View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.

 

Question 161

Which tool is commonly used to identify hosts, services, and open ports on a network?

1. Nmap
2. Hashcat
3. Burp Suite
4. BloodHound

Correct Answer: 1

Explanation

Nmap is a network discovery and security auditing tool commonly used to identify hosts, open ports, and running services. During an authorized penetration test, it can help testers build an inventory of reachable systems and determine which services may require further assessment. Nmap supports multiple scanning techniques and service-detection capabilities. Results should be interpreted carefully because firewalls, filtering, and network configurations can affect scan accuracy. Testers should also ensure that all scanned addresses are explicitly included within the approved engagement scope.

Question 162

What does the principle of least privilege require?

1. Every user receives administrator access
2. Users receive only the permissions required for their tasks
3. All accounts share one password
4. Services remain publicly accessible

Correct Answer: 2

Explanation

The principle of least privilege requires users, applications, and services to receive only the permissions necessary to perform their authorized functions. Limiting privileges reduces the potential impact of compromised accounts and applications because unnecessary resources remain inaccessible. During penetration testing, excessive permissions can be an important finding when they create practical escalation or lateral-movement opportunities. Organizations should regularly review permissions, remove unnecessary access, separate administrative roles, and use dedicated privileged accounts where appropriate. Least privilege works alongside authentication, monitoring, and segmentation controls.

Question 163

Which DNS record is commonly used to provide text-based information about a domain?

1. PTR
2. TXT
3. MX
4. AAAA

Correct Answer: 2

Explanation

A TXT record stores text information associated with a DNS name. Organizations commonly use TXT records for purposes such as email-security policies, domain verification, and other service-related information. During passive reconnaissance, reviewing TXT records can sometimes reveal useful details about an organization’s external services or security configurations. However, the contents vary significantly between domains, so testers should interpret them in context. PTR records are used for reverse DNS, MX records identify mail servers, and AAAA records map names to IPv6 addresses.

Question 164

A web application places untrusted user input directly into an HTML page. Which security control is most relevant?

1. Output encoding
2. Port forwarding
3. Password spraying
4. Network routing

Correct Answer: 1

Explanation

Output encoding converts untrusted data into a form that browsers interpret as data rather than executable markup or script content. Context-appropriate output encoding is an important defense against cross-site scripting because it prevents attacker-controlled characters from being interpreted as active HTML or JavaScript. During authorized testing, testers should identify where user input is reflected or stored and determine whether the application safely handles it. Output encoding should be combined with input validation and other controls rather than treated as the only web security mechanism.

Question 165

Which assessment technique attempts to identify weaknesses by sending controlled inputs to an application and observing its responses?

1. Active testing
2. Passive reconnaissance
3. Asset disposal
4. Data classification

Correct Answer: 1

Explanation

Active testing involves directly interacting with a target by sending requests, probes, or controlled inputs and analyzing the resulting behavior. This approach can identify services, application weaknesses, authentication issues, and other security conditions that cannot always be discovered through passive information gathering. Because active testing generates traffic and may affect systems, it must remain within the authorized scope and follow defined testing limits. Passive reconnaissance, by contrast, relies on information gathered without directly probing the target infrastructure.

Question 166

Which attack involves using a fraudulent wireless access point to capture or redirect client connections?

1. Rogue access point attack
2. SQL injection
3. Kerberoasting
4. Directory traversal

Correct Answer: 1

Explanation

A rogue access point is an unauthorized wireless access point connected to or operating near an organization’s network environment. It can create security risks by allowing unauthorized network access or encouraging users to connect through infrastructure that is not controlled by the organization. During an authorized wireless assessment, testers may identify whether rogue access points can be detected and whether network access controls limit their impact. Wireless monitoring, authentication controls, network segmentation, and endpoint protections can help reduce risks associated with unauthorized access points.

Question 167

Which vulnerability occurs when an application trusts client-side authorization decisions instead of enforcing access controls on the server?

1. Broken access control
2. DNS poisoning
3. UDP scanning
4. Packet fragmentation

Correct Answer: 1

Explanation

Broken access control occurs when an application fails to properly enforce authorization restrictions. If an application relies on client-side controls, such as hidden interface elements or browser-side checks, a user may potentially bypass those controls by sending requests directly to the server. During an authorized assessment, testers should determine whether sensitive operations are protected by server-side authorization checks. Authorization should be evaluated for different users and roles rather than assuming that hiding a function in the interface prevents access.

Question 168

Which type of password attack systematically attempts many possible combinations?

1. Dictionary attack
2. Brute-force attack
3. Credential stuffing
4. Password spraying

Correct Answer: 2

Explanation

A brute-force attack systematically attempts many possible password combinations according to a defined character set or search space. Unlike dictionary attacks, which rely on likely words or passwords, brute-force methods can eventually test combinations that are not present in a predefined wordlist. During authorized testing, password-attack limits should be established to avoid account lockouts, service disruption, or excessive authentication traffic. Strong password length, MFA, rate limiting, and appropriate monitoring can make brute-force attacks significantly less practical.

Question 169

What is the purpose of an engagement contact or escalation matrix?

1. Identify who should be notified when important issues occur
2. Store password hashes
3. Identify open network ports
4. Configure DNS records

Correct Answer: 1

Explanation

An engagement contact or escalation matrix identifies the people responsible for handling different situations during a penetration test. It may include technical contacts, management contacts, emergency personnel, and individuals authorized to approve scope changes or stop testing. This information becomes particularly important when testers encounter unexpected system behavior, serious vulnerabilities, or potential service disruption. Clear communication paths help prevent delays and ensure that significant events are handled according to the agreed rules of engagement.

Question 170

Which security weakness can result when sensitive credentials are stored in plaintext configuration files?

1. Credential exposure
2. Network segmentation
3. Strong authentication
4. Secure hashing

Correct Answer: 1

Explanation

Plaintext credentials stored in configuration files can be exposed to unauthorized users, processes, backups, or source-code repositories. If an attacker gains access to the file, they may obtain credentials without needing to recover them from a protected representation. During authorized testing, testers should document the location and sensitivity of exposed credentials while minimizing unnecessary disclosure. Secure secret-management systems, restricted file permissions, credential rotation, and avoiding hard-coded secrets can reduce this risk. Credentials should be protected both at rest and during transmission.

Question 171

Which cloud control helps restrict which network locations can access a cloud resource?

1. Network security group or equivalent firewall rule
2. Password dictionary
3. DNS TXT record
4. Document metadata

Correct Answer: 1

Explanation

Cloud network security controls, such as security groups or equivalent firewall policies, can restrict inbound and outbound traffic based on addresses, ports, protocols, or other conditions. During an authorized cloud assessment, testers can review whether sensitive services are unnecessarily exposed and whether access rules match the intended architecture. Overly broad rules can increase attack surface, particularly when administrative services are accessible from untrusted networks. Restricting network access should be combined with strong authentication, least privilege, encryption, monitoring, and secure service configurations.

Question 172

A tester observes that an API accepts a user’s token but does not verify the requested operation against the user’s role. What should be investigated?

1. Broken function-level authorization
2. DNS recursion
3. Wireless encryption
4. Packet capture

Correct Answer: 1

Explanation

Broken function-level authorization occurs when users can access application functions that should be restricted based on their role or privileges. Authentication establishes identity, but the application must also verify whether that identity is authorized to perform each requested operation. During an authorized API assessment, testers should compare behavior across roles and determine whether restricted functions can be invoked directly. Server-side authorization checks should be applied consistently to sensitive operations rather than relying on client-side interface restrictions or assumptions about user behavior.

Question 173

Which tool is commonly used to inspect and manipulate web requests during an API security assessment?

1. Burp Suite
2. Nmap
3. Wireshark
4. Hashcat

Correct Answer: 1

Explanation

Burp Suite provides functionality for intercepting, inspecting, and modifying HTTP and HTTPS requests, making it useful for web and API security assessments. Testers can examine parameters, headers, cookies, authentication tokens, and server responses to understand how an API handles different requests. This can support testing of authorization, input validation, session management, and other security controls. Nmap focuses on network discovery, Wireshark analyzes captured network packets, and Hashcat is primarily associated with password-hash recovery testing.

Question 174

Which finding indicates that a web application is using an expired TLS certificate?

1. Certificate validation failure
2. Strong password policy
3. Secure cookie attribute
4. Network segmentation

Correct Answer: 1

Explanation

An expired TLS certificate can cause certificate validation warnings or failures when clients connect to the affected service. During an authorized assessment, certificate configuration should be reviewed for expiration, hostname mismatches, weak configurations, and inappropriate trust relationships. An expired certificate may disrupt legitimate users and can indicate weaknesses in certificate lifecycle management. Automated monitoring and renewal processes can reduce this risk. TLS certificate problems are separate from password policies, cookies, and network segmentation, although all may contribute to a broader security assessment.

Question 175

What is the main purpose of network access control lists?

1. Control permitted or denied network traffic
2. Recover deleted passwords
3. Identify document authors
4. Create software backups

Correct Answer: 1

Explanation

Network access control lists (ACLs) define rules that permit or deny traffic based on characteristics such as source and destination addresses, protocols, and ports. During penetration testing, ACLs can be evaluated to determine whether communication restrictions match the organization’s intended security architecture. Overly permissive rules may expose services unnecessarily, while overly restrictive rules can interfere with legitimate operations. Effective ACLs should be reviewed regularly and combined with segmentation, authentication, monitoring, and secure service configurations to provide layered network protection.

Question 176

Which vulnerability involves an application accepting a file upload without adequately validating its type or content?

1. Unrestricted file upload
2. Password spraying
3. DNS poisoning
4. ARP spoofing

Correct Answer: 1

Explanation

An unrestricted file-upload vulnerability occurs when an application accepts uploaded files without adequate validation of their type, content, size, name, or storage location. Depending on the application architecture, unsafe uploads may expose sensitive information, enable malicious content hosting, or create more serious security consequences. During authorized testing, testers should carefully evaluate upload controls without causing unnecessary system impact. Strong defenses include allowlisting permitted file types, validating file content, generating safe filenames, storing uploads outside executable directories, and enforcing appropriate permissions.

Question 177

Which reconnaissance technique uses information from search engines to locate publicly indexed target resources?

1. Search engine reconnaissance
2. Privilege escalation
3. Credential stuffing
4. Token replay

Correct Answer: 1

Explanation

Search engine reconnaissance uses publicly indexed information to identify domains, documents, pages, technologies, and other resources associated with a target. This passive technique can reveal information that an organization may not realize is publicly discoverable. During an authorized assessment, testers can use search results to supplement other reconnaissance sources and identify assets for scope verification. Public indexing does not automatically mean an asset is authorized for testing, so discovered systems should be checked against the engagement boundaries before active interaction occurs.

Question 178

Which security control is designed to detect suspicious activity and generate alerts for investigation?

1. Intrusion detection system
2. File compression
3. DNS resolver
4. Load balancer

Correct Answer: 1

Explanation

An Intrusion Detection System (IDS) monitors activity for patterns or events associated with potential attacks and can generate alerts for security teams. Network-based and host-based IDS technologies can provide visibility into suspicious traffic, system behavior, and known attack indicators. During a penetration test, testers may evaluate whether authorized activity is detected and whether alerts reach the appropriate monitoring team. Detection systems are not preventive controls by themselves, but they can support rapid investigation and response when combined with logging, analysis, and incident-response procedures.

Question 179

Which approach provides the tester with no internal credentials or architecture details before testing begins?

1. White-box testing
2. Gray-box testing
3. Black-box testing
4. Credentialed scanning

Correct Answer: 3

Explanation

Black-box testing begins with little or no internal information about the target environment. The tester generally approaches the assessment from an external perspective and gathers information through permitted reconnaissance and testing activities. This can provide insight into what an attacker with limited prior knowledge might discover. White-box testing provides extensive internal information, while gray-box testing provides partial information. The chosen methodology should be documented in the engagement plan because it affects testing depth, assumptions, available resources, and expected assessment coverage.

Question 180

What should be done with sensitive credentials discovered during a penetration test after they are no longer needed?

1. Retain them indefinitely
2. Dispose of them according to the agreed data-handling procedure
3. Publish them in the final report
4. Share them with unrelated personnel

Correct Answer: 2

Explanation

Sensitive credentials collected during an authorized penetration test should be handled according to the engagement’s data-retention, protection, and destruction requirements. Once the credentials are no longer necessary, they should be securely disposed of or otherwise handled according to the agreed procedure. Testers should avoid retaining unnecessary sensitive material because it creates additional security risk. Reports should generally contain only the evidence necessary to explain the finding, with secrets sanitized or redacted where appropriate. Proper credential handling protects both the organization and the testing team.