Free PT0-002 Exam Braindumps

You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious. INSTRUCTIONS
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

Solution:
* 1. Reflected XSS - Input sanitization (<> ...)
* 2. Sql Injection Stacked - Parameterized Queries
* 3. DOM XSS - Input Sanitization (<> ...)
* 4. Local File Inclusion - sandbox req
* 5. Command Injection - sandbox req
* 6. SQLi union - paramtrized queries
* 7. SQLi error - paramtrized queries
* 8. Remote File Inclusion - sandbox
* 9. Command Injection - input saniti $
* 10. URL redirect - prevent external calls

Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: A

A penetration tester would like to obtain FTP credentials by deploying a workstation as an on-path attack between the target and the server that has the FTP protocol. Which of the following methods would be the BEST to accomplish this objective?

1. A. Wait for the next login and perform a downgrade attack on the server.
2. B. Capture traffic using Wireshark.
3. C. Perform a brute-force attack over the server.
4. D. Use an FTP exploit against the server.

Correct Answer: B

Which of the following BEST describes why a client would hold a lessons-learned meeting with the penetration-testing team?

1. A. To provide feedback on the report structure and recommend improvements
2. B. To discuss the findings and dispute any false positives
3. C. To determine any processes that failed to meet expectations during the assessment
4. D. To ensure the penetration-testing team destroys all company data that was gathered during the test

Correct Answer: C

A penetration tester conducts an Nmap scan against a target and receives the following results:

Which of the following should the tester use to redirect the scanning tools using TCP port 1080 on the target?

1. A. Nessus
2. B. ProxyChains
3. C. OWASPZAP
4. D. Empire

Correct Answer: B

A penetration tester was contracted to test a proprietary application for buffer overflow vulnerabilities. Which of the following tools would be BEST suited for this task?

1. A. GDB
2. B. Burp Suite
3. C. SearchSpliot
4. D. Netcat

Correct Answer: A