CompTIA PT0-002 問題集

質問 1：
Which of the following types of information should be included when writing the remediation section of a penetration test report to be viewed by the systems administrator and technical staff?
A. A quick description of the vulnerability and a high-level control to fix it
B. The executive summary and information regarding the testing company
C. Information regarding the business impact if compromised
D. The rules of engagement from the assessment
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 2：
Which of the following is the MOST common vulnerability associated with IoT devices that are directly connected to the Internet?
A. Inability to network
B. The existence of default passwords
C. Unsupported operating systems
D. Susceptibility to DDoS attacks
正解：C

質問 3：
In Java and C/C++, variable initialization is critical because:
A. the unknown value, when used later, will cause unexpected behavior.
B. the initial state of the variable creates a race condition.
C. the compiler will assign null to the variable, which will cause warnings and errors.
D. the variable will not have an object type assigned to it.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 4：
A penetration tester has gained access to a network device that has a previously unknown IP range on an interface. Further research determines this is an always-on VPN tunnel to a third-party supplier.
Which of the following is the BEST action for the penetration tester to take?
A. Stop the assessment and inform the emergency contact.
B. Disregard the IP range, as it is out of scope.
C. Scan the IP range for additional systems to exploit.
D. Utilize the tunnel as a means of pivoting to other internal devices.
正解：C

質問 5：
A penetration tester is looking for a particular type of service and obtains the output below:
I Target is synchronized with 127.127.38.0 (reference clock)
I Alternative Target Interfaces:
I 10.17.4.20
I Private Servers (0)
I Public Servers (0)
I Private Peers (0)
I Public Peers (0)
I Private Clients (2)
I 10.20.8.69 169.254.138.63
I Public Clients (597)
I 4.79.17.248 68.70.72.194 74.247.37.194 99.190.119.152
I 12.10.160.20 68.80.36.133 75.1.39.42 108.7.58.118
I 68.56.205.98
I 2001:1400:0:0:0:0:0:1 2001:16d8:ddOO:38:0:0:0:2
I 2002:db5a:bccd:l:21d:e0ff:feb7:b96f 2002:b6ef:81c4:0:0:1145:59c5:3682
I Other Associations (1)
|_ 127.0.0.1 seen 1949869 times, last tx was unicast v2 mode 7
Which of the following commands was executed by the tester?
A. nmap -sU -pU:517 -Pn -n -script=supermicro-ipmi-config <target>
B. nmap -sU -pU:161 -Pn -n -script=voldemort-info <target>
C. nmap -sU -pU:37 -Pn -n -script=icap-info <target>
D. nmap -sU -pU:123 -Pn -n -script=ntp-monlist <target>
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 6：
An assessment has been completed, and all reports and evidence have been turned over to the client. Which of the following should be done NEXT to ensure the confidentiality of the client's information?
A. Report any findings to regulatory oversight groups
B. Publish the findings after the client reviews the report
C. Follow the established data retention and destruction process
D. Encrypt and store any client information for future analysis
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 7：
A security consultant wants to perform a vulnerability assessment with an application that can effortlessly generate an easy-to-read report. Which of the following should the attacker use?
A. Brakeman
B. Metasploit
C. Nessus
D. SCAP
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 8：
A penetration tester recently completed a review of the security of a core network device within a corporate environment. The key findings are as follows:
* The following request was intercepted going to the network device:
GET /login HTTP/1.1
Host: 10.50.100.16
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0
Accept-Language: en-US,en;q=0.5
Connection: keep-alive
Authorization: Basic WU9VUilOQU1FOnNlY3JldHBhc3N3b3jk
* Network management interfaces are available on the production network.
* An Nmap scan returned the following:

Which of the following would be BEST to add to the recommendations section of the final report? (Choose two.)
A. Implement a better method for authentication.
B. Disable HTTP/301 redirect configuration.
C. Eliminate network management and control interfaces.
D. Enforce enhanced password complexity requirements.
E. Create an out-of-band network for management.
F. Disable or upgrade SSH daemon.
正解：A,E
解説: (Topexam メンバーにのみ表示されます)