CompTIA PenTest+ Certification (PT0-002) Free Practice Test

Question 1

A penetration tester would like to crack a hash using a list of hashes and a predefined set of rules. The tester runs the following command: hashcat.exe -a 0 .\hash.txt .\rockyou.txt -r .\rules\replace.rule
Which of the following is the penetration tester using to crack the hash?

A. Dictionary

B. Rainbow table

C. Hybrid attack

D. Brute-force method

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

Which of the following BEST explains why a penetration tester cannot scan a server that was previously scanned successfully?

A. The IP address is on the allow list.

B. The IP address is wrong.

C. The server is unreachable.

D. The IP address is on the blocklist.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

A company has recruited a penetration tester to conduct a vulnerability scan over the network. The test is confirmed to be on a known environment. Which of the following would be the BEST option to identify a system properly prior to performing the assessment?

A. Asset inventory

B. Web-application scan

C. DNS records

D. Full scan

Correct Answer: A

Question 4

Which of the following are the MOST important items to include in the final report for a penetration test? (Choose two.)

A. The vulnerability identifier

B. The name of the person who found the flaw

C. The client acceptance form

D. The CVSS score of the finding

E. The tool used to find the issue

F. The network location of the vulnerable device

Correct Answer: A,E

Question 5

The delivery of a penetration test within an organization requires defining specific parameters regarding the nature and types of exercises that can be conducted and when they can be conducted. Which of the following BEST identifies this concept?

A. Rules of engagement

B. Program scope

C. Statement of work

D. Non-disclosure agreement

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

A penetration tester is performing an assessment for an application that is used by large organizations operating in the heavily regulated financial services industry. The penetration tester observes that the default Admin User account is enabled and appears to be used several times a day by unfamiliar IP addresses. Which of the following is the most appropriate way to remediate this issue?

A. Implement system hardening.

B. Increase password complexity.

C. Restrict simultaneous user log-ins.

D. Require local network access.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

A penetration tester has gained access to the Chief Executive Officer's (CEO's) internal, corporate email. The next objective is to gain access to the network.
Which of the following methods will MOST likely work?

A. Move laterally from the mail server to the domain controller.

B. Attempt to escalate privileges on the mail server to gain root access.

C. Send an email from the CEO's account, requesting a new account.

D. Try to obtain the private key used for S/MIME from the CEO's account.

Correct Answer: B

Question 8

A security analyst needs to perform a scan for SMB port 445 over a/16 network. Which of the following commands would be the BEST option when stealth is not a concern and the task is time sensitive?

A. Nmap -p 445 -n -T4 -open 172.21.0.0/16

B. Nmap -p 445 -max -sT 172. 21.0.0/16

C. Nmap -sV --script=smb* 172.21.0.0/16

D. Nmap -s 445 -Pn -T5 172.21.0.0/16

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 9

The following PowerShell snippet was extracted from a log of an attacker machine:

A penetration tester would like to identify the presence of an array. Which of the following line numbers would define the array?

A. Line 8

B. Line 13

C. Line 19

D. Line 20

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

CompTIA PenTest+ Certification (PT0-002) Free Practice Test