View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.

 

Question 341

A penetration tester is given a target list containing several IP addresses and hostnames. One hostname resolves to an address that is not included in the approved target list. What should the tester do?

1. Test the address because DNS resolution confirms ownership
2. Add the address to the scope without approval
3. Verify authorization before testing the address
4. Ignore the entire target list

Correct Answer: 3

Explanation

DNS resolution does not automatically establish authorization to test an asset. If a hostname resolves to an address outside the documented scope, the tester should verify whether that address is intentionally included before conducting active assessment activities. This is particularly important when organizations use third-party hosting, shared infrastructure, or cloud services. Testing an unauthorized address could affect another organization or violate contractual restrictions. Scope verification ensures that reconnaissance findings are handled appropriately and that testing remains within the rules of engagement.

Question 342

Which document defines the authorized activities, limitations, communication procedures, and responsibilities for a penetration test?

1. Rules of engagement
2. Asset inventory
3. Vulnerability database
4. Network topology

Correct Answer: 1

Explanation

Rules of engagement define how an authorized penetration test is conducted. They can specify targets, permitted techniques, testing windows, prohibited activities, communication contacts, escalation procedures, and conditions requiring testing to stop. This document provides operational boundaries that help testers work safely and consistently. An asset inventory identifies systems, a vulnerability database contains information about known weaknesses, and a network topology describes infrastructure relationships. Rules of engagement are therefore central to maintaining authorization throughout the engagement.

Question 343

A tester is asked to assess a production application but is explicitly prohibited from testing its payment-processing functionality. What does this restriction represent?

1. Scope exclusion
2. Network segmentation
3. Authentication bypass
4. Data retention

Correct Answer: 1

Explanation

A scope exclusion identifies an asset, function, technique, or activity that the penetration tester is specifically not authorized to assess. In this scenario, the payment-processing functionality remains outside the permitted testing boundary even though other parts of the production application may be in scope. Exclusions are documented to protect sensitive systems, reduce operational risk, or satisfy contractual requirements. Network segmentation controls communication, authentication bypass is a security weakness, and data retention governs information handling rather than testing boundaries.

Question 344

A penetration test requires an emergency contact who can immediately authorize changes when unexpected production impact occurs. Which engagement element provides this information?

1. Escalation contact
2. DNS record
3. Vulnerability score
4. Asset hostname

Correct Answer: 1

Explanation

An escalation contact identifies the person or team responsible for handling unexpected issues during an engagement. This contact may be authorized to approve scope changes, pause testing, coordinate incident response, or address production-impact concerns. Having clearly defined escalation procedures helps testers respond quickly when circumstances differ from expectations. DNS records and hostnames identify infrastructure, while vulnerability scores describe technical risk. Emergency contacts are particularly important during production assessments where unexpected service behavior may require immediate coordination.

Question 345

Which reconnaissance source is most useful for identifying publicly issued TLS certificates associated with an organization’s domain?

1. Certificate Transparency logs
2. DHCP leases
3. Local ARP tables
4. Password databases

Correct Answer: 4

Explanation

Certificate Transparency logs provide publicly accessible records of TLS certificates issued by participating certificate authorities. These records can reveal hostnames associated with certificates, including subdomains that may not be prominently advertised. During authorized reconnaissance, testers can use certificate information to identify potential assets and then verify whether those assets fall within scope. DHCP leases and ARP tables provide local network information, while password databases contain authentication data. Certificate Transparency is especially useful for passive external attack-surface discovery.

Question 346

A tester identifies a domain’s authoritative nameserver and wants to determine whether it will provide a full copy of the DNS zone to an unauthorized requester. What should be evaluated?

1. Zone transfer configuration
2. Password expiration
3. Cookie security
4. Wireless encryption

Correct Answer: 1

Explanation

DNS zone transfer configuration determines which systems are permitted to receive replicated DNS zone information. If an authoritative nameserver permits unrestricted transfers, an unauthorized requester may obtain numerous records containing hostnames and infrastructure details. During an authorized assessment, testers can determine whether transfers are restricted to approved secondary nameservers. Password expiration controls account credentials, cookie security protects web sessions, and wireless encryption protects wireless communication. Properly restricting zone transfers reduces unnecessary disclosure of DNS infrastructure information.

Question 347

Which DNS record is commonly used to map an IPv4 address to a hostname?

1. A
2. PTR
3. MX
4. TXT

Correct Answer: 1

Explanation

An A record maps a hostname to an IPv4 address. It is one of the fundamental DNS record types and is frequently examined during reconnaissance to identify systems associated with a domain. PTR records provide reverse DNS mappings from addresses to names, MX records identify mail servers, and TXT records contain text-based information used for several purposes. Understanding DNS record types allows penetration testers to interpret reconnaissance results correctly and identify relationships between domains, hostnames, and network infrastructure.

Question 348

A tester discovers that reverse DNS information provides a hostname suggesting a server is used for development. What should the tester conclude?

1. The hostname is evidence of its current function but should still be verified
2. The server is automatically authorized for testing
3. The hostname proves the server contains sensitive data
4. The hostname guarantees the operating system version

Correct Answer: 1

Explanation

A reverse DNS hostname can provide useful clues about the intended or historical role of a system, but DNS naming should not be treated as definitive evidence. Naming conventions can become outdated, generic, or misleading. The tester should verify the system’s role using appropriate authorized methods and separately confirm that the address is within scope. A hostname does not establish authorization, prove the presence of sensitive information, or identify the operating system version with certainty.

Question 349

Which scanning feature attempts to identify the specific application and version associated with an open network port?

1. Service and version detection
2. Password spraying
3. DNS recursion
4. File hashing

Correct Answer: 1

Explanation

Service and version detection attempts to identify the software and version operating behind an accessible network service. This information can help testers correlate observed services with known vulnerabilities and configuration requirements. Because version identification can sometimes be inferred from banners or responses, results should be validated when accuracy matters. Password spraying targets authentication, DNS recursion concerns name resolution, and file hashing is used to verify file integrity or identify data characteristics. Service identification is commonly performed after discovering open ports.

Question 350

A tester needs to identify scripts or specialized checks supported by a network scanning framework to assess a particular service. Which capability is most relevant?

1. Nmap Scripting Engine
2. Password blocklist
3. Certificate Transparency
4. DNS reverse lookup

Correct Answer: 1

Explanation

The Nmap Scripting Engine, or NSE, extends Nmap with scripts that can perform specialized discovery, enumeration, and security checks. During authorized penetration testing, appropriate NSE scripts can provide additional information about supported services and configurations. Testers should select scripts carefully and consider their potential impact, particularly against production systems. Password blocklists protect account creation, Certificate Transparency supports passive certificate discovery, and DNS reverse lookup maps addresses to hostnames. NSE is therefore useful when standard port and service identification does not provide enough information.

Question 351

A vulnerability scanner has access to host credentials and can inspect installed packages directly instead of inferring versions remotely. What advantage does this provide?

1. Greater visibility into local configuration and software
2. Guaranteed exploitation of every vulnerability
3. Automatic authorization to access unrelated systems
4. Elimination of all false positives

Correct Answer: 3

Explanation

Authenticated vulnerability scanning provides visibility that may not be available through remote network inspection alone. With authorized credentials, a scanner can inspect installed software, configuration settings, patches, and other local information. This can improve the accuracy and completeness of vulnerability identification. Authenticated scanning does not guarantee exploitation, grant authorization to unrelated systems, or eliminate every false positive. Results should still be reviewed and validated where necessary. Credentials used for scanning should also be protected carefully throughout the engagement.

Question 352

Which factor describes whether exploitation requires the target user to perform an action?

1. User interaction
2. Attack vector
3. Privileges required
4. Remediation status

Correct Answer: 1

Explanation

In vulnerability assessment terminology such as CVSS, User Interaction describes whether exploitation requires participation from another user. Some vulnerabilities can be exploited without any user involvement, while others require a victim to open a document, visit a page, or perform another action. Attack Vector describes how the vulnerable component is reached, while Privileges Required describes the permissions needed before exploitation. Remediation status is not a CVSS metric. Understanding these factors helps testers communicate vulnerability characteristics accurately.

Question 353

A vulnerability can be exploited remotely over the Internet without requiring prior authentication. Which characteristics are especially relevant when describing its technical exposure?

1. Network reachability and privileges required
2. Screen resolution and browser theme
3. DNS TTL and file size
4. CPU temperature and disk capacity

Correct Answer: 1

Explanation

When describing a vulnerability’s technical exposure, testers should consider how the vulnerable system can be reached and what privileges are required before exploitation. A vulnerability reachable remotely over a network without prior privileges presents a different exposure profile from one requiring local access and authenticated permissions. These characteristics can contribute to standardized severity assessments such as CVSS. Screen settings, DNS TTL values, file sizes, CPU temperature, and disk capacity do not directly describe the vulnerability’s attack requirements.

Question 354

A tester discovers that an application uses the same session identifier before and after authentication. Which security issue should be investigated?

1. Session fixation
2. DNS poisoning
3. VLAN hopping
4. Password spraying

Correct Answer: 1

Explanation

Session fixation occurs when an attacker can cause a victim to use a session identifier that the attacker already knows or can predict, and the application fails to issue a new session identifier after authentication. Regenerating session identifiers when privilege or authentication state changes helps prevent this class of weakness. DNS poisoning manipulates name resolution, VLAN hopping attempts to cross network segmentation boundaries, and password spraying targets multiple accounts. During authorized web testing, session lifecycle behavior should be reviewed around login and privilege transitions.

Question 355

Which cookie attribute helps restrict a cookie from being sent with certain cross-site requests?

1. SameSite
2. Secure
3. HttpOnly
4. Domain

Correct Answer: 1

Explanation

The SameSite cookie attribute controls when browsers send cookies in cross-site contexts. Appropriate SameSite settings can reduce certain cross-site request risks and complement other application-level protections. The Secure attribute limits cookie transmission to HTTPS connections, HttpOnly restricts access from client-side scripts, and Domain controls which hosts can receive the cookie. During a penetration test, testers should examine cookie settings in the context of the application’s authentication and cross-origin requirements rather than assuming that one attribute alone provides complete session security.

Question 356

A web application permits a user to modify another customer’s profile by changing an identifier in a request. Which control should the application enforce?

1. Object-level authorization
2. DNSSEC validation
3. Network time synchronization
4. Wireless encryption

Correct Answer: 2

Explanation

Object-level authorization ensures that an authenticated user is permitted to access or modify the specific resource referenced by a request. Authentication alone is insufficient because a valid user may still attempt to access another user’s object. During an authorized assessment, testers can evaluate whether the server checks ownership or appropriate permissions for each requested resource. DNSSEC protects DNS integrity, time synchronization supports reliable system clocks, and wireless encryption protects wireless communication. Proper object-level authorization is essential for preventing unauthorized cross-account access.

Question 357

Which application weakness occurs when a user can access a privileged endpoint simply by knowing its URL, without the server checking authorization?

1. Broken function-level authorization
2. DNS enumeration
3. Certificate expiration
4. Network address translation

Correct Answer: 1

Explanation

Broken function-level authorization occurs when an application fails to enforce permissions for specific functions or endpoints. A user may be authenticated but still lack the authority to perform administrative operations. If simply knowing or guessing an administrative URL provides access, the server is not adequately enforcing authorization. DNS enumeration gathers domain information, certificate expiration concerns TLS lifecycle management, and NAT translates network addresses. During authorized testing, privileged endpoints should be assessed using accounts with different permission levels to verify proper server-side enforcement.

Question 358

A tester observes that a login endpoint continues accepting unlimited authentication attempts from the same client. Which control should be reviewed?

1. Rate limiting and account protection
2. DNS zone transfers
3. Certificate pinning
4. VLAN tagging

Correct Answer: 1

Explanation

Rate limiting and account-protection controls can restrict repeated authentication attempts and reduce the effectiveness of automated password guessing. Depending on the application, protections may include request throttling, temporary account restrictions, risk-based challenges, monitoring, or other mechanisms. During an authorized assessment, testers should evaluate these controls within the defined testing limits to avoid unnecessary account disruption. DNS zone transfers, certificate pinning, and VLAN tagging address different security areas and do not directly control repeated authentication requests.

Question 359

Which reconnaissance technique can use publicly available employee information to identify potential organizational email-address patterns?

1. OSINT
2. Port knocking
3. Packet fragmentation
4. VLAN hopping

Correct Answer: 3

Explanation

Open-source intelligence, or OSINT, involves collecting and analyzing publicly available information from sources such as websites, public documents, professional profiles, and other accessible records. During authorized reconnaissance, this information can help identify organizational naming conventions or publicly exposed contact patterns. Testers should avoid unnecessary collection of personal information and remain within the engagement’s privacy and data-handling requirements. Port knocking, packet fragmentation, and VLAN hopping are technical network concepts rather than broad passive intelligence-gathering methods.

Question 360

A penetration tester finds a security issue but cannot reproduce it after manually reviewing the affected system. What should happen before the issue is presented as a confirmed finding?

1. Validate the evidence and investigate whether it is a false positive
2. Automatically assign critical severity
3. Publish the scanner output unchanged
4. Remove the affected system from the report without review

Correct Answer: 1

Explanation

A finding that cannot be reproduced or supported by evidence should be investigated before being presented as confirmed. The tester should review scanner output, system configuration, affected versions, and other available evidence to determine whether the issue is valid or represents a false positive. Reporting unverified findings can reduce confidence in the assessment and lead to unnecessary remediation work. Automatically assigning a critical severity or publishing raw scanner results does not establish validity. Evidence-based validation improves the accuracy and usefulness of the final report.