Pentest+ Practice Exam Chapter 4 Vulnerability Scanning and Analysis (Jonathan Ammerman) Flashcards
Which of the following is not a publicly accessible list used for vulnerability research and analysis?
A. Common Vulnerabilities and Exposures (CVE)
B.The Japan Computer Emergency Response Team (JPCERT)
C. Common Weakness Enumeration (CWE)
D.Common Attack Pattern Enumeration and Classification (CAPEC)
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 71). McGraw-Hill Education. Kindle Edition.
B. The Japan Computer Emergency Response Team (JPCERT)
Explanation:
The Japan Computer Emergency Response Team, or JPCERT, is a cybersecurity information-sharing organization backed by the Japanese government, rather than a specific resource provided by such an organization
A is incorrect because the Common Vulnerabilities and Exposures, or CVE (https://cve.mitre.org), is a list of entries for publicly known cybersecurity vulnerabilities provided by MITRE (which is the name of the company, rather than an acronym). Each entry contains an identification number, a description, and at least one public reference for further information. C is incorrect because the Common Weakness Enumeration, or CWE (https://cwe.mitre.org), is a community-developed list of common software security weaknesses managed by MITRE. Per MITRE, CWE provides a baseline for weakness identification, mitigation, and prevention efforts. D is incorrect because the Common Attack Pattern Enumeration and Classification, or CAPEC (https://capec.mitre.org), is a dictionary provided by MITRE that serves to help classify various types of attacks so that they can be better understood by analysts, developers, testers, and educators.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 84). McGraw-Hill Education. Kindle Edition.
Which of the following is a public, vendor-neutral forum and mailing list that publishes vulnerability analysis details, exploitation techniques, and other relevant information for the security community? A. US-CERT B. MITRE C. NIST D. Full Disclosure
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 71). McGraw-Hill Education. Kindle Edition.
D. Full Disclosure
Explanation:
Full Disclosure is a public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques.
It also provides tools, papers, news and events of interest to the cybersecurity community
Which of the following is a major benefit of running a credentialed vulnerability scan over a uncredentialed scan?
A.Uncredentialed vulnerability scans are known to more commonly produce false positives.
B.Credentialed vulnerability scans more accurately represent real-world conditions when facing an outside threat actor.
C.Uncredentialed vulnerability scans tend to reveal more issues, so credentialed scans are easier to report.
D.Credentialed vulnerability scans are usually faster.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 71). McGraw-Hill Education. Kindle Edition.
A. Uncredentialed vulnerability scans are known to more commonly produce false positives.
Explanation:
Uncredentialed vulnerability scans are known to more commonly produce false positives when scanning systems and applications.
As such, credentialed scans are desirable due to their tendency to cut down on such unwarranted alerts during a pentest
The National Institute of Standards and Technology (NIST) maintains what public resource for analysis on vulnerabilities published to the CVE dictionary, using the Common Vulnerability Scoring System (CVSS)?
A. Full Disclosure
B. National Vulnerability Database (NVD)
C. CWE
D. OWASP
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 71). McGraw-Hill Education. Kindle Edition.
B. National Vulnerability Database (NVD)
Explanation:
NIST maintains the National Vulnerability Database, or NVD
A discovery scan in nmap is described by which of the following statements? (Choose two.)
A. It’s an active scanning technique.
B.It scans all 65,000+ possible network ports.
C.It performs a simple ping test to determine if a host is up and alive on the network.
D.It identifies software and versions running on open ports.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 71). McGraw-Hill Education. Kindle Edition.
A. It’s an active scanning technique.
C. It performs a simple ping test to determine if a host is up and alive on the network.
Explanation:
A discovery scan is an active scanning technique that relies on performing a ping test to determine if a host is up and alive on a network
A stealth scan in nmap is denoted by the \_\_\_\_\_\_\_\_\_\_ flag and leverages the use of \_\_\_\_\_\_\_\_\_\_ when probing ports. A. -sT, TCP Connect() calls B. -sT, SYN packets C. -sU, RST packets D. -sS, SYN and RST packets
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (pp. 71-72). McGraw-Hill Education. Kindle Edition.
D. -sS, SYN and RST packets
Explanation:
A stealth scan in nmap is denoted by the -sS flag and leverages the use of SYN and RST packets when probing ports.
If a server responds with a SYN/ACK packet to continue a three-way TCP handshake, nmap trashes the connection by sending an RST packet; this often prevents scans from showing up in server logs
Security Content Automation Protocol (SCAP) aware scanners, such as Tenable’s Nessus, test the implementation of best-practice security configuration baselines from the Center for Internet Security (CIS). For which type of scan are these baselines most helpful? A. Full scan B. Discovery scan C. Compliance scan D. Stealth scan
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 72). McGraw-Hill Education. Kindle Edition.
C. Compliance scan
Explanation:
The baselines established by SCAP and embedded in scanners such as Nessus are most helpful during a compliance scan.
Supervisory Control and Data Acquisition (SCADA) is a real-time control system that monitors the health and status of components of what type of infrastructure?
A.Industrial control systems (ICS) used in manufacturing, power generation, water treatment, and other public works
B. Point-of-sale systems
C.Embedded systems such as MP3 players, smartphones, and e-readers
D.Biometric scanners such as fingerprint readers and retinal scanners
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 72). McGraw-Hill Education. Kindle Edition.
A. Industrial control systems (ICS) used in manufacturing, power generation, water treatment, and other public works
Explanation:
Supervisory Control and Data Acquisition (SCADA) is a real-time control system that monitors the health and status of components of industrial control systems (ICS) used in manufacturing, power generation, water treatment and other public works
Which of the following is not an example of a nontraditional asset? A. Real-time operating systems (RTOSs) B. SCADA networks C. Linux servers D. IoT devices
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 72). McGraw-Hill Education. Kindle Edition.
C. Linux servers
Explanation:
Linux servers are common computer hardware, and as such are considered rather traditional sort of information system asset
The tool shown in the following illustration provides web and web application security testing capabilities. What is it called? A. Nikto B. W3AF C. Burp Suite D. OpenVAS
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 72). McGraw-Hill Education. Kindle Edition.
C. Burp Suite
Which of the following is not an issue to consider when performing a vulnerability scan?
A.Services and protocols known to be in use in the environment
B. Bandwidth limitations
C.Overall topology of the network in question
D.The public reputation of the developers of the software or operating system being tested
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 73). McGraw-Hill Education. Kindle Edition.
D. The public reputation of the developers of the software or operating system being tested
Explanation:
The public reputation of the developers of software or an operating system are the concern of those developers alone; the job of the penetration tester is to test and verify system security
Why might it be necessary to throttle queries to a target system during a penetration test?
A.To keep your testing system from getting slow
B.To prevent your hard drive from filling up due to the volume of data
C.To more accurately mirror real-world service-use conditions
D.To avoid taking down a system or service through effectively running a denial-of-service attack, or to avoid detection by not tripping log sensors or other alerts
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 73). McGraw-Hill Education. Kindle Edition.
D. To avoid taking down a system or service through effectively running a denial-of-service attack, or to avoid detection by not tripping log sensors or other alerts
Explanation:
Throttling queries to a target system necessarily adds to the load that system encounters.
SInce some scanners can be aggressive, letting them run at full speed can sometimes be enough to take the system down, since overloading a system in such a manner is only distinguishable from an intentional DoS attack in that it was not intedned to be malicious.
Moreover, aggressive scans can trip warning sensors or alerts; if conducting a red team assessment, this could be detrimental to your success as a pentester since an alert blue team is able to counter your activities more readily
In addition to their value in compliance-based penetration tests, which of the following is another benefit of the use of testing an environment against CIS preconfigured operational baseline scan templates?
A.Less work on the part of the penetration tester
B. Simplification of the scanning process
C.Aid in the development of organizational security policy
D.Assisting the organization with asset categorization and implementation of industry best practices
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (pp. 73-74). McGraw-Hill Education. Kindle Edition.
D. Assisting the organization with asset categorization and implementation of industry best practices
Explanation:
Preconfigured operational baseline scan templates allow an organization to better understand their technological footprint, which simplifies asset categorization and empowers them to identify and implement industry best practices that may be applicable to their architecture and environment
Which of the following is not a benefit of performing vulnerability scanning during a penetration test?
A.Aids penetration testers in prioritizing attack vectors for manual testing based on those most likely to produce findings
B.Thorough review of application code outside of a running system for details on the vulnerability
C.Assists in time management during a penetration test by automating vulnerability discovery
D.Improves the overall quality of the penetration test and the resulting report by providing the penetration tester a sense of focus on higher priority (that is, higher risk) vulnerabilities
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 74). McGraw-Hill Education. Kindle Edition.
B. Thorough review of application code outside of a running system for details on the vulnerability
Explanation:
B is correct. This is an example of the potential benefits of static application analysis, not a benefit of vulnerability scanning. A, C, and D are incorrect. These are all examples of benefits of leveraging vulnerability mapping during a penetration test, making them all incorrect answers. Prioritization of likely successful attack vectors, time management, and overall penetration test quality improvement are all expected benefits
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 90). McGraw-Hill Education. Kindle Edition.
As shown by the following output, this open-source command-line tool is a web server scanner that tests for dangerous files or CGIs, outdated server software, and other problems. A. OpenVAS B. Dirbuster C. Nikto D. Gobuster
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 74). McGraw-Hill Education. Kindle Edition.
C. Nikto
Explanation:
The screenshot shows the beginning of a scan using Nikto. A, B, and D are incorrect. A may be safely ruled out as OpenVAS is a graphical interface tool. Since the image in question is of a command-line interface, you can easily determine that OpenVAS is incorrect. B and D are tools that serve to help enumerate directories and file names present on web servers; dirbuster may be used via the command line or graphical interface, and gobuster is a simplified, functionally similar tool exclusive to the command line.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 91). McGraw-Hill Education. Kindle Edition.
Which of the following is not a commonly reported theme or issue in vulnerability scan results?
A. Observations
B. Exploits
C. Vulnerabilities
D.Failure to apply industry best practices
B. Exploits
Explanation:
While it is common for vulnerability scan results to detail vulnerabilities specific to a system, a functional exploit that takes advantage of that vulnerability is not going to be presented in the vulnerability scan results. A, C, and D are incorrect because all are examples of commonly reported themes or issues found in vulnerability scan results. Observations may include items such as software or OS version numbers. Vulnerabilities would be highlighted when identified, such as through software or OS build version numbers or based on port scan results. Failure to apply industry best practices is highlighted with vulnerability vulnerability scanners such as Nessus and Burp Suite, and may include items such as a failure to enable HTTP Secure Transport Security or leaving SSLv2 or v3 enabled on a system.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 91). McGraw-Hill Education. Kindle Edition.
Which of the following is an example of a vulnerability identification that is typical of those detailed in the results of a vulnerability scan?
A.Software version numbers revealed during scanning.
B.HTTP Strict Transport Security is not enabled on a system web application.
C.OS fingerprinting reveals a system running Windows XP SP2, suggesting susceptibility to MS08-067.
D.SSLv2 and v3 found to be enabled.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 75). McGraw-Hill Education. Kindle Edition.
C. OS fingerprinting reveals a system running Windows XP SP2, suggesting susceptibility to MS08-067.
Explanation:
OS fingerprinting revealing susceptibility to exploits targeting MS08-067 would be an example of a vulnerability identified by a vulnerability scan. A, B, and D are incorrect. A is incorrect because it is an example of an observation that may be identified during a vulnerability scan. B and D are incorrect because they are examples of identified failure to apply industry best practices.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 92). McGraw-Hill Education. Kindle Edition.
Which of the following is an example of a failure to apply best practices typical of those detailed in the results of a vulnerability scan?
A.HTTP Strict Transport Security is not enabled on a system web application.
B.Target is identified as an Apache web server.
C.Software version numbers are revealed during scanning.
D.OS fingerprinting reveals a system running Windows XP SP2, suggesting susceptibility to MS08-067.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 75). McGraw-Hill Education. Kindle Edition.
A. HTTP Strict Transport Security is not enabled on a system web application.
Explanation:
A is correct. Not requiring HTTP Strict Transport Security is an example of a failure to apply best practices that may be identified during a vulnerability scan. B, C, and D are incorrect. B and C are incorrect because these are examples of observations that may be identified during a vulnerability scan. D is incorrect because it is an example of a specific vulnerability identified during a penetration test.
Ammerman, Jonathan; Ammerman, Jonathan. CompTIA PenTest+ Certification Practice Exams (Exam PT0-001) (p. 92). McGraw-Hill Education. Kindle Edition.
