View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.

 

Question 261

Before an authorized penetration test begins, the client specifies that testing may occur only between 11:00 PM and 4:00 AM. What part of the engagement documentation defines this restriction?

1. Testing window
2. Asset inventory
3. Risk register
4. Executive summary

Correct Answer: 1

Explanation

A testing window defines the approved period during which penetration-testing activities may be performed. Organizations commonly establish testing windows to reduce the possibility of disrupting business operations, especially when intrusive activities could affect production systems. The penetration tester should follow the documented window and obtain approval before conducting activities outside it. An asset inventory identifies systems and resources, a risk register records risks, and an executive summary communicates major findings. Following the testing window is an important part of maintaining authorization throughout the engagement.

Question 262

A penetration tester receives a list of approved source IP addresses from the client. Why is this information important?

1. It determines which tester traffic is authorized
2. It identifies the client’s password policy
3. It determines the application’s programming language
4. It replaces the rules of engagement

Correct Answer: 1

Explanation

Approved source IP addresses can define where authorized testing traffic is expected to originate. This is especially important when the client has security monitoring, access-control lists, or allowlists that distinguish approved testing activity from unauthorized traffic. Using the designated addresses can also help defenders recognize and correlate penetration-testing events. Source IP information does not determine application technology or password policies, and it does not replace the broader rules of engagement. It is one operational detail that helps ensure testing remains controlled and attributable.

Question 263

Which reconnaissance technique uses public registration databases to gather information about a domain’s registrar, registration status, or related administrative details?

1. WHOIS lookup
2. Packet capture
3. Port knocking
4. Credential stuffing

Correct Answer: 1

Explanation

WHOIS is a traditional mechanism for querying domain registration information. Depending on the registry and privacy protections, results may include registrar information, registration dates, nameservers, and other domain-related details. Modern registration data is increasingly accessed through RDAP, which provides structured responses. During authorized reconnaissance, this information can help establish ownership and identify infrastructure relationships before active testing begins. Packet capture, port knocking, and credential stuffing address different areas and are not primarily intended for gathering public domain registration information.

Question 264

A tester discovers an externally accessible DNS server that responds to recursive queries from arbitrary Internet hosts. What configuration should be reviewed first?

1. Recursive resolver access restrictions
2. Password expiration settings
3. HTTP cookie attributes
4. File compression settings

Correct Answer: 1

Explanation

A DNS resolver that permits arbitrary external hosts to perform recursive queries may be functioning as an open resolver. Such configurations can create security and operational concerns, including possible abuse in reflection or amplification activity. During an authorized assessment, the tester should determine whether recursion is required and whether access is restricted to appropriate networks or clients. Password expiration, HTTP cookie attributes, and file compression do not directly control DNS recursion. Proper resolver configuration helps limit unnecessary exposure and prevents services from being misused.

Question 265

Which DNS record is primarily used to identify the mail servers responsible for accepting email for a domain?

1. TXT
2. PTR
3. MX
4. CNAME

Correct Answer: 3

Explanation

An MX, or Mail Exchange, record identifies the mail servers responsible for receiving email for a domain. During reconnaissance, reviewing MX records can reveal external mail infrastructure and provide clues about third-party email services or organizational architecture. TXT records can contain information such as SPF-related data, CNAME records create aliases to other DNS names, and PTR records are used for reverse DNS. Understanding these record types helps testers interpret DNS information accurately without confusing mail infrastructure with other forms of domain records.

Question 266

A tester wants to determine whether a web server exposes information about its software version through HTTP responses. Which approach is most appropriate?

1. Review response headers and server banners
2. Attempt VLAN hopping
3. Capture wireless deauthentication frames
4. Perform password spraying

Correct Answer: 1

Explanation

HTTP response headers and server banners can disclose information about the software or framework handling web requests. Although such information may sometimes be intentionally provided, excessive version disclosure can assist attackers in identifying potentially relevant vulnerabilities. During an authorized assessment, testers can document the information exposed and determine whether disclosure is necessary for normal operation. VLAN hopping concerns network segmentation, wireless deauthentication affects wireless clients, and password spraying targets authentication. Banner information should be treated as reconnaissance evidence and verified where possible.

Question 267

An organization wants to reduce the likelihood that a compromised workstation can directly communicate with sensitive database servers. Which architecture provides this protection?

1. Network segmentation
2. Password expiration
3. Certificate pinning
4. Data compression

Correct Answer: 1

Explanation

Network segmentation separates systems or services into distinct security zones and limits communication between them. Proper segmentation can reduce lateral movement opportunities by preventing compromised endpoints from directly reaching sensitive infrastructure. Controls such as firewalls, ACLs, and security groups can enforce these boundaries. Password expiration and certificate pinning address authentication or trust mechanisms, while data compression affects data transfer efficiency. During a penetration test, the tester can verify whether documented segmentation rules actually prevent unauthorized communication between network zones.

Question 268

A tester discovers that an application returns detailed stack traces containing database connection information whenever an unexpected error occurs. What type of weakness is this?

1. Information disclosure
2. VLAN hopping
3. Password spraying
4. DNS tunneling

Correct Answer: 1

Explanation

Detailed error messages can expose internal implementation information such as database connection details, file paths, software components, or configuration values. This is commonly classified as information disclosure. Although an error message may not directly provide unauthorized access, the exposed information can assist further reconnaissance and vulnerability analysis. Authorized testers should document what sensitive details are revealed and recommend appropriate error handling that provides useful information to legitimate users without exposing internal implementation data. VLAN hopping, password spraying, and DNS tunneling involve different security mechanisms.

Question 269

Which technique is designed to identify web application parameters that are not obvious from normal application navigation?

1. Parameter discovery or fuzzing
2. Reverse DNS lookup
3. NTP synchronization
4. ARP inspection

Correct Answer: 1

Explanation

Parameter discovery and web fuzzing can help identify undocumented parameters accepted by an application. Such parameters may be used by hidden functionality, legacy features, APIs, or administrative interfaces. During an authorized assessment, testers can evaluate discovered parameters for validation and authorization weaknesses while controlling request volume to avoid unnecessary disruption. Reverse DNS maps addresses to hostnames, NTP provides time synchronization, and ARP inspection is a network security control. Discovering undocumented inputs can expand understanding of an application’s actual attack surface.

Question 270

A tester identifies a web application endpoint that allows users to access resources by supplying an object identifier. The application does not verify whether the requesting user owns the referenced object. What issue is most likely present?

1. Insecure direct object reference
2. Cross-site request forgery
3. Open redirect
4. Clickjacking

Correct Answer: 1

Explanation

An insecure direct object reference occurs when an application exposes an internal object identifier and fails to enforce authorization for the referenced resource. If a user can access another user’s object simply by changing an identifier, the application has an access-control weakness. Proper server-side authorization should verify that the authenticated user is permitted to access the requested object. CSRF concerns unauthorized state-changing requests, open redirects manipulate navigation destinations, and clickjacking involves deceptive framing of application interfaces.

Question 271

A web application redirects users to a URL supplied through a request parameter without sufficiently validating the destination. Which weakness should be investigated?

1. Open redirect
2. Local file inclusion
3. SQL injection
4. Session fixation

Correct Answer: 1

Explanation

An open redirect occurs when an application accepts a user-controlled destination and redirects the browser without adequately restricting where the request can go. Such behavior can be abused in phishing or trust-based redirection scenarios because users may initially see a legitimate domain before being sent elsewhere. During authorized testing, the tester should determine whether redirects are constrained to approved destinations. Local file inclusion concerns server-side file access, SQL injection targets database queries, and session fixation concerns session identifier handling.

Question 272

Which security attribute helps prevent a browser from sending a session cookie over an unencrypted HTTP connection?

1. Secure
2. HttpOnly
3. SameSite
4. Domain

Correct Answer: 1

Explanation

The Secure cookie attribute instructs compatible browsers to send the cookie only over HTTPS connections. This reduces the chance that a session cookie will be transmitted through an unencrypted HTTP connection. HttpOnly helps prevent client-side scripts from directly accessing the cookie, while SameSite influences when cookies are sent with cross-site requests. The Domain attribute controls which hosts can receive the cookie. During web application testing, reviewing these attributes can reveal weaknesses in session-cookie protection.

Question 273

A tester finds that a session cookie remains valid even after the user explicitly logs out. Which security area requires investigation?

1. Session invalidation
2. DNS configuration
3. Network segmentation
4. Password complexity

Correct Answer: 1

Explanation

Session invalidation ensures that an authenticated session is no longer usable after logout or another event that should terminate access. If a previously issued session remains valid after logout, an unauthorized party who possesses that session may potentially continue using it. During authorized testing, the tester should verify the application’s documented session lifecycle and determine whether server-side invalidation occurs as expected. DNS configuration, network segmentation, and password complexity are important security controls but do not directly determine whether an existing authenticated session has been terminated.

Question 274

Which HTTP response header instructs compatible browsers to use HTTPS instead of making future HTTP requests to the specified site?

1. Content-Security-Policy
2. Strict-Transport-Security
3. X-Frame-Options
4. Referrer-Policy

Correct Answer: 2

Explanation

Strict-Transport-Security, commonly known as HSTS, tells compatible browsers that a website should be accessed using HTTPS for a specified period. This helps reduce certain downgrade and accidental plaintext-HTTP scenarios after the policy has been received. Content-Security-Policy controls permitted content sources and related browser behavior, X-Frame-Options addresses framing restrictions, and Referrer-Policy controls referrer information. During a penetration test, testers can review whether security headers are appropriately configured and whether their settings align with the application’s security requirements.

Question 275

A tester wants to determine whether an application exposes functionality through an HTTP method that ordinary users should not be able to invoke. What should be reviewed?

1. Allowed HTTP methods
2. DNS TXT records
3. MAC address tables
4. Password history

Correct Answer: 1

Explanation

Reviewing allowed HTTP methods helps identify whether an application or web server supports operations that are unnecessary or insufficiently restricted. Methods such as PUT, DELETE, or other application-specific operations may be legitimate, but they should be enabled only when required and protected by appropriate authorization. During an authorized assessment, testers can compare observed methods against the application’s intended design. DNS TXT records, MAC address tables, and password history do not determine which HTTP operations an application accepts.

Question 276

Which tool is commonly used to identify web technologies, frameworks, and server components through passive analysis of a website’s characteristics?

1. WhatWeb
2. Hashcat
3. tcpdump
4. John the Ripper

Correct Answer: 1

Explanation

WhatWeb is designed to identify technologies used by websites, including web servers, frameworks, JavaScript libraries, content-management systems, and other recognizable components. Technology fingerprinting can help authorized testers understand the application’s technology stack and identify areas that warrant further review. Hashcat and John the Ripper focus on password-hash auditing, while tcpdump captures network traffic. Technology identification is generally an early reconnaissance activity, and findings should be verified because fingerprints can sometimes be incomplete or inaccurate.

Question 277

A penetration tester wants to identify whether an organization has accidentally exposed sensitive files through public search-engine indexing. Which reconnaissance approach is appropriate?

1. Search-engine reconnaissance
2. VLAN hopping
3. Kerberos ticket analysis
4. Packet injection

Correct Answer: 1

Explanation

Search-engine reconnaissance uses publicly indexed information to identify domains, documents, directories, cached references, and other resources that may be visible without directly interacting with protected systems. During an authorized assessment, this can reveal unintentionally exposed information such as old documents or publicly indexed administrative resources. The tester should verify findings carefully and avoid accessing sensitive information beyond what is necessary to document the issue. VLAN hopping, Kerberos analysis, and packet injection address different technical areas and are not passive search-engine reconnaissance techniques.

Question 278

A tester is assessing an API and notices that an access token is accepted without checking its expiration time. Which control should be reviewed?

1. Token lifecycle validation
2. DNS recursion
3. Wireless channel selection
4. File compression

Correct Answer: 1

Explanation

Token lifecycle validation ensures that authentication or authorization tokens are accepted only while they remain valid according to their intended lifetime and revocation rules. If an API continues accepting expired tokens, the exposure period for compromised credentials may be unnecessarily extended. During authorized testing, the tester should assess expiration, revocation, audience, issuer, and other relevant token-validation requirements. DNS recursion, wireless channel selection, and file compression do not directly address the validity period or lifecycle of API authentication tokens.

Question 279

Which security testing technique evaluates whether a web application’s input validation can handle unexpected values, malformed data, or unusual input lengths?

1. Fuzzing
2. Reverse DNS
3. Network segmentation
4. Certificate registration

Correct Answer: 1

Explanation

Fuzzing involves supplying varied, unexpected, malformed, or boundary-condition inputs to evaluate how an application responds. It can uncover input-validation weaknesses, crashes, unexpected errors, and other conditions that may not appear during normal use. In an authorized penetration test, fuzzing should be carefully controlled to avoid excessive load or unintended service disruption. Reverse DNS provides hostname information, network segmentation controls communication boundaries, and certificate registration concerns public TLS certificate records rather than application input handling.

Question 280

A penetration tester identifies a serious vulnerability during an assessment, but exploiting it could interrupt a critical production service. What should guide the decision to proceed further?

1. The documented rules of engagement and risk controls
2. The tester’s personal preference
3. The vulnerability’s technical name alone
4. The availability of an exploit online

Correct Answer: 1

Explanation

The rules of engagement define what testing activities are authorized and establish restrictions for actions that could affect production systems. When exploitation presents a meaningful risk of service interruption, the tester should follow the documented approval, escalation, and safety requirements rather than deciding independently. The existence of a public exploit does not establish permission to use it. A vulnerability’s name also does not determine whether exploitation is acceptable. Controlled decision-making helps preserve system availability while keeping testing within the agreed authorization.