View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.

 

Question 361

Which technique can help identify email addresses, employee names, and organizational information from publicly available sources?

1. Port scanning
2. OSINT
3. SQL injection
4. Packet capture

Correct Answer: 2

Explanation

Open-source intelligence, or OSINT, involves collecting and analyzing information that is publicly available. During an authorized penetration test, OSINT may reveal employee names, business relationships, email-address patterns, public documents, technology references, and other information useful for understanding an organization’s external exposure. Unlike active scanning, OSINT can often be performed without directly interacting with target systems. Port scanning and SQL injection are active technical activities, while packet capture examines network traffic. Testers should still follow privacy and data-minimization requirements when collecting publicly available information.

Question 362

A tester discovers an IP range associated with the target organization through routing information. Which identifier can help determine the organization responsible for announcing that range?

1. MX
2. PTR
3. CNAME
4. ASN

Correct Answer: 4

Explanation

An Autonomous System Number, or ASN, identifies an autonomous system participating in Internet routing. During authorized reconnaissance, ASN information can help testers understand which network ranges are associated with an organization or service provider. This can provide additional context for identifying publicly exposed infrastructure, although ownership and authorization should always be verified before testing discovered addresses. MX records identify mail servers, PTR records support reverse DNS, and CNAME records provide DNS aliases. ASN reconnaissance is particularly useful when mapping an organization’s broader Internet presence.

Question 363

Which DNS record can be used to identify the hostname associated with an IP address during reverse DNS reconnaissance?

1. PTR
2. MX
3. TXT
4. CNAME

Correct Answer: 1

Explanation

A PTR record provides reverse DNS information by associating an IP address with a hostname. During authorized reconnaissance, PTR records can reveal naming conventions and provide clues about the function of networked systems. The information should not be considered definitive because records can be outdated, generic, or intentionally configured with limited descriptive value. MX records identify mail servers, TXT records store textual information, and CNAME records provide aliases between DNS names. Reverse DNS is therefore useful for supplementing other asset-discovery methods.

Question 364

A penetration tester receives an automated scan showing that an application has a vulnerable library, but the application vendor has backported the relevant security patch. What should the tester document?

1. The application should immediately be removed
2. The scanner output should be reported without review
3. The finding should be verified against vendor patch information
4. The vulnerability should automatically be rated critical

Correct Answer: 3

Explanation

Software vendors sometimes backport security fixes into older package versions without changing the apparent version number in the way a scanner expects. Consequently, automated vulnerability detection can produce false positives. The tester should compare the installed package information with the vendor’s security advisory or patch documentation and determine whether the relevant fix is actually present. Reporting an unverified vulnerability can create unnecessary remediation work and reduce trust in the assessment. Manual validation is especially important when package-version detection is involved.

Question 365

Which vulnerability scoring factor describes how difficult exploitation is because of conditions outside the attacker’s direct control?

1. User Interaction
2. Attack Complexity
3. Privileges Required
4. Attack Vector

Correct Answer: 2

Explanation

Attack Complexity describes conditions that must exist for successful exploitation and that are generally beyond the attacker’s direct control. Examples can include specific race conditions, uncommon system states, or other environmental requirements. User Interaction measures whether another person must participate, Privileges Required describes the permissions needed before exploitation, and Attack Vector addresses how the vulnerable component can be reached. Understanding these distinctions helps penetration testers communicate standardized vulnerability characteristics accurately and avoid confusing different elements of a risk assessment.

Question 366

A tester discovers a vulnerability that can be exploited only after a legitimate user clicks a specially crafted link. Which characteristic should be considered?

1. Scope
2. Availability
3. Attack Vector
4. User Interaction

Correct Answer: 4

Explanation

User Interaction describes whether exploitation requires an action from another user. If a victim must click a link, open a document, or otherwise participate before the vulnerability can be triggered, user interaction is involved. This characteristic is distinct from Attack Vector, which describes how the vulnerable component is reached, and from Scope and Availability, which represent other aspects of vulnerability impact and assessment. Correctly identifying the requirement helps testers communicate how an attack scenario depends on user behavior.

Question 367

Which vulnerability can result when a web application uses a predictable session identifier that an attacker can determine before a victim authenticates?

1. SQL injection
2. SSRF
3. Session fixation
4. DNS poisoning

Correct Answer: 3

Explanation

Session fixation occurs when an attacker can influence or obtain a session identifier that remains associated with a victim after authentication. If the application does not regenerate the session identifier when authentication status changes, the attacker may potentially reuse the known identifier. Proper session management should generate unpredictable identifiers and invalidate or rotate them appropriately during authentication transitions. SQL injection targets database queries, SSRF causes server-side requests based on controlled input, and DNS poisoning manipulates name resolution.

Question 368

A tester reviews a web application and finds that a cookie containing a session identifier can be accessed through client-side JavaScript. Which cookie attribute could reduce this exposure?

1. HttpOnly
2. Domain
3. Secure
4. SameSite

Correct Answer: 1

Explanation

The HttpOnly attribute prevents ordinary client-side scripts from directly reading a cookie. Applying it to session cookies can reduce the potential impact of some cross-site scripting scenarios because injected JavaScript cannot simply access the session cookie through standard browser APIs. SameSite controls cross-site cookie behavior, Secure restricts transmission to HTTPS, and Domain controls the hosts to which a cookie applies. HttpOnly does not prevent XSS itself, so it should be considered one layer of a broader session-security strategy.

Question 369

Which control ensures that an authenticated user cannot modify another user’s account information by changing an object identifier?

1. DNSSEC
2. Object-level authorization
3. Network time synchronization
4. Wireless encryption

Correct Answer: 2

Explanation

Object-level authorization verifies that the authenticated user has permission to access or modify the specific object referenced by a request. Without this check, an application may authenticate the user correctly while still allowing unauthorized access to another user’s resources. During an authorized assessment, testers can compare access behavior between accounts with different permissions. DNSSEC protects DNS integrity, time synchronization supports consistent system clocks, and wireless encryption protects wireless communication. Object-level authorization is a core control against IDOR-style access-control weaknesses.

Question 370

A tester notices that an API automatically accepts client-supplied fields and updates internal account properties that should be controlled only by administrators. Which issue is most relevant?

1. Open redirect
2. DNS tunneling
3. Clickjacking
4. Mass assignment

Correct Answer: 4

Explanation

Mass assignment occurs when an application automatically maps user-supplied fields to internal object properties without restricting which attributes can be modified. This can become a security issue when sensitive properties, such as account roles or authorization-related settings, are exposed through the same mechanism as ordinary user-controlled fields. During authorized API testing, testers should determine which fields are intended to be writable and whether server-side allowlists are enforced. Open redirects, DNS tunneling, and clickjacking are separate security concerns.

Question 371

Which API security issue involves returning sensitive properties that the requesting client does not require?

1. VLAN hopping
2. NTP spoofing
3. Excessive data exposure
4. Certificate expiration

Correct Answer: 3

Explanation

Excessive data exposure occurs when an API response contains more information than is necessary for the requesting client or user. Sensitive fields may be unintentionally revealed even if the application’s visible interface does not display them. During an authorized assessment, testers should review API responses and compare returned fields with the application’s intended functionality and authorization model. VLAN hopping concerns network segmentation, NTP spoofing affects time-related communications, and certificate expiration concerns TLS certificate lifecycle. Limiting API responses to necessary information reduces unnecessary exposure.

Question 372

A tester finds that an API accepts a valid token even when the token was issued for a different service. Which token validation property should be checked?

1. Audience
2. Subject length
3. DNS TTL
4. HTTP compression

Correct Answer: 1

Explanation

The audience claim identifies the intended recipient or service for a token. APIs should validate that the token’s audience corresponds to the service receiving it. If this validation is absent, a token legitimately issued for one service might be incorrectly accepted by another service. During authorized testing, testers can review audience, issuer, signature, expiration, and other relevant claims. Subject length, DNS TTL, and HTTP compression do not determine whether an authentication token was intended for the receiving application.

Question 373

Which mobile application weakness occurs when sensitive credentials or tokens are stored in plaintext on the device?

1. VLAN hopping
2. Insecure local storage
3. DNS poisoning
4. Open redirect

Correct Answer: 2

Explanation

Insecure local storage occurs when sensitive information such as credentials, authentication tokens, or private user data is stored without appropriate protection on a mobile device. If another process, malicious application, backup mechanism, or compromised device environment can access that information, the application’s security can be weakened. During an authorized mobile assessment, testers should examine how sensitive data is stored and whether platform-supported secure storage mechanisms are used. VLAN hopping, DNS poisoning, and open redirects address different network or web application concerns.

Question 374

A mobile application uses certificate pinning. What security property is this control primarily intended to strengthen?

1. Password complexity
2. DNS record availability
3. File compression
4. Server identity verification

Correct Answer: 4

Explanation

Certificate pinning strengthens server identity verification by requiring an application to recognize a particular certificate or public-key identity in addition to ordinary platform trust mechanisms. This can reduce exposure to certain certificate-authority or interception scenarios. During an authorized mobile assessment, testers should review whether pinning is implemented correctly and whether the application’s certificate-rotation process is secure. Password complexity, DNS availability, and file compression are unrelated to the primary purpose of certificate pinning.

Question 375

Which cloud security weakness exists when a workload identity has permissions to modify resources that it does not need for its normal function?

1. Excessive permissions
2. DNS poisoning
3. Session fixation
4. Wireless deauthentication

Correct Answer: 1

Explanation

Excessive permissions occur when an identity, service account, or workload receives more access than necessary for its intended function. This violates least-privilege principles and can increase the potential impact if the identity or application is compromised. During an authorized cloud assessment, testers should compare assigned permissions with documented business requirements and identify unnecessary access. DNS poisoning affects name resolution, session fixation affects web authentication, and wireless deauthentication affects wireless connectivity. Reducing unnecessary permissions limits potential unauthorized actions.

Question 376

A container is configured with unnecessary host filesystem access. Which risk does this configuration create?

1. Stronger password hashing
2. Improved DNS integrity
3. Weakened container isolation
4. Reduced network latency

Correct Answer: 3

Explanation

Containers rely on isolation mechanisms to separate workloads from the underlying host and from one another. Unnecessary host filesystem access can weaken that separation and increase the potential consequences of a compromised container. During an authorized assessment, testers should review host mounts, runtime permissions, capabilities, and other configuration settings to determine whether access is required. Password hashing, DNS integrity, and network latency are unrelated to the security implications of excessive host filesystem access. Limiting container privileges helps maintain a stronger security boundary.

Question 377

Which wireless attack attempts to impersonate a legitimate wireless network so that users connect to a fraudulent access point?

1. VLAN hopping
2. Evil twin
3. Credential stuffing
4. DNS tunneling

Correct Answer: 2

Explanation

An evil twin is a fraudulent wireless access point designed to imitate a legitimate network. If users connect to the rogue network, an attacker may attempt to observe or manipulate traffic depending on the surrounding security controls. During an authorized wireless assessment, testers can evaluate whether users and devices properly validate network identity and whether enterprise authentication protections are implemented. VLAN hopping concerns wired network segmentation, credential stuffing targets reused credentials, and DNS tunneling uses DNS communications for data transfer.

Question 378

A penetration tester wants to determine whether a firewall correctly blocks traffic from an unauthorized network segment to an administrative server. Which activity is most appropriate?

1. Password hash recovery
2. Certificate enumeration
3. Web archive analysis
4. Controlled network access testing

Correct Answer: 4

Explanation

Controlled network access testing verifies whether documented firewall or network access rules are actually enforced. A tester can assess permitted and denied communication paths using approved source networks and target services while following the engagement’s testing boundaries. This helps identify overly permissive rules or unexpected paths to administrative infrastructure. Password hash recovery examines credentials, certificate enumeration supports reconnaissance, and web archive analysis reviews historical public content. Network access testing should be carefully planned when production systems or sensitive management services are involved.

Question 379

Which technique can help a tester identify weak passwords that are variations of common words by combining dictionary entries with predictable modifications?

1. Hybrid password attack
2. DNS enumeration
3. Port scanning
4. Session fixation

Correct Answer: 1

Explanation

A hybrid password attack combines dictionary words with predictable modifications such as numbers, symbols, or common substitutions. This approach can be useful during authorized password auditing because users frequently modify familiar words rather than creating fully random passwords. Testers should apply appropriate rate limits and organizational rules when assessing live authentication systems and should prefer offline analysis where possible. DNS enumeration identifies infrastructure, port scanning discovers network services, and session fixation concerns authentication session handling rather than password composition.

Question 380

A client asks for a penetration-testing report that allows technical administrators to reproduce findings and understand exactly how each issue should be corrected. Which content is most important?

1. Only the tester’s personal opinions
2. A list of company employees
3. Technical details, evidence, affected assets, impact, and remediation guidance
4. Unfiltered confidential data collected during testing

Correct Answer: 3

Explanation

A useful technical penetration-testing report should provide enough information for authorized administrators to understand, validate, and remediate each finding. Relevant content can include the affected asset, vulnerability description, technical evidence, impact, severity or risk context, and practical remediation guidance. Reports should avoid unnecessary disclosure of sensitive information and should distinguish confirmed findings from unverified observations. Personal opinions, employee lists, or unfiltered confidential data do not provide appropriate remediation value and can introduce unnecessary privacy and security risks.