{"id":17033,"date":"2026-09-21T06:07:19","date_gmt":"2026-09-21T06:07:19","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=17033"},"modified":"2026-09-21T06:07:19","modified_gmt":"2026-09-21T06:07:19","slug":"comptia-pentest-pt0-003-practice-test-questions-and-exam-dumps-part7-q121-140","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/comptia-pentest-pt0-003-practice-test-questions-and-exam-dumps-part7-q121-140\/","title":{"rendered":"CompTIA Pentest+ PT0-003 Practice Test Questions and Exam Dumps Part7 Q121-140"},"content":{"rendered":"

View Full <\/b>CompTIA PT0-003 Exam Dumps<\/b><\/a> and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 121<\/b><\/h3>\n

Which tool is commonly used for automated web directory and file discovery?<\/b><\/p>\n

    \n
  1. Hashcat<\/span><\/li>\n
  2. Gobuster<\/span><\/li>\n
  3. Wireshark<\/span><\/li>\n
  4. BloodHound<\/span><\/li>\n<\/ol>\n

    Correct Answer: 2<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    Gobuster is commonly used during authorized security assessments to discover directories, files, DNS subdomains, and other resources depending on its configuration. For web testing, it can help identify hidden application paths that are not linked from visible pages. Discovering these resources may reveal forgotten administrative interfaces, backup files, or other potentially exposed content. Testers should use appropriate request rates and remain within the approved scope. Hashcat focuses on password recovery, Wireshark analyzes network traffic, and BloodHound focuses on relationships within directory environments.<\/span><\/p>\n

    Question 122<\/b><\/h3>\n

    What does the HTTP status code 404 generally indicate?<\/b><\/p>\n

      \n
    1. Unauthorized access<\/span><\/li>\n
    2. Server error<\/span><\/li>\n
    3. Resource not found<\/span><\/li>\n
    4. Successful request<\/span><\/li>\n<\/ol>\n

      Correct Answer: 3<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      HTTP status code 404 generally indicates that the requested resource could not be found on the server. During web application testing, response codes can provide useful clues about whether a requested path exists, has been removed, or is intentionally hidden. However, applications sometimes customize error responses, so testers should not rely solely on status codes when performing content discovery. A 401 generally relates to authentication requirements, 403 indicates that access is forbidden, and 200 commonly represents a successful response.<\/span><\/p>\n

      Question 123<\/b><\/h3>\n

      Which attack abuses a browser’s trust in an authenticated session to perform an unwanted action?<\/b><\/p>\n

        \n
      1. CSRF<\/span><\/li>\n
      2. SSRF<\/span><\/li>\n
      3. SQL injection<\/span><\/li>\n
      4. Kerberoasting<\/span><\/li>\n<\/ol>\n

        Correct Answer: 1<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        Cross-Site Request Forgery (CSRF) takes advantage of an authenticated user’s existing session to cause a web application to process an unintended request. If the application does not adequately verify the legitimacy of sensitive requests, a malicious site or crafted interaction may cause actions to occur using the victim’s existing privileges. Effective defenses can include anti-CSRF tokens, appropriate SameSite cookie settings, and additional request validation. CSRF targets the relationship between a user’s browser and an application, whereas SSRF causes the server to make requests to another destination.<\/span><\/p>\n

        Question 124<\/b><\/h3>\n

        Which reconnaissance source may reveal information embedded in publicly shared office documents?<\/b><\/p>\n

          \n
        1. Document metadata<\/span><\/li>\n
        2. ARP cache<\/span><\/li>\n
        3. TCP handshake<\/span><\/li>\n
        4. Firewall state table<\/span><\/li>\n<\/ol>\n

          Correct Answer: 1<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          Document metadata can contain information such as author names, usernames, software versions, creation dates, or organizational details. During passive reconnaissance, publicly available documents can therefore provide useful intelligence about a target’s technology and personnel. Metadata should be reviewed carefully because its presence depends on the file type and how the document was created or sanitized. Organizations can reduce unnecessary exposure by removing metadata from documents before publication. Penetration testers should collect only information relevant to the engagement and respect privacy and scope requirements.<\/span><\/p>\n

          Question 125<\/b><\/h3>\n

          Which vulnerability occurs when an application executes operating-system commands using insufficiently validated user input?<\/b><\/p>\n

            \n
          1. Command injection<\/span><\/li>\n
          2. CSRF<\/span><\/li>\n
          3. IDOR<\/span><\/li>\n
          4. Open redirect<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            Command injection occurs when an application incorporates untrusted input into operating-system commands without adequate validation or safe handling. If exploitable, this weakness may allow unintended commands to execute with the application’s privileges. During authorized testing, testers should validate the security boundary carefully and avoid unnecessary system changes. Secure development practices include avoiding shell execution when unnecessary, using safe APIs, applying strict input validation, and restricting process privileges. Command injection is distinct from SQL injection, which targets database query processing rather than operating-system command execution.<\/span><\/p>\n

            Question 126<\/b><\/h3>\n

            A tester finds an exposed API key in a publicly accessible source file. What should be assessed first?<\/b><\/p>\n

              \n
            1. The color scheme of the application<\/span><\/li>\n
            2. The key’s permissions and potential impact<\/span><\/li>\n
            3. The monitor resolution<\/span><\/li>\n
            4. The DNS TTL<\/span><\/li>\n<\/ol>\n

              Correct Answer: 2<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              An exposed API key should be assessed to determine what services or resources it can access and what privileges are associated with it. The tester should avoid unnecessary actions and collect only enough evidence to demonstrate the security impact. If the key provides access to sensitive resources, the finding may require prompt escalation according to the rules of engagement. Organizations should avoid embedding secrets in publicly accessible source code and should use secure secret-management mechanisms, appropriate access restrictions, rotation, and monitoring.<\/span><\/p>\n

              Question 127<\/b><\/h3>\n

              Which protocol is commonly used for centralized directory services and querying user or organizational information?<\/b><\/p>\n

                \n
              1. LDAP<\/span><\/li>\n
              2. FTP<\/span><\/li>\n
              3. SMTP<\/span><\/li>\n
              4. SNMP<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                Lightweight Directory Access Protocol (LDAP) is commonly used to access and query directory services containing information about users, groups, computers, and organizational resources. In enterprise environments, LDAP may be associated with directory platforms such as Active Directory and other identity systems. During authorized testing, LDAP enumeration can help identify exposed directory information and assess access controls. FTP is primarily used for file transfer, SMTP handles email transmission, and SNMP is used for network management and monitoring. Proper LDAP access controls help prevent unnecessary disclosure of directory information.<\/span><\/p>\n

                Question 128<\/b><\/h3>\n

                Which attack attempts to exploit a flaw in a web application by causing the server to make a request to an unintended internal resource?<\/b><\/p>\n

                  \n
                1. XSS<\/span><\/li>\n
                2. SSRF<\/span><\/li>\n
                3. CSRF<\/span><\/li>\n
                4. Password spraying<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 2<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  Server-Side Request Forgery (SSRF) occurs when an application can be manipulated into making requests to destinations controlled or influenced by an attacker. The security concern becomes especially significant when the server can reach internal services that are not directly accessible from outside the network. During authorized testing, the objective is to determine whether destination restrictions and network controls are effective without unnecessarily accessing sensitive resources. Defenses can include strict destination allowlists, network segmentation, URL validation, and limiting the application’s ability to access internal administrative services.<\/span><\/p>\n

                  Question 129<\/b><\/h3>\n

                  Which authentication protocol is commonly associated with ticket-based authentication in Active Directory environments?<\/b><\/p>\n

                    \n
                  1. Kerberos<\/span><\/li>\n
                  2. FTP<\/span><\/li>\n
                  3. HTTP<\/span><\/li>\n
                  4. DNS<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    Kerberos is a ticket-based authentication protocol widely used in Active Directory environments. Instead of repeatedly sending a user’s password to each service, Kerberos uses tickets issued by trusted components within the authentication infrastructure. During penetration testing, understanding Kerberos is important for assessing authentication relationships, service accounts, delegation, and potential credential-related weaknesses. Security controls include protecting privileged credentials, monitoring authentication activity, maintaining secure time synchronization, and minimizing unnecessary privileges. Kerberos is fundamentally different from application protocols such as HTTP or infrastructure protocols such as DNS.<\/span><\/p>\n

                    Question 130<\/b><\/h3>\n

                    Which finding most strongly suggests that a server is exposing unnecessary services?<\/b><\/p>\n

                      \n
                    1. Only required services are accessible<\/span><\/li>\n
                    2. Multiple unused services are reachable from untrusted networks<\/span><\/li>\n
                    3. Administrative access requires MFA<\/span><\/li>\n
                    4. Security patches are current<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 2<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      Multiple unnecessary services exposed to untrusted networks can increase a server’s attack surface. Each reachable service may contain vulnerabilities, weak configurations, or authentication weaknesses that could provide an entry point for an attacker. During authorized testing, service enumeration helps identify what is actually exposed and whether those services are required for business operations. Organizations can reduce exposure by disabling unused services and restricting necessary services through firewalls, segmentation, and access controls. Minimizing externally reachable services is an important component of attack-surface reduction.<\/span><\/p>\n

                      Question 131<\/b><\/h3>\n

                      What is the primary purpose of a proof of concept in a penetration test report?<\/b><\/p>\n

                        \n
                      1. Demonstrate that a finding can be validated<\/span><\/li>\n
                      2. Replace remediation guidance<\/span><\/li>\n
                      3. Hide the affected asset<\/span><\/li>\n
                      4. Increase the report’s page count<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        A proof of concept (PoC) provides evidence that a reported security weakness can be demonstrated under the conditions of the assessment. It may include sanitized screenshots, relevant request and response information, logs, or other evidence appropriate to the finding. A PoC should be sufficient to support the conclusion without unnecessarily exposing sensitive data or causing additional impact. During authorized testing, testers should document the conditions and limitations of the demonstration clearly. Remediation guidance remains a separate part of the finding.<\/span><\/p>\n

                        Question 132<\/b><\/h3>\n

                        Which tool is primarily associated with identifying vulnerabilities through automated network and host scanning?<\/b><\/p>\n

                          \n
                        1. Nessus<\/span><\/li>\n
                        2. Netcat<\/span><\/li>\n
                        3. Burp Suite<\/span><\/li>\n
                        4. John the Ripper<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 1<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          Nessus is a vulnerability assessment platform commonly used to scan systems for known vulnerabilities, missing patches, configuration weaknesses, and other security issues. It can examine hosts and services and produce findings based on its vulnerability detection capabilities. Automated results should still be reviewed because scanners can generate false positives, miss context-specific issues, or interpret version information incorrectly. Netcat is a network utility, Burp Suite focuses on web application testing, and John the Ripper is primarily used for password-recovery testing.<\/span><\/p>\n

                          Question 133<\/b><\/h3>\n

                          A tester wants to determine whether a web server supports an HTTP method that should not be available on a sensitive endpoint. What should be reviewed?<\/b><\/p>\n

                            \n
                          1. Allowed HTTP methods and their authorization behavior<\/span><\/li>\n
                          2. CPU manufacturer<\/span><\/li>\n
                          3. Keyboard layout<\/span><\/li>\n
                          4. DNS registrar<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            Reviewing supported HTTP methods can reveal whether an endpoint permits actions beyond those intended by the application design. Methods such as GET, POST, PUT, PATCH, and DELETE can have different security implications depending on how they are implemented. A tester should determine whether unsupported or unexpected methods are accepted and whether authentication and authorization controls are consistently enforced. During authorized testing, the goal is to identify a security weakness without causing unnecessary changes. Proper method restrictions and server-side authorization checks can reduce this risk.<\/span><\/p>\n

                            Question 134<\/b><\/h3>\n

                            Which wireless security standard provides stronger modern protections than WPA2?<\/b><\/p>\n

                              \n
                            1. WEP<\/span><\/li>\n
                            2. WPA<\/span><\/li>\n
                            3. WPA3<\/span><\/li>\n
                            4. Open authentication<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 3<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              WPA3 is a newer Wi-Fi security standard designed to provide stronger protections than earlier standards such as WPA and WPA2. It introduces improvements to authentication and cryptographic protections, although the exact security benefits depend on the deployment mode and configuration. During an authorized wireless assessment, testers can identify which security standard is being used and whether legacy or insecure configurations remain enabled. WEP is obsolete and vulnerable, while open authentication provides no comparable wireless encryption or authentication protection.<\/span><\/p>\n

                              Question 135<\/b><\/h3>\n

                              Which activity involves identifying the security impact of a vulnerability after initial discovery?<\/b><\/p>\n

                                \n
                              1. Vulnerability validation<\/span><\/li>\n
                              2. Logo design<\/span><\/li>\n
                              3. Asset disposal<\/span><\/li>\n
                              4. Network cabling<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                Vulnerability validation determines whether a suspected security issue is genuine and helps establish its practical impact. Automated scanners may identify potential weaknesses, but manual validation can determine whether the issue is exploitable under the actual configuration and whether compensating controls change the risk. Testers should use controlled methods and remain within the engagement scope. Proper validation improves report accuracy and helps organizations prioritize remediation based on evidence rather than unverified scanner output or assumptions.<\/span><\/p>\n

                                Question 136<\/b><\/h3>\n

                                What is a common purpose of a web application proxy during penetration testing?<\/b><\/p>\n

                                  \n
                                1. Inspect and modify HTTP traffic<\/span><\/li>\n
                                2. Recover deleted files<\/span><\/li>\n
                                3. Discover Wi-Fi channels<\/span><\/li>\n
                                4. Assign IP addresses<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 1<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  A web application proxy sits between a tester’s browser and the target application, allowing HTTP and HTTPS requests and responses to be inspected and, where authorized, modified. This capability is useful for analyzing parameters, cookies, headers, authentication flows, and application behavior. Tools such as Burp Suite provide proxy functionality specifically designed for web security testing. A proxy does not itself replace vulnerability validation or guarantee exploitation. Testers should use it responsibly and ensure that modifications remain within the approved assessment boundaries.<\/span><\/p>\n

                                  Question 137<\/b><\/h3>\n

                                  Which activity is most closely associated with determining what information a compromised system can access?<\/b><\/p>\n

                                    \n
                                  1. Post-exploitation assessment<\/span><\/li>\n
                                  2. Password policy creation<\/span><\/li>\n
                                  3. DNS registration<\/span><\/li>\n
                                  4. Asset disposal<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    Post-exploitation assessment examines the security implications after authorized access to a system has been established. Testers may evaluate accessible resources, privileges, trust relationships, and potential paths to additional systems while following strict engagement limits. The purpose is to demonstrate the consequences of the initial weakness and determine how far an attacker could potentially progress. Testers should avoid unnecessary data access or destructive activity. Findings should clearly explain the relationship between the initial compromise, available privileges, and potential business impact.<\/span><\/p>\n

                                    Question 138<\/b><\/h3>\n

                                    Which practice helps protect sensitive penetration-testing evidence?<\/b><\/p>\n

                                      \n
                                    1. Store it using appropriate access controls and encryption<\/span><\/li>\n
                                    2. Upload it to a public file-sharing service<\/span><\/li>\n
                                    3. Share it with unrelated employees<\/span><\/li>\n
                                    4. Leave it on an unmanaged device<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 1<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      Penetration-testing evidence can contain credentials, personal information, configuration details, screenshots, logs, or other sensitive material. It should therefore be protected with appropriate access controls, secure storage, encryption where suitable, and defined retention and destruction procedures. Testers should collect only the information necessary to support their findings. Publicly sharing evidence or storing it on unmanaged devices can create additional security risks. Proper evidence handling is part of professional testing practice and should follow the organization’s requirements and the engagement agreement.<\/span><\/p>\n

                                      Question 139<\/b><\/h3>\n

                                      Which attack relies on previously leaked credentials being reused against another service?<\/b><\/p>\n

                                        \n
                                      1. Credential stuffing<\/span><\/li>\n
                                      2. Password spraying<\/span><\/li>\n
                                      3. Brute force<\/span><\/li>\n
                                      4. Deauthentication<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 1<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        Credential stuffing uses previously compromised username and password combinations against another service, relying on users reusing credentials across multiple platforms. It differs from password spraying, which applies a small number of common passwords across many accounts, and brute force, which systematically tries many possible combinations. During an authorized assessment, credential testing should be carefully controlled to avoid account lockouts or unnecessary disruption. Organizations can reduce credential-stuffing risk through MFA, breached-password detection, unique passwords, rate limiting, and monitoring for unusual authentication activity.<\/span><\/p>\n

                                        Question 140<\/b><\/h3>\n

                                        What should be included when reporting a high-severity vulnerability?<\/b><\/p>\n

                                          \n
                                        1. Only the vulnerability name<\/span><\/li>\n
                                        2. Evidence, impact, affected assets, severity, and remediation<\/span><\/li>\n
                                        3. Only the tester’s contact information<\/span><\/li>\n
                                        4. Only the scan date<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 2<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          A high-severity finding should provide enough information for stakeholders to understand the security issue and take corrective action. Useful details commonly include the affected asset, vulnerability description, evidence, severity rationale, potential impact, and recommended remediation. Depending on the engagement, reproduction information and relevant limitations may also be included. Clear reporting helps technical teams investigate and fix the issue while allowing management to understand its broader significance. Reporting only a vulnerability name or scan date would not provide sufficient context for effective remediation.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.   Question 121 Which tool is commonly used for automated web directory and file discovery? Hashcat Gobuster Wireshark BloodHound Correct Answer: 2 Explanation Gobuster is commonly used during authorized security assessments to discover directories, files, DNS subdomains, and other resources depending on its configuration. For […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17033"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=17033"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17033\/revisions"}],"predecessor-version":[{"id":17034,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17033\/revisions\/17034"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=17033"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=17033"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=17033"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}