(2025) PT0-002 Dumps and Practice Test (460 Questions) [Q55-Q77]

(2025) PT0-002 Dumps and Practice Test (460 Questions)

Guide (New 2025) Actual CompTIA PT0-002 Exam Questions

NEW QUESTION # 55
A security engineer identified a new server on the network and wants to scan the host to determine if it is running an approved version of Linux and a patched version of Apache. Which of the following commands will accomplish this task?

A. nmap -A -T4 -p80 192.168.1.20
B. nmap -f -sV -p80 192.168.1.20
C. nmap -sS -sL -p80 192.168.1.20
D. nmap -O -v -p80 192.168.1.20

Answer: A

Explanation:
This command will scan the host 192.168.1.20 on port 80 using the following options:
* -A: This option enables OS detection, version detection, script scanning, and traceroute. This will help to determine if the host is running an approved version of Linux and a patched version of Apache, as well as other information about the host and the network path.
* -T4: This option sets the timing template to aggressive, which speeds up the scan by increasing the number of parallel probes, reducing the timeouts, and assuming faster responses.
* -p80: This option specifies the port to scan, which is 80 in this case. Port 80 is commonly used for HTTP services, such as Apache web server.

NEW QUESTION # 56
A CentOS computer was exploited during a penetration test. During initial reconnaissance, the penetration tester discovered that port 25 was open on an internal Sendmail server. To remain stealthy, the tester ran the following command from the attack machine:

Which of the following would be the BEST command to use for further progress into the targeted network?

A. nc 127.0.0.1 5555
B. ssh 127.0.0.1 5555
C. nc 10.10.1.2
D. ssh 10.10.1.2

Answer: A

NEW QUESTION # 57
A penetration tester has obtained shell access to a Windows host and wants to run a specially crafted binary for later execution using the wmic.exe process call create function. Which of the following OS or filesystem mechanisms is MOST likely to support this objective?

A. PowerShell modules
B. PsExec
C. Alternate data streams
D. MP4 steganography

Answer: C

Explanation:
Explanation
Alternate data streams (ADS) are a feature of the NTFS file system that allows storing additional data in a file without affecting its size, name, or functionality. ADS can be used to hide or embed data or executable code in a file, such as a specially crafted binary for later execution. ADS can be created or accessed using various tools or commands, such as the command prompt, PowerShell, or Sysinternals12. For example, the following command can create an ADS named secret.exe in a file named test.txt and run it using wmic.exe process call create function: type secret.exe > test.txt:secret.exe & wmic process call create "cmd.exe /c test.txt:secret.exe"

NEW QUESTION # 58
A penetration tester was conducting a penetration test and discovered the network traffic was no longer reaching the client's IP address. The tester later discovered the SOC had used sinkholing on the penetration tester's IP address. Which of the following BEST describes what happened?

A. The penetration tester was testing the wrong assets
B. The penetration tester had incorrect contact information
C. The client was not ready for the assessment to start
D. The planning process failed to ensure all teams were notified

Answer: D

Explanation:
Explanation
Sinkholing is a technique used by security teams to redirect malicious or unwanted network traffic to a controlled destination, such as a black hole or a honeypot. This can help prevent or mitigate attacks, analyze malware behavior, or isolate infected hosts. If the SOC used sinkholing on the penetration tester's IP address, it means that they detected the tester's activity and blocked it from reaching the client's network. This indicates that the planning process failed to ensure all teams were notified about the penetration testing engagement, which could have avoided this situation.

NEW QUESTION # 59
A penetration tester gains access to a system and establishes persistence, and then runs the following commands:
cat /dev/null > temp
touch -r .bash_history temp
mv temp .bash_history
Which of the following actions is the tester MOST likely performing?

A. Redirecting Bash history to /dev/null
B. Making decoy files on the system to confuse incident responders
C. Making a copy of the user's Bash history for further enumeration
D. Covering tracks by clearing the Bash history

Answer: D

NEW QUESTION # 60
Given the following Nmap scan command:
[root@kali ~]# nmap 192.168.0 .* -- exclude 192.168.0.101

Which of the following is the total number of servers that Nmap will attempt to scan?

A. 0
B. 1
C. 2
D. 3

Answer: C

Explanation:
The Nmap scan command given will scan all the hosts in the 192.168.0.0/24 subnet, except for the one with the IP address 192.168.0.101. The subnet has 256 possible hosts, but one of them is excluded, so the total number of servers that Nmap will attempt to scan is 255. Reference:
Nmap Commands - 17 Basic Commands for Linux Network, Section: Scan Multiple Hosts, Subsection: Excluding Hosts from Search Nmap Cheat Sheet 2023: All the Commands and More, Section: Target Specification, Subsection: -exclude

NEW QUESTION # 61
A penetration tester performs the following command:
curl -I -http2 https://www.comptia.org
Which of the following snippets of output will the tester MOST likely receive?

A. Option B
B. Option A
C. Option C
D. Option D

Answer: B

Explanation:
Reference: https://research.securitum.com/http-2-protocol-it-is-faster-but-is-it-also-safer/

NEW QUESTION # 62
A penetration tester is working on a scoping document with a new client. The methodology the client uses includes the following:
Pre-engagement interaction (scoping and ROE)
Intelligence gathering (reconnaissance)
Threat modeling
Vulnerability analysis
Exploitation and post exploitation
Reporting
Which of the following methodologies does the client use?

A. OSSTMM
B. NIST SP 800-115
C. OWASP Web Security Testing Guide
D. PTES technical guidelines

Answer: D

NEW QUESTION # 63
A penetration tester is conducting an assessment on 192.168.1.112. Given the following output:

Which of the following is the penetration tester conducting?

A. Credential stuffing
B. Brute force
C. DoS attack
D. Port scan

Answer: B

Explanation:
The output shows multiple login attempts with different passwords for the same username "root" on the IP address 192.168.1.112. This is indicative of a brute force attack, where an attacker systematically tries various password combinations to gain unauthorized access. References: The Official CompTIA PenTest+ Study Guide (Exam PT0-002), Chapter 4: Conducting Passive Reconnaissance; The Official CompTIA PenTest+ Student Guide (Exam PT0-002), Lesson 4: Conducting Active Reconnaissance.

NEW QUESTION # 64
During a vulnerability scanning phase, a penetration tester wants to execute an Nmap scan using custom NSE scripts stored in the following folder:
/home/user/scripts

Which of the following commands should the penetration tester use to perform this scan?

A. nmap script /home/user/scripts
B. nmap script default safe
C. nmap -load /home/user/scripts
D. nmap resume "not intrusive"

Answer: A

Explanation:
The Nmap command in the question aims to use custom NSE scripts stored in a specific folder. The correct syntax for this option is to use the script argument followed by the path to the folder. The other commands are either invalid, use the wrong argument, or do not specify the folder path. References: Best PenTest+ certification study resources and training materials, CompTIA PenTest+ PT0-002 Cert Guide, 101 Labs - CompTIA PenTest+: Hands-on Labs for the PT0-002 Exam

NEW QUESTION # 65
During an assessment, a penetration tester was able Jo get access on all target servers by attempting authentication using a service account key that was published on the intranet site as part of a standard procedure. Which of the following should the penetration tester recommend for this type of finding?

A. Password encryption
B. Time-of-day restrictions
C. Role-based access control
D. Secrets management solution

Answer: D

NEW QUESTION # 66
A penetration tester is looking for a particular type of service and obtains the output below:
I Target is synchronized with 127.127.38.0 (reference clock)
I Alternative Target Interfaces:
I 10.17.4.20
I Private Servers (0)
I Public Servers (0)
I Private Peers (0)
I Public Peers (0)
I Private Clients (2)
I 10.20.8.69 169.254.138.63
I Public Clients (597)
I 4.79.17.248 68.70.72.194 74.247.37.194 99.190.119.152
I 12.10.160.20 68.80.36.133 75.1.39.42 108.7.58.118
I 68.56.205.98
I 2001:1400:0:0:0:0:0:1 2001:16d8:ddOO:38:0:0:0:2
I 2002:db5a:bccd:l:21d:e0ff:feb7:b96f 2002:b6ef:81c4:0:0:1145:59c5:3682 I Other Associations (1)
|_ 127.0.0.1 seen 1949869 times, last tx was unicast v2 mode 7
Which of the following commands was executed by the tester?

A. nmap-sU-pU:123-Pn-n-script=ntp-monlist <target>
B. nmap-sU-pU:517-Pn-n-script=supermicro-ipmi-config<target>
C. nmap-sU-pU:37 -Pn -n -script=icap-info <target>
D. nmap-sU-pU:161-Pn-n-script=voldemort-info <target>

Answer: A

Explanation:
The output provided indicates the use of the NTP protocol (Network Time Protocol) for querying a target system. The reference to "Public Clients" and the specific IP addresses listed, along with the mention of
"Other Associations" and the use of NTP version 2, points towards the execution of an NTP monlist request.
The monlist feature in NTP servers can be used to obtain a list of the last 600 hosts that have interacted with the NTP server. The command nmap -sU -pU:123 -Pn -n -script=ntp-monlist <target> specifically targets NTP servers on UDP port 123 to retrieve this information, making it the correct choice based on the output shown.

NEW QUESTION # 67
You are a penetration tester running port scans on a server.
INSTRUCTIONS
Part 1: Given the output, construct the command that was used to generate this output from the available options.
Part 2: Once the command is appropriately constructed, use the given output to identify the potential attack vectors that should be investigated further.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

Answer:

Explanation:
See explanation below.
Explanation
Part 1 - 192.168.2.2 -O -sV --top-ports=100 and SMB vulns
Part 2 - Weak SMB file permissions
https://subscription.packtpub.com/book/networking-and-servers/9781786467454/1/ch01lvl1sec13/fingerprinting

NEW QUESTION # 68
In an unprotected network file repository, a penetration tester discovers a text file containing usernames and passwords in cleartext and a spreadsheet containing data for 50 employees, including full names, roles, and serial numbers. The tester realizes some of the passwords in the text file follow the format: <name- serial_number>. Which of the following would be the best action for the tester to take NEXT with this information?

A. Document the unprotected file repository as a finding in the penetration-testing report.
B. Recommend configuring password complexity rules in all the systems and applications.
C. Create a custom password dictionary as preparation for password spray testing.
D. Recommend using a password manage/vault instead of text files to store passwords securely.

Answer: A

NEW QUESTION # 69
A penetration tester who is doing a company-requested assessment would like to send traffic to another system using double tagging. Which of the following techniques would BEST accomplish this goal?

A. RFID cloning
B. Tag nesting
C. Meta tagging
D. RFID tagging

Answer: B

Explanation:
since vlan hopping requires 2 vlans to be nested in a single packet. Double tagging occurs when an attacker adds and modifies tags on an Ethernet frame to allow the sending of packets through any VLAN. This attack takes advantage of how many switches process tags. Most switches will only remove the outer tag and forward the frame to all native VLAN ports. With that said, this exploit is only successful if the attacker belongs to the native VLAN of the trunk link. https://cybersecurity.att.com/blogs/security-essentials/vlan-hopping-and-mitigation
Tag nesting is a technique that involves inserting two VLAN tags into an Ethernet frame to bypass VLAN hopping prevention mechanisms. The first tag is stripped by the first switch, and the second tag is processed by the second switch, allowing the frame to reach a different VLAN than intended. RFID cloning is a technique that involves copying the data from an RFID tag to another tag or device. RFID tagging is a technique that involves attaching an RFID tag to an object or person for identification or tracking purposes. Meta tagging is a technique that involves adding metadata to web pages or files for search engine optimization or classification purposes.

NEW QUESTION # 70
A penetration tester ran the following commands on a Windows server:

Which of the following should the tester do AFTER delivering the final report?

A. Close the reverse shell connection.
B. Downgrade the svsaccount permissions.
C. Remove the tester-created credentials.
D. Delete the scheduled batch job.

Answer: C

NEW QUESTION # 71
Which of the following documents describes specific activities, deliverables, and schedules for a penetration tester?

A. MOU
B. SOW
C. NDA
D. MSA

Answer: B

Explanation:
Explanation
As mentioned in question 1, the SOW describes the specific activities, deliverables, and schedules for a penetration tester. The other documents are not relevant for this purpose. An NDA is a non-disclosure agreement that protects the confidentiality of the client's information. An MSA is a master service agreement that defines the general terms and conditions of a business relationship. An MOU is a memorandum of understanding that expresses a common intention or agreement between parties.

NEW QUESTION # 72
When preparing for an engagement with an enterprise organization, which of the following is one of the MOST important items to develop fully prior to beginning the penetration testing activities?

A. Clarify the statement of work.
B. Obtain an asset inventory from the client.
C. Identify all third parties involved.
D. Interview all stakeholders.

Answer: A

Explanation:
Explanation
Clarifying the statement of work is one of the most important items to develop fully prior to beginning the penetration testing activities, as it defines the scope, objectives, deliverables, and expectations of the engagement. The statement of work is a formal document that outlines the agreement between the penetration tester and the client and serves as a reference for both parties throughout the engagement. It should include details such as the type, duration, and frequency of testing, the target systems and networks, the authorized methods and tools, the reporting format and schedule, and any legal or ethical considerations.

NEW QUESTION # 73
A penetration tester issues the following command after obtaining a low-privilege reverse shell: wmic service get name,pathname,startmode Which of the following is the most likely reason the penetration tester ran this command?

A. To register a service to run as System
B. To list scheduled tasks that may be exploitable
C. To find services that have unquoted service paths
D. To search for passwords in the service directory

Answer: C

Explanation:
The command wmic service get name,pathname,startmode is used by penetration testers to enumerate services and their configurations, specifically looking for services with unquoted paths. If a service's path contains spaces and is not enclosed in quotes, it can be exploited by placing a malicious executable along the path, leading to privilege escalation. For example, if the service path is C:\Program Files\My Service\service.exe and is unquoted, an attacker could place a malicious Program.exe in C:\, which would then be executed with the same privileges as the service when the service starts. Identifying such services allows penetration testers to highlight potential security risks that could be exploited for privilege escalation.

NEW QUESTION # 74
A security firm is discussing the results of a penetration test with the client. Based on the findings, the client wants to focus the remaining time on a critical network segment. Which of the following BEST describes the action taking place?

A. Maximizing the likelihood of finding vulnerabilities
B. Eliminating the potential for false positives
C. Reducing the risk to the client environment
D. Reprioritizing the goals/objectives

Answer: A

NEW QUESTION # 75
SIMULATION
Using the output, identify potential attack vectors that should be further investigated.

Answer:

Explanation:
See explanation below.
Explanation:
1: Null session enumeration
Weak SMB file permissions
Fragmentation attack
2: nmap
-sV
-p 1-1023
192.168.2.2
3: #!/usr/bin/python
export $PORTS = 21,22
for $PORT in $PORTS:
try:
s.connect((ip, port))
print("%s:%s - OPEN" % (ip, port))
except socket.timeout
print("%:%s - TIMEOUT" % (ip, port))
except socket.error as e:
print("%:%s - CLOSED" % (ip, port))
finally
s.close()
port_scan(sys.argv[1], ports)

NEW QUESTION # 76
You are a penetration tester reviewing a client's website through a web browser.
INSTRUCTIONS
Review all components of the website through the browser to determine if vulnerabilities are present.
Remediate ONLY the highest vulnerability from either the certificate, source, or cookies.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.