Winter Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: bigdisc65

Free Access CompTIA PT0-002 New Release

Page: 11 / 34
Question 44

During a penetration-testing engagement, a consultant performs reconnaissance of a client to identify potential targets for a phishing campaign. Which of the following would allow the consultant to retrieve email addresses for technical and billing contacts quickly, without triggering any of the client’s cybersecurity tools? (Choose two.)

Options:

A.

Scraping social media sites

B.

Using the WHOIS lookup tool

C.

Crawling the client’s website

D.

Phishing company employees

E.

Utilizing DNS lookup tools

F.

Conducting wardriving near the client facility

Question 45

A penetration tester has completed an analysis of the various software products produced by the company under assessment. The tester found that over the past several years the company has been including vulnerable third-party modules in multiple products, even though the quality of the organic code being developed is very good. Which of the following recommendations should the penetration tester include in the report?

Options:

A.

Add a dependency checker into the tool chain.

B.

Perform routine static and dynamic analysis of committed code.

C.

Validate API security settings before deployment.

D.

Perform fuzz testing of compiled binaries.

Question 46

A company hired a penetration-testing team to review the cyber-physical systems in a manufacturing plant. The team immediately discovered the supervisory systems and PLCs are both connected to the company intranet. Which of the following assumptions, if made by the penetration-testing team, is MOST likely to be

valid?

Options:

A.

PLCs will not act upon commands injected over the network.

B.

Supervisors and controllers are on a separate virtual network by default.

C.

Controllers will not validate the origin of commands.

D.

Supervisory systems will detect a malicious injection of code/commands.

Question 47

A penetration tester who is performing a physical assessment of a company’s security practices notices the company does not have any shredders inside the office building. Which of the following techniques would be BEST to use to gain confidential information?

Options:

A.

Badge cloning

B.

Dumpster diving

C.

Tailgating

D.

Shoulder surfing

Page: 11 / 34
Exam Code: PT0-002
Exam Name: CompTIA PenTest+ Certification Exam
Last Update: Jan 22, 2025
Questions: 464
PT0-002 pdf

PT0-002 PDF

$29.75  $84.99
PT0-002 Engine

PT0-002 Testing Engine

$33.25  $94.99
PT0-002 PDF + Engine

PT0-002 PDF + Testing Engine

$47.25  $134.99