CompTIA PT0-003 Exam Dumps

CompTIA PT0-003 Sample Question Answers

Question # 1

A penetration tester performs a service enumeration process and receives the following result after scanning a server using the Nmap tool:PORT STATE SERVICE22/tcp open ssh25/tcp filtered smtp111/tcp open rpcbind2049/tcp open nfsBased on the output, which of the following services provides the best target for launching an attack?

A. Database
B. Remote access
C. Email
D. File sharing

Show Answer

Question # 2

During a wireless penetration assessment for a small business client, a tester attempts to capture wireless packets. However, whenever the tester sets the capture device to monitor mode, it fails to see the client's wireless network, as provided by the scope. Which of the following is the most likely reason for this issue?

A. The client's network uses 6GHz and not 5GHz/2.4GHz.
B. The tester misconfigured the capture device.
C. The client provided the wrong SSID for the network.
D. The tester is not using Aircrack-ng.

Show Answer

Question # 3

A company hires a penetration tester to test the security of its wireless networks. The main goal is to intercept and access sensitive data.Which of the following tools should the security professional use to best accomplish this task?

A. Metasploit
B. WiFi-Pumpkin
C. SET
D. theHarvester
E. WiGLE.net

Show Answer

Question # 4

During an assessment, a penetration tester plans to gather metadata from various online files, including pictures. Which of the following standards outlines the formats for pictures, audio, and additional tags that facilitate this type of reconnaissance?

A. EXIF
B. GIF
C. COFF
D. ELF

Show Answer

Question # 5

A penetration tester discovers exposed cloud storage buckets and needs to access the contents. Which of the following should the tester do?

A. Protocol fingerprinting
B. Credential brute forcing
C. Service discovery
D. Secrets enumeration

Show Answer

Question # 6

A client recently hired a penetration testing firm to conduct an assessment of their consumer-facing web application. Several days into the assessment, the client’s networking team observes a substantial increase in DNS traffic. Which of the following would most likely explain the increase in DNS traffic?

A. Covert data exfiltration
B. URL spidering
C. HTML scraping
D. DoS attack

Show Answer

Question # 7

During an assessment, a penetration tester gains a low-privilege shell and then runs the following command:findstr /SIM /C:"pass" *.txt *.cfg *.xmlWhich of the following is the penetration tester trying to enumerate?

A. Configuration files
B. Permissions
C. Virtual hosts
D. Secrets

Show Answer

Question # 8

A penetration tester discovers data to stage and exfiltrate. The client has authorized movement to the tester's attacking hosts only. Which of the following would be most appropriate to avoid alerting the SOC?

A. Apply UTF-8 to the data and send over a tunnel to TCP port 25.
B. Apply Base64 to the data and send over a tunnel to TCP port 80.
C. Apply 3DES to the data and send over a tunnel UDP port 53.
D. Apply AES-256 to the data and send over a tunnel to TCP port 443.

Show Answer

Question # 9

A penetration tester enumerates a legacy Windows host on the same subnet. The tester needs to select exploit methods that will have the least impact on the host's operating stability. Which of the following commands should the tester try first?

A. responder -I eth0 john responder_output.txt <rdp to target>
B. hydra -L administrator -P /path/to/pwlist.txt -t 100 rdp://<target_host>
C. msf > use <module_name> msf > set <options> msf > set PAYLOADwindows/meterpreter/reverse_tcp msf > run
D. python3 ./buffer_overflow_with_shellcode.py <target> 445

Show Answer

Question # 10

A penetration tester wants to check the security awareness of specific workers in the company with targeted attacks. Which of the following attacks should the penetration tester perform?

A. Phishing
B. Tailgating
C. Whaling
D. Spear phishing

Show Answer

Question # 11

A penetration tester needs to identify all vulnerable input fields on a customer website.Which of the following tools would be best suited to complete this request?

A. DAST
B. SAST
C. IAST
D. SCA

Show Answer

Question # 12

During an assessment, a penetration tester runs the following command:setspn.exe -Q /Which of the following attacks is the penetration tester preparing for?

A. LDAP injection
B. Pass-the-hash
C. Kerberoasting
D. DictionaryAnswer: C

Show Answer

Question # 13

A penetration tester plans to conduct reconnaissance during an engagement using readily available resources. Which of the following resources would most likely identify hardware and software being utilized by the client?

A. Cryptographic flaws
B. Protocol scanning
C. Cached pages
D. Job boards

Show Answer

Question # 14

A penetration tester has been asked to conduct a blind web application test against a customer's corporate website. Which of the following tools would be best suited to perform this assessment?

A. ZAP
B. Nmap
C. Wfuzz
D. Trufflehog

Show Answer

Question # 15

A penetration tester is conducting an assessment of offline systems that control a power plant. The tester is looking for vulnerabilities observable in the network stack. The rules of engagement state that the tester cannot interact with production systems. Which of the following tools or techniques should the tester use for the assessment?

A. Port mirroring
B. Storyboarding
C. Write blocker
D. SAST tool

Show Answer

Question # 16

Which of the following is the most efficient way to exfiltrate a file containing data that could be sensitive?

A. Use steganography and send the file over FTP.
B. Compress the file and send it using TFTP.
C. Split the file in tiny pieces and send it over dnscat.
D. Encrypt and send the file over HTTPS.

Show Answer

Question # 17

A penetration tester is conducting reconnaissance for an upcoming assessment of a large corporate client. The client authorized spear phishing in the rules of engagement. Which of the following should the tester do first when developing the phishing campaign?

A. Shoulder surfing
B. Recon-ng
C. Social media
D. Password dumps

Show Answer

Question # 18

A penetration tester writes the following script to enumerate a /24 network:1 #!/bin/bash2 for i in {1..254}3 ping -c1 192.168.1.$i4 doneThe tester executes the script, but it fails with the following error:-bash: syntax error near unexpected token 'ping'Which of the following should the tester do to fix the error?

A. Add do after line 2
B. Replace {1..254} with $(seq 1 254)
C. Replace bash with zsh
D. Replace $i with ${i}

Show Answer

Question # 19

A penetration tester conducts a web application assessment and receives the followingSet-Cookie upon logging in:Set-Cookie auth=UGVudGVzdFVzZXI6OTE1MzYKUpon analysis, the penetration tester determines this is a Base64-encoded string, whichwhen decoded reads: Pentestuser:91536The penetration tester logs out, logs back in, and sees the decoded string now reads: Pentestuser:91944Which of the following attacks will the penetration tester most likely conduct based on this information?

A. Collision attack
B. JWT manipulation
C. Session hijacking
D. Insecure direct object reference

Show Answer

Question # 20

A penetration tester conducts a scan on an exposed Linux web server and gathers the following data:Host: 192.168.55.23Open Ports:22/tcp Open OpenSSH 7.2p2 Ubuntu 4ubuntu2.1080/tcp Open Apache httpd 2.4.18 (Ubuntu)111/tcp Open rpcbind 2-4 (RPC #100000Additional notes:Directory listing enabled on /adminApache mod_cgi enabledNo authentication required to access /cgi-bin/debug.shX-Powered-By: PHP/5.6.40-0+deb8u12Which of the following is the most effective action to take?

A. Launch a payload using msfvenom and upload it to the /admin directory.
B. Review the contents of /cgi-bin/debug.sh.
C. Use Nikto to scan the host and port 80.
D. Attempt a brute-force attack against OpenSSH 7.2p2.

Show Answer

Question # 21

A penetration tester needs to exploit a vulnerability in a wireless network that has weak encryption to perform traffic analysis and decrypt sensitive information. Which of the following techniques would best allow the penetration tester to have access to the sensitive information?

A. Bluejacking
B. SSID spoofing
C. Packet sniffing
D. ARP poisoning

Show Answer

Question # 22

A penetration tester cannot use Nmap and must perform port discovery and banner grabbing for potential vulnerable SSH services. Given the following script:#!/usr/bin/baship_address = "192.168.5."...for i in {1..254}do-missing command--done...Which of the following commands will best help the tester achieve this objective?

A. ping -c 22 "$ip_address$i"
B. nc "$ip_address$i" ":22"
C. arp "$ip_address$i" ":22"
D. curl scp://"$ip_address$i" ":22"

Show Answer

Question # 23

A penetration tester achieves shell access. The tester tries to use the following command, but it fails:netsh advfirewall set domainprofile state offWhich of the following should the tester do to help correct this issue?

A. Find other attack paths.
B. Perform privilege escalation.
C. Validate the target system’s fingerprint.
D. Gather more data about the network.

Show Answer

Question # 24

A tester is working on an engagement that has evasion and stealth requirements. Which of the following enumeration methods is the least likely to be detected by the IDS?

A. curl https://api.shodan.io/shodan/host/search?key=&query=hostname:
B. proxychains nmap -sV -T2 <target>
C. for i in <target>; do curl -k $i; done
D. nmap -sV -T2 <target>

Show Answer

Question # 25

During an assessment, a penetration tester gains access to one of the internal hosts. Given the following command:schtasks /create /sc onlogon /tn "Windows Update" /tr "cmd.exe /c reverse_shell.exe"Which of the following is the penetration tester trying to do with this code?

A. Enumerate the scheduled tasks
B. Establish persistence
C. Deactivate the Windows Update functionality
D. Create a binary application for Windows System Updates

Show Answer

Question # 26

A penetration tester is conducting an assessment of a web application's login page. The tester needs to determine whether there are any hidden form fields of interest. Which of the following is the most effective technique?

A. XSS
B. On-path attack
C. SQL injection
D. HTML scraping

Show Answer

Question # 27

A penetration tester assesses a complex web application and wants to explore potential security weaknesses by searching for subdomains that might have existed in the past.Which of the following tools should the penetration tester use?

A. Censys.io
B. Shodan
C. Wayback Machine
D. SpiderFoot

Show Answer

Question # 28

While conducting an assessment, a penetration tester identifies the details for several unreleased products announced at a company-wide meeting. Which of the following attacks did the tester most likely use to discover this information?

A. Eavesdropping
B. Bluesnarfing
C. Credential harvesting
D. SQL injection attack

Show Answer

Question # 29

A penetration tester wants to send a specific network packet with custom flags and sequence numbers to a vulnerable target. Which of the following should the tester use?

A. tcprelay
B. Bluecrack
C. Scapy
D. tcpdump

Show Answer

Question # 30

A penetration tester wants to gather the names of potential phishing targets who have access to sensitive data. Which of the following would best meet this goal?

A. WHOIS
B. Censys.io
C. SpiderFoot
D. theHarvester

Show Answer

Question # 31

A penetration tester is performing a cloud-based penetration test against a company. Stakeholders have indicated the priority is to see if the tester can get into privileged systems that are not directly accessible from the internet. Given the following scanner information:Server-side request forgery (SSRF) vulnerability in test.comptia.orgReflected cross-site scripting (XSS) vulnerability in test2.comptia.orgPublicly accessible storage system named static_comptia_assetsSSH port 22 open to the internet on test3.comptia.orgOpen redirect vulnerability in test4.comptia.orgWhich of the following attack paths should the tester prioritize first?

A. Synchronize all the information from the public bucket and scan it with Trufflehog.
B. Run Pacu to enumerate permissions and roles within the cloud-based systems.
C. Perform a full dictionary brute-force attack against the open SSH service using Hydra.
D. Use the reflected cross-site scripting attack within a phishing campaign to attack administrators.
E. Leverage the SSRF to gain access to credentials from the metadata service.

Show Answer

Question # 32

A penetration tester is getting ready to conduct a vulnerability scan to evaluate an environment that consists of a container orchestration cluster. Which of the following tools would be best to use for this purpose?

A. NSE
B. Nessus
C. CME
D. Trivy

Show Answer

Question # 33

A penetration tester enters an invalid user ID on the login page of a web application. The tester receives a message indicating the user is not found. Then, the tester tries a validuser ID but an incorrect password, but the web application indicates the password is invalid. Which of the following should the tester attempt next?

A. Error log analysis
B. DoS attack
C. Enumeration
D. Password dictionary attack 

Show Answer

Question # 34

A penetration tester needs to launch an Nmap scan to find the state of the port for both TCP and UDP services. Which of the following commands should the tester use?

A. nmap -sU -sW -p 1-65535 example.com
B. nmap -sU -sY -p 1-65535 example.com
C. nmap -sU -sT -p 1-65535 example.com
D. nmap -sU -sN -p 1-65535 example.com

Show Answer