PT0-001 試験問題を無料オンラインアクセス

A penetration tester was able to enter an SQL injection command into a text box and gain access to the information store on the database. Which of the following is the BEST recommendation that would mitigate the vulnerability?

• A.Install host-based intrusion detection
• B.Perform system hardening
• C.Randomize the credentials used to log in
• D.Implement input normalization

Joe, a penetration tester, was able to exploit a web application behind a firewall He is trying to get a reverse shell back to his machine but the firewall blocks the outgoing traffic Ports for which of the following should the security consultant use to have the HIGHEST chance to bypass the firewall?

• A.SMTP
• B.DNS
• C.FTP
• D.HTTP

A penetration tester is required to report installed shells on compromised systems. Which of the following is the reason?

• A.To allow the developer to troubleshoot the vulnerability
• B.To allow the systems administrator to perform the cleanup
• C.To allow another security consultant access to the shell
• D.To allow the systems administrator to write a rule on the WAF

A penetration tester wants to check manually if a "ghost" vulnerability exists in a system. Which of the following methods is the correct way to validate the vulnerability?

• A.Download the GHOST file to a Linux system and compile
  gcc -o GHOST
  test i:
  ./GHOST
• B.Download the GHOST file to a Windows system and compile
  gcc -o GHOST
  test i:
  ./GHOST
• C.Download the GHOST file to a Linux system and compile
  gcc -o GHOST GHOST.c
  test i:
  ./GHOST
• D.Download the GHOST file to a Windows system and compile
  gcc -o GHOST GHOST.c
  test i:
  ./GHOST

A penetration tester successfully exploits a system, receiving a reverse shell. Which of the following is a Meterpreter command that is used to harvest locally stored credentials?

• A.psexec
• B.session
• C.hashdump
• D.getuid
• E.background