PT0-002 Questions Bank

ROE stands for Rules of Engagement, which are the guidelines and limitations that define the scope, objectives, and methods of a penetration testing engagement. ROE should be agreed upon by both the client and the tester before the testing begins, and they should include the authorization to perform certain actions, such as requesting CVE numbers, disclosing vulnerabilities, or exploiting systems. By requesting a CVE number without express authorization, the penetration tester most likely breached the ROE and violated the client’s trust and expectations. References:

•The Official CompTIA PenTest+ Study Guide (Exam PT0-002), Chapter 1: Planning and Scoping Penetration Tests, page 23-24.

•CVE - CVE1

•NDA, MSA, SOW and SLA. Confidentiality agreements when you outsource QA

The Python script mentioned in the question is designed to send HTTP requests using different methods ('OPTIONS', 'TRACE', 'TEST') to a specified URL ('http://server.net ') and print out the method used along with the status code and reason for each response. The key objectives of this script are:

HTTP Methods Availability (B): By cycling through different HTTP methods, the script checks which methods are supported by the web server. This can reveal potential vulnerabilities, as certain methods like 'TRACE' can be exploited in certain situations (e.g., Cross Site Tracing (XST) attacks).

Web Server Fingerprinting (D): The response to different HTTP methods can provide clues about the web server's software and configuration, contributing to server fingerprinting. This information can be used to tailor further attacks or understand the security posture of the server.

This script is not designed for causing a denial of service, detecting web application firewalls, examining error handling, or performing banner grabbing directly, which excludes options A, C, E, and F.

The Nmap scan command given will scan all the hosts in the 192.168.0.0/24 subnet, except for the one with the IP address 192.168.0.101. The subnet has 256 possible hosts, but one of them is excluded, so the total number of servers that Nmap will attempt to scan is 255. References:

Nmap Commands - 17 Basic Commands for Linux Network, Section: Scan Multiple Hosts, Subsection: Excluding Hosts from Search

Nmap Cheat Sheet 2023: All the Commands and More, Section: Target Specification, Subsection: -exclude

In the scenario where users are mistyping the name of a fileshare server, leading to broadcast requests, the most effective exploitation strategy would be for the penetration tester to respond to these requests with their own IP address (D) and set up a service to capture authentication credentials. This technique is known as a "Man-in-the-Middle" (MitM) attack, where the attacker intercepts communication between two parties. In this case, the tester can exploit the misdirected requests to potentially capture sensitive information such as usernames and passwords.