View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.

 

Question 81

Which tool is commonly used to identify relationships and privilege paths within an Active Directory environment?

1. Nikto
2. BloodHound
3. tcpdump
4. John the Ripper

Correct Answer: 2

Explanation

BloodHound is designed to visualize relationships within Active Directory environments and can help security professionals identify potential privilege paths. It analyzes information about users, groups, computers, sessions, and permissions to reveal relationships that may not be obvious from individual objects. During an authorized penetration test, this can help demonstrate how excessive privileges or poorly configured relationships could contribute to privilege escalation. BloodHound is different from web scanners and password-recovery tools because its primary purpose is analyzing identity and access relationships within directory-based environments.

Question 82

What is the main purpose of a vulnerability scanner?

1. Identify potential security weaknesses
2. Replace all manual penetration testing
3. Encrypt network traffic
4. Manage employee passwords

Correct Answer: 1

Explanation

A vulnerability scanner automatically examines systems, applications, or network services for conditions that may indicate known security weaknesses. It can identify missing patches, outdated software, insecure configurations, and other issues by comparing observed characteristics against vulnerability databases or detection rules. Scanner results should be validated because automated tools can produce false positives and may not understand application-specific context. Vulnerability scanning supports penetration testing but does not completely replace manual testing, which can identify logic flaws and attack paths that automated tools may overlook.

Question 83

During reconnaissance, a tester discovers an organization’s certificate transparency entries. What can these records potentially reveal?

1. Employee salaries
2. Previously issued domain certificates and related hostnames
3. Password hashes
4. Firewall administrator credentials

Correct Answer: 2

Explanation

Certificate Transparency (CT) logs publicly record information about certificates issued by trusted certificate authorities. Reviewing these records during passive reconnaissance can reveal domains and hostnames that have appeared in certificates, including systems that may not be prominently advertised. This information can help testers understand an organization’s external footprint and identify assets that should be checked against the authorized scope. CT logs do not normally expose passwords or administrator credentials. Because certificates can remain visible in logs even after infrastructure changes, they can be a useful source of historical reconnaissance information.

Question 84

Which attack attempts to relay captured authentication material to another service rather than directly recovering the password?

1. Credential stuffing
2. Password spraying
3. NTLM relay
4. Dictionary attack

Correct Answer: 3

Explanation

NTLM relay involves forwarding authentication exchanges to another service in an attempt to authenticate as the original user without directly recovering the user’s password. In authorized assessments, testers may evaluate whether network services and authentication configurations are susceptible to relay-based attacks. Controls such as SMB signing, LDAP signing or channel binding where applicable, network segmentation, and reducing unnecessary NTLM usage can help limit exposure. NTLM relay differs from credential stuffing and password spraying because it abuses authentication protocols rather than repeatedly testing known or guessed password combinations.

Question 85

Which web security mechanism helps prevent a browser from sending cookies in certain cross-site requests?

1. SameSite cookie attribute
2. DNS MX record
3. HTTP status code
4. TCP SYN flag

Correct Answer: 1

Explanation

The SameSite cookie attribute controls when browsers include cookies with requests originating from different sites. Appropriate SameSite settings can reduce the likelihood of certain cross-site request attacks by limiting when session cookies accompany cross-site requests. Values such as Strict and Lax provide different levels of cross-site cookie restrictions, while None requires additional conditions such as Secure in modern browsers. SameSite is not a replacement for complete CSRF protection, but it can provide an important additional defense when combined with proper request validation and application security controls.

Question 86

A tester identifies a login endpoint that reveals whether a username exists based on different error messages. What weakness should be considered?

1. Account enumeration
2. VLAN hopping
3. Packet fragmentation
4. DNS tunneling

Correct Answer: 1

Explanation

Account enumeration occurs when an application unintentionally reveals whether particular usernames or accounts exist. Differences in login errors, password-reset responses, registration messages, or response timing can sometimes provide this information. During an authorized assessment, identifying enumeration can demonstrate how attackers might build a list of valid accounts before attempting other attacks. Applications can reduce this exposure by using consistent responses, carefully controlling timing differences, and monitoring suspicious requests. Account enumeration does not necessarily provide access by itself, but it can make subsequent credential attacks more targeted.

Question 87

Which technique involves testing a small number of common passwords against many different accounts?

1. Credential stuffing
2. Password spraying
3. Brute force
4. Rainbow-table lookup

Correct Answer: 2

Explanation

Password spraying tests one or a small number of commonly used passwords against many accounts rather than trying numerous passwords against one account. This approach attempts to reduce the likelihood of triggering account lockout policies that activate after repeated failures against an individual account. During authorized assessments, testers should follow approved credential-testing limits and avoid unnecessary account disruption. Credential stuffing instead uses previously compromised username-password pairs, while brute-force attacks systematically try many combinations. Password spraying specifically focuses on broadly applying common passwords across multiple accounts.

Question 88

What does a reverse DNS lookup attempt to determine?

1. The hostname associated with an IP address
2. The password associated with a username
3. The encryption key for a VPN
4. The software license of a server

Correct Answer: 1

Explanation

A reverse DNS lookup attempts to identify a hostname associated with an IP address, typically using a PTR record. During reconnaissance, reverse DNS information can help testers map infrastructure and discover naming conventions or systems associated with an address range. The result depends on how DNS is configured, and many addresses may not have useful reverse records. Reverse DNS should therefore be treated as one source of reconnaissance information rather than definitive proof of an asset’s identity or role.

Question 89

A tester discovers that an API accepts a valid user’s token but does not verify whether that user can access the requested object. Which issue is most relevant?

1. Broken object-level authorization
2. DNS cache poisoning
3. Wireless deauthentication
4. Open redirect

Correct Answer: 1

Explanation

Broken Object Level Authorization (BOLA) occurs when an API fails to verify whether the authenticated user is authorized to access a particular object. Authentication confirms who the requester is, but authorization determines what that requester is allowed to access. During an authorized assessment, testers can evaluate whether changing object references or identifiers results in access to resources belonging to another user or role. Proper server-side authorization checks should be applied to every sensitive object request. This issue is particularly important for APIs that expose numerous resource identifiers.

Question 90

Which security assessment technique involves observing network traffic without actively sending probes to the target?

1. Passive traffic analysis
2. Active port scanning
3. Password spraying
4. Exploit validation

Correct Answer: 1

Explanation

Passive traffic analysis involves observing network communications without actively probing the target systems. It can provide information about protocols, hosts, communication patterns, and potentially exposed data, depending on where the monitoring occurs and whether traffic is encrypted. During an authorized assessment, passive techniques can be useful when minimizing interaction with production systems is important. Active scanning differs because it deliberately sends packets or requests to identify services and vulnerabilities. Testers should ensure that monitoring activities are explicitly permitted and that captured data is handled securely.

Question 91

Which control is specifically designed to limit access between network segments?

1. Network segmentation
2. Password hashing
3. File compression
4. Certificate transparency

Correct Answer: 1

Explanation

Network segmentation separates systems or resources into distinct network zones and controls communication between them. This can limit lateral movement if an attacker compromises one system because access to other segments can be restricted according to defined security policies. During a penetration test, segmentation can be evaluated by determining whether systems in one security zone can reach resources in another without appropriate authorization. Effective segmentation often works alongside firewalls, access-control rules, identity controls, and monitoring to reduce the potential spread of a compromise.

Question 92

A web application reflects user-supplied input into an HTTP response without adequate output encoding. Which vulnerability should be investigated?

1. XSS
2. Kerberoasting
3. ARP spoofing
4. UDP scanning

Correct Answer: 1

Explanation

Cross-site scripting (XSS) can occur when an application places untrusted user input into a web page without appropriate output encoding or other contextual protections. Reflected XSS occurs when the malicious input is returned as part of the immediate server response, while stored XSS persists within application data and is later displayed to users. During authorized testing, testers should determine how input is processed and whether browser-side execution is possible. Context-aware output encoding, input validation, and suitable content security policies can help reduce XSS risk.

Question 93

Which wireless attack attempts to disconnect clients from a legitimate access point?

1. Evil twin
2. Deauthentication attack
3. DNS poisoning
4. Credential stuffing

Correct Answer: 2

Explanation

A deauthentication attack sends specially crafted wireless management traffic intended to cause clients to disconnect from an access point. In an authorized wireless assessment, this technique can be used to evaluate whether networks are appropriately protected against unauthorized management-frame manipulation, particularly where protected management frames are not properly implemented. Deauthentication is different from an evil twin attack, which creates a fraudulent access point. Testers must carefully control wireless disruption because repeated deauthentication activity can affect legitimate users and potentially interrupt business operations.

Question 94

Which document should identify systems that are explicitly excluded from a penetration test?

1. Rules of engagement or scope documentation
2. Password database
3. Vulnerability scanner output
4. Network packet capture

Correct Answer: 1

Explanation

The scope and rules of engagement should clearly identify systems, applications, networks, or activities that are excluded from testing. Explicit exclusions help prevent accidental interaction with sensitive or third-party assets and establish clear boundaries for the penetration tester. They may also specify prohibited techniques, testing windows, communication procedures, and emergency contacts. Testers should review these restrictions before beginning and whenever the scope changes. Scanner output and packet captures provide technical information but are not substitutes for formal authorization and scope documentation.

Question 95

Which technique attempts to discover operating-system and service information by analyzing network responses?

1. OS fingerprinting
2. Password cracking
3. Data exfiltration
4. File encryption

Correct Answer: 1

Explanation

OS fingerprinting analyzes characteristics of network responses to estimate which operating system a target is running. Factors such as TCP/IP behavior, response patterns, and protocol characteristics can provide clues about the underlying platform. Service fingerprinting can similarly identify applications and versions. During authorized reconnaissance, this information helps testers select appropriate validation methods and understand the technology landscape. Fingerprinting is not always perfectly accurate because firewalls, proxies, customized network stacks, and security tools can alter responses or intentionally conceal identifying characteristics.

Question 96

What is the primary security benefit of applying least privilege to service accounts?

1. It limits the damage if the account is compromised
2. It makes all passwords unnecessary
3. It disables network monitoring
4. It guarantees that vulnerabilities cannot exist

Correct Answer: 1

Explanation

Least privilege gives an account only the permissions required to perform its intended function. Applying this principle to service accounts can reduce the potential impact if credentials are exposed or the associated application is compromised. An attacker operating through a restricted account may have fewer opportunities to access sensitive resources or move to other systems. Least privilege does not eliminate vulnerabilities or replace other controls. Organizations should periodically review service-account permissions and remove unnecessary access while ensuring required business functions continue to operate.

Question 97

Which tool can be used to perform password-hash recovery testing against captured hashes?

1. Wireshark
2. Hashcat
3. Burp Suite
4. Nmap

Correct Answer: 2

Explanation

Hashcat is a password-recovery and auditing tool commonly used to test the strength of password hashes in authorized security assessments. Given appropriate hash material and an approved testing scope, it can evaluate whether passwords are susceptible to various recovery approaches. The purpose of such testing is to identify weak credential practices and support stronger password policies or authentication controls. Wireshark analyzes network traffic, Burp Suite focuses on web applications, and Nmap primarily performs network discovery and service scanning.

Question 98

A tester discovers an application endpoint that makes requests to user-specified external URLs. What security concern should be assessed?

1. SSRF
2. XSS
3. CSRF
4. IDOR

Correct Answer: 1

Explanation

An endpoint that makes server-side requests to user-specified URLs should be assessed for Server-Side Request Forgery (SSRF). If the application does not properly restrict destinations, an attacker may potentially cause the server to communicate with resources that should not be reachable through the application’s intended functionality. During an authorized assessment, testers should focus on demonstrating the security boundary and potential impact without unnecessarily accessing sensitive internal resources. Strong destination allowlists, network restrictions, and careful URL validation can help reduce SSRF exposure.

Question 99

Which report element provides technical details about the affected asset, evidence, impact, and remediation?

1. Technical finding
2. Company logo
3. Cover page
4. Engagement invitation

Correct Answer: 1

Explanation

A technical finding provides detailed information about a specific security issue identified during the assessment. It commonly includes the affected asset, vulnerability description, evidence, severity or risk context, potential impact, and recommended remediation. Clear technical findings allow security and engineering teams to reproduce or investigate the issue and determine appropriate corrective action. The executive summary serves a broader audience and typically presents high-level themes. Detailed findings therefore provide the technical substance needed to support remediation and later verification.

Question 100

After remediation, what activity is performed to determine whether a reported vulnerability has been fixed?

1. Retesting
2. Reconnaissance
3. Asset discovery
4. Social engineering

Correct Answer: 1

Explanation

Retesting is performed after remediation to determine whether a previously identified vulnerability has been successfully corrected. The tester should use appropriate validation methods to confirm that the original security condition no longer exists and, where relevant, verify that the remediation has not introduced a related weakness. Retesting results should be documented clearly, including whether the issue was resolved, partially resolved, or remains present. This provides the organization with evidence that corrective measures were effective rather than relying solely on a statement that a change was made.