{"id":17031,"date":"2026-09-21T06:06:56","date_gmt":"2026-09-21T06:06:56","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=17031"},"modified":"2026-09-21T06:06:56","modified_gmt":"2026-09-21T06:06:56","slug":"comptia-pentest-pt0-003-practice-test-questions-and-exam-dumps-part6-q101-120","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/comptia-pentest-pt0-003-practice-test-questions-and-exam-dumps-part6-q101-120\/","title":{"rendered":"CompTIA Pentest+ PT0-003 Practice Test Questions and Exam Dumps Part6 Q101-120"},"content":{"rendered":"

View Full <\/b>CompTIA PT0-003 Exam Dumps<\/b><\/a> and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 101<\/b><\/h3>\n

Which reconnaissance method uses publicly available information to identify details about a target?<\/b><\/p>\n

    \n
  1. Active exploitation<\/span><\/li>\n
  2. Privilege escalation<\/span><\/li>\n
  3. OSINT<\/span><\/li>\n
  4. Persistence<\/span><\/li>\n<\/ol>\n

    Correct Answer: 3<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    Open-source intelligence (OSINT) involves collecting and analyzing publicly available information about a target. During an authorized penetration test, OSINT can reveal domains, technology references, employee information, public documents, infrastructure details, and other useful intelligence without directly attacking the target. Sources may include search engines, public records, company websites, certificate information, and archived material. OSINT helps testers understand the external attack surface before active testing begins. Information gathered should remain within the engagement scope and should be handled responsibly when it contains sensitive organizational details.<\/span><\/p>\n

    Question 102<\/b><\/h3>\n

    What is the main purpose of an ASN during external reconnaissance?<\/b><\/p>\n

      \n
    1. To identify an organization’s announced network ranges<\/span><\/li>\n
    2. To decrypt HTTPS traffic<\/span><\/li>\n
    3. To recover password hashes<\/span><\/li>\n
    4. To bypass MFA<\/span><\/li>\n<\/ol>\n

      Correct Answer: 1<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      An Autonomous System Number (ASN) identifies an autonomous system that participates in Internet routing. During external reconnaissance, ASN information can help testers identify IP address ranges publicly associated with an organization or network provider. This can assist with building an authorized external attack-surface inventory. ASN information does not provide passwords or decrypt encrypted traffic. Because organizations may use cloud providers, hosting companies, content delivery networks, and third-party infrastructure, testers should verify whether discovered ranges are actually within the approved scope before performing active testing.<\/span><\/p>\n

      Question 103<\/b><\/h3>\n

      Which scan is specifically designed to identify services running over UDP?<\/b><\/p>\n

        \n
      1. TCP SYN scan<\/span><\/li>\n
      2. UDP scan<\/span><\/li>\n
      3. TCP connect scan<\/span><\/li>\n
      4. Idle scan<\/span><\/li>\n<\/ol>\n

        Correct Answer: 2<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        A UDP scan is designed to identify services operating over the User Datagram Protocol. UDP differs from TCP because it does not establish connections through a conventional handshake, so determining whether a port is open can require different probing techniques and interpretation. Some UDP services may respond only to valid application-specific requests, while firewalls can also affect results. During an authorized assessment, testers should account for these limitations and avoid interpreting an unanswered UDP probe as definitive proof that a service is unavailable.<\/span><\/p>\n

        Question 104<\/b><\/h3>\n

        Which vulnerability occurs when an application fails to properly restrict an authenticated user’s access to another user’s data?<\/b><\/p>\n

          \n
        1. CSRF<\/span><\/li>\n
        2. XSS<\/span><\/li>\n
        3. IDOR<\/span><\/li>\n
        4. SSRF<\/span><\/li>\n<\/ol>\n

          Correct Answer: 3<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          Insecure Direct Object Reference (IDOR) occurs when an application exposes references to objects but fails to enforce proper authorization when those objects are requested. A user may therefore access another user’s record by manipulating an identifier or reference. The core issue is insufficient server-side authorization rather than the visibility of the identifier itself. During authorized testing, testers should validate access controls carefully and collect only the evidence necessary to demonstrate the problem. Proper object-level authorization checks should be applied to every sensitive resource request.<\/span><\/p>\n

          Question 105<\/b><\/h3>\n

          Which HTTP response header can help restrict where a browser is allowed to load certain types of content from?<\/b><\/p>\n

            \n
          1. Content-Security-Policy<\/span><\/li>\n
          2. Server<\/span><\/li>\n
          3. Host<\/span><\/li>\n
          4. Referer<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            The Content-Security-Policy (CSP) header allows a web application to define restrictions on the sources from which browsers may load scripts, styles, images, frames, and other content. A properly configured CSP can reduce the impact of certain client-side attacks, particularly some forms of cross-site scripting. It should be considered an additional security layer rather than a substitute for secure coding and output encoding. During an authorized web assessment, testers can review whether CSP is present, appropriately restrictive, and consistent with the application’s actual security requirements.<\/span><\/p>\n

            Question 106<\/b><\/h3>\n

            Which technique is commonly used to test whether a web application improperly trusts user-controlled redirect destinations?<\/b><\/p>\n

              \n
            1. Open redirect testing<\/span><\/li>\n
            2. Password spraying<\/span><\/li>\n
            3. ARP inspection<\/span><\/li>\n
            4. VLAN hopping<\/span><\/li>\n<\/ol>\n

              Correct Answer: 1<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              Open redirect vulnerabilities occur when an application accepts a user-controlled destination and redirects the browser without adequately validating where the user will be sent. Attackers may abuse trusted domains to make malicious links appear more legitimate or to support phishing campaigns. During an authorized assessment, testers can determine whether redirect parameters are restricted to approved destinations or validated appropriately. Secure applications should avoid unrestricted redirects and use controlled destination lists or safe redirect mechanisms. Open redirect is primarily a web application issue rather than a network-layer attack.<\/span><\/p>\n

              Question 107<\/b><\/h3>\n

              A security team wants to identify outdated software packages installed on a host. Which assessment capability is most useful?<\/b><\/p>\n

                \n
              1. Vulnerability scanning<\/span><\/li>\n
              2. Social engineering<\/span><\/li>\n
              3. Wireless deauthentication<\/span><\/li>\n
              4. DNS poisoning<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                Vulnerability scanning can identify outdated software and compare detected versions against known security issues. Depending on the scanner and configuration, it may also identify missing patches, insecure settings, and vulnerable components. Authenticated scanning can provide deeper visibility into installed packages and local configuration than an external scan alone. Scanner results should be reviewed and validated because version detection can sometimes be inaccurate or affected by backported security patches. Combining automated scanning with manual verification provides a more reliable assessment of the host’s actual security condition.<\/span><\/p>\n

                Question 108<\/b><\/h3>\n

                What is the primary purpose of a reverse shell in an authorized penetration test?<\/b><\/p>\n

                  \n
                1. Allow a compromised system to initiate a connection back to the tester<\/span><\/li>\n
                2. Enumerate DNS records<\/span><\/li>\n
                3. Encrypt a database<\/span><\/li>\n
                4. Identify wireless channels<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 1<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  A reverse shell establishes an interactive command session in which the target system initiates a connection back to a designated testing system. In authorized penetration testing, this concept can demonstrate the practical impact of a vulnerability that permits command execution. Testers must ensure that such activity is explicitly authorized because command sessions can provide significant access to a system. The assessment should minimize unnecessary actions and avoid accessing or modifying unrelated data. Reverse shells are distinct from reconnaissance techniques because they represent post-exploitation access.<\/span><\/p>\n

                  Question 109<\/b><\/h3>\n

                  Which authentication weakness occurs when an application allows unlimited login attempts without effective protections?<\/b><\/p>\n

                    \n
                  1. Broken access control<\/span><\/li>\n
                  2. Unrestricted authentication attempts<\/span><\/li>\n
                  3. DNS misconfiguration<\/span><\/li>\n
                  4. Certificate expiration<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 2<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    Allowing unlimited authentication attempts without appropriate controls can increase exposure to password guessing and automated credential attacks. Effective protections may include rate limiting, account lockout mechanisms where appropriate, adaptive authentication, monitoring, and multi-factor authentication. During authorized testing, testers should assess these controls carefully and follow defined limits to avoid unnecessary account disruption. The absence of restrictions does not automatically mean an account is compromised, but it can significantly increase the feasibility of repeated credential attempts. Authentication defenses should be evaluated alongside password and MFA policies.<\/span><\/p>\n

                    Question 110<\/b><\/h3>\n

                    Which network attack attempts to redirect traffic by providing false ARP information?<\/b><\/p>\n

                      \n
                    1. DNS poisoning<\/span><\/li>\n
                    2. ARP spoofing<\/span><\/li>\n
                    3. SQL injection<\/span><\/li>\n
                    4. Kerberoasting<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 2<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      ARP spoofing manipulates Address Resolution Protocol information on a local network so devices associate an attacker’s hardware address with another IP address. This can potentially redirect traffic through the attacker’s system and create opportunities for interception. During an authorized penetration test, the technique can help determine whether network controls adequately protect against local-layer manipulation. Security measures such as Dynamic ARP Inspection, proper switch configuration, segmentation, and encrypted application traffic can reduce the potential impact. ARP spoofing operates at the local network level rather than the application or DNS layer.<\/span><\/p>\n

                      Question 111<\/b><\/h3>\n

                      Which tool is commonly associated with automated exploitation and payload management during penetration testing?<\/b><\/p>\n

                        \n
                      1. Metasploit<\/span><\/li>\n
                      2. Wireshark<\/span><\/li>\n
                      3. Gobuster<\/span><\/li>\n
                      4. Nessus<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        Metasploit is a penetration-testing framework that provides modules for vulnerability validation, exploitation, payload handling, and related security assessment tasks. In authorized engagements, it can help testers demonstrate whether a known weakness is practically exploitable. Its modules and capabilities should only be used against systems explicitly included in the engagement scope. Wireshark focuses on packet analysis, Gobuster is commonly used for content enumeration, and Nessus is primarily associated with vulnerability scanning. Metasploit therefore fits the requirement for an exploitation-oriented testing framework.<\/span><\/p>\n

                        Question 112<\/b><\/h3>\n

                        A tester discovers a backup file containing application configuration information in a publicly accessible web directory. What should be assessed first?<\/b><\/p>\n

                          \n
                        1. Whether the file exposes sensitive information<\/span><\/li>\n
                        2. Whether the website uses a dark theme<\/span><\/li>\n
                        3. Whether the DNS TTL is short<\/span><\/li>\n
                        4. Whether the server supports IPv6<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 1<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          A publicly accessible backup file may expose configuration details, credentials, API keys, database information, source code, or other sensitive data. The tester should determine the nature and sensitivity of the exposed information while collecting only the minimum evidence required to demonstrate the finding. During an authorized assessment, unnecessary downloading or disclosure of sensitive data should be avoided. Backup files should generally be stored outside publicly accessible web directories, and sensitive values should not be embedded in files that can be retrieved without appropriate authentication.<\/span><\/p>\n

                          Question 113<\/b><\/h3>\n

                          Which attack targets a web application’s handling of database queries by injecting crafted input?<\/b><\/p>\n

                            \n
                          1. SQL injection<\/span><\/li>\n
                          2. CSRF<\/span><\/li>\n
                          3. IDOR<\/span><\/li>\n
                          4. SSRF<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            SQL injection occurs when untrusted input is incorporated into database queries without adequate protection. A successful SQL injection may allow unauthorized database interaction, depending on the application’s architecture and database permissions. During authorized penetration testing, testers can assess whether input is safely handled and whether parameterized queries or equivalent protections are implemented. The issue can potentially affect confidentiality, integrity, and availability. Secure development practices such as prepared statements, parameterized queries, appropriate input handling, and restricted database privileges can significantly reduce SQL injection risk.<\/span><\/p>\n

                            Question 114<\/b><\/h3>\n

                            What is the main purpose of network segmentation during a penetration test?<\/b><\/p>\n

                              \n
                            1. To increase Internet bandwidth<\/span><\/li>\n
                            2. To determine whether access between security zones is properly restricted<\/span><\/li>\n
                            3. To create stronger passwords<\/span><\/li>\n
                            4. To identify employee names<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 2<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              Testing network segmentation determines whether communication between different security zones is restricted according to organizational policy. A properly segmented environment can limit an attacker’s ability to move from a compromised system into sensitive networks. During an authorized assessment, testers may evaluate whether permitted and prohibited communication paths match the documented design. Weak segmentation can increase the potential impact of a compromise. Firewalls, access-control lists, routing policies, and identity-based controls can all contribute to effective segmentation and should be considered when interpreting test results.<\/span><\/p>\n

                              Question 115<\/b><\/h3>\n

                              Which file is commonly associated with manually mapping hostnames to IP addresses on a Unix-like system?<\/b><\/p>\n

                                \n
                              1. \/etc\/hosts<\/span><\/li>\n
                              2. \/etc\/shadow<\/span><\/li>\n
                              3. \/var\/log\/auth.log<\/span><\/li>\n
                              4. \/etc\/fstab<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                The <\/span>\/etc\/hosts<\/span> file provides local hostname-to-IP address mappings on many Unix-like systems. During authorized troubleshooting or security testing, reviewing this file can reveal manually configured hosts that may not be represented in normal DNS queries. It can therefore provide useful information about local system configuration and naming. The <\/span>\/etc\/shadow<\/span> file stores password-related account information in protected form, <\/span>\/var\/log\/auth.log<\/span> commonly contains authentication events on applicable systems, and <\/span>\/etc\/fstab<\/span> defines filesystem mounting information.<\/span><\/p>\n

                                Question 116<\/b><\/h3>\n

                                Which attack attempts to trick users into connecting to a fraudulent wireless network that resembles a trusted one?<\/b><\/p>\n

                                  \n
                                1. Evil twin<\/span><\/li>\n
                                2. SQL injection<\/span><\/li>\n
                                3. NTLM relay<\/span><\/li>\n
                                4. Directory traversal<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 1<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  An evil twin attack creates a fraudulent wireless access point that imitates a legitimate network. Users may connect because the network name appears familiar, potentially exposing their traffic or authentication activity depending on the circumstances. During authorized wireless assessments, testers can use controlled scenarios to evaluate whether users and technical controls can distinguish legitimate access points from rogue infrastructure. Wireless security policies, certificate validation, protected authentication, network monitoring, and user awareness can help reduce exposure. Evil twin attacks specifically target wireless trust rather than application input or directory permissions.<\/span><\/p>\n

                                  Question 117<\/b><\/h3>\n

                                  A tester needs to determine whether a discovered service is actually running the software version reported by a scanner. What is the best approach?<\/b><\/p>\n

                                    \n
                                  1. Manually validate the service<\/span><\/li>\n
                                  2. Immediately report it as confirmed<\/span><\/li>\n
                                  3. Delete the scanner result<\/span><\/li>\n
                                  4. Ignore the version information<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    Manual validation helps determine whether automated service and version detection accurately represents the target. Scanner signatures can sometimes identify software incorrectly, particularly when applications hide banners, use proxies, backported patches, or customized responses. Confirming the service can involve reviewing authorized service responses, application behavior, configuration information, or other appropriate evidence. Validation is especially important when a reported version is associated with a serious vulnerability. Accurate verification reduces false positives and ensures that remediation recommendations are based on the actual technology deployed.<\/span><\/p>\n

                                    Question 118<\/b><\/h3>\n

                                    Which control can help prevent unauthorized users from accessing an administrative interface exposed to the Internet?<\/b><\/p>\n

                                      \n
                                    1. Network access restrictions<\/span><\/li>\n
                                    2. Public directory listings<\/span><\/li>\n
                                    3. Shared passwords<\/span><\/li>\n
                                    4. Unrestricted firewall rules<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 1<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      Network access restrictions can limit administrative interfaces to trusted networks, VPN connections, approved source addresses, or other authorized access paths. Reducing Internet exposure can significantly decrease the number of systems and users that can reach sensitive administrative services. Additional protections such as MFA, strong authentication, monitoring, and secure configuration should also be considered. During penetration testing, testers may assess whether administrative endpoints are reachable from unauthorized locations and whether access controls operate as intended. Exposing administrative interfaces publicly without appropriate restrictions can increase attack surface.<\/span><\/p>\n

                                      Question 119<\/b><\/h3>\n

                                      Which technique attempts to use previously captured Kerberos authentication material to access another service or session?<\/b><\/p>\n

                                        \n
                                      1. Pass-the-ticket<\/span><\/li>\n
                                      2. Password spraying<\/span><\/li>\n
                                      3. Open redirect<\/span><\/li>\n
                                      4. DNS enumeration<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 1<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        Pass-the-ticket involves using a captured Kerberos ticket to authenticate to services without obtaining the user’s plaintext password. In an authorized assessment, this technique can demonstrate the potential consequences of compromised Kerberos authentication material and excessive privileges. Defenses include protecting privileged accounts, limiting ticket exposure, monitoring unusual authentication activity, and applying appropriate credential-security practices. Pass-the-ticket differs from password attacks because it relies on authentication tickets rather than repeatedly guessing or reusing password credentials.<\/span><\/p>\n

                                        Question 120<\/b><\/h3>\n

                                        What should a tester do if an assessment reveals evidence of an unexpected high-impact compromise outside the planned test path?<\/b><\/p>\n

                                          \n
                                        1. Continue expanding access without notification<\/span><\/li>\n
                                        2. Stop or follow the defined escalation procedure<\/span><\/li>\n
                                        3. Delete the evidence<\/span><\/li>\n
                                        4. Publish the finding immediately<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 2<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          Unexpected high-impact findings should be handled according to the engagement’s predefined escalation and stop procedures. Depending on the rules of engagement, the tester may need to pause the activity, preserve appropriate evidence, and notify the designated contact. Continuing to expand access without authorization can create unnecessary operational and legal risk. Publishing information independently is also inappropriate. Clear escalation procedures allow organizations and testers to respond consistently when testing reveals a serious condition that could affect production systems, sensitive information, or critical business operations.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.   Question 101 Which reconnaissance method uses publicly available information to identify details about a target? Active exploitation Privilege escalation OSINT Persistence Correct Answer: 3 Explanation Open-source intelligence (OSINT) involves collecting and analyzing publicly available information about a target. During an authorized penetration test, OSINT […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17031"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=17031"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17031\/revisions"}],"predecessor-version":[{"id":17032,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17031\/revisions\/17032"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=17031"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=17031"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=17031"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}