be executed by the file owner?

A. chmod o+e script.sh
B. chmod o+x script.sh
C. chmod u+x script.sh
D. chmod u+e script.sh

正解：C

解説：
Reference: https://newbedev.com/chmod-u-x-versus-chmod-x

質問 # 25
Which of the following can be used to store alphanumeric data that can be fed into scripts or programs as input to penetration-testing tools?

A. Dictionary
B. Catalog
C. For-loop
D. Directory
E. Symlink

正解：A

解説：
A dictionary can be used to store alphanumeric data that can be fed into scripts or programs as input to penetration-testing tools. A dictionary is a collection of key-value pairs that can be accessed by using the keys. For example, a dictionary can store usernames and passwords, or IP addresses and hostnames, that can be used as input for brute-force or reconnaissance tools.

質問 # 26
A penetration tester obtains password dumps associated with the target and identifies strict lockout policies. The tester does not want to lock out accounts when attempting access. Which of the following techniques should the tester use?

A. Credential stuffing
B. MFA fatigue
C. Dictionary attack
D. Brute-force attack

正解：A

解説：
To avoid locking out accounts while attempting access, the penetration tester should use credential stuffing.
Credential Stuffing:
Definition: An attack method where attackers use a list of known username and password pairs, typically obtained from previous data breaches, to gain unauthorized access to accounts.
Advantages: Unlike brute-force attacks, credential stuffing uses already known credentials, which reduces the number of attempts per account and minimizes the risk of triggering account lockout mechanisms.
Tool: Tools like Sentry MBA, Snipr, and others are commonly used for credential stuffing attacks.
Other Techniques:
MFA Fatigue: A social engineering tactic to exhaust users into accepting multi-factor authentication requests, not applicable for avoiding lockouts in this context.
Dictionary Attack: Similar to brute-force but uses a list of likely passwords; still risks lockout due to multiple attempts.
Brute-force Attack: Systematically attempts all possible password combinations, likely to trigger account lockouts due to high number of failed attempts.
Pentest Reference:
Password Attacks: Understanding different types of password attacks and their implications on account security.
Account Lockout Policies: Awareness of how lockout mechanisms work and strategies to avoid triggering them during penetration tests.
By using credential stuffing, the penetration tester can attempt to gain access using known credentials without triggering account lockout policies, ensuring a stealthier approach to password attacks.

質問 # 27
An Nmap scan of a network switch reveals the following:

Which of the following technical controls will most likely be the FIRST recommendation for this device?