Exam PT0-002 topic 1 question 204 discussion

Actual exam question from CompTIA's PT0-002

Question #: 204
Topic #: 1

A penetration tester gives the following command to a systems administrator to execute on one of the target servers:

rm -f /var/www/html/G679h32gYu.php

Which of the following BEST explains why the penetration tester wants this command executed?

A. To trick the systems administrator into installing a rootkit
B. To close down a reverse shell
C. To remove a web shell after the penetration test
D. To delete credentials the tester created

Show Suggested Answer

Suggested Answer: C 🗳️

by cy_analyst at March 6, 2023, 6:19 p.m.

Comments

Submit Cancel

cy_analyst

11 months, 1 week ago

Selected Answer: C

The command "rm -f /var/www/html/G679h32gYu.php" is used to delete a file named "G679h32gYu.php" from the directory "/var/www/html/". Based on this information, the BEST explanation for why the penetration tester wants this command executed is: C. To remove a web shell after the penetration test The file "G679h32gYu.php" may be a web shell that was uploaded by the penetration tester during the course of the penetration test. Web shells are scripts that can be uploaded to a web server to enable remote access and control of the server. Removing the web shell after the penetration test is complete is a good security practice to ensure that unauthorized access to the server is prevented.

upvoted 4 times

...