View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.

 

Question 381

Before testing a production application that restricts access by source IP address, what should the penetration tester confirm?

1. The application’s logo
2. The authorized testing source IP
3. The database table names
4. The server’s screen resolution

Correct Answer: 2

Explanation

Source-IP restrictions can prevent legitimate testing traffic from reaching an application or can cause unexpected security events if testing originates from an unauthorized location. Before beginning the assessment, the penetration tester should confirm which source IP addresses, VPN connections, or approved jump hosts are authorized by the engagement documentation. This ensures that testing traffic follows the agreed network path and remains within scope. Verifying the testing source also helps the client distinguish authorized penetration-testing activity from potentially suspicious external traffic.

Question 382

Which DNS record creates an alias that points one domain name to another canonical hostname?

1. CNAME
2. AAAA
3. PTR
4. MX

Correct Answer: 1

Explanation

A CNAME, or Canonical Name, record creates an alias from one DNS name to another hostname. It is commonly used when multiple names should resolve through a shared canonical destination. An AAAA record maps a hostname to an IPv6 address, a PTR record supports reverse DNS lookups, and an MX record identifies mail servers responsible for receiving email. During authorized reconnaissance, identifying CNAME relationships can help testers understand how different publicly accessible names are connected to shared infrastructure or external service providers.

Question 383

A security assessment identifies a public DNS zone containing internal hostnames that should not be exposed externally. Which issue should the tester document?

1. DNS information exposure
2. Session fixation
3. Password spraying
4. Container escape

Correct Answer: 1

Explanation

Publicly accessible DNS information can reveal internal naming conventions, infrastructure roles, development systems, management hosts, or other details that were not intended for external disclosure. During an authorized assessment, testers should document the exposed information and explain how it could assist reconnaissance without assuming that disclosure automatically represents a critical vulnerability. The appropriate severity depends on the sensitivity of the information and the organization’s architecture. Session fixation, password spraying, and container escape are unrelated security issues.

Question 384

Which DNS security mechanism uses cryptographic signatures to provide authenticity and integrity for DNS responses?

1. DHCP
2. SNMP
3. DNSSEC
4. FTP

Correct Answer: 3

Explanation

DNSSEC, or Domain Name System Security Extensions, uses digital signatures to help validate the authenticity and integrity of DNS data. It is designed to reduce certain DNS manipulation risks by allowing validating resolvers to verify that responses originate from an authorized DNS hierarchy and have not been altered. DHCP assigns network configuration, SNMP is used for network management, and FTP transfers files. During an authorized assessment, reviewing DNSSEC configuration can help identify weaknesses in an organization’s DNS security architecture.

Question 385

A tester discovers that a web application processes serialized objects received from users without adequately validating their contents. Which vulnerability class may be involved?

1. Insecure deserialization
2. Network segmentation failure
3. Password spraying
4. Certificate expiration

Correct Answer: 1

Explanation

Insecure deserialization occurs when an application reconstructs serialized objects from untrusted or insufficiently validated input. Depending on the technology and implementation, unsafe deserialization can lead to unauthorized actions, data manipulation, or other serious security consequences. During an authorized assessment, testers should determine whether serialized data is trusted, whether integrity controls exist, and whether the application restricts accepted object types. Network segmentation, password spraying, and certificate expiration address different security areas and do not describe unsafe object reconstruction.

Question 386

Which web security weakness occurs when a server uses a user-controlled URL to make requests to another resource without adequately restricting the destination?

1. CORS misconfiguration
2. SSRF
3. Clickjacking
4. Session fixation

Correct Answer: 2

Explanation

Server-Side Request Forgery, or SSRF, occurs when an application causes its server to make requests based on attacker-controlled or insufficiently restricted input. The security concern is that the server may have network access or privileges that the external requester does not possess. During an authorized assessment, testers should evaluate whether destination controls, network segmentation, and request validation are properly implemented. CORS misconfiguration concerns browser-origin policies, clickjacking involves deceptive framing, and session fixation concerns session identifiers.

Question 387

An API accepts requests from arbitrary websites and exposes sensitive authenticated data through browser-based requests. Which configuration should the tester investigate?

1. CORS policy
2. DNS TTL
3. SMTP banner
4. NTP configuration

Correct Answer: 1

Explanation

Cross-Origin Resource Sharing, or CORS, controls which web origins are permitted to interact with resources through browser-based cross-origin requests. An overly permissive CORS configuration can expose sensitive API responses when combined with authentication and other conditions. During an authorized assessment, testers should review allowed origins, credential handling, and whether sensitive endpoints are unnecessarily accessible cross-origin. DNS TTL controls caching duration, SMTP banners identify mail services, and NTP configuration concerns time synchronization. CORS should be evaluated in the context of the application’s actual authentication model.

Question 388

Which web vulnerability can occur when an application includes a local server file based on insufficiently validated user input?

1. VLAN hopping
2. Local file inclusion
3. Password spraying
4. DNS poisoning

Correct Answer: 2

Explanation

Local File Inclusion, or LFI, occurs when an application incorporates or processes files from the local server based on user-controlled input without adequate validation. Depending on the application and server configuration, this can expose sensitive files or affect application behavior. During an authorized assessment, testers should determine whether file paths are constrained to intended resources and whether strong allowlisting is used. VLAN hopping affects network segmentation, password spraying targets authentication systems, and DNS poisoning manipulates name resolution.

Question 389

A web application redirects users after login based on a URL supplied by the client. What should the tester verify to reduce OAuth-related redirect abuse?

1. Whether the redirect URI is strictly validated
2. Whether DNS uses short TTL values
3. Whether the server supports IPv6
4. Whether SMTP uses encryption

Correct Answer: 1

Explanation

OAuth implementations should carefully validate redirect URIs so authorization responses are returned only to approved destinations. Weak or overly flexible redirect validation can create opportunities for authorization information to be sent to an unintended location. During an authorized assessment, testers should review whether registered redirect URIs are exact or appropriately constrained and whether wildcard behavior introduces unnecessary risk. DNS TTL, IPv6 support, and SMTP encryption do not directly address OAuth redirect validation. Proper redirect handling is an important part of secure authorization-flow design.

Question 390

Which network attack can exploit insufficient separation between VLANs by causing traffic from one VLAN to reach another?

1. Session fixation
2. XXE
3. VLAN hopping
4. Credential stuffing

Correct Answer: 3

Explanation

VLAN hopping refers to techniques that can allow network traffic to cross VLAN boundaries when switch configuration or trunking controls are improperly implemented. This can weaken intended network segmentation and potentially expose systems that should be isolated from one another. During an authorized internal assessment, testers should evaluate VLAN configuration and segmentation controls according to the engagement’s scope. Session fixation affects web sessions, XXE concerns XML processing, and credential stuffing involves reused credentials. Proper switch configuration and segmentation reduce the risk of unintended VLAN traversal.

Question 391

Which protocol is commonly associated with authentication in enterprise wireless networks using centralized identity services?

1. 802.1X
2. FTP
3. Telnet
4. POP3

Correct Answer: 1

Explanation

IEEE 802.1X provides port-based network access control and is commonly used with enterprise wireless authentication. It can work with an authentication server to validate users or devices before granting network access. During an authorized wireless assessment, testers may review whether enterprise authentication is properly configured and whether appropriate authentication methods and certificate validation are used. FTP and Telnet are older application-layer protocols, while POP3 is primarily used for retrieving email. Enterprise wireless security generally benefits from centralized authentication rather than shared credentials.

Question 392

A tester observes that Windows hosts are resolving names through a legacy local-name-resolution protocol that could expose authentication information. Which protocol should receive attention?

1. HTTPS
2. LLMNR
3. SFTP
4. DNSSEC

Correct Answer: 2

Explanation

Link-Local Multicast Name Resolution, or LLMNR, is a legacy name-resolution mechanism used in some Windows environments. If improperly configured, name-resolution behavior can create opportunities for credential-related information exposure during an authorized internal assessment. Organizations can reduce unnecessary exposure by disabling legacy protocols where they are not required and using appropriately secured name-resolution services. HTTPS protects web communications, SFTP provides secure file transfer, and DNSSEC adds integrity protections to DNS. The exact risk should be evaluated against the organization’s configuration and security controls.

Question 393

Which attack technique attempts to use captured NTLM authentication material against another service without requiring the original password?

1. NTLM relay
2. Clickjacking
3. SQL injection
4. Open redirect

Correct Answer: 1

Explanation

NTLM relay involves forwarding captured NTLM authentication exchanges to another service that accepts NTLM authentication. The security concern is that an attacker may potentially authenticate to a service using relayed authentication material without knowing the user’s plaintext password. During authorized testing, organizations can assess whether protections such as SMB signing, appropriate authentication configurations, and network segmentation reduce this risk. Clickjacking, SQL injection, and open redirects involve different application-layer weaknesses and do not describe authentication relay behavior.

Question 394

A tester identifies an Active Directory service account associated with a service principal name and wants to assess whether its password is susceptible to offline cracking. Which technique is relevant?

1. Kerberoasting
2. VLAN hopping
3. DNS tunneling
4. Clickjacking

Correct Answer: 1

Explanation

Kerberoasting is an Active Directory attack technique involving service accounts associated with service principal names. Authentication-related material can be obtained in a form that may permit offline password-strength assessment. During an authorized penetration test, the objective is to determine whether service-account passwords are sufficiently strong and whether unnecessary service-account privileges increase risk. VLAN hopping concerns network segmentation, DNS tunneling concerns use of DNS communications for data transfer, and clickjacking targets web interfaces. Service accounts should use strong credentials and appropriate privilege restrictions.

Question 395

During an authorized wireless assessment, which technique can test whether clients properly respond to unexpected wireless management-frame activity?

1. Password spraying
2. Wireless deauthentication testing
3. SQL injection
4. Local file inclusion

Correct Answer: 2

Explanation

Wireless deauthentication testing can be used in an authorized assessment to evaluate how wireless clients and infrastructure respond to deauthentication-related management traffic. The purpose may include determining whether protections such as Protected Management Frames are properly implemented and whether clients reconnect securely. Because wireless testing can disrupt connectivity, it must be explicitly authorized and carefully controlled. Password spraying targets authentication systems, SQL injection targets database-driven applications, and local file inclusion concerns server-side file handling.

Question 396

A cloud-hosted virtual machine can access a metadata service that exposes sensitive temporary credentials because application access is not restricted. What should the tester investigate?

1. Cloud metadata service exposure
2. Email forwarding rules
3. DNS zone expiration
4. Browser cache settings

Correct Answer: 1

Explanation

Cloud metadata services can provide information about the workload environment and, depending on the platform and configuration, temporary credentials or other sensitive data. If applications can access metadata unnecessarily, a compromised workload may potentially obtain information beyond what it requires. During an authorized cloud assessment, testers should review metadata-service protections, workload identity permissions, and network access controls. Email forwarding, DNS expiration, and browser caching do not directly address this cloud-specific risk. Restricting unnecessary metadata access can reduce credential exposure.

Question 397

Which practice helps ensure that software packages used in a penetration-testing environment or client application originate from a trusted source?

1. Image or package provenance verification
2. Disabling all logging
3. Sharing administrator credentials
4. Removing version information

Correct Answer: 1

Explanation

Package and image provenance verification helps establish that software originates from an expected and trusted source. This can involve signed packages, trusted repositories, verified container images, or other integrity mechanisms. During security assessments, supply-chain controls are relevant because malicious or tampered components can introduce vulnerabilities before software reaches production. Disabling logging, sharing administrator credentials, and removing version information do not establish software authenticity. Organizations should maintain trusted sources and verify integrity where practical, particularly for security-sensitive workloads.

Question 398

A container platform permits a workload to run with unnecessary administrative privileges. Which security concern should the tester prioritize?

1. Container escape risk
2. DNS record expiration
3. Email spoofing
4. Browser history exposure

Correct Answer: 1

Explanation

Excessive container privileges can increase the consequences of a compromised workload and may weaken isolation from the host environment. A container escape risk becomes particularly important when privileged configurations, excessive capabilities, or dangerous host access are present. During an authorized assessment, testers should review runtime privileges and isolation controls without performing disruptive actions outside the agreed scope. DNS expiration, email spoofing, and browser history exposure are separate security concerns. Strong container isolation and minimal runtime privileges reduce the potential impact of workload compromise.

Question 399

A penetration tester is given authorization to assess a partner-owned application. What additional documentation should the tester verify before testing the partner’s systems?

1. The tester’s preferred operating system
2. Explicit authorization from the partner or system owner
3. The application’s programming language
4. The office printer configuration

Correct Answer: 2

Explanation

Testing a third-party or partner-owned system requires explicit authorization from the organization that owns or controls the relevant infrastructure. The tester should verify that the authorization clearly identifies the systems, testing activities, timing, and applicable restrictions. A client’s permission alone may not automatically authorize actions against infrastructure owned by another organization. Operating-system preferences, programming languages, and printer configurations do not establish legal or operational authorization. Confirming third-party approval protects both the tester and participating organizations from unauthorized activity.

Question 400

After completing an engagement, what is the most appropriate approach to sensitive evidence collected during the penetration test?

1. Keep every file indefinitely
2. Publish interesting findings publicly
3. Protect, retain, and securely dispose of evidence according to the engagement requirements
4. Send all evidence to unrelated employees

Correct Answer: 3

Explanation

Penetration-testing evidence can contain credentials, personal information, configuration details, screenshots, logs, and other sensitive material. Testers should protect this evidence throughout the engagement and retain it only for the period and purposes authorized by the client or applicable requirements. When retention is no longer necessary, evidence should be securely disposed of according to the agreed procedures. Indefinite retention, public disclosure, or distribution to unrelated personnel increases confidentiality and privacy risks and is inconsistent with responsible evidence handling.