View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.

 

Question 121

Which tool is commonly used for automated web directory and file discovery?

1. Hashcat
2. Gobuster
3. Wireshark
4. BloodHound

Correct Answer: 2

Explanation

Gobuster is commonly used during authorized security assessments to discover directories, files, DNS subdomains, and other resources depending on its configuration. For web testing, it can help identify hidden application paths that are not linked from visible pages. Discovering these resources may reveal forgotten administrative interfaces, backup files, or other potentially exposed content. Testers should use appropriate request rates and remain within the approved scope. Hashcat focuses on password recovery, Wireshark analyzes network traffic, and BloodHound focuses on relationships within directory environments.

Question 122

What does the HTTP status code 404 generally indicate?

1. Unauthorized access
2. Server error
3. Resource not found
4. Successful request

Correct Answer: 3

Explanation

HTTP status code 404 generally indicates that the requested resource could not be found on the server. During web application testing, response codes can provide useful clues about whether a requested path exists, has been removed, or is intentionally hidden. However, applications sometimes customize error responses, so testers should not rely solely on status codes when performing content discovery. A 401 generally relates to authentication requirements, 403 indicates that access is forbidden, and 200 commonly represents a successful response.

Question 123

Which attack abuses a browser’s trust in an authenticated session to perform an unwanted action?

1. CSRF
2. SSRF
3. SQL injection
4. Kerberoasting

Correct Answer: 1

Explanation

Cross-Site Request Forgery (CSRF) takes advantage of an authenticated user’s existing session to cause a web application to process an unintended request. If the application does not adequately verify the legitimacy of sensitive requests, a malicious site or crafted interaction may cause actions to occur using the victim’s existing privileges. Effective defenses can include anti-CSRF tokens, appropriate SameSite cookie settings, and additional request validation. CSRF targets the relationship between a user’s browser and an application, whereas SSRF causes the server to make requests to another destination.

Question 124

Which reconnaissance source may reveal information embedded in publicly shared office documents?

1. Document metadata
2. ARP cache
3. TCP handshake
4. Firewall state table

Correct Answer: 1

Explanation

Document metadata can contain information such as author names, usernames, software versions, creation dates, or organizational details. During passive reconnaissance, publicly available documents can therefore provide useful intelligence about a target’s technology and personnel. Metadata should be reviewed carefully because its presence depends on the file type and how the document was created or sanitized. Organizations can reduce unnecessary exposure by removing metadata from documents before publication. Penetration testers should collect only information relevant to the engagement and respect privacy and scope requirements.

Question 125

Which vulnerability occurs when an application executes operating-system commands using insufficiently validated user input?

1. Command injection
2. CSRF
3. IDOR
4. Open redirect

Correct Answer: 1

Explanation

Command injection occurs when an application incorporates untrusted input into operating-system commands without adequate validation or safe handling. If exploitable, this weakness may allow unintended commands to execute with the application’s privileges. During authorized testing, testers should validate the security boundary carefully and avoid unnecessary system changes. Secure development practices include avoiding shell execution when unnecessary, using safe APIs, applying strict input validation, and restricting process privileges. Command injection is distinct from SQL injection, which targets database query processing rather than operating-system command execution.

Question 126

A tester finds an exposed API key in a publicly accessible source file. What should be assessed first?

1. The color scheme of the application
2. The key’s permissions and potential impact
3. The monitor resolution
4. The DNS TTL

Correct Answer: 2

Explanation

An exposed API key should be assessed to determine what services or resources it can access and what privileges are associated with it. The tester should avoid unnecessary actions and collect only enough evidence to demonstrate the security impact. If the key provides access to sensitive resources, the finding may require prompt escalation according to the rules of engagement. Organizations should avoid embedding secrets in publicly accessible source code and should use secure secret-management mechanisms, appropriate access restrictions, rotation, and monitoring.

Question 127

Which protocol is commonly used for centralized directory services and querying user or organizational information?

1. LDAP
2. FTP
3. SMTP
4. SNMP

Correct Answer: 1

Explanation

Lightweight Directory Access Protocol (LDAP) is commonly used to access and query directory services containing information about users, groups, computers, and organizational resources. In enterprise environments, LDAP may be associated with directory platforms such as Active Directory and other identity systems. During authorized testing, LDAP enumeration can help identify exposed directory information and assess access controls. FTP is primarily used for file transfer, SMTP handles email transmission, and SNMP is used for network management and monitoring. Proper LDAP access controls help prevent unnecessary disclosure of directory information.

Question 128

Which attack attempts to exploit a flaw in a web application by causing the server to make a request to an unintended internal resource?

1. XSS
2. SSRF
3. CSRF
4. Password spraying

Correct Answer: 2

Explanation

Server-Side Request Forgery (SSRF) occurs when an application can be manipulated into making requests to destinations controlled or influenced by an attacker. The security concern becomes especially significant when the server can reach internal services that are not directly accessible from outside the network. During authorized testing, the objective is to determine whether destination restrictions and network controls are effective without unnecessarily accessing sensitive resources. Defenses can include strict destination allowlists, network segmentation, URL validation, and limiting the application’s ability to access internal administrative services.

Question 129

Which authentication protocol is commonly associated with ticket-based authentication in Active Directory environments?

1. Kerberos
2. FTP
3. HTTP
4. DNS

Correct Answer: 1

Explanation

Kerberos is a ticket-based authentication protocol widely used in Active Directory environments. Instead of repeatedly sending a user’s password to each service, Kerberos uses tickets issued by trusted components within the authentication infrastructure. During penetration testing, understanding Kerberos is important for assessing authentication relationships, service accounts, delegation, and potential credential-related weaknesses. Security controls include protecting privileged credentials, monitoring authentication activity, maintaining secure time synchronization, and minimizing unnecessary privileges. Kerberos is fundamentally different from application protocols such as HTTP or infrastructure protocols such as DNS.

Question 130

Which finding most strongly suggests that a server is exposing unnecessary services?

1. Only required services are accessible
2. Multiple unused services are reachable from untrusted networks
3. Administrative access requires MFA
4. Security patches are current

Correct Answer: 2

Explanation

Multiple unnecessary services exposed to untrusted networks can increase a server’s attack surface. Each reachable service may contain vulnerabilities, weak configurations, or authentication weaknesses that could provide an entry point for an attacker. During authorized testing, service enumeration helps identify what is actually exposed and whether those services are required for business operations. Organizations can reduce exposure by disabling unused services and restricting necessary services through firewalls, segmentation, and access controls. Minimizing externally reachable services is an important component of attack-surface reduction.

Question 131

What is the primary purpose of a proof of concept in a penetration test report?

1. Demonstrate that a finding can be validated
2. Replace remediation guidance
3. Hide the affected asset
4. Increase the report’s page count

Correct Answer: 1

Explanation

A proof of concept (PoC) provides evidence that a reported security weakness can be demonstrated under the conditions of the assessment. It may include sanitized screenshots, relevant request and response information, logs, or other evidence appropriate to the finding. A PoC should be sufficient to support the conclusion without unnecessarily exposing sensitive data or causing additional impact. During authorized testing, testers should document the conditions and limitations of the demonstration clearly. Remediation guidance remains a separate part of the finding.

Question 132

Which tool is primarily associated with identifying vulnerabilities through automated network and host scanning?

1. Nessus
2. Netcat
3. Burp Suite
4. John the Ripper

Correct Answer: 1

Explanation

Nessus is a vulnerability assessment platform commonly used to scan systems for known vulnerabilities, missing patches, configuration weaknesses, and other security issues. It can examine hosts and services and produce findings based on its vulnerability detection capabilities. Automated results should still be reviewed because scanners can generate false positives, miss context-specific issues, or interpret version information incorrectly. Netcat is a network utility, Burp Suite focuses on web application testing, and John the Ripper is primarily used for password-recovery testing.

Question 133

A tester wants to determine whether a web server supports an HTTP method that should not be available on a sensitive endpoint. What should be reviewed?

1. Allowed HTTP methods and their authorization behavior
2. CPU manufacturer
3. Keyboard layout
4. DNS registrar

Correct Answer: 1

Explanation

Reviewing supported HTTP methods can reveal whether an endpoint permits actions beyond those intended by the application design. Methods such as GET, POST, PUT, PATCH, and DELETE can have different security implications depending on how they are implemented. A tester should determine whether unsupported or unexpected methods are accepted and whether authentication and authorization controls are consistently enforced. During authorized testing, the goal is to identify a security weakness without causing unnecessary changes. Proper method restrictions and server-side authorization checks can reduce this risk.

Question 134

Which wireless security standard provides stronger modern protections than WPA2?

1. WEP
2. WPA
3. WPA3
4. Open authentication

Correct Answer: 3

Explanation

WPA3 is a newer Wi-Fi security standard designed to provide stronger protections than earlier standards such as WPA and WPA2. It introduces improvements to authentication and cryptographic protections, although the exact security benefits depend on the deployment mode and configuration. During an authorized wireless assessment, testers can identify which security standard is being used and whether legacy or insecure configurations remain enabled. WEP is obsolete and vulnerable, while open authentication provides no comparable wireless encryption or authentication protection.

Question 135

Which activity involves identifying the security impact of a vulnerability after initial discovery?

1. Vulnerability validation
2. Logo design
3. Asset disposal
4. Network cabling

Correct Answer: 1

Explanation

Vulnerability validation determines whether a suspected security issue is genuine and helps establish its practical impact. Automated scanners may identify potential weaknesses, but manual validation can determine whether the issue is exploitable under the actual configuration and whether compensating controls change the risk. Testers should use controlled methods and remain within the engagement scope. Proper validation improves report accuracy and helps organizations prioritize remediation based on evidence rather than unverified scanner output or assumptions.

Question 136

What is a common purpose of a web application proxy during penetration testing?

1. Inspect and modify HTTP traffic
2. Recover deleted files
3. Discover Wi-Fi channels
4. Assign IP addresses

Correct Answer: 1

Explanation

A web application proxy sits between a tester’s browser and the target application, allowing HTTP and HTTPS requests and responses to be inspected and, where authorized, modified. This capability is useful for analyzing parameters, cookies, headers, authentication flows, and application behavior. Tools such as Burp Suite provide proxy functionality specifically designed for web security testing. A proxy does not itself replace vulnerability validation or guarantee exploitation. Testers should use it responsibly and ensure that modifications remain within the approved assessment boundaries.

Question 137

Which activity is most closely associated with determining what information a compromised system can access?

1. Post-exploitation assessment
2. Password policy creation
3. DNS registration
4. Asset disposal

Correct Answer: 1

Explanation

Post-exploitation assessment examines the security implications after authorized access to a system has been established. Testers may evaluate accessible resources, privileges, trust relationships, and potential paths to additional systems while following strict engagement limits. The purpose is to demonstrate the consequences of the initial weakness and determine how far an attacker could potentially progress. Testers should avoid unnecessary data access or destructive activity. Findings should clearly explain the relationship between the initial compromise, available privileges, and potential business impact.

Question 138

Which practice helps protect sensitive penetration-testing evidence?

1. Store it using appropriate access controls and encryption
2. Upload it to a public file-sharing service
3. Share it with unrelated employees
4. Leave it on an unmanaged device

Correct Answer: 1

Explanation

Penetration-testing evidence can contain credentials, personal information, configuration details, screenshots, logs, or other sensitive material. It should therefore be protected with appropriate access controls, secure storage, encryption where suitable, and defined retention and destruction procedures. Testers should collect only the information necessary to support their findings. Publicly sharing evidence or storing it on unmanaged devices can create additional security risks. Proper evidence handling is part of professional testing practice and should follow the organization’s requirements and the engagement agreement.

Question 139

Which attack relies on previously leaked credentials being reused against another service?

1. Credential stuffing
2. Password spraying
3. Brute force
4. Deauthentication

Correct Answer: 1

Explanation

Credential stuffing uses previously compromised username and password combinations against another service, relying on users reusing credentials across multiple platforms. It differs from password spraying, which applies a small number of common passwords across many accounts, and brute force, which systematically tries many possible combinations. During an authorized assessment, credential testing should be carefully controlled to avoid account lockouts or unnecessary disruption. Organizations can reduce credential-stuffing risk through MFA, breached-password detection, unique passwords, rate limiting, and monitoring for unusual authentication activity.

Question 140

What should be included when reporting a high-severity vulnerability?

1. Only the vulnerability name
2. Evidence, impact, affected assets, severity, and remediation
3. Only the tester’s contact information
4. Only the scan date

Correct Answer: 2

Explanation

A high-severity finding should provide enough information for stakeholders to understand the security issue and take corrective action. Useful details commonly include the affected asset, vulnerability description, evidence, severity rationale, potential impact, and recommended remediation. Depending on the engagement, reproduction information and relevant limitations may also be included. Clear reporting helps technical teams investigate and fix the issue while allowing management to understand its broader significance. Reporting only a vulnerability name or scan date would not provide sufficient context for effective remediation.