View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.

 

Question 301

Which file is commonly used on Linux systems to define local hostname-to-IP address mappings?

1. /etc/resolv.conf
2. /etc/passwd
3. /etc/hosts
4. /etc/fstab

Correct Answer: 3

Explanation

The /etc/hosts file provides static local mappings between hostnames and IP addresses on Linux and other Unix-like systems. During an authorized assessment, reviewing this file may reveal internal naming conventions, development systems, or infrastructure references that are not necessarily available through public DNS. /etc/resolv.conf contains DNS resolver configuration, /etc/passwd contains local account information, and /etc/fstab defines filesystem mounting information. Testers should handle any discovered internal information carefully because it may contain sensitive infrastructure details.

Question 302

A tester discovers a development hostname that resolves to an IP address but is not publicly linked from the organization’s website. Which technique most likely helped identify it?

1. DNS enumeration
2. Password spraying
3. Session fixation
4. Packet injection

Correct Answer: 1

Explanation

DNS enumeration can uncover hostnames and related records that are not linked through an organization’s public website. Authorized testers may examine available DNS information to identify development, staging, mail, or other infrastructure associated with a domain. These discoveries can expand understanding of the organization’s externally visible attack surface, but each asset must still be checked against the approved scope before active testing. Password spraying and session fixation address authentication, while packet injection is an active network technique unrelated to basic DNS discovery.

Question 303

Which reconnaissance source can provide historical versions of publicly accessible websites and may reveal information that is no longer present on the current site?

1. Web archives
2. Network ACLs
3. DHCP logs
4. Password databases

Correct Answer: 1

Explanation

Web archives preserve historical copies or references to publicly accessible web content. During authorized reconnaissance, archived pages can reveal old subdomains, documentation, contact information, application paths, or technologies that are no longer visible on the current website. Such information should be treated as historical evidence and verified before assuming that an old resource remains active. Network ACLs control traffic, DHCP logs concern address assignment, and password databases contain authentication information rather than historical public web content.

Question 304

A tester needs to determine whether a discovered vulnerability has a publicly documented severity based on standardized technical characteristics. Which scoring system is most appropriate?

1. CVSS
2. DNSSEC
3. LDAP
4. NTP

Correct Answer: 1

Explanation

The Common Vulnerability Scoring System, or CVSS, provides a standardized framework for describing vulnerability severity using factors such as attack complexity, privileges required, user interaction, scope, and potential impact. During penetration testing, CVSS can support consistent risk communication, although organizational context may also influence remediation priorities. DNSSEC protects DNS integrity, LDAP provides directory services, and NTP synchronizes system clocks. Testers should explain the factors behind a severity assessment rather than relying on a score without supporting context.

Question 305

A vulnerability requires valid administrator credentials before it can be exploited. Which CVSS-related characteristic does this most directly affect?

1. Attack vector
2. Privileges required
3. User interaction
4. Attack complexity

Correct Answer: 2

Explanation

The CVSS Privileges Required metric describes the level of privileges an attacker must possess before successfully exploiting a vulnerability. If administrator-level credentials are required, the vulnerability has a different privilege prerequisite from one that can be exploited without authentication or privileges. Attack Vector describes how the vulnerable component can be reached, User Interaction addresses whether another person must participate, and Attack Complexity describes conditions beyond the attacker’s control that affect exploitation. Understanding these characteristics helps testers communicate technical severity consistently.

Question 306

A tester finds that a vulnerable service is reachable only from an isolated internal network and not from the Internet. Which factor is especially relevant when assessing its exposure?

1. Attack vector
2. File extension
3. Cookie name
4. DNS record length

Correct Answer: 1

Explanation

Attack Vector considers how an attacker can reach the vulnerable component. A service restricted to an internal network has a different exposure profile from an Internet-accessible service. During an authorized assessment, testers should document network placement, access requirements, and segmentation because these factors can significantly influence practical risk. File extensions, cookie names, and DNS record lengths do not determine how a vulnerable service can be reached. Technical severity should therefore be interpreted alongside the actual network conditions surrounding the affected asset.

Question 307

Which tool can help map relationships between users, groups, computers, and permissions in an Active Directory environment?

1. BloodHound
2. Nikto
3. ffuf
4. WhatWeb

Correct Answer: 1

Explanation

BloodHound is designed to analyze relationships within Active Directory environments and can help identify paths between users, groups, computers, permissions, and other directory objects. During an authorized assessment, this type of analysis can reveal privilege relationships and potentially risky access configurations. Nikto focuses on web-server security checks, ffuf performs web fuzzing and content discovery, and WhatWeb identifies web technologies. BloodHound’s value comes from representing complex identity relationships in a way that allows security teams to identify excessive or unintended privilege paths.

Question 308

A tester observes that an account belonging to a standard employee group can access a sensitive administrative share. Which security principle should be reviewed?

1. Least privilege
2. Data compression
3. Certificate transparency
4. DNS recursion

Correct Answer: 1

Explanation

Least privilege requires users and accounts to have only the access necessary for their assigned responsibilities. If a standard employee account can access a sensitive administrative share without a legitimate business requirement, the permissions should be reviewed. Excessive access can increase the impact of compromised credentials and facilitate unauthorized access to sensitive resources. Data compression, certificate transparency, and DNS recursion address unrelated technical functions. During an assessment, testers should document the excessive permission and identify the responsible access-control mechanism.

Question 309

Which protocol is commonly associated with directory services and can be used to query centralized identity information?

1. LDAP
2. SMTP
3. NTP
4. SSH

Correct Answer: 1

Explanation

LDAP, or Lightweight Directory Access Protocol, is commonly used to access and manage directory information such as users, groups, and organizational objects. In enterprise environments, directory services can support authentication, authorization, and centralized identity management. During an authorized penetration test, LDAP configuration and access controls may be assessed to determine whether sensitive directory information is unnecessarily exposed. SMTP handles email transfer, NTP synchronizes system clocks, and SSH provides secure remote access. Proper directory permissions are important for preventing unauthorized information disclosure.

Question 310

A tester encounters an authentication service that reveals whether a username exists before a password is submitted. What risk can this behavior create?

1. Account enumeration
2. VLAN hopping
3. Packet fragmentation
4. Certificate expiration

Correct Answer: 1

Explanation

Account enumeration occurs when an application or authentication service reveals information that allows someone to distinguish valid accounts from nonexistent ones. Clear differences in messages, response codes, or other behavior can provide attackers with a list of potentially valid usernames. During an authorized assessment, testers can document this behavior and determine whether it meaningfully increases attack exposure. VLAN hopping concerns network segmentation, packet fragmentation concerns network transmission, and certificate expiration concerns TLS certificate lifecycle rather than account discovery.

Question 311

Which authentication attack attempts a small number of commonly used passwords against many different accounts?

1. Credential stuffing
2. Password spraying
3. Brute-force attack
4. Rainbow table attack

Correct Answer: 2

Explanation

Password spraying uses a limited set of commonly used passwords across many accounts rather than repeatedly attacking one account with a large number of passwords. This approach attempts to avoid account lockouts while identifying weak password choices. Credential stuffing instead uses previously compromised username-and-password combinations, while a traditional brute-force attack systematically attempts many password combinations against a target. Rainbow tables use precomputed information for certain password-hash recovery scenarios. Testing authentication controls should always follow the engagement’s rate limits and authorization requirements.

Question 312

A tester discovers that users can reuse credentials from previous breaches without the identity system blocking known compromised passwords. Which control would directly reduce this risk?

1. Password compromise screening
2. DNSSEC validation
3. VLAN segmentation
4. HTTP compression

Correct Answer: 1

Explanation

Password compromise screening checks proposed passwords against lists of known compromised or commonly exposed credentials. Preventing users from selecting passwords that are already publicly associated with breaches can reduce the likelihood of successful credential attacks. This control works alongside appropriate password length and authentication protections. DNSSEC validates DNS integrity, VLAN segmentation limits network communication, and HTTP compression affects web traffic size. During an authorized assessment, testers can review whether the organization’s identity platform applies appropriate screening without unnecessarily exposing users’ existing passwords.

Question 313

Which wireless security mechanism commonly uses centralized authentication through an authentication server rather than a shared password for every user?

1. WPA3-Personal
2. WPA2-Personal
3. WPA3-Enterprise
4. WEP

Correct Answer: 3

Explanation

WPA3-Enterprise is designed for environments that use centralized authentication and individual user credentials rather than a single shared wireless password. Enterprise wireless deployments commonly integrate with authentication infrastructure such as an authentication server. This approach can provide better identity-level control and facilitate individual access management. WPA3-Personal and WPA2-Personal typically use a shared pre-shared key model, while WEP is an obsolete wireless security mechanism. During testing, the configuration should be reviewed against the organization’s intended authentication architecture.

Question 314

A penetration tester needs to determine whether a wireless network uses a particular authentication and encryption configuration. Which information should be examined first?

1. Wireless security settings
2. Web page metadata
3. DNS MX records
4. Database indexes

Correct Answer: 1

Explanation

Wireless security settings reveal how an access point protects communication and authenticates clients. Relevant characteristics can include the security protocol, authentication mode, encryption configuration, and related enterprise settings. Reviewing these details helps testers determine whether the wireless deployment follows the organization’s security requirements. Web metadata and DNS MX records provide different forms of reconnaissance information, while database indexes are application or database structures. Wireless assessment should be performed only against explicitly authorized networks because testing activities can affect connected users.

Question 315

Which post-exploitation objective focuses on determining whether an attacker could maintain access after the initial compromise?

1. Persistence assessment
2. Asset discovery
3. Passive reconnaissance
4. DNS enumeration

Correct Answer: 1

Explanation

Persistence assessment examines whether access obtained during a compromise could remain available after events such as logout, reboot, credential changes, or other recovery actions. In an authorized penetration test, testers evaluate whether security controls detect or prevent mechanisms that could maintain unauthorized access. Asset discovery identifies systems, passive reconnaissance gathers public information, and DNS enumeration identifies DNS-related infrastructure. Persistence testing should be carefully controlled because modifications that remain on production systems can create operational and security risks if not properly documented and removed.

Question 316

A tester obtains access to a workstation and needs to determine what sensitive information can be collected without accessing unrelated personal data. Which principle should guide the activity?

1. Data minimization
2. Maximum collection
3. Public disclosure
4. Unrestricted retention

Correct Answer: 1

Explanation

Data minimization means collecting only the information necessary to achieve the authorized testing objective and support relevant findings. After obtaining access to a system, a tester should avoid unnecessarily viewing or copying unrelated personal, financial, or business information. This reduces privacy exposure and simplifies evidence handling. Maximum collection and unrestricted retention increase risk, while public disclosure is inappropriate for confidential assessment information. Data minimization should be considered throughout post-exploitation activities, not only when preparing the final report.

Question 317

Which network-analysis tool provides a graphical interface for examining captured packets and protocol details?

1. Wireshark
2. Hashcat
3. Amass
4. BloodHound

Correct Answer: 1

Explanation

Wireshark is a graphical network protocol analyzer that allows security professionals to inspect captured packets and understand communication between systems. It supports detailed analysis of numerous protocols and can help identify unexpected traffic, configuration issues, or evidence relevant to an authorized assessment. Hashcat performs password-hash auditing, Amass focuses on reconnaissance and attack-surface discovery, and BloodHound analyzes identity relationships. Because packet captures can contain sensitive information, testers should protect them and collect only the traffic necessary for the assessment.

Question 318

A penetration tester needs to collect network traffic from a Linux host for later analysis. Which tool is commonly appropriate?

1. tcpdump
2. ffuf
3. Nikto
4. Amass

Correct Answer: 1

Explanation

tcpdump is a command-line packet capture utility commonly available on Linux and Unix-like systems. It can capture network traffic for later inspection and can help testers investigate protocol behavior, communication patterns, and security events during authorized assessments. ffuf is used for web fuzzing, Nikto performs web-server security checks, and Amass supports reconnaissance. Packet captures should be handled as sensitive evidence because they may contain authentication data, session information, or confidential application traffic.

Question 319

A tester identifies an administrative interface that is accessible from every network segment even though only a management subnet should reach it. Which control should be reviewed?

1. Network ACLs
2. Password history
3. Certificate transparency
4. DNS TXT records

Correct Answer: 1

Explanation

Network Access Control Lists, or ACLs, can restrict traffic between networks, interfaces, or security zones according to defined rules. If an administrative interface is reachable from network segments that should be blocked, ACL configuration should be reviewed to determine why the intended boundary is not being enforced. Password history concerns credential reuse, certificate transparency concerns public certificate records, and DNS TXT records contain textual DNS information. Correctly configured ACLs can reduce exposure of management services to unauthorized network locations.

Question 320

A penetration test is complete, and the client requests a concise document showing each finding, its affected asset, business impact, evidence, and recommended corrective action. What deliverable is most appropriate?

1. Technical penetration-testing report
2. Password dictionary
3. Network packet capture
4. DNS zone file

Correct Answer: 1

Explanation

A technical penetration-testing report consolidates security findings and provides the evidence and context needed for remediation. It commonly identifies affected assets, vulnerability details, impact, supporting evidence, severity or risk information, and recommended corrective actions. This format allows technical teams to understand what must be fixed and how the issue affects the environment. A password dictionary, packet capture, or DNS zone file may be supporting artifacts in some assessments, but none provides the comprehensive finding-and-remediation structure expected from the final technical report.