Free CompTIA PenTest+ PT0-002: 10 Tools & Code Analysis + Anki Decks

Ref:📕CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

PenTest+ (PT0-002) Chapter 10. Tools and Code Analysis

1 / 130

Which tool is most likely to be used for analyzing embedded information in music or audio recordings?

A. OpenStego

B. Sonic Visualiser

C. metagoofil

D. Coagula

2 / 130

Which of the following utilities can be used to perform DNS tunneling?

A. Metasploit

B. BeEF

C. sods

D. Feederbot

3 / 130

What is the function of the tool ’metagoofil’ in terms of analyzing information in files?

A. It can reveal vulnerabilities in cloud platforms.

B. It can be used to make sound from an image.

C. It can be used to extract metadata information from documents and images.

D. It is used for AWS exploitation.

4 / 130

What kind of reconaissance involves gathering info about a victim using public information without any active tools?

A. Active Reconnaissance

B. Passive Reconnaissance

C. Field Reconnaissance

D. Live Reconnaissance

5 / 130

What is the function of the Whois utility?

A. For broadcasting advertisements

B. For querying the Whois database to get information on a domain

C. For sending mass unsolicited emails

D. For high volume, automated, electronic processes that send queries or data to the systems of Registry Operator

6 / 130

What is the correct syntax to use the Hydra tool for a brute-force attack with a combination of usernames and passwords?

A. hydra -l logins.txt -p passwords.txt ftp://10.1.2.3

B. hydra -L logins.txt -P passwords.txt ftp://10.1.2.3

C. hydra -l logins.txt -P passwords.txt ftp://10.1.2.3

D. hydra -L logins.txt -p passwords.txt ftp://10.1.2.3

7 / 130

Which tool can be used to make sound from an image for steganography purposes?

A. OpenStego

B. Snow

C. Coagula

D. Sonic Visualiser

8 / 130

What can be said about functions in Python based on the provided text?

A. They run continuously until stopped.

B. They never need to be called to run.

C. They only run when they are called.

D. They are specific to Python and don’t exist in other programming languages.

9 / 130

What is the main use of Objdump in the context of penetration testing?

A. To compile an application using a Linux-based computer

B. To disassemble binaries and display information about object files

C. To create new hacking tools for reverse engineering

D. To analyze network traffic and uncover malicious packets

10 / 130

What options are available to schedule a scan in OpenVAS?

A. By using the Task Wizard only

B. By navigating to Scans -> Tasks and selecting Task Wizard

C. By using the API, by using the Task Wizard, or by navigating to Configuration -> Schedules

D. By accessing the documentation at https://docs.greenbone.net/#user_documentation

11 / 130

Which of the following penetration testing distributions is based on Debian and focuses on digital forensics and privacy protection?

A. Kali Linux

B. Parrot OS

C. BlackArch Linux

D. WHax

12 / 130

What set of actions does the w3af tool perform based on the provided examples?

A. Scanning for web application vulnerabilities and performing an SQL injection audit

B. Scanning and patching web application vulnerabilities

C. Performing w3af version updates

D. Scanning for OS vulnerabilities and performing a Buffer Overflow audit

13 / 130

Which of the following tools can be used to analyze embedded information in music or audio recordings?

A. Coagula

B. Sonic Visualiser

C. TinEye

D. metagoofil

14 / 130

How does the Tor tool allow users to surf the web anonymously?

A. It utilizes ’onion routing’ by encrypting the application layer of a communication protocol stack that is ’nested’ like the layers of an onion.

B. It deflects hackers and potential threats away from the user’s actual IP address using mirror sites.

C. It provides a shield to protect all online activities from third-party observation.

D. It implements the use of firewalls and additional security systems to protect a user’s online activity.

15 / 130

What is the function of the tool, Cain and Abel?

A. To create a secure password generator

B. To establish a secure connection

C. To recover Windows-based system passwords

D. To identify unused system resources

16 / 130

Which of the following tools can be used to reveal vulnerabilities in AWS, Azure, Google Cloud Platform, and other cloud platforms?

A. Coagula

B. metagoofil

C. ScoutSuite

D. snow

17 / 130

Which of the following Linux distributions are most commonly used for penetration testing tools according to the CompTIA PenTest+ PT0-002 blueprint?

A. Ubuntu Linux

B. CentOS

C. Red Hat Enterprise Linux

D. Kali Linux, Parrot OS, BlackArch Linux

18 / 130

Which of the following tools or Linux distributions is designed for small to medium-sized digital investigations and acquisitions?

A. CAINE

B. ADIA

C. Skadi

D. PALADIN

19 / 130

What type of information can FOCA and ExifTool extract from files?

A. Only EXIF information from graphics files

B. Metadata, hidden information and EXIF information

C. Only metadata and hidden information

D. Only URL information from a scanned website

20 / 130

Which of the following can be used for post-exploitation activities after maintaining persistence on a compromised system?

A. Netcat

B. Empire

C. PowerSploit

D. All of the above

21 / 130

What is the function of theHarvester tool as studied in Section 10 Tools and Code Analysis?

A. It’s a tool for executing DNS brute force attacks

B. It’s used for discovering all subdomains of a given domain

C. It’s meant to mine data in LinkedIn for email harvesting

D. It’s a tool to check the health status of DNS servers

22 / 130

What does OpenVAS enable you to do?

A. Perform detailed vulnerability scanning against hosts and networks

B. Monitor network traffic

C. Encrypt data

D. Repair vulnerabilities

23 / 130

Which of the following tools is not built specifically for use with Java applications?

A. SpotBugs

B. Findsecbugs

C. SonarQube

D. American Fuzzy Lop

24 / 130

Which of the following is not a tool used for fuzz testing?

A. Peach

B. Mutiny Fuzzing Framework

C. Findsecbugs

D. American Fuzzy Lop

25 / 130

What is the tool mdk4 used for in wireless network assessments?

A. To perform brute-force attacks against Wi-Fi Protected Setup (WPS) implementations

B. To perform fuzzing, IDS evasions, and other wireless attacks

C. To spoof and clone Bluetooth devices

D. To perform different attacks against wireless networks, including cracking WEP, WPA, and WPS keys

26 / 130

When is a JavaScript function executed?

A. It runs automatically when the code is loaded.

B. It runs only when it is called.

C. It runs on a predefined schedule.

D. It runs when another function is completed.

27 / 130

What type of attacks can the Patator tool be used for?

A. Dictionary attacks on WiFi passwords

B. Brute-force attacks on enumerations of SNMPv3 usernames, VPN passwords and other types of credential attacks

C. DDoS attacks on web servers

D. Injection attacks on SQL databases

28 / 130

Which tool can be used to make sound from an image in the act of steganography?

A. TinEye

B. Coagula

C. metagoofil

D. Pacu

29 / 130

Which one of the following logic constructs is used to handle decisions in programming?

A. String operators

B. Loops

C. Conditionals

D. Arithmetic operators

30 / 130

Which of the following steganography tools can be used to extract metadata information from documents and images?

A. OpenStego

B. Coagula

C. Sonic Visualiser

D. metagoofil

31 / 130

Which tool is written in Java and supports bidirectional communication through DNS?

A. DNScat or DNScat-P

B. iodine

C. DeNiSe

D. dns2tcp

32 / 130

What is the role of the Bash Shell in penetration testing engagements?

A. It provides a user interface for creating and organizing files.

B. It enables you to quickly create scripts, parse data, and automate tasks.

C. It protects data on a network from unauthorized access.

D. It helps improve website performance and load time.

33 / 130

What is the primary usage of Proxychains?

A. To enhance an application’s execution speed

B. To force any TCP connection made by a specified application to use a proxy

C. To secure the data at rest

D. To detect vulnerabilities in a system network

34 / 130

Which of the following is NOT a programming logic construct?

A. Loops

B. Conditionals

C. Recursion

D. Boolean Operators

35 / 130

Which of the following data structures is characterized by being a plaintext file that contains data delimited by commas, tabs, or other characters?

A. Arrays

B. JavaScript Object Notation (JSON)

C. Comma-separated values (CSV)

D. Trees

36 / 130

What are examples of encoding methods that threat actors might use for DNS exfiltration?

A. ROT13 and Caesar cipher

B. Base64 encoding and Binary (8-bit) encoding

C. AES encryption and DES encryption

D. Huffman encoding and Burrows-Wheeler transform

37 / 130

Which among the given options are popular exploitation frameworks among pen testers?

A. Nmap and Nessus

B. Metasploit and BeEF

C. Wireshark and BeEF

D. Nmap and Metasploit

38 / 130

Which of the following tools is specifically designed to make parsed data from multiple hosts easily searchable?

A. ADIA (Appliance for Digital Investigation and Analysis)

B. CAINE (Computer Aided Investigative Environment)

C. Skadi

D. PALADIN

39 / 130

What is the primary function of the CeWL tool?

A. It is a tool for creating virtual private networks.

B. It is a tool for encrypting data traffic.

C. It is a tool for creating wordlists by crawling websites.

D. It is a tool for automating SQL injections.

40 / 130

Which of the following is not supported by John the Ripper?

A. AES

B. DES variants

C. MD5

D. Blowfish

41 / 130

Which of the following wireless hacking tools is used to perform evil twin attacks?

A. Wifite2

B. Fern Wi-Fi Cracker

C. EAPHammer

D. mdk4

42 / 130

What can the Windows Debugger (WinDbg) be used for?

A. To debug kernel and user mode code

B. To analyze emails

C. To encrypt data

D. To generate barcodes

43 / 130

Which tool is suitable for the extraction of metadata information from documents and images?

A. OpenStego

B. metagoofil

C. Snow

D. Coagula

44 / 130

What listed statement is accurate regarding Nmap and Zenmap as used in active reconnaissance?

A. Zenmap provides a feature that allows you to illustrate the topology of the hosts it finds

B. Zenmap does not require Nmap to function properly

C. Nmap cannot scan a specific range of IP addresses and the ports they may have open

D. Scanning with Nmap or Zenmap does not risks inadvertently scanning an IP address that you are not authorized to test

45 / 130

What does the message ’Program terminated with signal SIGSEGV, Segmentation fault’ indicate when it is displayed after executing the ’continue’ command in GDB?

A. The program was unable to compile

B. The program has detected a virus

C. The program took too long to execute a command

D. A potential buffer overflow

46 / 130

What is the purpose of dns2tcp?

A. It allows for TCP to be tunneled over DNS

B. It allows for base32 encoding in DNS packets

C. It is used to inject data into existing DNS requests

D. It is used for setting up an SSH tunnel over DNS

47 / 130

What is the function of Boolean operators in programming?

A. They are used to manipulate values of variables

B. They are used to repeatedly execute a section of code

C. They are used for handling decisions

D. They are used as conjunctions to combine or exclude keywords in a search, resulting in more focused and productive results

48 / 130

What do the colored arrows in IDA represent when disassembling and analyzing a program?

A. Error codes

B. Control flow between function blocks

C. Different types of functions

D. The size of the function blocks

49 / 130

In the context of programming, what best describes a function?

A. A block of code that runs only when it is called and is used for repeated similar tasks

B. unique piece of code that runs autonomously

C. A programming language

D. A method for building user interfaces

50 / 130

What is the primary function of the Nikto tool?

A. It is used to create a secure network

B. It is used to aid in the development of web applications

C. It is used to examine a web server for potential problems and security vulnerabilities

D. It is used to provide end-point security on individual machines

51 / 130

Which of the following is a lightweight format for storing and transporting data that is common in RESTful APIs and many other implementations?

A. Arrays

B. Dictionaries

C. JavaScript Object Notation (JSON)

D. Comma-separated values (CSV)

52 / 130

What is the function of the ’Veil’ tool in the context of penetration testing?

A. It is used to implement encryption during data transmission

B. It is used to evade antivirus checks and other security controls

C. It is used to create secure tunnels using DNS and protocols such as NTP

D. It is used to create payload for malware

53 / 130

What are the ways through which you can initiate a scan in OpenVAS?

A. By going to Scans -> Tasks and selecting Task Wizard or Advanced Task Wizard

B. By going to Configuration -> Schedules

C. By manually creating a new task

D. All of the above

54 / 130

What is one key feature of the Empire post-exploitation framework?

A. It is strictly limited to work exclusively with the Linux kernel.

B. It can only run on Mac systems.

C. It cannot run PowerShell agents without the need for powershell.exe.

D. It implements the ability to run PowerShell agents without the need for powershell.exe.

55 / 130

Which of the following tools can be used to perform software and protocol robustness tests?

A. Peach

B. Findsecbugs

C. SonarQube

D. All of the above

56 / 130

Which tool is used to analyze embedded information in music or audio recordings?

A. OpenStego

B. Sonic Visualiser

C. Coagula

D. metagoofil

57 / 130

Which of the following Linux distributions are renowned for penetration testing, according to the CompTIA PenTest+ PT0-002 blueprint?

A. Kali Linux

B. Ubuntu

C. CentOS

D. Fedora

58 / 130

What are conditionals in the context of programming logic constructs?

A. They are operators used to manipulate values of variables

B. They are commands used to repeatedly execute a section of code

C. They are commands used for handling decisions

D. They are operators used to perform mathematical operations

59 / 130

What is the primary function of the tool metagoofil?

A. Analyzes embedded information in music or audio recordings.

B. Extracts metadata information from documents and images.

C. Can be used to make sound from an image.

D. Reveals vulnerabilities in cloud platforms such as AWS, Azure, Google Cloud Platform.

60 / 130

Which of the following is NOT considered a logic construct in programming?

A. Loops

B. Conditionals

C. String operators

D. Arithmetic operators

61 / 130

Which tool is primarily used for analyzing embedded information in music or audio recordings?

A. OpenStego

B. Sonic Visualiser

C. TinEye

D. metagoofil

62 / 130

What is a common use of the OpenVAS API in the context of vulnerability scanning?

A. To post comments on forum threads

B. To write blog articles

C. To programmatically interact with its tools and automate the scanning of hosts and networks

D. To configure the user interface

63 / 130

What describes the ADIA (Appliance for Digital Investigation and Analysis) tool for forensics?

A. It is a tool built especially for large-sized digital investigations and acquisitions.

B. It is a tool that only runs on Linux.

C. It is a VMware-based appliance used for digital investigation and acquisition.

D. It is a tool that does not include Autopsy, the Sleuth Kit, the Digital Forensics Framework, log2timeline, Xplico, and Wireshark.

64 / 130

Which one of the listed tools provides more than 1900 security penetration testing tools?

A. Kali Linux

B. Parrot OS

C. BlackArch Linux

D. WHAX

65 / 130

What capabilities does the edb Debugger tool provide when analyzing a vulnerable program?

A. It allows you to identify the IP address of the system being attacked.

B. It steps through the execution of the code and highlights potential buffer overflow exploits.

C. It helps you map the network topology of the target system.

D. It provides encryption and decryption functionalities for secure communication.

66 / 130

Which of the following is not a commonly used data structure in programming languages according to the text?

A. Arrays

B. Stacks

C. JavaScript Object Notation (JSON)

D. Dictionaries

67 / 130

Which of the following is not supported by John the Ripper?

A. DES variants

B. MD5

C. Blowfish

D. AES

68 / 130

What command can be used to perform a brute force attack utilizing the tool Ncrack?

A. ncrack -u chris -P my_list 172.18.104.166

B. ncrack -p 22 –user chris -P my_list 172.18.104.166

C. ncrack -p 22 -u chris -p my_list 172.18.104.166

D. ncrack -p 22 –user chris -P my_list

69 / 130

Which of the following tools supports both NetBIOS encoding and Hex encoding for DNS requests?

A. DeNiSe

B. dns2tcp

C. DNScapy

D. DNScat2 (DNScat-B)

70 / 130

Which tool is used to perform different attacks against wireless networks, including cracking WEP, WPA, and WPS keys?

A. EAPHammer

B. mdk4

C. Fern Wi-Fi Cracker

D. Reaver

71 / 130

What command is used to create and initialize the Metasploit database?

A. metadb init

B. postgresql start

C. msfdb init

D. metasploit-database initialize

72 / 130

What is the function of DirBuster in web application servers?

A. It enhances the functionality of OWASP ZAP as an add-on.

B. It is designed to brute force directory names and filenames.

C. It improves the directory and file lists they come with.

D. It hides pages and applications within a web server.

73 / 130

Which of the following Linux distributions is primarily designed for network security monitoring and features advanced analysis tools that can also help in forensic investigations?

A. ADIA

B. CAINE

C. Security Onion

D. SIFT Workstation

74 / 130

Which of the given tools can be used to perform evil twin attacks on wireless networks?

A. EAPHammer

B. Kismet

C. Rogue access points

D. Wifite2

75 / 130

What is the purpose of using the tool FOCA?

A. To improve the organization of archives

B. To analyze website’s security protocols

C. To find metadata and hidden information in documents

D. To create EXIF information for images

76 / 130

What features does Qualys provide in addition to vulnerability scanning?

A. Configuration compliance measure

B. Web design services

C. Email security

D. Firewall setup

77 / 130

What are some examples of utilities that have been created to perform DNS tunneling?

A. DeNiSe, DNScapy, DNScats2 (DNScat-B)

B. Metasploit, BeEF, Feederbot

C. Feederbot, Moto, DNScat or DNScat-P

D. Browser Exploitation Framework Project (BeEF), Heyoka, iodine

78 / 130

Which of the following statements about fuzzing tools is correct?

A. The Mutiny Fuzzing Framework uses Radamsa to perform mutations.

B. SpotBugs and Findsecbugs are used for fuzzing.

C. SonarQube is a fuzzer.

D. American Fuzzy Lop is a static analysis tool.

79 / 130

What is Nexpose used for in penetration testing?

A. Code encryption.

B. Vulnerability scanning.

C. Intrusion detection.

D. Firewall configuration.

80 / 130

What specific type of attacks can the EAPHammer tool be used to perform in wireless networks?

A. Fuzzing and IDS evasions

B. Spoofing and cloning Bluetooth devices

C. Brute-force attacks against Wi-Fi Protected Setup (WPS)

D. Evil twin attacks

81 / 130

What is the purpose of the Enum4linux tool?

A. It is used for DNS enumeration

B. It is used for enumerating SMB shares, vulnerable Samba implementations, and users

C. It is used for port scanning

D. It is used for sniffing network traffic

82 / 130

Which tool is described in the text as having features of compile-time instrumentation and genetic algorithms to automatically improve the coverage of fuzzing test cases?

A. SpotBugs

B. SonarQube

C. Peach

D. American Fuzzy Lop

83 / 130

Which of the following data structures is described as a collection of data values that are ordered using a key/value pair?

A. JSON

B. Arrays

C. Dictionaries

D. Trees

84 / 130

Which of the following is not a use case of penetration testing tools as highlighted in CompTIA PenTest+ PT0-002 blueprint?

A. Reconnaissance

B. Decompilation

C. Software optimization

D. Forensics

85 / 130

Which tool supports SSH tunneling over DNS and includes a SOCKS proxy?

A. dns2tcp

B. DNScapy

C. DNScat or DNScat-P

D. iodine

86 / 130

Which of the following tools offer Base64 encoding for DNS tunneling and exfiltration?

A. sods

B. DNScapy

C. DeNiSe

D. psudp

87 / 130

What is the primary purpose of the Shodan tool?

A. To scan the contents of the user’s computer for vulnerabilities

B. To identify vulnerable and exposed systems on the Internet

C. To track the geographical location of users

D. To protect the user’s computer from malware

88 / 130

Which of the following statements is true about Programming Logic Constructs?

A. Arithmetic operators are used to combine or exclude keywords in a search, resulting in more focused and productive results.

B. Loops can be used to make a section of the code execute only once.

C. Conditionals are programming language commands that are used to handle repetitions or loops.

D. Boolean operators are simple words (AND, OR, NOT, or AND NOT) that are used as conjunctions to combine or exclude keywords in a search.

89 / 130

What is the most common data structure used in RESTful APIs?

A. Arrays

B. JSON

C. Dictionaries

D. CSV Files

90 / 130

What is the purpose of the DeNiSe utility in regard to DNS?

A. It uses DNS for data exfiltration by encoding data into DNS packets.

B. It performs TCP tunneling over DNS.

C. It uses DNS to resolve domain names into IP addresses.

D. It uses DNS to steal sensitive information.

91 / 130

Which tool is used to perform fuzz testing by replaying packet capture files through a mutational fuzzer?

A. Peach

B. Mutiny Fuzzing Framework

C. American Fuzzy Lop

D. SpotBugs

92 / 130

What is Hashcat primarily used for in penetration testing?

A. To create custom password lists

B. To crack password hashes

C. To strengthen the security of passwords

D. To encrypt data with password hashes

93 / 130

What is SQLmap primarily used for in penetration testing?

A. Automating the enumeration and exploitation of SQL injection vulnerabilities

B. Retrieving information about website HTML

C. Injecting desired data into an SQL database

D. Mapping and visualizing the network infrastructure of an SQL server

94 / 130

What is the primary function of tools like Nmap and Zenmap in active reconnaissance?

A. Testing website loading speed

B. Measuring network traffic

C. Enumerating hosts and identifying open TCP ports

D. Encrypting data transmissions

95 / 130

What are the two best ways to become familiar with programming languages such as Bash, Python, Ruby, PowerShell, Perl, and JavaScript for the CompTIA PenTest+ PT0-002 exam?

A. creating your own scripts and inspecting scripts created by others

B. reading books about these languages and taking online courses

C. collaborating with other programmers and attending workshops

D. writing essays about programming and watching online tutorials

96 / 130

Which tool is used to analyze embedded information in music or audio recordings?

A. OpenStego

B. Sonic Visualiser

C. Cloud Custodian

D. Pacu

97 / 130

What is the mdk4 tool used for within wireless network assessments?

A. Perform brute-force attacks against Wi-Fi Protected Setup (WPS) implementations.

B. Spoof and clone Bluetooth devices.

C. Perform fuzzing, IDS evasions, and other wireless attacks.

D. Test wireless networks using a Python program.

98 / 130

Which of the following tools supports bidirectional communication through DNS?

A. Heyoka

B. DeNiSe

C. psudp

D. Metasploit

99 / 130

Which Linux distribution is specifically modified for performing various evidence collection tasks in a forensically sound manner?

A. Skadi

B. ADIA

C. PALADIN

D. SIFT Workstation

100 / 130

What is the main purpose of Maltego in a Cybersecurity context?

A. To test a software’s robustness

B. To gather information from public records for passive reconnaissance

C. To actively infiltrate a system’s security

D. To create phishing campaigns

101 / 130

What is the purpose of the Veil framework in a pen testing engagement?

A. It is used for network scanning and information gathering.

B. It is used with Metasploit to evade antivirus checks and other security controls.

C. It is used for orchestrating large scale cyber attacks.

D. It is used for establishing secure communication lines with the attacker.

102 / 130

What does the RainbowCrack tool aid in?

A. Automating the process of password cracking using rainbow tables

B. Creating hashed values for rainbow tables

C. Directly hacking into protected systems

D. Geographical tracking of system networks

103 / 130

What is a major function of DNS-based tools such as Nslookup, Host, and Dig in penetration testing?

A. To perform brute force attacks

B. To perform passive reconnaissance

C. To execute DDoS attacks

D. To deploy malware on target systems

104 / 130

What is the purpose of creating a function in PowerShell?

A. To store data

B. To execute similar tasks repeatedly

C. To improve the graphical user interface

D. To facilitate system shutdown

105 / 130

What is the primary purpose of the GNU Project Debugger (GDB)?

A. To develop new software applications

B. To debug, troubleshoot, and modify elements of a program

C. To create buffer overflows in a system

D. To decrypt encrypted data

106 / 130

What features does the Nessus scanner from Tenable offer?

A. Continuous monitoring and compliance analysis

B. Real-time detection and asset tracking

C. Rogue device detection and vulnerability assessment

D. Intrusion detection and firewall management

107 / 130

What is a characteristic of bash functions?

A. They run automatically.

B. They run only when they are called.

C. They only function within Python.

D. They can’t be used to execute similar tasks over and over.

108 / 130

Which one of these is not a commonly used data structure in programming languages?

A. Arrays

B. Datasets

C. Dictionaries

D. Lists

109 / 130

What resources can a library include?

A. Configurations and Classes

B. Prewritten code and Message templates

C. Classes and Subroutines

D. All of the above

110 / 130

What is the primary purpose of the OllyDbg tool in penetration testing?

A. It is used to develop 32-bit Windows applications

B. It is used to debug the Windows 32-bit version of the Git installation package

C. It is used to carry out network scanning on Windows 32-bit systems

D. It is used to encrypt data on Windows 32-bit systems

111 / 130

What are some ways to start a scan in OpenVAS?

A. By navigating to Scans -> Tasks and selecting Task Wizard

B. By manually configuring a scan by creating a new task

C. By using the API

D. All of the above

112 / 130

What is Censys primarily used for in cyber security?

A. Active scanning of target networks

B. OSINT and passive reconnaissance

C. Cleaning up malware from infected devices

D. Intrusion prevention and firewalls

113 / 130

What is the main purpose of FOCA when it comes to analyzing files?

A. Extracting EXIF information from graphic files

B. Extracting metadata and hidden information in documents

C. Analyzing the coding language of a website

D. Pinpointing vulnerabilities in a software

114 / 130

What is the primary purpose of the Recon-ng tool?

A. It is a tool to automate software testing.

B. It is a tool to automate the gathering of OSINT.

C. It is a command-line tool for querying databases.

D. It is a tool for generating and managing SSH keys.

115 / 130

What are the potential challenges of ’encrypt everything’ for incident response professionals and law enforcement agencies?

A. Compromise of user data and lack of privacy

B. Reduced ability to detect malicious activity due to traffic encryption

C. Increased risk of data theft by threat actors

D. Difficulty in deploying secure HTTP connections

116 / 130

What describes a procedure in the context of code analysis?

A. A procedure is a system of rules to follow in calculations.

B. A procedure is a section of code designed to perform a specific task.

C. A procedure is a specific type of programming language.

D. A procedure is a path that a code follows when executed.

117 / 130

What is the purpose of BeEF in the context of web application testing?

A. It is used to test the speed of the web application.

B. It is utilized for exploiting browser vulnerabilities and interacting with web browsers to launch command modules.

C. It specifically targets device vulnerabilities, not browser vulnerabilities.

D. It is employed to periodically update the browsers to the latest versions.

118 / 130

Which of the following data structures contains an ordered structure of elements?

A. JSON

B. Trees

C. Lists

D. Dictionaries

119 / 130

What is the purpose of the tool ’EAPHammer’?

A. To perform brute-force attacks against Wi-Fi Protected Setup (WPS) implementations.

B. To spoof and clone Bluetooth devices.

C. To perform different attacks against wireless networks, including cracking WEP, WPA, and WPS keys.

D. To perform evil twin attacks.

120 / 130

What is PowerSploit used for in penetration testing?

A. To create a bind shell on a victim system

B. It is used for post-exploitation and other phases of an assessment

C. To rapidly deploy pre-exploitation modules

D. To execute Bash shell

121 / 130

What is a class in the context of object-oriented programming languages?

A. A framework for defining methods and properties.

B. A specific instance of an object.

C. An initial value for member variables and functions.

D. A predefined set of code templates for scripts.

122 / 130

What is the primary function of the tool Mimikatz in penetration testing?

A. To facilitate network scanning

B. To help in code analysis

C. To retrieve password hashes from memory

D. To prevent attacks by malware

123 / 130

Which Python program is specifically designed to test wireless networks?

A. Fern Wi-Fi Cracker

B. Spooftooph

C. Wifite2

D. Rogue access points

124 / 130

Which of the following tools/distributions is described as an ’all-in-one solution to parsing collected data, making the data easily searchable with built-in common searches and enables searching of single and multiple hosts simultaneously’?

A. Security Onion

B. ADIA (Appliance for Digital Investigation and Analysis)

C. Skadi

D. SIFT Workstation

125 / 130

Which of the following is a data structure represented using nodes in a hierarchical model?

A. Lists

B. Arrays

C. Trees

D. JSON

126 / 130

What is one of the primary functions of OWASP Zed Attack Proxy (ZAP)?

A. It provides network traffic monitoring capabilities.

B. It provides web vulnerability scanning capabilities.

C. It serves as a firewall for web application security.

D. It encrypts web traffic to prevent interception.

127 / 130

What main functionality does the Spooftooph tool provide and for which technology it is used for?

A. Fuzzing and IDS evasion in wireless networks

B. Brute-force attacks against Wi-Fi Protected Setup implementations

C. Spoofing and cloning Bluetooth devices

D. Cracking WEP, WPA and WPS keys in wireless networks

128 / 130

Which of the following DNS tunneling utilities encodes DNS requests in NetBIOS encoding or hex encoding?

A. DeNiSe

B. DNScat2 (DNScat-B)

C. iodine

D. Heyoka

129 / 130

What is the Immunity Debugger commonly used for in penetration testing and security research?

A. File encryption

B. Content filtering

C. Write exploits, analyze malware, and reverse engineer binary files

D. Installing anti-malware software

130 / 130

Which tool is a VMware-based appliance used for digital investigation and acquisition that contains Autopsy, the Sleuth Kit, the Digital Forensics Framework, log2timeline, Xplico, and Wireshark?

A. CAINE

B. SIFT Workstation

C. PALADIN

D. ADIA

Your score is

Share the Post:

Previous slide

Next slide

Share the Post:

Conclude your CompTIA PenTest+ preparation with Chapter 10: Tools and Code Analysis practice questions.

This chapter focuses on understanding and utilizing various tools and techniques for code analysis.
Strengthen your skills with our Free Anki decks.
For official resources, visit CompTIA’s website.

After completing this chapter, revisit Chapter 01: Introduction to Ethical Hacking and Pentesting to reinforce your foundational knowledge and ensure you’re fully prepared for the exam.

Discover How to Work Remotely and Travel!
Have you ever dreamed about working from beautiful places like Thailand or Japan, but weren’t sure if it’s possible? I’m here to share my adventures and some tips on how to make working remotely while exploring the world a reality. Who Am I? My name is Josh, and I’m all about creating helpful content on […]
Why Contract Work in IT Can Be a Good Start for Your Career
Hey buddies! Are you curious about what it’s like to work in IT and cyber security? Well, you’re in luck because today we’re diving into the world of contract work and how it might just be the jumpstart your career needed! Getting Into the World of Contract Work in IT Josh, an expert in IT […]
Is Cyber Security a Career That Will Last Forever?
Hey everyone! Have you ever wondered if choosing a career in cyber security is a good idea for the long haul? Well, let’s dive into this topic with the help of Josh Maor’s insights, and find out why cyber security might just be one of the smartest career choices out there. What Is Cyber Security? […]

Hands-on
Cybersecurity Training
in a LIVE SOC
with Enterprise Security Tools

Internships Available.

Join Now!

Free CompTIA PenTest+ PT0-002: 10 Tools & Code Analysis + Anki Decks

Fill up to receive the FREE CompTIA PenTest+ deck!

Related Posts

Hands-onCybersecurity Training in a LIVE SOCwith Enterprise Security ToolsInternships Available.

Hands-on
Cybersecurity Training
in a LIVE SOC
with Enterprise Security Tools

Internships Available.