PT0-002 Free Practice Test

A penetration tester receives the following results from an Nmap scan:

Which of the following OSs is the target MOST likely running?

1. A. CentOS
2. B. Arch Linux
3. C. Windows Server
4. D. Ubuntu

Correct Answer: C

Penetration-testing activities have concluded, and the initial findings have been reviewed with the client. Which of the following best describes the NEXT step in the engagement?

1. A. Acceptance by the client and sign-off on the final report
2. B. Scheduling of follow-up actions and retesting
3. C. Attestation of findings and delivery of the report
4. D. Review of the lessons learned during the engagement

Correct Answer: C

You are a penetration tester running port scans on a server. INSTRUCTIONS
Part 1: Given the output, construct the command that was used to generate this output from the available options.
Part 2: Once the command is appropriately constructed, use the given output to identify the potential attack vectors that should be investigated further.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.


Solution:
Part 1 - 192.168.2.2 -O -sV --top-ports=100 and SMB vulns
Part 2 - Weak SMB file permissions
https://subscription.packtpub.com/book/networking-and-servers/9781786467454/1/ch01lvl1sec13/fingerprinting

Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: A

A penetration tester is looking for a vulnerability that enables attackers to open doors via a specialized TCP service that is used for a physical access control system. The service exists on more than 100 different hosts, so the tester would like to automate the assessment. Identification requires the penetration tester to:
Have a full TCP connection
Send a “hello” payload
Walt for a response
Send a string of characters longer than 16 bytes
Which of the following approaches would BEST support the objective?

1. A. Run nmap –Pn –sV –script vuln <IP address>.
2. B. Employ an OpenVAS simple scan against the TCP port of the host.
3. C. Create a script in the Lua language and use it with NSE.
4. D. Perform a credentialed scan with Nessus.

Correct Answer: C
The Nmap Scripting Engine (NSE) is one of Nmap's most powerful and flexible features. It allows users to
write (and share) simple scripts (using the Lua programming language ) to automate a wide variety of networking tasks. https://nmap.org
Creating a script in the Lua language and using it with NSE would best support the objective of finding a vulnerability that enables attackers to open doors via a specialized TCP service that is used for a physical access control system. NSE (Nmap Scripting Engine) is a feature of Nmap that allows users to write and run scripts to automate tasks or perform advanced scans. Lua is a scripting language that NSE supports and can be used to create custom scripts for Nmap.

When developing a shell script intended for interpretation in Bash, the interpreter /bin/bash should be explicitly specified. Which of the following character combinations should be used on the first line of the script to accomplish this goal?

1. A. <#
2. B. <$
3. C. ##
4. D. #$
5. E. #!

Correct Answer: E