QUESTION: 105

Which of the following web-application security risks are part of the OWASP Top 10 v2017? (Choose two.)

Buffer overflows
Cross-site scripting
Race-condition attacks
Zero-day attacks
Injection flaws
Ransomware attacks

Answer(s): B,E

Reveal Solution Next Question

QUESTION: 106

The results of an Nmap scan are as follows:

Which of the following would be the BEST conclusion about this device?

This device may be vulnerable to the Heartbleed bug due to the way transactions over TCP/22 handle heartbeat extension packets, allowing attackers to obtain sensitive information from process memory.
This device is most likely a gateway with in-band management services.
This device is most likely a proxy server forwarding requests over TCP/443.
This device may be vulnerable to remote code execution because of a buffer overflow vulnerability in the method used to extract DNS names from packets prior to DNSSEC validation.

Answer(s): B

Reveal Solution Next Question

QUESTION: 107

When preparing for an engagement with an enterprise organization, which of the following is one of the MOST important items to develop fully prior to beginning the penetration testing activities?

Clarify the statement of work
Obtain an asset inventory from the client
Interview all stakeholders
Identify all third parties involved.

Answer(s): A

Reveal Solution Next Question

A penetration tester is reviewing the following SOW prior to engaging with a client.

`Network diagrams, logical and physical asset inventory, and employees' names are to be treated as client confidential. Upon completion of the engagement, the penetration tester will submit findings to the client's Chief Information Security Officer (CISO) via encrypted protocols and subsequently dispose of all findings by erasing them in a secure manner.`

Based on the information in the SOW, which of the following behaviors would be considered unethical? (Choose two.)

Utilizing proprietary penetration-testing tools that are not available to the public or to the client for auditing and inspection
Utilizing public-key cryptography to ensure findings are delivered to the CISO upon completion of the engagement.
Failing to share with the client critical vulnerabilities that exist within the client architecture to appease the client's senior leadership team.
Seeking help with the engagement in underground hacker forums by sharing the client's public IP address
Using a software-based erase tool to wipe the client's findings from the penetration tester's laptop.
Retaining the SOW within the penetration tester's company for future use so the sales team can plan future engagements

Answer(s): C,D

Reveal Solution Next Question

Free PT0-002 Exam Braindumps (page: 27)

QUESTION: 105

QUESTION: 106

QUESTION: 107

QUESTION: 108