View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.

Question 141

Which tool is commonly used to capture and analyze network packets?

1. Gobuster
2. Wireshark
3. Hashcat
4. Burp Suite

Correct Answer: 2

Explanation

Wireshark is a network protocol analyzer used to capture and inspect network traffic. During an authorized penetration test, it can help identify communication patterns, protocol behavior, unexpected connections, and potentially exposed information. Testers can use packet analysis to investigate network security controls and validate observations from other assessment activities. Gobuster is generally used for resource enumeration, Hashcat for password-hash recovery testing, and Burp Suite primarily for web application testing. Packet captures should be handled securely because they may contain sensitive organizational information.

Question 142

Which DNS record maps a hostname to an IPv4 address?

1. MX
2. PTR
3. A
4. TXT

Correct Answer: 3

Explanation

An A record maps a hostname to an IPv4 address. During reconnaissance, examining DNS records can help testers understand how publicly accessible services are organized and identify infrastructure associated with a domain. Other DNS record types serve different purposes: MX records identify mail servers, PTR records support reverse DNS lookups, and TXT records can contain various forms of domain-related information. DNS information should be interpreted within the approved scope because a domain may point to third-party infrastructure that is not authorized for testing.

Question 143

What is the primary goal of privilege escalation?

1. Obtain higher access privileges
2. Identify DNS records
3. Discover public domains
4. Capture wireless traffic

Correct Answer: 1

Explanation

Privilege escalation occurs when a user or process gains permissions beyond those originally authorized. It can be vertical, such as moving from a standard user to an administrator, or horizontal, such as gaining access to another user’s resources with similar privilege levels. During an authorized penetration test, demonstrating privilege escalation can show how an initial compromise could lead to greater system control or access to sensitive resources. Testers should document the original privilege level, resulting access, security weakness, and business impact without performing unnecessary actions.

Question 144

Which technique uses a list of commonly expected passwords to test authentication?

1. Brute-force attack
2. Dictionary attack
3. Credential stuffing
4. Token replay

Correct Answer: 2

Explanation

A dictionary attack uses a predefined list of likely passwords or password components to test authentication credentials. The list may contain common words, phrases, or other frequently selected password patterns. During an authorized assessment, dictionary-based testing can help identify weak passwords without attempting every possible character combination. Brute force systematically tests a much broader range of combinations, while credential stuffing uses previously compromised credential pairs. Testing should follow approved limits to avoid account lockouts, service disruption, or unauthorized access.

Question 145

Which cloud security issue occurs when sensitive resources are unintentionally accessible from the public Internet?

1. Public cloud exposure
2. Packet fragmentation
3. DNS recursion
4. Local privilege escalation

Correct Answer: 1

Explanation

Public cloud exposure occurs when cloud resources that should be restricted are unintentionally accessible from the Internet. Examples may include publicly readable storage, exposed management interfaces, databases, or services with overly broad network permissions. During an authorized cloud assessment, testers should determine whether the exposure is intentional and what information or functionality is reachable. Cloud providers offer numerous access-control mechanisms, but secure deployment still depends on correct configuration. Organizations should regularly review permissions, network exposure, storage settings, and public-access controls.

Question 146

A tester wants to identify the technology framework used by a web application. Which activity is most appropriate?

1. Technology fingerprinting
2. Password spraying
3. ARP poisoning
4. Credential stuffing

Correct Answer: 1

Explanation

Technology fingerprinting attempts to identify software frameworks, web servers, programming technologies, content-management systems, and other components used by an application. Information may come from response headers, page structures, cookies, file naming conventions, or other observable characteristics. During an authorized assessment, fingerprinting helps testers understand the technology stack and select appropriate validation methods. Fingerprinting results should be verified because applications may hide or modify identifying information. Knowing the technology stack can also help identify relevant security advisories and configuration weaknesses.

Question 147

Which attack attempts to exploit a user’s trust by sending a fraudulent message designed to obtain sensitive information?

1. Phishing
2. Port scanning
3. DNS enumeration
4. VLAN hopping

Correct Answer: 1

Explanation

Phishing is a social-engineering technique in which deceptive messages are used to persuade recipients to reveal information, interact with malicious content, or perform an unintended action. In an authorized penetration test, phishing simulations can assess user awareness and organizational controls when explicitly included in the rules of engagement. Testers should establish approved targets, communication procedures, and data-handling requirements before conducting such activities. Effective defenses include user awareness training, email filtering, MFA, domain protections, and monitoring for suspicious messages.

Question 148

Which network protocol is commonly used for remote desktop access to Windows systems?

1. RDP
2. LDAP
3. SMTP
4. DNS

Correct Answer: 1

Explanation

Remote Desktop Protocol (RDP) is commonly used to provide graphical remote access to Windows systems. During authorized penetration testing, exposed RDP services may be assessed for authentication controls, encryption settings, patch status, network restrictions, and other security weaknesses. RDP exposure does not automatically indicate a vulnerability, but unnecessary Internet accessibility can increase attack surface. Organizations can reduce risk by restricting RDP access through VPNs or network controls, requiring strong authentication and MFA where supported, and keeping systems properly patched.

Question 149

What is the purpose of a stop condition in rules of engagement?

1. Define when testing must be paused or terminated
2. Identify employee salaries
3. Increase scan speed
4. Replace the final report

Correct Answer: 1

Explanation

A stop condition specifies circumstances under which penetration testing should be paused or terminated. Examples may include service instability, unexpected impact to production systems, discovery of highly sensitive information, or direction from an authorized organizational contact. Defining stop conditions before testing begins helps ensure that testers respond consistently to unexpected events. It also reduces the likelihood that an assessment will cause unnecessary operational disruption. Testers should understand these conditions before starting and follow the agreed escalation process when a stop condition occurs.

Question 150

Which attack attempts to manipulate DNS responses so users are directed to an unintended destination?

1. DNS poisoning
2. SQL injection
3. CSRF
4. Kerberoasting

Correct Answer: 1

Explanation

DNS poisoning involves causing incorrect DNS information to be provided or stored so that users or systems resolve a domain to an unintended destination. Depending on the scenario, manipulation can occur through compromised DNS infrastructure, cache-related weaknesses, or other mechanisms. During authorized assessments, testers can evaluate whether DNS infrastructure is properly secured and whether users receive trustworthy resolution information. DNSSEC, secure resolver configuration, appropriate monitoring, and protection of DNS infrastructure can help reduce certain forms of DNS manipulation.

Question 151

Which authentication factor is something a user possesses?

1. Password
2. Security token
3. PIN
4. Security question

Correct Answer: 2

Explanation

A security token is an example of a “something you have” authentication factor because the user must possess the physical or digital token to authenticate. A password, PIN, and security question are generally categorized as “something you know.” Multi-factor authentication combines different factor categories to provide stronger authentication than relying on a single type alone. During penetration testing, testers may evaluate whether sensitive systems require appropriate combinations of authentication factors and whether authentication controls are consistently enforced across different access paths.

Question 152

A tester discovers that an application stores passwords using a fast, unsalted hashing algorithm. What risk should be assessed?

1. Increased resistance to offline cracking
2. Weak password protection
3. Improved session security
4. Reduced account enumeration

Correct Answer: 2

Explanation

Fast, unsalted password hashing can make stored credentials more vulnerable to offline password-recovery attempts. A salt ensures that identical passwords do not produce identical stored hashes and makes precomputed attacks less effective. Password hashing should generally use algorithms specifically designed for password storage, with appropriate work factors. During an authorized assessment, testers can review the application’s password-storage implementation and determine whether appropriate protections are present. Strong password hashing does not prevent every authentication attack, but it significantly improves protection if password databases are compromised.

Question 153

Which cloud resource is commonly associated with storing objects such as files and backups?

1. Object storage
2. DNS resolver
3. Load balancer
4. Directory service

Correct Answer: 1

Explanation

Object storage is designed to store data objects such as documents, images, backups, logs, and application files. Cloud object-storage services commonly use buckets or containers and provide access through APIs or web interfaces. During an authorized cloud assessment, testers may review whether storage resources have appropriate access controls, encryption, logging, and public-access restrictions. Misconfigured object storage can accidentally expose sensitive information. Understanding the role of object storage helps testers distinguish data repositories from other cloud components such as load balancers, DNS services, and identity systems.

Question 154

Which technique attempts to move from one compromised system to another within an environment?

1. Lateral movement
2. Password hashing
3. Passive reconnaissance
4. Data classification

Correct Answer: 1

Explanation

Lateral movement describes the process of moving from one compromised system or account to additional systems within an environment. During an authorized penetration test, assessing lateral movement helps determine whether network segmentation, authentication controls, privilege boundaries, and monitoring effectively limit an attacker’s progress. Testers should only access additional systems that are explicitly authorized and should avoid unnecessary data collection. A successful lateral-movement path can demonstrate how a vulnerability on one system may affect broader organizational resources.

Question 155

Which tool is commonly used to perform network connection testing and communicate with TCP or UDP services?

1. Netcat
2. BloodHound
3. Nessus
4. Hashcat

Correct Answer: 1

Explanation

Netcat is a versatile network utility that can establish connections to TCP or UDP services and is commonly used for troubleshooting, connectivity testing, and authorized security assessments. It can help testers determine whether a service is reachable and examine basic network communication behavior. Because of its flexibility, Netcat can also be used in security-testing scenarios where its use is explicitly authorized. BloodHound analyzes directory relationships, Nessus performs vulnerability scanning, and Hashcat focuses on password-hash recovery.

Question 156

Which vulnerability allows an attacker to access files outside an application’s intended directory?

1. Directory traversal
2. CSRF
3. Password spraying
4. DNS poisoning

Correct Answer: 1

Explanation

Directory traversal occurs when an application improperly handles file or path input, potentially allowing access outside the intended directory structure. If successful, the vulnerability may expose configuration files, application data, or other sensitive resources. During authorized testing, testers should carefully validate the security boundary and avoid unnecessarily retrieving confidential information. Applications can reduce directory traversal risk through strict path validation, safe file APIs, canonicalization, and controlled access to permitted resources. Proper server-side authorization remains important even when input appears to be safely formatted.

Question 157

What is the primary purpose of an authenticated web session cookie?

1. Maintain the user’s authenticated session
2. Identify the operating system
3. Resolve DNS names
4. Store network routes

Correct Answer: 1

Explanation

An authenticated session cookie allows a web application to associate subsequent browser requests with an authenticated session. If the cookie is stolen or improperly protected, an attacker may potentially impersonate the associated user until the session expires or is invalidated. During authorized testing, testers can review cookie attributes such as Secure, HttpOnly, and SameSite and assess session expiration and invalidation behavior. Strong session management should protect authentication tokens during transmission and storage while limiting their lifetime and exposure.

Question 158

Which control helps reduce the risk of credential attacks by limiting repeated authentication attempts?

1. Rate limiting
2. Public file sharing
3. Open DNS recursion
4. Anonymous access

Correct Answer: 1

Explanation

Rate limiting restricts how frequently authentication attempts can be made within a defined period. It can reduce the effectiveness of brute-force and password-guessing attacks by slowing repeated attempts and increasing the difficulty of automated attacks. Other controls such as MFA, strong passwords, account monitoring, and appropriate lockout mechanisms can provide additional protection. During an authorized penetration test, testers should respect configured rate limits and agreed testing thresholds. Effective rate limiting should balance security with legitimate user access and should avoid creating unnecessary denial-of-service conditions.

Question 159

Which activity involves comparing discovered assets against the approved penetration-testing scope?

1. Scope validation
2. Password cracking
3. Data exfiltration
4. Wireless jamming

Correct Answer: 1

Explanation

Scope validation ensures that identified hosts, applications, domains, networks, and other assets are actually authorized for testing. This is particularly important during reconnaissance because public information can reveal infrastructure belonging to cloud providers, business partners, subsidiaries, or unrelated organizations. Before actively scanning or testing a discovered asset, the tester should confirm its inclusion in the approved scope. Maintaining accurate scope boundaries reduces operational, contractual, and legal risks and helps ensure that the assessment remains aligned with the organization’s authorized objectives.

Question 160

Which report characteristic makes a technical finding easier for engineers to remediate?

1. Clear evidence and actionable remediation guidance
2. Complex language with no evidence
3. A list of unrelated vulnerabilities
4. An unexplained severity label

Correct Answer: 1

Explanation

Technical findings are more useful when they provide clear evidence, identify the affected asset, explain the vulnerability, describe its impact, and provide actionable remediation guidance. Engineers need enough technical context to understand the root cause and determine what change is required. Evidence also helps confirm that the finding is genuine and assists with later retesting. A report filled with unexplained terminology or unrelated information can make remediation harder. Clear, concise, technically accurate findings help connect the penetration test directly to corrective security improvements.