View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.

 

Question 61

Which technique is commonly used to identify a web server’s software and version from its responses?

1. Banner grabbing
2. Password spraying
3. Token replay
4. ARP poisoning

Correct Answer: 1

Explanation

Banner grabbing collects service information returned by a system, often revealing the software name, version, or other identifying details. During an authorized penetration test, this information can help determine which technologies are running and whether known vulnerabilities may apply. Banners can be obtained from various network services, although administrators may intentionally suppress detailed version information. Testers should verify banner-based findings because displayed versions are not always accurate indicators of the actual software installed. Banner grabbing is therefore useful during reconnaissance and service enumeration.

Question 62

Which protocol is primarily used to securely transfer files over an SSH connection?

1. FTP
2. TFTP
3. SCP
4. Telnet

Correct Answer: 3

Explanation

Secure Copy Protocol (SCP) transfers files between systems using the SSH protocol, providing encrypted communication and authenticated access. In penetration testing, SCP may be encountered when securely moving authorized assessment files or when evaluating file-transfer configurations. FTP and TFTP do not inherently provide the same SSH-based protection, while Telnet is primarily a remote terminal protocol and transmits traffic without modern encryption by default. SCP is therefore the appropriate choice when the requirement is secure file transfer through an SSH connection.

Question 63

A tester finds a service listening on UDP but receives no response to a basic probe. What should the tester consider?

1. The host must be offline
2. UDP services may not respond unless valid application data is sent
3. The port is automatically confirmed closed
4. TCP must be disabled

Correct Answer: 2

Explanation

UDP scanning can be more difficult than TCP scanning because many UDP services do not respond to empty or unexpected probes. A lack of response does not automatically prove that the port is closed. The tester may need service-specific probes or additional validation to determine whether a UDP service is actually available. Firewalls and filtering can also affect the result. Understanding UDP behavior helps reduce incorrect conclusions during vulnerability assessments and improves the accuracy of service discovery.

Question 64

Which web vulnerability allows an attacker to include or access unintended files through manipulated file parameters?

1. CSRF
2. File inclusion
3. Credential stuffing
4. ARP spoofing

Correct Answer: 2

Explanation

File inclusion vulnerabilities occur when an application uses user-controlled input to determine which files are loaded without adequate validation. Depending on the application and configuration, this may expose sensitive files or cause unintended resources to be processed. Local File Inclusion (LFI) commonly involves files available on the same server, while Remote File Inclusion (RFI) involves external resources where supported. During authorized testing, testers should validate the impact carefully and avoid accessing unnecessary sensitive information. Strong input validation and controlled file-selection mechanisms help prevent these issues.

Question 65

Which assessment approach provides the tester with limited internal information before testing begins?

1. Gray-box testing
2. Black-box testing
3. Blind scanning
4. Passive monitoring

Correct Answer: 1

Explanation

Gray-box testing gives the penetration tester some information about the target before the assessment, such as limited credentials, architecture details, application documentation, or user roles. This approach represents a balance between black-box and fully informed testing. It can allow testers to evaluate internal functionality more efficiently while still simulating an attacker with partial knowledge. Black-box testing generally starts with little or no internal information. The selected approach should be documented in the engagement scope because it directly affects testing coverage and objectives.

Question 66

What is the primary purpose of a TCP connect scan?

1. Identify wireless encryption
2. Complete a TCP connection to determine port availability
3. Recover password hashes
4. Enumerate DNS records

Correct Answer: 2

Explanation

A TCP connect scan attempts to establish a complete TCP connection with the target port. If the connection succeeds, the port is generally considered open. Unlike a SYN scan, the TCP connect method completes the connection process rather than stopping after the initial handshake response. This makes it useful when raw packet capabilities are unavailable, although it can generate more noticeable connection activity. During authorized testing, scan selection should consider network conditions, detection controls, and the rules defined for the engagement.

Question 67

Which finding would most directly indicate a weak password policy?

1. TLS enabled on a website
2. MFA required for administrators
3. Very short passwords allowed without complexity or length controls
4. Network segmentation between departments

Correct Answer: 3

Explanation

Allowing very short passwords without appropriate length or complexity requirements can indicate a weak password policy. Such configurations may make accounts more susceptible to password guessing and other credential attacks, particularly when additional controls such as MFA or rate limiting are absent. During an authorized assessment, testers can review password policies and evaluate their effectiveness without unnecessarily attempting large numbers of credentials. Strong password policies generally emphasize sufficient password length and resistance to commonly compromised credentials, while supporting additional authentication protections where appropriate.

Question 68

Which technique exploits weaknesses in ARP to associate an attacker’s MAC address with another device’s IP address?

1. DNS tunneling
2. ARP spoofing
3. SQL injection
4. Directory enumeration

Correct Answer: 2

Explanation

ARP spoofing manipulates Address Resolution Protocol communications on a local network so that devices associate an attacker’s MAC address with the IP address of another system, such as a gateway. This can allow traffic to be redirected through the attacker’s system in environments lacking appropriate protections. During authorized testing, the technique can be used conceptually to assess susceptibility to local network interception. Network segmentation, dynamic ARP inspection, secure switching configurations, and encryption can reduce the potential impact of ARP-based attacks.

Question 69

A tester wants to identify subdomains using publicly available information without directly querying the target infrastructure. Which approach is most appropriate?

1. Passive reconnaissance
2. Active exploitation
3. Credential replay
4. Privilege escalation

Correct Answer: 1

Explanation

Passive reconnaissance gathers information from publicly available sources without directly interacting with the target infrastructure. For subdomain discovery, a tester may review search indexes, public datasets, certificate information, archived content, and other external sources. This approach can reduce the amount of direct traffic sent to the organization while providing useful information about its external footprint. Active reconnaissance, by contrast, directly interacts with target systems. The chosen method should match the engagement’s scope because some organizations place specific restrictions on reconnaissance activities.

Question 70

Which security control can significantly reduce the impact of compromised user passwords?

1. Open ports
2. Shared administrator accounts
3. Multi-factor authentication
4. Unrestricted file shares

Correct Answer: 3

Explanation

Multi-factor authentication (MFA) requires users to provide additional verification beyond a password, such as a security key, authenticator-generated code, or biometric factor. This can reduce the risk associated with stolen or guessed passwords because possession of the password alone may not provide access. MFA does not eliminate every authentication risk, particularly when other weaknesses exist, but it provides an important additional control. During penetration testing, testers may assess whether MFA is consistently enforced on sensitive applications, administrative interfaces, remote access systems, and other high-value services.

Question 71

What does a DNS MX record identify?

1. An email server responsible for a domain
2. A domain’s IPv6 address
3. A web server’s operating system
4. A user’s password policy

Correct Answer: 1

Explanation

A Mail Exchange (MX) record identifies the mail servers responsible for receiving email for a domain. During reconnaissance, reviewing MX records can reveal externally accessible mail infrastructure and provide useful information about an organization’s email architecture. This information can help testers understand the external attack surface and identify systems that may require additional authorized assessment. An AAAA record is associated with IPv6 addressing, while operating system information and password policies are not provided directly by MX records.

Question 72

Which attack attempts to use a stolen authentication token instead of obtaining the user’s password?

1. Token replay
2. DNS poisoning
3. Port scanning
4. Directory traversal

Correct Answer: 1

Explanation

Token replay involves using a previously captured or stolen authentication token to impersonate a legitimate user or session. Depending on the application, tokens may be stored in cookies, headers, or other authentication mechanisms. During an authorized assessment, testers can evaluate whether tokens are properly protected, expire appropriately, and are invalidated when required. Secure transport, short token lifetimes, session invalidation, and appropriate token protection can reduce the risk. Token replay differs from password attacks because the attacker attempts to reuse an existing authentication artifact.

Question 73

Which tool is commonly used to analyze packets captured from a network interface?

1. Hashcat
2. Wireshark
3. Gobuster
4. Metasploit

Correct Answer: 2

Explanation

Wireshark is a network protocol analyzer that allows testers to inspect captured network traffic at the packet level. It supports numerous protocols and can help identify communication patterns, unexpected connections, authentication exchanges, and protocol misconfigurations. During an authorized penetration test, packet analysis can provide evidence about how systems communicate and whether sensitive information is transmitted improperly. Hashcat focuses on password-hash recovery, Gobuster is commonly used for content or resource enumeration, and Metasploit provides a broad framework for security testing.

Question 74

A tester discovers that a web application accepts serialized objects from an untrusted client. What security issue should be investigated?

1. Insecure deserialization
2. Wireless jamming
3. Password spraying
4. VLAN hopping

Correct Answer: 1

Explanation

Insecure deserialization occurs when an application processes serialized data from an untrusted source without adequate validation or security controls. Depending on the programming language and implementation, manipulated serialized objects may lead to unexpected application behavior, unauthorized actions, or potentially code execution. During authorized testing, the tester should determine whether untrusted serialized data is accepted and whether appropriate integrity and validation mechanisms are present. Safer designs avoid deserializing untrusted objects whenever possible and enforce strict validation of data formats and permitted object types.

Question 75

Which cloud security weakness involves assigning excessive permissions to an identity?

1. Data compression
2. Overprivileged IAM permissions
3. Network latency
4. DNS caching

Correct Answer: 2

Explanation

Overprivileged Identity and Access Management (IAM) permissions occur when a user, service account, role, or application receives more access than required for its intended responsibilities. Excessive permissions can increase the impact of compromised credentials because an attacker may inherit the same unnecessary privileges. During an authorized cloud assessment, testers can review assigned roles and determine whether permissions follow least-privilege principles. Reducing unnecessary permissions, separating administrative roles, and regularly reviewing access assignments can limit the potential consequences of compromised identities.

Question 76

Which activity should generally occur before exploiting a potentially disruptive vulnerability in a production environment?

1. Obtain appropriate authorization and confirm the test conditions
2. Disable all monitoring
3. Delete existing logs
4. Expand the scope independently

Correct Answer: 1

Explanation

Potentially disruptive exploitation should only occur when it is explicitly authorized and consistent with the engagement’s rules and testing conditions. Before proceeding, the tester should confirm that the target is in scope, understand potential impact, and follow any required communication or approval process. Production systems may contain critical services, so uncontrolled exploitation can cause outages or data loss. Penetration testing is intended to demonstrate security weaknesses responsibly, not create unnecessary operational damage. Proper authorization and coordination are therefore essential before high-impact testing.

Question 77

What is the primary purpose of a vulnerability remediation recommendation?

1. Increase the number of vulnerabilities
2. Describe how the identified risk can be reduced
3. Hide evidence from management
4. Replace the penetration test scope

Correct Answer: 2

Explanation

A remediation recommendation explains practical measures that can reduce or eliminate the risk associated with a finding. Depending on the vulnerability, recommendations may include applying patches, changing configurations, improving authentication, restricting access, correcting application logic, or implementing additional monitoring. Effective recommendations should relate directly to the observed root cause and business context. They should also be realistic enough for the organization to implement. Remediation guidance is an important part of a penetration-testing report because identifying a weakness without explaining appropriate corrective action provides limited value.

Question 78

Which Windows authentication attack targets service accounts associated with Kerberos service principal names?

1. Kerberoasting
2. CSRF
3. Smurf attack
4. DNS tunneling

Correct Answer: 1

Explanation

Kerberoasting is an attack technique involving Kerberos service accounts and service principal names (SPNs). In an authorized security assessment, a tester may evaluate whether service accounts are configured with sufficiently strong credentials and appropriate privileges. Weak service-account passwords can increase the risk that captured authentication material can be subjected to offline password recovery. Organizations can reduce exposure by using strong, unique service-account credentials, minimizing privileges, and adopting managed service-account mechanisms where appropriate. Kerberoasting is distinct from web attacks such as CSRF and infrastructure techniques such as DNS tunneling.

Question 79

A penetration tester needs to automate repetitive tasks and process security-testing data. Which language is commonly suitable?

1. Python
2. HTML
3. CSS
4. SQL

Correct Answer: 1

Explanation

Python is widely used in security testing for automation, data processing, API interaction, parsing output, and creating custom assessment utilities. Its extensive libraries and straightforward syntax make it suitable for repetitive tasks that would otherwise require manual effort. For example, testers can use Python to process scan results or transform structured data into a more useful format while staying within authorized testing boundaries. HTML and CSS primarily describe web content and presentation, while SQL is a database query language rather than a general-purpose automation language.

Question 80

Which section of a penetration test report is primarily intended for organizational leadership?

1. Packet capture
2. Executive summary
3. Exploit source code
4. Port scan output

Correct Answer: 2

Explanation

The executive summary presents the overall security assessment in language appropriate for organizational leadership and other nontechnical stakeholders. It typically explains the assessment purpose, major findings, overall risk themes, business impact, and key remediation priorities without requiring detailed technical knowledge. Technical sections can provide deeper evidence, affected assets, reproduction information, and remediation guidance for security and engineering teams. Separating executive and technical reporting allows each audience to receive information relevant to its responsibilities while maintaining a consistent overall assessment.