View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.

 

Question 221

Which reconnaissance technique is most useful for identifying the organization that owns a registered IP address or network range?

1. DNS zone transfer
2. WHOIS or RDAP lookup
3. Password spraying
4. Web application fuzzing

Correct Answer: 2

Explanation

WHOIS and RDAP lookups provide registration and ownership information associated with domains, IP addresses, and autonomous systems. During an authorized penetration test, this information can help identify the organization responsible for infrastructure that may fall within the assessment scope. RDAP is the modern replacement for many traditional WHOIS services and provides structured registration data. DNS zone transfers serve a different purpose by attempting to retrieve DNS zone information. Password spraying and fuzzing are active testing techniques and are not appropriate for basic ownership reconnaissance.

Question 222

A penetration tester discovers a certificate containing a hostname that is not listed on the company’s public website. Which technique could help identify additional subdomains from publicly issued certificates?

1. Certificate transparency searching
2. Password hash cracking
3. ARP inspection
4. VLAN hopping

Correct Answer: 1

Explanation

Certificate Transparency logs record publicly issued TLS certificates and can reveal hostnames included in certificate records. Searching these logs can help authorized testers discover subdomains that may not appear in ordinary website navigation or search results. This technique is particularly useful during passive reconnaissance because the tester can gather information without directly interacting with the target systems. The discovered names should still be verified against the engagement scope before any active testing is performed.

Question 223

Which DNS record type maps a hostname to an IPv6 address?

1. MX
2. PTR
3. AAAA
4. TXT

Correct Answer: 3

Explanation

An AAAA record maps a hostname to an IPv6 address. It is the IPv6 counterpart of the A record, which maps a hostname to an IPv4 address. MX records identify mail servers, PTR records support reverse DNS lookups, and TXT records can contain various forms of textual information such as verification or email-security data. Recognizing DNS record types is important during reconnaissance because they can reveal infrastructure, services, and relationships between hostnames and network addresses.

Question 224

During a DNS assessment, a tester is authorized to determine whether a nameserver accidentally exposes an entire DNS zone. Which mechanism should be checked?

1. DNSSEC signing
2. DNS zone transfer
3. DHCP reservation
4. HTTP redirection

Correct Answer: 2

Explanation

A DNS zone transfer is a mechanism used to replicate DNS zone information between authoritative nameservers. When improperly configured, a server may allow unauthorized parties to request a complete copy of the zone. During an authorized assessment, checking whether zone transfers are overly permissive can reveal hostnames and infrastructure details that should not be broadly exposed. DNSSEC protects DNS integrity, DHCP reservations concern address assignment, and HTTP redirection operates at the web layer rather than providing DNS zone replication.

Question 225

A security team wants a vulnerability scan that can use authenticated credentials to inspect installed software and configuration settings on a Windows host. Which scanning approach is most appropriate?

1. Authenticated scanning
2. Passive packet capture
3. DNS enumeration
4. Unauthenticated banner grabbing

Correct Answer: 1

Explanation

Authenticated scanning allows a vulnerability scanner to log in to a target system using authorized credentials and inspect information that cannot reliably be identified from the network alone. On Windows systems, this can include installed software, patches, configuration settings, and security controls. Compared with unauthenticated scanning, authenticated assessments can provide deeper visibility and often reduce uncertainty around vulnerabilities. Passive packet capture and DNS enumeration gather different types of information, while banner grabbing generally provides only limited service-level details.

Question 226

A tester wants to identify TCP services while minimizing the amount of connection establishment performed against each port. Which scan type is commonly associated with this goal?

1. TCP connect scan
2. TCP SYN scan
3. UDP scan
4. ICMP echo scan

Correct Answer: 2

Explanation

A TCP SYN scan sends SYN packets to determine how TCP ports respond without completing a normal TCP connection when the scanner receives the expected response. This can provide efficient port discovery while generating less connection-level activity than a full TCP connect scan. A TCP connect scan completes the connection through the operating system’s normal networking stack. UDP scanning targets UDP services, while ICMP echo scanning is primarily used for host discovery rather than identifying TCP service ports.

Question 227

A vulnerability scanner reports a package as outdated, but the organization states that a vendor backport contains the required security fix. What should the tester do before reporting the finding as confirmed?

1. Immediately classify it as critical
2. Delete the scanner result
3. Manually verify the installed package and vendor patch information
4. Begin privilege escalation testing

Correct Answer: 3

Explanation

Automated scanners can incorrectly flag software when vendors backport security fixes into older package versions. The tester should manually verify the installed package version, vendor advisory, and applicable patch information before treating the result as a confirmed vulnerability. This prevents false positives from entering the final report and ensures that remediation recommendations are accurate. Simply deleting the scanner result removes potentially useful evidence, while assigning a critical rating or moving to privilege escalation without validation would be premature.

Question 228

Which tool is commonly used to discover subdomains and perform broader DNS reconnaissance during an authorized penetration test?

1. Amass
2. John the Ripper
3. tcpdump
4. Wireshark

Correct Answer: 1

Explanation

Amass is widely used for attack-surface discovery and DNS reconnaissance, including identifying relationships between domains, subdomains, and related infrastructure. It can combine multiple sources of information to build a broader picture of an organization’s externally visible assets. John the Ripper is primarily associated with password-hash auditing, while tcpdump and Wireshark focus on capturing or analyzing network traffic. Using reconnaissance tools within the defined engagement scope can help testers identify assets that might otherwise be overlooked.

Question 229

An API accepts a JSON Web Token (JWT) for authentication. Which security concern should a tester specifically investigate when reviewing token-based authorization?

1. Whether users can alter authorization claims without valid server-side verification
2. Whether the API uses DNS MX records
3. Whether the server has an unused SMTP banner
4. Whether the application supports HTTP compression

Correct Answer: 1

Explanation

JWT-based authentication requires the server to correctly validate the token’s integrity, claims, expiration, and intended use. A serious authorization weakness can occur if an application trusts modified claims without properly verifying the token’s signature and relevant security controls. Testers should assess this behavior only within the authorized API scope. MX records, SMTP banners, and HTTP compression address unrelated infrastructure or application characteristics. Proper JWT validation helps ensure that authentication data cannot simply be altered to obtain privileges that were not legitimately assigned.

Question 230

A web application allows users to upload profile images. The tester notices that the server appears to trust the filename extension supplied by the client. Which vulnerability class should receive further investigation?

1. Open redirect
2. Unrestricted file upload
3. Clickjacking
4. DNS poisoning

Correct Answer: 2

Explanation

Unrestricted or improperly validated file uploads occur when an application accepts files without adequately checking their type, content, size, or intended storage and execution behavior. Trusting only a client-supplied filename extension can be a warning sign because extensions can be manipulated. During an authorized assessment, the tester should determine whether server-side validation and safe storage controls are effective. Open redirects involve URL handling, clickjacking concerns interface framing, and DNS poisoning affects name resolution rather than application file-upload functionality.

Question 231

Which technique is primarily intended to identify whether a web application incorrectly trusts requests originating from another website while a user is authenticated?

1. CSRF testing
2. DNS reconnaissance
3. Port scanning
4. Password auditing

Correct Answer: 1

Explanation

Cross-Site Request Forgery, or CSRF, occurs when an application accepts an unwanted state-changing request because it relies on a user’s existing authenticated session without sufficiently verifying that the request was intentionally generated by the application. Authorized testers can assess whether appropriate anti-CSRF controls are present, such as suitable request tokens and origin validation where applicable. DNS reconnaissance, port scanning, and password auditing address different security areas and do not directly evaluate whether authenticated browser requests can be forged from another site.

Question 232

A company asks a penetration tester to evaluate an internal application, but the application is hosted by an external cloud provider. What should the tester verify before testing the provider-hosted system?

1. The tester’s preferred scanning tool
2. Authorization covering the relevant third-party infrastructure
3. The application’s logo
4. The number of employees at the provider

Correct Answer: 2

Explanation

Third-party hosted infrastructure introduces additional authorization requirements. The tester should verify that the engagement permits testing the relevant provider-hosted assets and that any required cloud-provider or third-party approvals have been obtained. Authorization from the client alone may not always grant permission to test infrastructure owned or operated by another organization. Confirming these boundaries before testing reduces legal and operational risk and ensures that activities remain within the documented rules of engagement.

Question 233

Which wireless attack involves transmitting frames intended to disconnect clients from a wireless access point?

1. Evil twin
2. Wireless deauthentication
3. DNS poisoning
4. Credential stuffing

Correct Answer: 2

Explanation

Wireless deauthentication involves transmitting specially crafted management frames that can cause compatible wireless clients to disconnect from an access point. In an authorized assessment, this technique may be used to evaluate wireless resilience and security controls, but it can disrupt legitimate connectivity and therefore requires explicit authorization and carefully defined limits. An evil twin is a fraudulent access point designed to impersonate a legitimate wireless network. DNS poisoning affects name resolution, while credential stuffing involves reused credentials rather than wireless management traffic.

Question 234

Which attack technique abuses local name-resolution protocols such as LLMNR or NBT-NS to obtain authentication-related information from nearby systems?

1. LLMNR/NBT-NS poisoning
2. SQL injection
3. Directory traversal
4. Open redirect

Correct Answer: 1

Explanation

LLMNR and NBT-NS are local name-resolution mechanisms that can be abused when systems trust responses from unauthorized sources. In certain environments, poisoning these protocols can cause systems to communicate with an attacker-controlled host and potentially expose authentication-related information. During authorized testing, security professionals assess whether these protocols are unnecessarily enabled and whether protective controls are implemented. SQL injection targets application database queries, directory traversal targets file-path handling, and open redirects manipulate application-controlled URL redirection.

Question 235

A tester discovers that several internal systems accept authentication through NTLM. Which assessment area is especially relevant when determining whether authentication can be improperly relayed between services?

1. NTLM relay exposure
2. DNS record expiration
3. HTTP caching
4. Password dictionary creation

Correct Answer: 1

Explanation

NTLM relay exposure concerns whether captured or coerced authentication exchanges can be improperly forwarded to another service for authentication. A secure environment should use protections that limit relay opportunities, such as appropriate signing and channel-binding controls where supported. During an authorized penetration test, the tester can assess whether these protections are consistently enforced. DNS expiration and HTTP caching address different infrastructure behaviors, while dictionary creation concerns password auditing rather than the relay of authentication protocols.

Question 236

Which Kerberos-focused technique attempts to identify service accounts whose tickets may be susceptible to offline password analysis?

1. Kerberoasting
2. VLAN hopping
3. ARP inspection
4. Session fixation

Correct Answer: 1

Explanation

Kerberoasting is an attack technique involving Kerberos service tickets associated with accounts that have service principal names. In an authorized assessment, testers may evaluate whether service accounts use strong passwords and appropriate configurations because ticket material can potentially be subjected to offline password analysis. The technique differs from pass-the-ticket attacks, which involve the reuse of Kerberos tickets. VLAN hopping targets network segmentation, ARP inspection concerns local network protection, and session fixation is a web application session-management issue.

Question 237

A network uses separate VLANs for users and servers, but a tester discovers that traffic can unexpectedly cross those boundaries through switch configuration weaknesses. What security issue should be investigated?

1. VLAN hopping
2. Certificate transparency
3. Password spraying
4. File inclusion

Correct Answer: 1

Explanation

VLAN hopping occurs when network segmentation implemented through VLANs can be bypassed, potentially allowing traffic to reach networks that should be isolated. Misconfigured switch ports, trunking behavior, or related configuration weaknesses can contribute to this exposure. During an authorized assessment, testers examine whether VLAN boundaries actually provide the intended separation. Certificate transparency is a passive reconnaissance technique, password spraying targets authentication, and file inclusion affects application file handling. Proper switch configuration is essential when VLANs are relied upon as a security boundary.

Question 238

Which report section is primarily intended to communicate major business risks, overall findings, and priorities to nontechnical decision-makers?

1. Packet capture appendix
2. Executive summary
3. Exploit development notes
4. Raw scanner output

Correct Answer: 2

Explanation

An executive summary presents the assessment’s major findings, overall risk themes, and significant business implications in language suitable for leadership and other nontechnical stakeholders. It should provide enough context for decision-makers to understand what requires attention without overwhelming them with implementation-level details. Technical findings, evidence, scanner output, and detailed testing methodology can appear elsewhere in the report. A strong executive summary connects security observations with organizational impact and helps stakeholders understand where remediation efforts may need to be prioritized.

Question 239

A tester must preserve screenshots, logs, and other evidence so that another reviewer can determine when and how each item was collected. Which practice best supports this requirement?

1. Evidence chain of custody
2. Password spraying
3. DNS enumeration
4. Session fixation

Correct Answer: 1

Explanation

A chain of custody records how evidence was collected, handled, transferred, and stored so its history can be reviewed. In penetration testing, maintaining this information helps demonstrate that screenshots, logs, files, and other artifacts have not been improperly altered or mishandled. Evidence should also be protected from unauthorized access because it may contain sensitive information. Password spraying and DNS enumeration are testing activities, while session fixation is an application security issue and does not provide a method for preserving assessment evidence.

Question 240

After completing an authorized penetration test, the tester discovers several customer records in temporary assessment files. What is the most appropriate action?

1. Keep the records indefinitely for future testing
2. Share the records with unrelated testers
3. Apply the engagement’s secure data-retention and disposal requirements
4. Publish the records as evidence of the finding

Correct Answer: 3

Explanation

Penetration testing can expose sensitive information that must be handled according to the engagement’s data-handling requirements. Once customer records are no longer necessary for a documented testing or reporting purpose, they should be securely retained only for the required period and then disposed of according to the agreed process. Keeping unnecessary data indefinitely increases exposure risk. Sharing or publishing customer information is inappropriate unless specifically authorized and legally permitted. Data minimization and secure disposal help protect affected individuals and the organization after testing concludes.