Exam PT0-002 topic 1 question 320 discussion

Actual exam question from CompTIA's PT0-002

Question #: 320
Topic #: 1

During an assessment, a penetration tester found a suspicious script that could indicate a prior compromise. While reading the script, the penetration tester noticed the following lines of code:

Which of the following was the script author trying to do?

A. Spawn a local shell.
B. Disable NIC.
C. List processes.
D. Change the MAC address.

Show Suggested Answer

Suggested Answer: D 🗳️

by 041ba31 at March 17, 2024, 7:02 p.m.

Comments

Submit Cancel

PMann

Highly Voted 7 months, 1 week ago

Selected Answer: D

Disabled nic, changed mac, then enabled nic again

upvoted 5 times

outnumber_gargle024

5 months, 1 week ago

thanks

upvoted 1 times

...

041ba31

Most Recent 7 months, 3 weeks ago

Selected Answer: D

This Python script uses the subprocess.call function to execute shell commands that first bring down the network interface eth0 (though it seems there's a typo with "etho0"), change its MAC address to "2a:33:41:56:21:34", and then bring the interface back up. The purpose of these actions is to change the MAC address of the network interface card (NIC) associated with eth0. Changing a MAC address can be used for various reasons, including bypassing MAC address filters or anonymizing the device on the network.

upvoted 2 times

...

Exam PT0-002 All Questions

View all questions & answers for the PT0-002 exam

Exam PT0-002 topic 1 question 320 discussion

Comments

PMann

outnumber_gargle024

041ba31

SY0-701