View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.

 

Question 21

Which reconnaissance technique involves collecting information about a target without directly interacting with its systems?

1. Passive reconnaissance
2. Privilege escalation
3. Exploitation
4. Lateral movement

Correct Answer: 1

Explanation

Passive reconnaissance gathers information about a target without directly interacting with the target’s systems. A penetration tester may review publicly available websites, search-engine results, certificate information, public records, job postings, and other sources to build an understanding of the environment. This approach generally creates less detectable activity than active reconnaissance. Active reconnaissance, by contrast, involves direct interaction such as scanning hosts or services. Privilege escalation, exploitation, and lateral movement occur later in the attack lifecycle. Therefore, passive reconnaissance is the correct technique described.

Question 22

A penetration tester discovers a company’s public DNS records and identifies an unexpected mail server. What should the tester do next to better understand the exposed service?

1. Destroy the server
2. Enumerate the identified service
3. Reset all employee passwords
4. Disable DNS

Correct Answer: 2

Explanation

After discovering an unexpected exposed service, service enumeration can provide additional information about its implementation and configuration. The tester may identify the software, version, supported protocols, and other characteristics that can help determine potential weaknesses within the authorized scope. Discovery alone does not establish that a vulnerability exists. Destructive actions and disabling infrastructure are inappropriate unless explicitly authorized, while resetting passwords is unrelated to understanding the mail service. Therefore, enumerating the identified service is the appropriate next step.

Question 23

Which DNS record identifies the mail servers responsible for receiving email for a domain?

1. A
2. TXT
3. MX
4. CNAME

Correct Answer: 3

Explanation

An MX, or Mail Exchange, record identifies the mail servers responsible for accepting email for a domain. During reconnaissance, reviewing MX records can reveal externally accessible mail infrastructure and provide useful information about an organization’s email architecture. A records map names to IPv4 addresses, CNAME records create aliases for other names, and TXT records can contain text-based information such as domain verification or email-security data. Therefore, the MX record is the correct DNS record for identifying mail servers associated with a domain.

Question 24

A tester wants to identify employee names, job roles, and technologies used by an organization by reviewing publicly available information. Which reconnaissance source can be particularly useful?

1. Job postings
2. Disk encryption
3. Local firewall logs
4. Memory dumps

Correct Answer: 1

Explanation

Public job postings can provide valuable reconnaissance information because organizations often mention technologies, operating systems, cloud platforms, security products, programming languages, and job responsibilities in their descriptions. Employee names and roles may also be identified through professional profiles and company information. This information can help a tester understand potential technologies and organizational structure before technical testing begins. Disk encryption, local firewall logs, and memory dumps generally require access to internal systems and are not typical public reconnaissance sources. Therefore, job postings are particularly useful for this purpose.

Question 25

Which protocol is commonly used to securely transfer files over an SSH connection?

1. FTP
2. Telnet
3. SCP
4. HTTP

Correct Answer: 3

Explanation

Secure Copy Protocol, or SCP, uses SSH to securely transfer files between systems. Because the communication occurs through an SSH-protected channel, authentication and data transfer can be protected from interception compared with unencrypted protocols such as traditional FTP or Telnet. During penetration testing, identifying SCP or SSH services can help testers understand available remote-access and file-transfer capabilities. HTTP is primarily an application-layer web protocol. Therefore, SCP is the protocol most directly associated with secure file transfer over an SSH connection.

Question 26

A web application accepts a filename from a user and executes operating-system commands based on that input without proper validation. Which vulnerability should be investigated?

1. Command injection
2. Clickjacking
3. DNS tunneling
4. Credential stuffing

Correct Answer: 1

Explanation

Command injection occurs when untrusted input is incorporated into operating-system commands in a way that allows an attacker to influence command execution. If a web application uses a user-supplied filename to construct a system command without adequate validation or safe handling, an attacker may potentially manipulate that input to execute unintended commands. Clickjacking concerns deceptive user-interface framing, DNS tunneling abuses DNS for data transfer, and credential stuffing uses previously compromised credentials. Therefore, command injection is the vulnerability that should be investigated.

Question 27

During a wireless assessment, a tester discovers that a corporate access point uses WPA2 with a weak shared password. What should the tester assess next?

1. Whether the wireless credentials can be compromised within scope
2. Whether the web server supports IPv6
3. Whether the database uses SQL
4. Whether the company has cloud storage

Correct Answer: 1

Explanation

A weak shared wireless password can represent a significant security risk because anyone who obtains or recovers the credential may gain access to the protected wireless network. During an authorized wireless assessment, the tester can evaluate whether the credential is susceptible to compromise using permitted techniques and then determine what network resources become accessible. Testing unrelated web, database, or cloud characteristics does not directly address the identified wireless weakness. Therefore, the next step should be assessing whether the wireless credentials can be compromised within the approved engagement scope.

Question 28

Which wireless security protocol provides stronger modern protection than WEP and is commonly associated with enterprise wireless authentication?

1. WPA2
2. FTP
3. SNMPv1
4. Telnet

Correct Answer: 1

Explanation

WPA2 provides substantially stronger wireless security than the older WEP protocol and has been widely deployed in enterprise wireless environments. Enterprise WPA2 commonly uses 802.1X authentication with an authentication server rather than relying solely on a shared password. Although newer standards such as WPA3 provide additional security improvements, WPA2 remains important when assessing existing enterprise environments. FTP, SNMPv1, and Telnet are network protocols unrelated to wireless encryption standards. Therefore, WPA2 is the correct choice among the listed options.

Question 29

A tester identifies an exposed SMB service on a Windows server. Which information would be most useful to gather before attempting exploitation?

1. Monitor brightness settings
2. Service version and configuration
3. Keyboard layout only
4. Browser bookmarks

Correct Answer: 2

Explanation

Service version and configuration information can help determine whether an exposed SMB service has known vulnerabilities or insecure settings that warrant further testing. Enumeration may reveal the protocol version, available shares, authentication configuration, and other relevant characteristics. This information allows the tester to select appropriate validation techniques while reducing unnecessary or potentially disruptive activity. Monitor brightness, keyboard layout, and browser bookmarks do not directly help evaluate the exposed SMB service. Therefore, gathering service version and configuration information is the most useful next step.

Question 30

Which attack attempts to trick a user into revealing sensitive information by pretending to be a trusted person or organization?

1. Phishing
2. Port scanning
3. Hash cracking
4. Packet fragmentation

Correct Answer: 1

Explanation

Phishing is a social-engineering technique that attempts to deceive users into providing sensitive information, opening malicious content, or performing an unintended action. Attackers commonly impersonate trusted organizations, coworkers, service providers, or other legitimate entities. During an authorized penetration test, phishing simulations can be used to evaluate employee awareness and organizational defenses when explicitly permitted. Port scanning discovers network services, hash cracking targets password hashes, and packet fragmentation concerns how network packets are divided. Therefore, phishing is the attack technique described.

Question 31

A tester sends carefully crafted email messages to selected employees to determine whether they will interact with a simulated malicious attachment. What type of security testing is being performed?

1. Social engineering
2. Database replication
3. Network segmentation
4. Storage enumeration

Correct Answer: 1

Explanation

A controlled email campaign designed to measure whether users interact with simulated malicious content is a form of social-engineering testing. The purpose is generally to assess human susceptibility, security awareness, reporting behavior, and organizational controls around suspicious messages. Such testing should have clearly defined authorization and rules of engagement because it directly involves employees and potentially sensitive communication systems. Database replication, network segmentation, and storage enumeration address technical infrastructure rather than human manipulation. Therefore, this scenario represents social-engineering testing.

Question 32

Which authentication attack uses previously exposed username-and-password combinations against other services?

1. Password spraying
2. Credential stuffing
3. Brute-force scanning
4. Kerberoasting

Correct Answer: 2

Explanation

Credential stuffing uses previously compromised username-and-password combinations and attempts them against other services, relying on password reuse by users. It differs from password spraying, which typically attempts a small set of commonly used passwords across many accounts. Brute-force attacks systematically attempt many possible credentials, while Kerberoasting targets service-account authentication material associated with Kerberos environments. During an authorized assessment, credential stuffing can demonstrate the risk created by password reuse. Therefore, credential stuffing is the technique described in this scenario.

Question 33

A tester is assessing an application that stores user input and later displays it to other users without proper output encoding. Which type of XSS is most likely involved?

1. Reflected XSS
2. Stored XSS
3. Blind SQL injection
4. Command injection

Correct Answer: 2

Explanation

Stored cross-site scripting occurs when malicious or attacker-controlled input is saved by an application and later delivered to other users when they access the affected content. Because the payload is persisted, multiple users may be exposed without the attacker needing to send each victim a specially crafted request. Reflected XSS generally involves input returned immediately in a response without persistent storage. SQL injection and command injection are different vulnerability classes. Therefore, stored XSS is the most likely vulnerability in this scenario.

Question 34

A tester wants to identify potentially vulnerable software versions across many hosts before manually validating individual findings. Which activity is most appropriate?

1. Vulnerability scanning
2. Data destruction
3. Social engineering
4. Password reset

Correct Answer: 1

Explanation

Vulnerability scanning can efficiently examine many systems for known weaknesses, outdated software, insecure configurations, and other indicators. The results can then help penetration testers prioritize systems for manual validation and controlled exploitation where permitted. Automated scanners are useful for coverage but can generate false positives and do not necessarily establish real-world exploitability. Data destruction and password resets are unrelated, while social engineering evaluates human behavior rather than software exposure. Therefore, vulnerability scanning is the most appropriate activity for broad initial vulnerability identification.

Question 35

A tester compromises one workstation and uses it to reach another internal server that was not directly accessible from the internet. What attack activity does this demonstrate?

1. Lateral movement
2. Passive reconnaissance
3. Data masking
4. Vulnerability disclosure

Correct Answer: 1

Explanation

Lateral movement occurs when an attacker or penetration tester moves from one compromised system to additional systems within an environment. It is often performed after obtaining an initial foothold and may involve credential reuse, remote services, trust relationships, or other authorized techniques. In this scenario, the tester uses the compromised workstation as a pathway to reach an internal server that was not directly exposed externally. Passive reconnaissance occurs before or around initial access, while the other choices do not describe internal movement. Therefore, this is lateral movement.

Question 36

Which technique attempts to exploit weaknesses in how an application handles file paths by using encoded or manipulated directory references?

1. Directory traversal
2. Password spraying
3. VLAN hopping
4. ARP poisoning

Correct Answer: 1

Explanation

Directory traversal targets applications that improperly process file paths and allow users to reference files outside the intended directory. Attackers may manipulate path components or encoding to attempt to bypass application restrictions. During an authorized penetration test, testers can determine whether the application properly validates requested paths and whether unintended files become accessible. Password spraying targets authentication, VLAN hopping attempts to cross network segmentation boundaries, and ARP poisoning manipulates local network address resolution. Therefore, directory traversal is the technique associated with manipulated file paths.

Question 37

A penetration tester needs to identify the technologies and frameworks used by a public web application before deeper testing. Which activity is useful?

1. Technology fingerprinting
2. Disk wiping
3. Credential rotation
4. Database deletion

Correct Answer: 1

Explanation

Technology fingerprinting attempts to identify software technologies, frameworks, web servers, content-management systems, libraries, and other components used by an application. This information can help testers understand the attack surface and select appropriate testing methods. Fingerprinting may use HTTP responses, headers, page characteristics, public information, and specialized tools. Disk wiping, credential rotation, and database deletion do not help identify the technologies powering the public application. Therefore, technology fingerprinting is the appropriate reconnaissance activity.

Question 38

A tester discovers that an application uses predictable session identifiers. What security area should receive further testing?

1. Session management
2. Physical security
3. DNS availability
4. Storage capacity

Correct Answer: 1

Explanation

Predictable session identifiers can weaken session management because an attacker may potentially infer or guess valid identifiers and gain unauthorized access to another user’s session. A penetration tester should examine how session tokens are generated, transmitted, protected, expired, and invalidated. Additional testing should remain within the engagement scope and avoid unnecessary access to unrelated accounts. Physical security, DNS availability, and storage capacity do not directly address the identified weakness. Therefore, session management should receive further testing.

Question 39

Which assessment approach provides the tester with limited internal information, such as credentials or architecture details, while still requiring some reconnaissance?

1. Black-box testing
2. Gray-box testing
3. Blind exploitation
4. Passive-only testing

Correct Answer: 2

Explanation

Gray-box testing provides the penetration tester with some internal information or limited privileges while still requiring the tester to investigate parts of the environment. This approach can simulate an attacker who has obtained partial knowledge or compromised a legitimate account. Black-box testing generally begins with minimal target information, while white-box testing provides extensive internal information. Gray-box assessments can therefore balance external realism with targeted coverage of authenticated or internal functionality. The scenario described is most consistent with gray-box testing.

Question 40

A penetration tester discovers an exposed administrative interface that requires authentication. Which action provides the most useful next step during an authorized assessment?

1. Identify and test the authentication controls
2. Permanently disable the interface
3. Delete the associated account
4. Shut down the server

Correct Answer: 1

Explanation

Testing the authentication controls can reveal weaknesses such as weak password policies, improper lockout behavior, insecure session handling, default credentials, or other authentication flaws. The tester should perform these checks only within the approved scope and according to the rules of engagement. Permanently disabling an interface, deleting accounts, or shutting down the server can disrupt business operations and are not appropriate assessment steps unless explicitly authorized. Therefore, evaluating the administrative interface’s authentication controls is the most useful next step.