PassLeader released the NEWEST CompTIA PT0-002 exam dumps recently! Both PT0-002 VCE dumps and PT0-002 PDF dumps are available on PassLeader, either PT0-002 VCE dumps or PT0-002 PDF dumps have the NEWEST PT0-002 exam questions in it, they will help you passing CompTIA PT0-002 exam easily! You can download the valid PT0-002 dumps VCE and PDF from PassLeader here:Â https://www.passleader.com/pt0-002.html (308 Q&As Dumps –> 346 Q&As Dumps –> 615 Q&As Dumps)
Also, previewing the NEWEST PassLeader PT0-002 dumps online for free on Google Drive: https://drive.google.com/drive/folders/1V9QhQP1zOYY8Mm8AF7ee2a1OwqSWbWKl
NEW QUESTION 261
A penetration tester has gained access to a network device that has a previously unknown IP range on an interface. Further research determines this is an always-on VPN tunnel to a third-party supplier. Which of the following is the BEST action for the penetration tester to take?
A.   Utilize the tunnel as a means of pivoting to other internal devices.
B.   Disregard the IP range, as it is out of scope.
C.   Stop the assessment and inform the emergency contact.
D.   Scan the IP range for additional systems to exploit.
Answer: D
NEW QUESTION 262
A penetration tester recently performed a social-engineering attack in which the tester found an employee of the target company at a local coffee shop and over time built a relationship with the employee. On the employee’s birthday, the tester gave the employee an external hard drive as a gift. Which of the following social-engineering attacks was the tester utilizing?
A.   Phishing
B.   Tailgating
C.   Baiting
D.   Shoulder Surfing
Answer: C
Explanation:
https://phoenixnap.com/blog/what-is-social-engineering-types-of-threats
NEW QUESTION 263
A security company has been contracted to perform a scoped insider-threat assessment to try to gain access to the human resources server that houses PII and salary data. The penetration testers have been given an internal network starting position. Which of the following actions, if performed, would be ethical within the scope of the assessment?
A.   Exploiting a configuration weakness in the SQL database.
B.   Intercepting outbound TLS traffic.
C.   Gaining access to hosts by injecting malware into the enterprise-wide update server.
D.   Leveraging a vulnerability on the internal CA to issue fraudulent client certificates.
E.   Establishing and maintaining persistence on the domain controller.
Answer: B
NEW QUESTION 264
A penetration tester is able to capture the NTLM challenge-response traffic between a client and a server. Which of the following can be done with the pcap to gain access to the server?
A.   Perform vertical privilege escalation.
B.   Replay the captured traffic to the server to recreate the session.
C.   Use John the Ripper to crack the password.
D.   Utilize a pass-the-hash attack.
Answer: D
NEW QUESTION 265
Which of the following protocols or technologies would in-transit confidentially protection for emailing the final security assessment report?
A.   S/MIME
B.   FTPS
C.   DNSSEC
D.   AS2
Answer: A
NEW QUESTION 266
A penetration tester is explaining the MITRE ATT&CK framework to a company’s chief legal counsel. Which of the following would the tester MOST likely describe as a benefit of the framework?
A.   Understanding the tactics of a security intrusion can help disrupt them.
B.   Scripts that are part of the framework can be imported directly into SIEM tools.
C.   The methodology can be used to estimate the cost of an incident better.
D.   The framework is static and ensures stability of a security program over time.
Answer: A
Explanation:
https://attack.mitre.org/
NEW QUESTION 267
A company obtained permission for a vulnerability scan from its cloud service provider and now wants to test the security of its hosted data. Which of the following should the tester verify FIRST to assess this risk?
A.   Whether sensitive client data is publicly accessible.
B.   Whether the connection between the cloud and the client is secure.
C.   Whether the client’s employees are trained properly to use the platform.
D.   Whether the cloud applications were developed using a secure SDLC.
Answer: B
NEW QUESTION 268
A Chief Information Security Officer wants a penetration tester to evaluate the security awareness level of the company’s employees. Which of the following tools can help the tester achieve this goal?
A.   Metasploit
B.   Hydra
C.   SET
D.   WPScan
Answer: A
NEW QUESTION 269
Which of the following is the MOST common vulnerability associated with IoT devices that are directly connected to the Internet?
A.   Unsupported operating systems.
B.   Susceptibility to DDoS attacks.
C.   Inability to network.
D.   The existence of default passwords.
Answer: A
NEW QUESTION 270
An Nmap scan shows open ports on web servers and databases. A penetration tester decides to run WPScan and SQLmap to identify vulnerabilities and additional information about those systems. Which of the following is the penetration tester trying to accomplish?
A.   Uncover potential criminal activity based on the evidence gathered.
B.   Identify all the vulnerabilities in the environment.
C.   Limit invasiveness based on scope.
D.   Maintain confidentiality of the findings.
Answer: C
NEW QUESTION 271
A company hired a penetration tester to do a social-engineering test against its employees. Although the tester did not find any employees’ phone numbers on the company’s website, the tester has learned the complete phone catalog was published there a few months ago. In which of the following places should the penetration tester look FIRST for the employees’ numbers?
A.   Web archive.
B.   GitHub.
C.   File metadata.
D.   Underground forums.
Answer: A
NEW QUESTION 272
A company’s Chief Executive Officer has created a secondary home office and is concerned that the WiFi service being used is vulnerable to an attack. A penetration tester is hired to test the security of the WiFi’s router. Which of the following is MOST vulnerable to a brute-force attack?
A.   WPS
B.   WPA2-EAP
C.   WPA-TKIP
D.   WPA2-PSK
Answer: A
Explanation:
https://us-cert.cisa.gov/ncas/alerts/TA12-006A
NEW QUESTION 273
A penetration tester is starting an assessment but only has publicly available information about the target company. The client is aware of this exercise and is preparing for the test. Which of the following describes the scope of the assessment?
A.   Partially known environment testing.
B.   Known environment testing.
C.   Unknown environment testing.
D.   Physical environment testing.
Answer: C
NEW QUESTION 274
A consulting company is completing the ROE during scoping. Which of the following should be included in the ROE?
A.   Cost of the assessment.
B.   Report distribution.
C.   Testing restrictions.
D.   Liability.
Answer: B
NEW QUESTION 275
A new client hired a penetration-testing company for a month-long contract for various security assessments against the client’s new service. The client is expecting to make the new service publicly available shortly after the assessment is complete and is planning to fix any findings, except for critical issues, after the service is made public. The client wants a simple report structure and does not want to receive daily findings. Which of the following is most important for the penetration tester to define FIRST?
A.   Establish the format required by the client.
B.   Establish the threshold of risk to escalate to the client immediately.
C.   Establish the method of potential false positives.
D.   Establish the preferred day of the week for reporting.
Answer: A
NEW QUESTION 276
A penetration tester received a .pcap file to look for credentials to use in an engagement. Which of the following tools should the tester utilize to open and read the .pcap file?
A.   Nmap
B.   Wireshark
C.   Metasploit
D.   Netcat
Answer: B
NEW QUESTION 277
A penetration tester was able to gather MD5 hashes from a server and crack the hashes easily with rainbow tables. Which of the following should be included as a recommendation in the remediation report?
A.   Stronger algorithmic requirements.
B.   Access controls on the server.
C.   Encryption on the user passwords.
D.   A patch management program.
Answer: C
NEW QUESTION 278
A penetration tester has been hired to perform a physical penetration test to gain access to a secure room within a client’s building. Exterior reconnaissance identifies two entrances, a WiFi guest network, and multiple security cameras connected to the Internet. Which of the following tools or techniques would BEST support additional reconnaissance?
A.   Wardriving
B.   Shodan
C.   Recon-ng
D.   Aircrack-ng
Answer: C
NEW QUESTION 279
A penetration tester completed a vulnerability scan against a web server and identified a single but severe vulnerability. Which of the following is the BEST way to ensure this is a true positive?
A.   Run another scanner to compare.
B.   Perform a manual test on the server.
C.   Check the results on the scanner.
D.   Look for the vulnerability online.
Answer: B
NEW QUESTION 280
Which of the following tools would be MOST useful in collecting vendor and other security-relevant information for IoT devices to support passive reconnaissance?
A.   Shodan
B.   Nmap
C.   WebScarab-NG
D.   Nessus
Answer: B
NEW QUESTION 281
A company has hired a penetration tester to deploy and set up a rogue access point on the network. Which of the following is the BEST tool to use to accomplish this goal?
A.   Wireshark
B.   Aircrack-ng
C.   Kismet
D.   Wifite
Answer: B
Explanation:
https://null-byte.wonderhowto.com/how-to/hack-wi-fi-stealing-wi-fi-passwords-with-evil-twin-attack-0183880/
NEW QUESTION 282
……
Welcome to choose PassLeader PT0-002 dumps for 100% passing CompTIA PT0-002 exam:Â https://www.passleader.com/pt0-002.html (308 Q&As VCE Dumps and PDF Dumps –> 346 Q&As VCE Dumps and PDF Dumps –> 615 Q&As VCE Dumps and PDF Dumps)
Also, previewing the NEWEST PassLeader PT0-002 dumps online for free on Google Drive: https://drive.google.com/drive/folders/1V9QhQP1zOYY8Mm8AF7ee2a1OwqSWbWKl