View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.

 

Question 181

Which protocol is commonly used to synchronize time between networked systems?

1. LDAP
2. NTP
3. SMB
4. FTP

Correct Answer: 2

Explanation

Network Time Protocol (NTP) is used to synchronize clocks between networked systems. Accurate time is important for authentication protocols, event correlation, logging, and security monitoring. In environments using Kerberos, synchronized system clocks are particularly important because significant time differences can interfere with authentication. During an authorized penetration test, inconsistent timestamps can also make it harder to correlate events across multiple systems. Organizations should use trusted time sources and restrict unauthorized changes to system clocks to maintain reliable security logging and authentication behavior.

Question 182

Which tool is commonly used to identify web technologies from publicly accessible information?

1. WhatWeb
2. Hashcat
3. Netcat
4. BloodHound

Correct Answer: 1

Explanation

WhatWeb is a technology-identification tool that can help determine characteristics of web applications and servers. It may identify frameworks, content-management systems, web servers, JavaScript libraries, and other technologies based on observable responses and patterns. During authorized reconnaissance, this information can help testers understand the technology stack and select appropriate testing methods. Technology fingerprinting is not always perfectly accurate because applications can hide or alter identifying information. Results should therefore be validated before being used to support vulnerability conclusions.

Question 183

Which security issue occurs when an application reveals excessive technical details in error messages?

1. Information disclosure
2. Password spraying
3. VLAN hopping
4. Wireless jamming

Correct Answer: 1

Explanation

Information disclosure occurs when an application unintentionally exposes sensitive or unnecessary details. Verbose error messages may reveal database names, file paths, software versions, internal hostnames, stack traces, or implementation details that could assist further attacks. During authorized web testing, testers can review error responses to determine whether they expose information beyond what legitimate users require. Applications should provide users with generic error messages while recording useful diagnostic details securely in internal logs. Reducing unnecessary information exposure can make reconnaissance and attack planning more difficult.

Question 184

A tester wants to determine whether a server accepts connections on a particular port. Which activity is most appropriate?

1. Port scanning
2. Password hashing
3. Data classification
4. Document analysis

Correct Answer: 1

Explanation

Port scanning is used to determine which network ports on a host are reachable and potentially associated with services. During authorized penetration testing, it helps establish the target’s exposed attack surface and identifies services that may require further enumeration. Different scan methods can provide different results depending on firewalls, filtering, and protocol behavior. Testers should scan only approved systems and use appropriate rates to avoid unnecessary network impact. Port scanning is generally an early technical discovery activity rather than an exploitation technique.

Question 185

Which web vulnerability allows an attacker to execute unauthorized database commands through application input?

1. SQL injection
2. CSRF
3. Open redirect
4. IDOR

Correct Answer: 1

Explanation

SQL injection occurs when untrusted application input is incorporated into database queries without sufficient protection. Depending on the application’s design and database privileges, successful SQL injection can affect confidentiality, integrity, or availability. During an authorized assessment, testers should validate the issue carefully and avoid destructive database operations. Parameterized queries, prepared statements, safe database APIs, and restricted database privileges are important defenses. Input validation can provide additional protection but should not be relied upon as the sole defense against SQL injection.

Question 186

Which attack attempts to obtain access by trying a known username with many different passwords?

1. Password spraying
2. Brute-force attack
3. Directory traversal
4. DNS poisoning

Correct Answer: 2

Explanation

A brute-force attack can involve repeatedly testing many password combinations against a particular account or authentication endpoint. When focused on one known username, it differs from password spraying, which generally applies a small number of common passwords across many accounts. During authorized testing, credential attempts should be limited according to the engagement rules to avoid account lockouts and service disruption. Rate limiting, MFA, strong password policies, and account monitoring can reduce exposure to repeated password-guessing attempts.

Question 187

Which file format is commonly used to exchange structured data between applications and APIs?

1. JSON
2. JPEG
3. MP3
4. EXE

Correct Answer: 1

Explanation

JSON, or JavaScript Object Notation, is a lightweight structured data format widely used by modern web applications and APIs. Security testers frequently encounter JSON when examining API requests and responses. Understanding its structure can help testers assess input validation, authorization, data exposure, and parameter handling. JSON itself is not a security control; vulnerabilities can occur when applications improperly process the data it contains. During authorized testing, testers should evaluate whether sensitive information is unnecessarily included in API responses or accepted without appropriate validation.

Question 188

What is the main purpose of security headers in a web application?

1. Provide additional browser-side security controls
2. Replace server authentication
3. Encrypt all databases
4. Discover hidden network hosts

Correct Answer: 1

Explanation

Security-related HTTP headers provide browsers with instructions that can strengthen application security. Examples include Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, and suitable cookie attributes. These controls can reduce risks such as content injection, protocol downgrade, and unsafe browser behavior when properly configured. During an authorized web assessment, testers can review whether security headers are present and whether their policies match the application’s requirements. Headers are defense-in-depth controls and do not replace secure application design, authentication, authorization, or proper input handling.

Question 189

Which activity helps identify whether discovered vulnerabilities are relevant to the specific target configuration?

1. Vulnerability validation
2. Password rotation
3. Asset disposal
4. Network cabling

Correct Answer: 1

Explanation

Vulnerability validation determines whether a suspected vulnerability actually exists under the target’s current configuration and circumstances. Automated scanners may identify issues based on software versions, banners, or generic signatures, but these results can sometimes be inaccurate. Manual validation can confirm whether the affected component is present, whether security controls mitigate the issue, and whether the vulnerability has meaningful impact. During authorized testing, validation should be performed carefully to avoid unnecessary disruption. Confirmed evidence makes the final report more accurate and actionable.

Question 190

Which protocol is commonly used to securely access a remote command-line session?

1. Telnet
2. FTP
3. SSH
4. SNMP

Correct Answer: 3

Explanation

Secure Shell (SSH) provides encrypted remote command-line access and can also support secure file transfer and tunneling capabilities. During authorized penetration testing, exposed SSH services may be assessed for configuration weaknesses, authentication controls, outdated software, and inappropriate network exposure. Telnet provides remote terminal functionality but does not offer comparable encryption by default. FTP is primarily a file-transfer protocol, while SNMP is used for network management. Restricting SSH access, using strong authentication, maintaining current software, and disabling unnecessary access can reduce risk.

Question 191

Which issue occurs when a user can perform administrative actions simply by changing a request parameter?

1. Broken access control
2. DNS enumeration
3. Packet fragmentation
4. Wireless interference

Correct Answer: 1

Explanation

Broken access control occurs when an application fails to enforce authorization for sensitive actions. If changing a request parameter allows an ordinary user to perform an administrative function, the application may be relying on client-controlled values or inadequate server-side authorization. During an authorized assessment, testers can compare access behavior across different roles to identify these weaknesses. Each sensitive operation should independently verify the user’s authorization. Proper server-side access controls are essential because interface restrictions alone cannot reliably prevent unauthorized requests.

Question 192

Which technique can be used to identify email-related infrastructure for a domain?

1. MX record lookup
2. ARP scanning
3. USB enumeration
4. Password spraying

Correct Answer: 1

Explanation

MX record lookup identifies mail-exchange servers responsible for receiving email for a domain. During passive reconnaissance, this information can help testers understand an organization’s external email infrastructure and identify relevant systems for authorized assessment. MX records do not reveal passwords or message contents. Additional DNS information may provide context about the organization’s domain configuration, but each discovered asset should be verified against the approved scope before active testing. Properly secured mail infrastructure should also use strong authentication and appropriate anti-abuse controls.

Question 193

Which tool is primarily designed to identify vulnerabilities in web servers and applications through automated checks?

1. Nikto
2. Hashcat
3. BloodHound
4. Netcat

Correct Answer: 1

Explanation

Nikto is a web server scanner that performs checks for potentially dangerous files, outdated server components, insecure configurations, and other known issues. It can provide useful initial information during an authorized web security assessment. However, automated scanner results should be manually reviewed because findings may be outdated, inaccurate, or lacking application-specific context. Hashcat is used for password-hash recovery testing, BloodHound analyzes directory relationships, and Netcat is a general network utility. Nikto is therefore the most appropriate tool for automated web-server checks.

Question 194

What is the purpose of a vulnerability severity rating in a penetration-testing report?

1. Communicate the relative significance of a finding
2. Guarantee exploitation
3. Identify the tester’s operating system
4. Replace remediation guidance

Correct Answer: 1

Explanation

A vulnerability severity rating communicates the relative significance of a security finding and helps stakeholders prioritize remediation. Ratings may consider factors such as exploitability, impact, affected assets, exposure, and organizational context. Standardized approaches such as CVSS can provide a technical severity framework, while organizations may supplement it with business risk considerations. A severity rating does not guarantee exploitation or replace detailed evidence and remediation guidance. Clear severity information helps technical teams and decision-makers understand which findings may require more immediate attention.

Question 195

Which authentication weakness can occur when a session remains valid after a user logs out?

1. Improper session invalidation
2. DNS poisoning
3. VLAN hopping
4. Open redirect

Correct Answer: 1

Explanation

Improper session invalidation occurs when an application’s authentication token remains usable after the user has logged out or when the session should otherwise have been terminated. If an attacker possesses that token, continued validity may allow unauthorized access to the associated account. During authorized testing, testers can assess whether logout operations properly invalidate sessions and whether tokens expire according to the application’s security requirements. Secure session management should include appropriate expiration, invalidation, protected cookie settings, and controls that reduce the impact of stolen authentication tokens.

Question 196

Which cloud security principle limits a service account to only the permissions it actually requires?

1. Least privilege
2. Open access
3. Shared administration
4. Anonymous access

Correct Answer: 1

Explanation

Least privilege limits identities and service accounts to the permissions necessary for their intended functions. In cloud environments, excessive permissions can significantly increase the impact of compromised credentials or vulnerable applications because an attacker may inherit the identity’s unnecessary access. During an authorized cloud assessment, testers can review roles, policies, and permissions to identify excessive privileges. Organizations should periodically review access, separate administrative functions, and use narrowly defined roles. Least privilege is a foundational principle for reducing unauthorized access and limiting potential blast radius.

Question 197

A tester receives different responses depending on whether an account exists during password-reset testing. What issue may this reveal?

1. Account enumeration
2. SQL injection
3. ARP spoofing
4. UDP fragmentation

Correct Answer: 1

Explanation

Different responses during password-reset or login processes can reveal whether a particular account exists, resulting in account enumeration. Attackers may use this information to build lists of valid usernames before attempting credential attacks or targeted social engineering. During authorized testing, testers can compare responses without unnecessarily attempting authentication against accounts. Applications can reduce enumeration by using consistent messages and carefully managing response behavior. Monitoring and rate limiting can provide additional protection against automated discovery of valid accounts.

Question 198

Which network security device commonly filters traffic according to defined security rules?

1. Firewall
2. Printer
3. DNS cache
4. Patch manager

Correct Answer: 1

Explanation

A firewall filters network traffic according to configured security policies. Rules may consider source and destination addresses, ports, protocols, interfaces, or other characteristics depending on the firewall type. During a penetration test, firewall behavior can be evaluated to determine whether only intended services are reachable and whether segmentation policies are properly enforced. Overly broad rules can expose unnecessary services, while incorrect restrictions may affect legitimate operations. Firewalls are an important layer of defense but should be combined with secure authentication, endpoint protection, monitoring, and application security controls.

Question 199

Which practice helps ensure that penetration-testing evidence can be traced and trusted?

1. Maintain proper evidence handling and documentation
2. Modify evidence after collection
3. Store evidence on a public website
4. Remove timestamps

Correct Answer: 1

Explanation

Proper evidence handling helps preserve the integrity, context, and traceability of information collected during a penetration test. Testers should document relevant collection details, protect evidence from unauthorized modification, and follow agreed storage and retention procedures. Depending on the engagement, timestamps, hashes, access records, and chain-of-custody information may help demonstrate that evidence was handled appropriately. Evidence should contain only what is necessary to support findings. Poor handling can make technical conclusions harder to verify and may expose sensitive organizational information unnecessarily.

Question 200

What is the main purpose of a penetration test remediation retest?

1. Verify that previously reported vulnerabilities have been corrected
2. Discover the tester’s personal preferences
3. Expand the original scope automatically
4. Remove all security documentation

Correct Answer: 1

Explanation

A remediation retest verifies whether previously reported vulnerabilities have been successfully corrected. The tester reviews the original finding and applies suitable validation methods to determine whether the security condition still exists. Results should clearly indicate whether remediation was effective, partially effective, or unsuccessful. A retest does not automatically expand the original assessment scope or constitute a completely new penetration test. It provides evidence that corrective actions addressed the specific weaknesses identified during the earlier assessment and helps organizations confirm the effectiveness of remediation.