{"id":17045,"date":"2026-09-21T06:10:08","date_gmt":"2026-09-21T06:10:08","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=17045"},"modified":"2026-09-21T06:10:08","modified_gmt":"2026-09-21T06:10:08","slug":"comptia-pentest-pt0-003-practice-test-questions-and-exam-dumps-part13-q241-260","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/comptia-pentest-pt0-003-practice-test-questions-and-exam-dumps-part13-q241-260\/","title":{"rendered":"CompTIA Pentest+ PT0-003 Practice Test Questions and Exam Dumps Part13 Q241-260"},"content":{"rendered":"

View Full <\/b>CompTIA PT0-003 Exam Dumps<\/b><\/a> and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 241<\/b><\/h3>\n

Which reconnaissance method can reveal the reverse DNS name associated with an IP address?<\/b><\/p>\n

    \n
  1. PTR lookup<\/span><\/li>\n
  2. MX lookup<\/span><\/li>\n
  3. TXT lookup<\/span><\/li>\n
  4. AAAA lookup<\/span><\/li>\n<\/ol>\n

    Correct Answer: 1<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    A PTR record is used for reverse DNS resolution, allowing an IP address to be associated with a hostname when such a record exists. During authorized reconnaissance, reverse DNS information can help identify naming conventions, infrastructure roles, or externally visible systems. MX records identify mail servers, TXT records store text-based DNS information, and AAAA records map hostnames to IPv6 addresses. Reverse DNS results should be treated as clues rather than definitive evidence of a system’s current function because DNS records can be outdated or intentionally generic.<\/span><\/p>\n

    Question 242<\/b><\/h3>\n

    A tester receives several IP addresses from DNS records but needs to determine which autonomous system announces those addresses. Which information source is most useful?<\/b><\/p>\n

      \n
    1. HTTP response headers<\/span><\/li>\n
    2. ASN registration and routing data<\/span><\/li>\n
    3. Browser cookies<\/span><\/li>\n
    4. SMTP message headers<\/span><\/li>\n<\/ol>\n

      Correct Answer: 2<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      Autonomous System Number information can help identify the network or organization associated with advertised IP address ranges. Reviewing ASN registration and routing data during reconnaissance can reveal additional address space that may belong to the same organization. This can improve an authorized tester’s understanding of the external attack surface, although every discovered range must still be confirmed against the engagement scope. HTTP headers, browser cookies, and SMTP message headers may provide useful application or protocol information, but they do not directly identify the autonomous system responsible for routing an IP range.<\/span><\/p>\n

      Question 243<\/b><\/h3>\n

      Which scanning technique sends a TCP SYN request and analyzes the response without normally completing the TCP three-way handshake?<\/b><\/p>\n

        \n
      1. UDP scan<\/span><\/li>\n
      2. TCP SYN scan<\/span><\/li>\n
      3. TCP connect scan<\/span><\/li>\n
      4. ICMP scan<\/span><\/li>\n<\/ol>\n

        Correct Answer: 2<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        A TCP SYN scan uses the initial SYN portion of the TCP connection process to determine how a port responds. An open port typically responds with SYN\/ACK, while a closed port commonly responds with RST. The scanner can generally avoid completing the full TCP connection, making this approach efficient for port discovery. A TCP connect scan completes the connection through the operating system, UDP scanning targets UDP services, and ICMP scanning is generally associated with host discovery rather than TCP port identification.<\/span><\/p>\n

        Question 244<\/b><\/h3>\n

        A tester wants to determine whether a web server supports unexpected HTTP request methods that could expose unintended functionality. What should be examined?<\/b><\/p>\n

          \n
        1. HTTP methods<\/span><\/li>\n
        2. DNS TTL values<\/span><\/li>\n
        3. MAC addresses<\/span><\/li>\n
        4. File metadata<\/span><\/li>\n<\/ol>\n

          Correct Answer: 1<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          Reviewing supported HTTP methods can reveal whether a web server or application accepts methods beyond those required for normal functionality. Unexpectedly enabled methods may expose administrative or file-management capabilities and therefore deserve further investigation within the authorized scope. Testers should determine whether each method is intentionally required and properly restricted. DNS TTL values relate to caching behavior, MAC addresses identify network interfaces, and file metadata provides information about files rather than HTTP request handling.<\/span><\/p>\n

          Question 245<\/b><\/h3>\n

          A web application places an authorization decision entirely in client-side JavaScript. What security principle should the tester investigate?<\/b><\/p>\n

            \n
          1. Server-side authorization enforcement<\/span><\/li>\n
          2. DNS recursion<\/span><\/li>\n
          3. Wireless encryption<\/span><\/li>\n
          4. Network time synchronization<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            Authorization decisions should be enforced on the server because client-side controls can potentially be modified or bypassed by users. If an application relies solely on JavaScript to determine whether a user can perform a sensitive action, the server may fail to independently verify authorization. During an authorized assessment, testers should examine whether protected functions validate the user’s privileges on the server. DNS recursion, wireless encryption, and time synchronization are important security topics but do not directly address client-side authorization weaknesses.<\/span><\/p>\n

            Question 246<\/b><\/h3>\n

            Which vulnerability occurs when an application processes serialized data from an untrusted source without adequate validation?<\/b><\/p>\n

              \n
            1. Clickjacking<\/span><\/li>\n
            2. Insecure deserialization<\/span><\/li>\n
            3. DNS poisoning<\/span><\/li>\n
            4. Credential stuffing<\/span><\/li>\n<\/ol>\n

              Correct Answer: 2<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              Insecure deserialization occurs when an application reconstructs objects or data structures from serialized input without sufficiently validating or restricting that input. Depending on the technology and implementation, unsafe deserialization can contribute to unauthorized actions, data manipulation, or other serious application security issues. During authorized testing, the tester should identify where serialized data crosses trust boundaries and determine whether appropriate integrity and validation controls exist. Clickjacking concerns interface framing, DNS poisoning affects name resolution, and credential stuffing involves reused authentication credentials.<\/span><\/p>\n

              Question 247<\/b><\/h3>\n

              A web application dynamically inserts a user-controlled URL into a server-side request. Which vulnerability class should be considered if the server can be persuaded to contact unintended internal resources?<\/b><\/p>\n

                \n
              1. Server-side request forgery<\/span><\/li>\n
              2. Password spraying<\/span><\/li>\n
              3. VLAN hopping<\/span><\/li>\n
              4. Session fixation<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                Server-Side Request Forgery, or SSRF, occurs when an application causes the server to make requests based on user-controlled input without adequately restricting the destination. If an attacker can influence those requests toward internal or otherwise unintended resources, sensitive services or information may become accessible through the application’s network position. Authorized testing should focus on confirming whether destination controls and network restrictions work as intended. Password spraying targets authentication, VLAN hopping concerns network segmentation, and session fixation relates to application session management.<\/span><\/p>\n

                Question 248<\/b><\/h3>\n

                Which application security weakness occurs when a server includes local files based on insufficiently validated user input?<\/b><\/p>\n

                  \n
                1. Local file inclusion<\/span><\/li>\n
                2. Wireless deauthentication<\/span><\/li>\n
                3. TCP SYN scanning<\/span><\/li>\n
                4. DNS enumeration<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 1<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  Local File Inclusion, or LFI, occurs when an application incorporates or reads files from the server based on user-controlled input without adequate validation. Depending on the application architecture, this may expose sensitive local resources or alter application behavior. During a penetration test, testers should verify the issue within the defined scope and avoid accessing unnecessary sensitive data. Wireless deauthentication affects wireless connectivity, TCP SYN scanning identifies TCP services, and DNS enumeration gathers information about domain infrastructure rather than server-side file inclusion.<\/span><\/p>\n

                  Question 249<\/b><\/h3>\n

                  A tester observes that an application accepts requests from many unrelated origins and exposes sensitive response data through browser-based cross-origin requests. Which security area should be reviewed?<\/b><\/p>\n

                    \n
                  1. CORS configuration<\/span><\/li>\n
                  2. Password hashing<\/span><\/li>\n
                  3. DNS zone transfers<\/span><\/li>\n
                  4. Network time protocol<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    Cross-Origin Resource Sharing, or CORS, controls which origins are permitted to make browser-based requests to web applications and what responses browsers may expose to those origins. An overly permissive configuration can create security concerns when sensitive authenticated resources are accessible across unintended origins. Authorized testers should examine allowed origins, credentials behavior, and response exposure while considering the application’s intended architecture. Password hashing protects stored credentials, DNS zone transfers concern DNS replication, and NTP provides network time synchronization.<\/span><\/p>\n

                    Question 250<\/b><\/h3>\n

                    A tester needs to identify whether an application uses a predictable or weak session identifier. Which area should be assessed?<\/b><\/p>\n

                      \n
                    1. Session token entropy<\/span><\/li>\n
                    2. DNS recursion<\/span><\/li>\n
                    3. TCP window size<\/span><\/li>\n
                    4. VLAN tagging<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 1<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      Session token entropy refers to the unpredictability and sufficient randomness of identifiers used to maintain authenticated sessions. Weak or predictable session identifiers may allow unauthorized parties to guess or otherwise obtain valid sessions. During authorized testing, testers can assess token length, randomness, uniqueness, and lifecycle behavior without unnecessarily accessing other users’ data. DNS recursion, TCP window sizing, and VLAN tagging are unrelated network characteristics. Strong session identifiers should be generated using appropriate randomness and should not expose predictable patterns.<\/span><\/p>\n

                      Question 251<\/b><\/h3>\n

                      Which password attack combines words from a dictionary with additional characters, numbers, or predictable substitutions?<\/b><\/p>\n

                        \n
                      1. Rainbow table attack<\/span><\/li>\n
                      2. Hybrid attack<\/span><\/li>\n
                      3. Password spraying<\/span><\/li>\n
                      4. Credential stuffing<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 2<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        A hybrid password attack combines dictionary-based words with modifications such as appended numbers, symbols, or common substitutions. This approach reflects how users often create passwords by altering familiar words rather than selecting completely random values. During authorized password auditing, hybrid techniques can help evaluate whether organizational password policies adequately resist common predictable patterns. Rainbow tables use precomputed hash information, password spraying attempts a limited number of passwords across multiple accounts, and credential stuffing relies on credentials obtained from previous compromises.<\/span><\/p>\n

                        Question 252<\/b><\/h3>\n

                        A penetration tester wants to assess whether a password policy prevents users from choosing passwords based on commonly breached credentials. Which control is most relevant?<\/b><\/p>\n

                          \n
                        1. Password blocklist<\/span><\/li>\n
                        2. DNSSEC<\/span><\/li>\n
                        3. Network segmentation<\/span><\/li>\n
                        4. Certificate pinning<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 1<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          A password blocklist can prevent users from selecting passwords that are known to be commonly used, compromised, or otherwise unsuitable. This control complements requirements such as appropriate password length and resistance to automated guessing. During an authorized assessment, the tester can review whether the organization checks proposed passwords against a suitable list of known weak credentials without exposing unnecessary user information. DNSSEC protects DNS integrity, network segmentation separates systems, and certificate pinning concerns trust validation in applications.<\/span><\/p>\n

                          Question 253<\/b><\/h3>\n

                          A mobile application stores authentication tokens in an unprotected local file. Which security issue does this represent?<\/b><\/p>\n

                            \n
                          1. Insecure local data storage<\/span><\/li>\n
                          2. VLAN hopping<\/span><\/li>\n
                          3. DNS cache poisoning<\/span><\/li>\n
                          4. SMTP misconfiguration<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            Insecure local data storage occurs when a mobile application stores sensitive information such as authentication tokens, passwords, or personal data without appropriate protection. If another process, user, backup mechanism, or compromised device component can access the stored information, the application’s security may be weakened. During authorized mobile application testing, testers should determine whether sensitive data is appropriately protected using platform-supported secure storage mechanisms. VLAN hopping, DNS poisoning, and SMTP configuration issues involve network or server infrastructure rather than local mobile application data protection.<\/span><\/p>\n

                            Question 254<\/b><\/h3>\n

                            A mobile application rejects a tester’s intercepted connection because it verifies that the server certificate matches a specific expected certificate or key. What control is being observed?<\/b><\/p>\n

                              \n
                            1. Certificate pinning<\/span><\/li>\n
                            2. DNS round-robin<\/span><\/li>\n
                            3. HTTP compression<\/span><\/li>\n
                            4. Password spraying<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 1<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              Certificate pinning strengthens TLS trust decisions by requiring an application to recognize a specific certificate or public-key identity rather than relying solely on the device’s general certificate authority trust store. This can make certain interception-based testing techniques ineffective unless the application is deliberately configured for testing. During an authorized assessment, testers should determine whether certificate pinning is implemented correctly and whether its operational design supports secure certificate rotation. DNS round-robin distributes DNS responses, HTTP compression affects content transfer, and password spraying targets authentication.<\/span><\/p>\n

                              Question 255<\/b><\/h3>\n

                              A cloud-hosted application retrieves configuration information from a special service available from within the cloud instance. Which security concern should be assessed?<\/b><\/p>\n

                                \n
                              1. Cloud metadata service exposure<\/span><\/li>\n
                              2. Wireless deauthentication<\/span><\/li>\n
                              3. DNS PTR resolution<\/span><\/li>\n
                              4. SMTP banner disclosure<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                Cloud metadata services can provide instances with information such as temporary credentials, configuration details, or instance-specific data. If an application exposes an unintended path to such services, sensitive information may potentially be accessed through server-side request functionality or other weaknesses. Authorized penetration testing should verify whether metadata access is appropriately restricted and whether applications can reach only the information they legitimately require. Wireless deauthentication, PTR resolution, and SMTP banner disclosure address different technologies and do not directly evaluate cloud instance metadata exposure.<\/span><\/p>\n

                                Question 256<\/b><\/h3>\n

                                A containerized application uses an outdated base image containing known vulnerable packages. Which security practice would best address the underlying issue?<\/b><\/p>\n

                                  \n
                                1. Regular container image scanning and rebuilding<\/span><\/li>\n
                                2. Increasing DNS TTL values<\/span><\/li>\n
                                3. Disabling HTTP compression<\/span><\/li>\n
                                4. Changing the application’s page title<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 1<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  Container image scanning can identify outdated or vulnerable packages before images are deployed. When vulnerabilities are discovered, rebuilding images from maintained base images and updating affected dependencies helps reduce inherited security weaknesses. Organizations should also establish processes for tracking image versions and removing obsolete images from deployment pipelines. DNS TTL values and HTTP compression do not address vulnerable software inside a container image, while changing a page title has no meaningful security impact. Image security is an important part of assessing modern cloud-native environments.<\/span><\/p>\n

                                  Question 257<\/b><\/h3>\n

                                  A tester reviews a cloud identity configuration and finds that an application account can modify resources unrelated to its assigned function. Which principle is being violated?<\/b><\/p>\n

                                    \n
                                  1. Least privilege<\/span><\/li>\n
                                  2. Defense through obscurity<\/span><\/li>\n
                                  3. Non-repudiation<\/span><\/li>\n
                                  4. Data compression<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    The principle of least privilege requires accounts and applications to receive only the permissions necessary to perform their legitimate functions. If a cloud identity can modify unrelated resources, its permissions exceed what the workload requires, increasing the potential impact of credential compromise or application abuse. During an authorized assessment, testers should document excessive permissions and identify the affected roles or policies. Defense through obscurity, non-repudiation, and data compression address different security or technical concerns and do not define appropriate access permissions.<\/span><\/p>\n

                                    Question 258<\/b><\/h3>\n

                                    Which tool is primarily designed to capture and inspect network packets from a command-line environment?<\/b><\/p>\n

                                      \n
                                    1. tcpdump<\/span><\/li>\n
                                    2. Amass<\/span><\/li>\n
                                    3. John the Ripper<\/span><\/li>\n
                                    4. ffuf<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 1<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      tcpdump is a command-line packet capture and network traffic analysis utility. It can help security professionals examine protocols, communication patterns, and unexpected network behavior during authorized troubleshooting or penetration testing. Amass is focused on attack-surface and DNS reconnaissance, John the Ripper is used for password-hash auditing, and ffuf is commonly used for web content discovery and fuzzing. Packet capture should be performed carefully because captured traffic can contain credentials, session information, or other sensitive data.<\/span><\/p>\n

                                      Question 259<\/b><\/h3>\n

                                      A web tester wants to discover hidden directories and files by supplying different candidate paths to an application. Which tool is commonly suited to this task?<\/b><\/p>\n

                                        \n
                                      1. ffuf<\/span><\/li>\n
                                      2. tcpdump<\/span><\/li>\n
                                      3. Responder<\/span><\/li>\n
                                      4. Hashcat<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 1<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        ffuf is a web fuzzing utility commonly used to identify hidden directories, files, parameters, and other content by testing candidate values against an authorized target. It can help uncover resources that are not linked from normal application pages. Testers should control request rates and remain within the defined scope to avoid unnecessary service disruption. tcpdump analyzes network traffic, Responder is associated with certain network authentication attacks, and Hashcat performs password-hash recovery and auditing rather than web content discovery.<\/span><\/p>\n

                                        Question 260<\/b><\/h3>\n

                                        A penetration test identifies a vulnerability that affects a system but has limited practical impact because another security control blocks exploitation. How should the tester document this situation?<\/b><\/p>\n

                                          \n
                                        1. Ignore the vulnerability completely<\/span><\/li>\n
                                        2. Report the vulnerability together with the relevant compensating control and residual risk<\/span><\/li>\n
                                        3. Automatically classify it as critical<\/span><\/li>\n
                                        4. Remove all supporting evidence<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 2<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          A vulnerability should not necessarily be omitted simply because another control reduces its practical impact. The report should describe the underlying weakness, explain the compensating control that limits exposure, and communicate the remaining risk accurately. This gives stakeholders a complete picture of both the vulnerability and the protection already in place. Automatically assigning a critical severity would ignore the mitigating control, while deleting evidence or completely ignoring the finding could prevent future reviewers from understanding the environment and its residual risk.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.   Question 241 Which reconnaissance method can reveal the reverse DNS name associated with an IP address? PTR lookup MX lookup TXT lookup AAAA lookup Correct Answer: 1 Explanation A PTR record is used for reverse DNS resolution, allowing an IP address to be associated […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17045"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=17045"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17045\/revisions"}],"predecessor-version":[{"id":17046,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17045\/revisions\/17046"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=17045"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=17045"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=17045"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}