View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.

 

Question 1

Which phase of a penetration test focuses on defining the scope, objectives, rules of engagement, and authorized targets?

1. Reporting
2. Exploitation
3. Planning and scoping
4. Post-exploitation

Correct Answer: 3

Explanation

Planning and scoping establishes the boundaries and objectives of a penetration test before technical activities begin. This phase identifies authorized systems, testing windows, communication procedures, limitations, and rules of engagement. Clearly defining these elements helps prevent unauthorized activity and ensures that the assessment addresses the customer’s actual requirements. Exploitation occurs later when vulnerabilities are validated, while reporting documents findings after testing. Post-exploitation focuses on determining the impact and access available after successful compromise. Therefore, planning and scoping is the correct phase for establishing test boundaries.

Question 2

A penetration tester discovers a web server running an outdated version of Apache. Before attempting exploitation, which activity would provide the most useful additional information about the target?

1. Perform service enumeration
2. Delete the server logs
3. Immediately deploy ransomware
4. Disable the firewall

Correct Answer: 1

Explanation

Service enumeration can provide valuable information about the target before exploitation is attempted. A tester may identify the exact service version, available ports, configurations, enabled modules, and other characteristics that can help determine whether a known vulnerability is applicable. This information supports a more controlled and targeted assessment. Immediately attempting exploitation without sufficient knowledge can increase the risk of unnecessary disruption. Deleting logs or disabling security controls is not an appropriate first step. Therefore, service enumeration is the most useful activity in this scenario.

Question 3

Which tool is commonly used to identify open ports and services on a network host?

1. Wireshark
2. Nmap
3. Hashcat
4. Burp Suite

Correct Answer: 2

Explanation

Nmap is a widely used network scanning and enumeration tool that can identify open ports, services, and other characteristics of network hosts. Depending on the scan configuration, it can also help determine service versions, operating-system information, and network filtering behavior. Wireshark is primarily a packet-analysis tool, Hashcat is commonly used for password-hash recovery, and Burp Suite focuses heavily on web application security testing. Therefore, Nmap is the appropriate choice when the primary objective is discovering open ports and services on a target.

Question 4

During a web application assessment, a tester inserts crafted input into a form and observes that database errors are returned to the browser. Which vulnerability should the tester investigate?

1. SQL injection
2. DNS poisoning
3. ARP spoofing
4. Shoulder surfing

Correct Answer: 1

Explanation

Database error messages triggered by crafted input can indicate that user-supplied data is reaching a database query without adequate input handling. This behavior warrants investigation for SQL injection. An attacker may attempt to manipulate database queries through specially constructed input when an application fails to properly validate or parameterize database operations. DNS poisoning affects name resolution, ARP spoofing targets local network address resolution, and shoulder surfing involves observing sensitive information physically. Therefore, SQL injection is the vulnerability most directly associated with the observed database errors.

Question 5

A tester needs to discover subdomains associated with an organization’s primary domain during reconnaissance. Which technique is most relevant?

1. Subdomain enumeration
2. Password spraying
3. File carving
4. Privilege escalation

Correct Answer: 1

Explanation

Subdomain enumeration is a reconnaissance technique used to identify additional hostnames associated with a target’s domain. Discovering subdomains can reveal development environments, administrative portals, APIs, testing systems, and other assets that may not be obvious from the primary website. Techniques can include examining DNS information, certificate transparency data, search-engine results, and authorized enumeration tools. Password spraying and privilege escalation occur in later attack stages, while file carving is a forensic recovery technique. Therefore, subdomain enumeration is the relevant reconnaissance technique.

Question 6

A penetration tester successfully gains limited access to a Linux server through a vulnerable application. The tester now wants to determine whether the compromised account can obtain higher privileges. What activity should be performed?

1. Credential stuffing
2. Privilege escalation assessment
3. DNS reconnaissance
4. Physical security testing

Correct Answer: 2

Explanation

A privilege escalation assessment determines whether an existing low-privileged account can obtain additional permissions on the compromised system. On Linux systems, this may involve reviewing permissions, running processes, service configurations, scheduled tasks, and other authorized system characteristics for weaknesses. The goal is to understand the potential impact of the initial compromise and determine whether additional access is possible. Credential stuffing targets authentication systems, DNS reconnaissance gathers network information, and physical testing concerns physical controls. Therefore, privilege escalation assessment is the appropriate activity.

Question 7

Which type of assessment attempts to evaluate an organization’s ability to detect and respond to an attack while the penetration tester actively simulates adversary behavior?

1. Vulnerability scanning
2. Compliance auditing
3. Red team assessment
4. Asset inventory

Correct Answer: 3

Explanation

A red team assessment simulates adversary behavior to evaluate an organization’s defensive capabilities, including detection, response, security controls, and attack-path resilience. Red team activities can involve multiple stages of an attack rather than simply identifying vulnerabilities. Vulnerability scanning is generally focused on discovering weaknesses, compliance auditing evaluates adherence to requirements, and asset inventory identifies organizational resources. A red team engagement is therefore the most appropriate assessment type when the objective includes testing how effectively defenders detect and respond to realistic adversarial activity.

Question 8

A tester captures a large number of authentication attempts and wants to determine whether users are reusing weak passwords. Which attack technique is most appropriate for an authorized password assessment?

1. Password spraying
2. Directory traversal
3. Cross-site scripting
4. Port knocking

Correct Answer: 1

Explanation

Password spraying is an authentication attack technique that attempts a small number of commonly used passwords against many accounts rather than repeatedly trying many passwords against one account. During an authorized penetration test, it can help identify weak password practices while reducing the likelihood of triggering account lockouts associated with repeated attempts against a single user. Directory traversal targets file-access controls, cross-site scripting targets web application input handling, and port knocking is a network access mechanism. Therefore, password spraying is the relevant technique for this assessment.

Question 9

Which type of vulnerability allows an attacker to execute unauthorized script content in another user’s browser?

1. Cross-site scripting
2. SQL injection
3. Buffer overflow
4. Race condition

Correct Answer: 1

Explanation

Cross-site scripting, commonly called XSS, occurs when an application allows attacker-controlled script content to be delivered to users and executed within their browsers. Depending on the vulnerability and context, XSS can affect sessions, manipulate page content, or perform actions using a victim’s browser context. SQL injection instead targets database queries, buffer overflows involve improper memory handling, and race conditions occur when the outcome depends on the timing of concurrent operations. Therefore, cross-site scripting is the vulnerability that directly involves unauthorized script execution in another user’s browser.

Question 10

A penetration tester receives no internal network information and must discover hosts, domains, and services using only publicly available information. What type of testing approach is this?

1. White-box
2. Gray-box
3. Black-box
4. Cooperative debugging

Correct Answer: 3

Explanation

Black-box testing provides the tester with little or no internal information about the target before testing begins. The tester must therefore perform reconnaissance and enumeration to discover externally visible assets and identify possible attack paths. White-box testing provides extensive internal information, while gray-box testing provides some information or limited credentials. Black-box testing can better simulate an external attacker with limited knowledge of the organization’s environment. Therefore, the described approach is black-box testing because the tester starts with minimal information about the target.

Question 11

What is the primary purpose of a vulnerability scanner during a penetration testing engagement?

1. Automatically guarantee that every vulnerability is exploitable
2. Identify potential weaknesses for further validation
3. Replace all manual testing
4. Permanently remediate discovered vulnerabilities

Correct Answer: 2

Explanation

A vulnerability scanner helps identify potential weaknesses across systems, applications, configurations, and services. Its findings should generally be reviewed and validated because automated scanning can produce false positives, miss context, or identify conditions that are not directly exploitable. A scanner does not guarantee exploitation, replace all manual testing, or permanently remediate vulnerabilities. Penetration testers use scanning results as input for deeper investigation and validation. Therefore, the primary purpose of a vulnerability scanner is to identify potential weaknesses that require further assessment.

Question 12

A tester needs to inspect HTTP requests and responses between a browser and a web application to identify security issues. Which tool category is most appropriate?

1. Web application proxy
2. Network time protocol server
3. File compression utility
4. Password manager

Correct Answer: 1

Explanation

A web application proxy allows a penetration tester to intercept, inspect, and modify HTTP or HTTPS traffic between a client and a web application. This capability is valuable when testing authentication, session handling, input validation, authorization, and application logic. A tester can examine requests and responses to understand how the application processes user input and security tokens. The other options do not provide equivalent web-traffic interception capabilities. Therefore, a web application proxy is the most appropriate tool category for this testing requirement.

Question 13

A tester discovers that a web application exposes ../ sequences in a file-download parameter and may allow access outside the intended directory. Which vulnerability should be investigated?

1. Command injection
2. Directory traversal
3. Credential replay
4. VLAN hopping

Correct Answer: 2

Explanation

Directory traversal occurs when an application improperly handles path information and allows a user to reference files outside the intended directory. Sequences such as ../ can be indicators that an application may permit navigation to parent directories. During an authorized test, the tester should validate whether the behavior actually permits unauthorized file access and determine the potential impact. Command injection involves executing operating-system commands, credential replay involves authentication material, and VLAN hopping concerns network segmentation. Therefore, directory traversal is the relevant vulnerability to investigate.

Question 14

An organization asks a penetration tester to determine whether a compromised workstation can be used to access systems that should be isolated from one another. What security concept is primarily being evaluated?

1. Network segmentation
2. Data compression
3. Certificate expiration
4. Disk defragmentation

Correct Answer: 1

Explanation

Network segmentation separates systems or network zones to limit unnecessary communication and reduce the potential spread of compromise. A penetration tester can evaluate segmentation by determining whether a compromised workstation can communicate with systems that should be isolated according to the organization’s security architecture. Weak segmentation can allow attackers to move laterally after gaining an initial foothold. Data compression, certificate expiration, and disk defragmentation do not directly address network isolation. Therefore, network segmentation is the primary security concept being evaluated.

Question 15

Which activity is most appropriate immediately after identifying a potentially serious vulnerability during a penetration test?

1. Publish the vulnerability publicly
2. Validate the finding within the authorized scope
3. Ignore the finding
4. Delete evidence of the vulnerability

Correct Answer: 2

Explanation

Potentially serious findings should be validated within the authorized scope to determine whether the vulnerability is genuine, reproducible, and relevant to the target. Validation helps distinguish false positives from exploitable conditions and provides evidence for assessing risk and impact. Testers should remain within the rules of engagement and avoid unnecessary disruption while confirming the issue. Public disclosure, ignoring the finding, or deleting evidence would undermine the assessment. Therefore, validating the finding within the authorized scope is the appropriate next step.

Question 16

A penetration tester obtains a password hash from a compromised system and needs to assess whether the password is susceptible to offline cracking. Which tool is commonly associated with this task?

1. Nmap
2. Hashcat
3. tcpdump
4. Nikto

Correct Answer: 2

Explanation

Hashcat is commonly used to perform password recovery and cracking assessments against password hashes. In an authorized penetration test, it can help determine whether captured hashes correspond to weak or easily recoverable passwords. The tester can evaluate password-strength controls without repeatedly interacting with the live authentication service. Nmap focuses on network discovery and enumeration, tcpdump captures network traffic, and Nikto is primarily associated with web-server scanning. Therefore, Hashcat is the tool most directly associated with offline password-hash assessment.

Question 17

A tester wants to determine which hosts are actively responding on a target network before conducting more detailed service enumeration. Which reconnaissance activity is appropriate?

1. Host discovery
2. Password reset
3. Source-code compilation
4. Data destruction

Correct Answer: 1

Explanation

Host discovery identifies systems that are active or reachable within a target network. Establishing which hosts respond can help a penetration tester build an initial map of the authorized environment before performing more detailed port and service enumeration. The exact discovery methods depend on network architecture, filtering, and the rules of engagement. Password resets, source-code compilation, and data destruction do not serve the purpose of identifying active network hosts. Therefore, host discovery is the appropriate reconnaissance activity before deeper enumeration.

Question 18

During a penetration test, a tester wants to understand whether an account with excessive permissions can access sensitive resources. Which security principle is being assessed?

1. Availability
2. Least privilege
3. Nonrepudiation
4. Data compression

Correct Answer: 2

Explanation

The principle of least privilege requires users, applications, and systems to receive only the permissions necessary to perform their intended functions. Testing an account with excessive permissions helps determine whether authorization controls allow access beyond the account’s legitimate requirements. Excessive privileges can increase the impact of credential compromise and facilitate unauthorized access to sensitive resources. Availability concerns service accessibility, nonrepudiation supports accountability, and data compression reduces storage or transmission size. Therefore, least privilege is the security principle being assessed.

Question 19

A penetration tester finishes technical testing and must communicate discovered vulnerabilities, evidence, business impact, and remediation guidance to the customer. Which deliverable is most appropriate?

1. Penetration testing report
2. Network cable diagram
3. Source-code compiler
4. Password database

Correct Answer: 1

Explanation

A penetration testing report documents the assessment results and communicates important findings to the customer. Depending on the engagement, it can include an executive summary, scope, methodology, vulnerabilities, evidence, affected assets, risk context, business impact, and remediation recommendations. The report provides both technical and management-oriented information so stakeholders can understand the findings and prioritize corrective actions. The other options are not appropriate deliverables for communicating penetration test results. Therefore, a penetration testing report is the correct choice.

Question 20

A tester identifies a vulnerability that could allow an attacker to execute commands on a server, but exploitation might interrupt a production service. What should the tester do before attempting exploitation?

1. Exploit it immediately because the vulnerability is serious
2. Ignore the vulnerability entirely
3. Confirm that exploitation is permitted by the rules of engagement
4. Publicly disclose the vulnerability

Correct Answer: 3

Explanation

Before attempting potentially disruptive exploitation, the tester must confirm that the activity is permitted under the engagement’s rules of engagement and authorized scope. Production systems may have restrictions on exploitation, testing windows, destructive techniques, or service interruption. If exploitation is not authorized, the tester should document the vulnerability and use safer validation methods where permitted. Immediately exploiting a serious vulnerability can cause unintended outages and violate contractual boundaries. Therefore, confirming authorization before exploitation is essential for a controlled penetration test.