View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.

 

Question 41

Which DNS technique attempts to obtain unauthorized records from a DNS server?

1. DNS zone transfer
2. Reverse DNS lookup
3. DNS caching
4. DNS sinkholing

Correct Answer: 1

Explanation

A DNS zone transfer copies DNS records from an authoritative DNS server to another DNS server. When improperly configured, an attacker may request a zone transfer and obtain information such as hostnames, IP addresses, mail servers, and internal systems. During an authorized penetration test, checking for unrestricted zone transfers can reveal excessive DNS information exposure. Proper DNS configuration should restrict zone transfers to approved secondary servers. Reverse lookups and caching serve different purposes and do not normally provide the same comprehensive record set as a successful zone transfer.

Question 42

A penetration tester wants to identify the organization responsible for a public IP address range. Which resource is most appropriate?

1. Browser cache
2. ARP table
3. ASN registration data
4. Local hosts file

Correct Answer: 3

Explanation

Autonomous System Number (ASN) information can help identify organizations associated with Internet-routable IP address ranges. During passive reconnaissance, a tester can use ASN registration and routing information to understand an organization’s external network footprint. This may reveal additional address ranges that should be considered during authorized scoping and reconnaissance. An ARP table generally contains local network mappings, while a hosts file contains manually configured hostname resolutions. Browser cache is unrelated to ownership information. ASN data is therefore useful for mapping publicly announced network infrastructure.

Question 43

Which Nmap scan type commonly uses a TCP SYN packet to determine whether a port is open?

1. TCP connect scan
2. SYN scan
3. UDP scan
4. Idle scan

Correct Answer: 2

Explanation

A TCP SYN scan sends a SYN packet to the target port and analyzes the response to determine the port’s state. An open port typically responds with SYN/ACK, while a closed port generally responds with RST. The technique is commonly used because it can identify TCP services without completing the full TCP connection in the normal way. A TCP connect scan completes the connection, whereas a UDP scan targets UDP services. An idle scan uses an intermediary host to obscure the tester’s source in specific circumstances.

Question 44

A vulnerability scanner reports a critical issue, but manual testing shows the affected component is not actually vulnerable. What should the tester document?

1. Exploitation success
2. Zero-day discovery
3. Privilege escalation
4. False positive

Correct Answer: 4

Explanation

A false positive occurs when a security tool reports a vulnerability that does not actually exist under the tested conditions. Penetration testers should validate significant scanner findings manually before reporting them as confirmed vulnerabilities. Documenting false positives helps distinguish automated detection from verified security weaknesses and prevents unnecessary remediation work. The tester should record the validation process and relevant evidence. Treating an unverified finding as a successful exploit, zero-day, or privilege escalation would produce inaccurate results and could mislead the organization about its actual security posture.

Question 45

Which attack attempts to force a victim’s browser to submit an unwanted request to a website where the victim is already authenticated?

1. Cross-site request forgery
2. Directory traversal
3. Server-side request forgery
4. SQL injection

Correct Answer: 1

Explanation

Cross-site request forgery (CSRF) abuses an authenticated user’s existing session to cause an unwanted action on a trusted web application. If an application does not adequately verify that requests originated from legitimate application interactions, a victim may unknowingly trigger actions such as changing account settings or submitting transactions. CSRF is different from SQL injection, which targets database queries, and SSRF, which causes a server to make requests to another resource. Common defenses include anti-CSRF tokens, appropriate SameSite cookie settings, and request validation.

Question 46

What is the primary purpose of CVSS in vulnerability management?

1. Encrypt vulnerability reports
2. Assign a standardized severity score
3. Discover wireless networks
4. Identify user accounts

Correct Answer: 2

Explanation

The Common Vulnerability Scoring System (CVSS) provides a standardized framework for assessing the severity of vulnerabilities. Its metrics consider factors such as attack complexity, privileges required, user interaction, scope, confidentiality impact, integrity impact, and availability impact. Organizations can use CVSS scores to help prioritize remediation, although the score should be considered alongside business criticality, exposure, exploit availability, and compensating controls. CVSS itself is not a vulnerability scanner or exploitation tool. It helps communicate the relative technical severity of discovered security issues consistently.

Question 47

During a web assessment, a tester changes an object identifier in a request and accesses another user’s record without authorization. What vulnerability is indicated?

1. CSRF
2. SSRF
3. IDOR
4. XSS

Correct Answer: 3

Explanation

Insecure Direct Object Reference (IDOR), commonly discussed alongside Broken Object Level Authorization (BOLA), occurs when an application exposes an object reference but fails to properly verify whether the requesting user is authorized to access that object. For example, changing an identifier associated with a record may expose another user’s information. The important issue is not simply that identifiers are visible, but that server-side authorization checks are insufficient. Testers should document the affected resource, authorization boundary, evidence, and business impact while staying within the engagement scope.

Question 48

Which wireless attack involves creating a fraudulent access point that imitates a legitimate network?

1. Evil twin
2. VLAN hopping
3. ARP poisoning
4. DNS tunneling

Correct Answer: 1

Explanation

An evil twin attack uses a rogue wireless access point designed to resemble a legitimate network. Users may connect to the fraudulent access point because its name appears familiar. In an authorized assessment, testers can evaluate whether wireless users or organizational controls properly distinguish trusted infrastructure from unauthorized access points. This type of assessment may reveal weaknesses in wireless authentication, user awareness, or network monitoring. VLAN hopping and ARP poisoning target different network mechanisms, while DNS tunneling is associated with covert data transfer through DNS queries.

Question 49

Which technique attempts to authenticate using passwords from a previously obtained database of username-password pairs?

1. Password spraying
2. Brute-force attack
3. Credential stuffing
4. Dictionary attack

Correct Answer: 3

Explanation

Credential stuffing uses previously compromised username and password combinations and attempts them against another service. The technique relies on password reuse rather than generating or systematically guessing passwords. Password spraying instead tests a small number of commonly used passwords across many accounts, while brute force systematically tries many possible combinations. A dictionary attack uses a wordlist of likely passwords. During authorized testing, credential-stuffing assessments can demonstrate the risks associated with password reuse and help organizations evaluate controls such as MFA, breached-password detection, rate limiting, and account monitoring.

Question 50

Which tool is commonly used to intercept, inspect, and modify HTTP requests during web application testing?

1. Wireshark
2. Burp Suite
3. Hashcat
4. BloodHound

Correct Answer: 2

Explanation

Burp Suite is widely used for web application security testing because it can intercept HTTP and HTTPS traffic between a browser and a target application. Testers can inspect requests and responses, modify parameters, analyze sessions, and investigate application behavior. Its proxy functionality is particularly useful when validating web vulnerabilities in an authorized environment. Wireshark focuses on packet analysis, Hashcat is primarily associated with password-hash recovery testing, and BloodHound helps analyze identity relationships in directory environments. Therefore, Burp Suite is the most appropriate choice for this task.

Question 51

What does an authenticated vulnerability scan provide that an unauthenticated scan may miss?

1. Physical security findings
2. External DNS ownership
3. Internal configuration and patch details
4. Wireless signal strength

Correct Answer: 3

Explanation

An authenticated vulnerability scan uses valid credentials to inspect systems from an internal, trusted perspective. This can reveal missing patches, insecure configurations, installed software versions, local vulnerabilities, and other conditions that may not be visible from outside the system. An unauthenticated scan is limited to information available without credentials and may therefore miss vulnerabilities that require local access or configuration inspection. During authorized testing, authenticated scanning can improve coverage and reduce uncertainty, although credentials should be handled securely and only used according to the engagement requirements.

Question 52

Which attack abuses weaknesses in the way a web application retrieves resources based on user-supplied URLs?

1. SSRF
2. CSRF
3. IDOR
4. XSS

Correct Answer: 1

Explanation

Server-Side Request Forgery (SSRF) occurs when an application can be influenced to make network requests based on attacker-controlled input. If improperly restricted, the server may access resources that are unavailable directly from the Internet, including internal services or administrative interfaces. During an authorized assessment, testers evaluate whether URL-fetching functionality properly restricts destinations and protocols. SSRF differs from CSRF because SSRF causes the server itself to make a request, whereas CSRF abuses a user’s authenticated browser session. Strong allowlists, network segmentation, and careful URL validation can reduce SSRF risk.

Question 53

Which Windows protocol is commonly associated with file and printer sharing?

1. LDAP
2. Kerberos
3. SMB
4. RDP

Correct Answer: 3

Explanation

Server Message Block (SMB) is commonly used in Windows environments for file and printer sharing and other network resource access. During penetration testing, SMB enumeration may reveal shared resources, server information, permissions, and configuration details. Improperly secured SMB services can expose sensitive information or provide opportunities for further authorized security assessment. LDAP is primarily associated with directory services, Kerberos provides authentication, and RDP enables remote desktop access. Understanding the role of each protocol helps testers identify appropriate services for enumeration and assess their security configurations accurately.

Question 54

A tester needs to identify hidden directories and files on a web server by comparing responses to generated paths. Which tool category is most relevant?

1. Password cracker
2. Directory and content enumerator
3. Packet analyzer
4. Hash database

Correct Answer: 2

Explanation

Directory and content enumeration tools are designed to discover web resources that are not prominently linked from an application’s visible pages. They can test potential directory and file names and compare server responses to identify potentially interesting resources. During an authorized penetration test, this can help locate forgotten administrative paths, backup files, application directories, or other exposed content. Testers should respect rate limits and engagement boundaries because excessive requests can affect application performance. Packet analyzers, password crackers, and hash databases serve different security-testing purposes.

Question 55

Which condition is most likely to indicate an overly permissive cloud storage configuration?

1. Public access to sensitive objects
2. Encrypted private objects
3. MFA-enabled administrator accounts
4. Restricted bucket policies

Correct Answer: 1

Explanation

Public access to sensitive cloud storage objects can indicate an overly permissive configuration. Depending on the service and permissions, unauthorized users may be able to read, modify, or sometimes upload content. During an authorized cloud security assessment, testers should verify access controls and determine whether exposure is intentional or accidental. Encryption and MFA can provide important protections but do not automatically prevent unauthorized public access. Proper bucket or storage policies should restrict access to only the identities and services that require it.

Question 56

What is the main purpose of a penetration testing rules-of-engagement document?

1. Replace all technical findings
2. Define authorized testing boundaries and conditions
3. Provide software installation instructions
4. Guarantee that vulnerabilities will be exploited

Correct Answer: 2

Explanation

Rules of engagement define how an authorized penetration test will be conducted. They can specify targets, excluded systems, testing windows, approved source addresses, communication procedures, emergency contacts, prohibited activities, and conditions requiring testing to stop. This document helps prevent misunderstandings between the tester and organization and provides clear boundaries for the assessment. It does not guarantee exploitation success or replace technical findings. A well-defined engagement protects both parties by establishing what activities are authorized and how unexpected situations should be handled.

Question 57

Which attack attempts to intercept traffic between two communicating systems?

1. Man-in-the-middle
2. Password spraying
3. Directory traversal
4. Credential stuffing

Correct Answer: 1

Explanation

A man-in-the-middle (MITM) attack occurs when an attacker positions themselves between communicating parties and potentially observes or manipulates traffic. The feasibility of such an attack depends on the network architecture, encryption, authentication, and other security controls. During an authorized assessment, testers may evaluate whether communications are adequately protected against interception or manipulation. Proper use of encryption, certificate validation, secure authentication, and network protections can reduce MITM risk. The other listed techniques target credentials or application resources rather than communication interception itself.

Question 58

A tester discovers that a web application accepts an unexpected HTTP method on a sensitive endpoint. What should be assessed next?

1. Monitor CPU temperature
2. Change the DNS registrar
3. Determine whether the method bypasses authorization controls
4. Replace the web server hardware

Correct Answer: 3

Explanation

Unexpectedly supported HTTP methods can create security issues when application logic or authorization controls are not consistently applied across methods. A penetration tester should determine whether the alternative method changes the endpoint’s behavior or allows an action that should be restricted. The assessment should remain within the authorized scope and avoid unnecessary impact to production systems. HTTP methods such as GET, POST, PUT, PATCH, and DELETE can have different intended purposes, so security controls should be consistently enforced regardless of the accepted method.

Question 59

Which post-exploitation activity focuses on identifying additional systems that may be accessible from a compromised host?

1. Data destruction
2. Lateral movement discovery
3. Report formatting
4. Password policy creation

Correct Answer: 2

Explanation

After gaining authorized access to a system, a tester may assess whether the compromised host provides a path toward other systems. This activity relates to lateral movement and helps determine how far an attacker could potentially progress within an environment. The tester may examine available network relationships, permissions, and accessible services while following the rules of engagement. The purpose is to demonstrate the potential impact of a security weakness rather than unnecessarily access unrelated systems. Findings should clearly describe the observed path and relevant security controls.

Question 60

Which evidence is most useful for demonstrating that a reported vulnerability was actually validated?

1. A tester’s personal opinion
2. A generic vulnerability description
3. The vendor’s marketing material
4. Captured request, response, and relevant system evidence

Correct Answer: 4

Explanation

Strong penetration-testing evidence directly demonstrates the observed security condition. Depending on the finding, this may include sanitized request and response data, screenshots, logs, command output, affected asset information, or other reproducible evidence collected during authorized testing. Evidence allows reviewers to understand how the finding was validated and supports accurate remediation. Testers should avoid collecting unnecessary sensitive information and should protect any evidence according to the engagement’s data-handling requirements. A generic description or personal opinion alone does not adequately demonstrate that a specific vulnerability was confirmed.