PT0-001 Tester Practice Questions

A penetration tester was able to retrieve the initial VPN user domain credentials by phishing a member of the IT department. Afterward, the penetration tester obtained hashes over the VPN and easily cracked them using a dictionary attack Which of the following remediation steps should be recommended? (Select THREE)

Select 3 answers.

• AA. Mandate all employees take security awareness training
• BB. Implement two-factor authentication for remote access
• CC. Install an intrusion prevention system
• DD. Increase password complexity requirements
• EE. Install a security information event monitoring solution.
• FF. Prevent members of the IT department from interactively logging in as administrators
• GG. Upgrade the cipher suite used for the VPN solution

A penetration tester is required to perform OSINT on staff at a target company after completing the infrastructure aspect. Which of the following would be the BEST step for the penetration tester to take?

• AA. Obtain staff information by calling the company and using social engineering techniques.
• BB. Visit the client and use impersonation to obtain information from staff.
• CC. Send spoofed emails to staff to see if staff will respond with sensitive information.
• DD. Search the Internet for information on staff such as social networking sites