Exam PT0-001 topic 1 question 142 discussion

Actual exam question from CompTIA's PT0-001

Question #: 142
Topic #: 1

SIMULATION -
You are a penetration tester reviewing a client's website through a web browser.

INSTRUCTIONS -
Review all components of the website through the browser to determine if vulnerabilities are present.
Remediate ONLY the highest vulnerability from either the certificate, source, or cookies.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

Show Suggested Answer

Suggested Answer: See explanation below.
Step 1 - Generate a Certificate Signing Request

Step 2 - Submit CSR to the CA -
Step 3 - Install re-issued certificate on the server
Step 4 - Remove Certificate from Server

by Mr_KiWi at May 27, 2021, 6:33 p.m.

Comments

Submit Cancel

CybeSecN

Highly Voted 3 years, 11 months ago

The correct answer is, Step 1 - Generate a Certificate Signing Request Step 2 - Submit CSR to the CA Step 3 - Install re-issued certificate on the server Step 4 - Remove Certificate from Server

upvoted 15 times

MrRiver

3 years, 9 months ago

Consider the Real World, yess you would remove the old certificate as last step. Even an expired certificate is better than no certificate.

upvoted 5 times

...

Bluedegard

Most Recent 1 year, 4 months ago

The HTML section line 11 vulnerable to XSS. You can change your GET parameter into something malicious like <script> rather than a string or numbrer. In cookies section __utmv you may change account_type to something that bypass access control

upvoted 1 times

...

Cock

3 years, 4 months ago

It was on the exam

upvoted 3 times

...

4 years ago

You cannot generate a CSR if you remove the expired cert as the first step. Once you get the re-issued cert or the completion of the CSR the old expired renews itself with the new info from the CA.

upvoted 3 times

joaks

4 years ago

So my take will be 1- Generate CSR 2-Submit 3- Install the new cert 4- Remove if necessary

upvoted 5 times

Bill_nye_russian_guy

3 years, 11 months ago

I mean if you do any research you can see that you cannot remove it first because there needs to be a certificate, Generate CSR, you submit your CSR request, install the new cert and depending on the framework, you may or may not need to remove.

upvoted 2 times

...

4 years, 1 month ago

This question is vague. Can someone explain it please. As soon as I saw the source code, I thought of the word "Admin" does that mean anything. If I used "admin" as my user name and "password" as my password, will I get admin access?

upvoted 3 times

...