最新なCompTIA PT0-001問題集（295題）、真実試験の問題を全部にカバー！

質問 1：
A security team is switching firewall vendors. The director of security wants to scope a penetration test to satisfy requirements to perform the test after major architectural changes. Which of the following is the BEST way to approach the project?
A. Review the firewall configuration, followed by a targeted attack by a read team.
B. Focus on an objective-based approach to assess network assets with a red team.
C. Perform a discovery scan to identify changes in the network.
D. Design a penetration test approach, focusing on publicly released firewall DoS vulnerabilities.
正解：B

質問 2：
A software developer wants to test the code of an application for vulnerabilities. Which of the following processes should the software developer perform?
A. Dynamic scan
B. Static scan
C. Compliance scan
D. Vulnerability scan
正解：B

質問 3：
A client's systems administrator requests a copy of the report from the penetration tester, but the systems administrator is not listed as a point of contact or signatory. Which of the following is the penetration tester's BEST course of action?
A. Send the report and carbon copy the point of contact/signatory for visibility.
B. Send the report since the systems administrator will be in charge of implementing the fixes.
C. Forward the request to the point of contact/signatory for authorization.
D. Reply and explain to the systems administrator that proper authorization is needed to provide the report.
正解：D

質問 4：
A MITM attack is being planned. The first step is to get information flowing through a controlled device. Which of the following should be used to accomplish this?
A. Evil twin
B. Replay attack
C. War driving
D. Bluejacking
E. Repeating
正解：A

質問 5：
A senior employee received a suspicious email from another executive requesting an urgent wire transfer.
Which of the following types of attacks is likely occurring?
A. Spear phishing
B. Business email compromise
C. Whaling
D. Vishing
正解：A

質問 6：
Which of the following is an example of a spear phishing attack?
A. Targeting a specific team with an email attack
B. Targeting an organization with a watering hole attack
C. Targeting random users with a USB key drop
D. Targeting an executive with an SMS attack
正解：A

質問 7：
In which of the following components is an exploited vulnerability MOST likely to affect multiple running application containers at once?
A. ASLR bypass
B. Configuration files
C. Common libraries
D. Sandbox escape
正解：C

質問 8：
A penetration tester wants to target NETBIOS name service. Which of the following is the most likely command to exploit the NETBIOS name service?
A. nmap
B. arPspoof
C. burpsuite
D. responder
正解：B

質問 9：
A penetration tester has successfully deployed an evil twin and is starting to see some victim traffic. The next step the penetration tester wants to take is to capture all the victim web traffic unencrypted. Which of the following would BEST meet this goal?
A. Implement a CA attack by impersonating trusted CAs.
B. Harvest the user credentials to decrypt traffic.
C. Perform an MITM attack.
D. Perform an HTTP downgrade attack.
正解：D