Book Image

CompTIA PenTest+ Study Guide

By : Mike Chapple, David Seidl
Book Image

CompTIA PenTest+ Study Guide

By: Mike Chapple, David Seidl

Overview of this book

The CompTIA PenTest+ Study Guide: Exam PT0-001 offers comprehensive preparation for the newest intermediate cybersecurity certification exam. With expert coverage of Exam PT0-001 objectives, this book is your ideal companion throughout all stages of study; whether you’re just embarking on your certification journey or finalizing preparations for the big day, this invaluable resource helps you solidify your understanding of essential skills and concepts. The book shows how to perform security assessments on desktops, mobile devices, cloud, IoT, as well as industrial and embedded systems. You'll learn how to identify security weaknesses and manage system vulnerabilities. As you progress, you'll learn methods to ensure that existing cybersecurity practices, configurations, and policies conform with current best practices. You'll assess your knowledge by simulating cyber attacks to pinpoint security weaknesses in operating systems, networks, and applications. By the end of the book, you'll have all the resources you need to prepare for the exam - identify what you already know, learn what you don’t know, and face the exam with full confidence.
Table of Contents (21 chapters)
Free Chapter
1
Acknowledgments
2
About the Authors
3
Introduction
4
Assessment Test
5
Answers to Assessment Test
18
Index
19
Advert
20
End User License Agreement

Review Questions

You can find the answers in the Appendix.

  1. Which one of the following approaches, when feasible, is the most effective way to defeat injection attacks?

    1. Browser-based input validation
    2. Input whitelisting
    3. Input blacklisting
    4. Signature detection
  2. Examine the following network diagram. What is the most appropriate location for a web application firewall (WAF) on this network?

    Image shows internet connected through blocks A, B, and C to internal network and block B connected through DMZ and block D to web server.
    1. Location A
    2. Location B
    3. Location C
    4. Location D
  3. Joe is examining the logs for his web server and discovers that a user sent input to a web application that contained the string WAITFOR. What type of attack was the user likely attempting?

    1. Timing-based SQL injection
    2. HTML injection
    3. Cross-site scripting
    4. Content-based SQL injection
  4. Which one of the following function calls is closely associated with Linux command injection attacks?

    1. system()
    2. sudo()
    3. mkdir()
    4. root()
  5. Tina is conducting a penetration test and is trying to gain access to a user account. Which of the following is a good source for...