{"id":17053,"date":"2026-09-21T06:11:40","date_gmt":"2026-09-21T06:11:40","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=17053"},"modified":"2026-09-21T06:11:55","modified_gmt":"2026-09-21T06:11:55","slug":"comptia-pentest-pt0-003-practice-test-questions-and-exam-dumps-part17-q321-340","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/comptia-pentest-pt0-003-practice-test-questions-and-exam-dumps-part17-q321-340\/","title":{"rendered":"CompTIA Pentest+ PT0-003 Practice Test Questions and Exam Dumps Part17 Q321-340"},"content":{"rendered":"

View Full <\/b>CompTIA PT0-003 Exam Dumps<\/b><\/a> and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 321<\/b><\/h3>\n

Which technique is used to determine whether a system can be reached through IPv6 when only IPv4 addresses were initially identified?<\/b><\/p>\n

    \n
  1. IPv6 reconnaissance<\/span><\/li>\n
  2. Password spraying<\/span><\/li>\n
  3. Cookie analysis<\/span><\/li>\n
  4. File fuzzing<\/span><\/li>\n<\/ol>\n

    Correct Answer: 1<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    IPv6 reconnaissance helps identify IPv6-enabled hosts, addresses, services, and network exposure that may not be obvious from an IPv4-focused assessment. Organizations sometimes deploy IPv6 without applying security controls equivalent to those used for IPv4. During an authorized penetration test, identifying IPv6 exposure can therefore reveal an overlooked portion of the attack surface. Password spraying targets authentication, cookie analysis evaluates web sessions, and file fuzzing searches for application resources. Testers should verify discovered IPv6 assets against the engagement scope before active testing.<\/span><\/p>\n

    Question 322<\/b><\/h3>\n

    A tester discovers that an organization’s public DNS server provides information about internal systems through an unnecessary record set. What should the tester assess next?<\/b><\/p>\n

      \n
    1. DNS information exposure<\/span><\/li>\n
    2. Wireless encryption strength<\/span><\/li>\n
    3. Password complexity<\/span><\/li>\n
    4. Session token entropy<\/span><\/li>\n<\/ol>\n

      Correct Answer: 1<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      Unnecessary DNS information can reveal internal hostnames, addressing schemes, infrastructure roles, or other details useful to an attacker. During an authorized assessment, the tester should determine whether the records are intentionally public and whether exposing them creates meaningful risk. DNS information should be reviewed in context because some records are required for normal services. Wireless encryption, password complexity, and session-token entropy address different security controls. The goal is to distinguish legitimate public DNS information from records that unnecessarily disclose internal infrastructure.<\/span><\/p>\n

      Question 323<\/b><\/h3>\n

      Which vulnerability occurs when an application includes a remote resource based on attacker-controlled input without sufficient validation?<\/b><\/p>\n

        \n
      1. Remote file inclusion<\/span><\/li>\n
      2. NTP misconfiguration<\/span><\/li>\n
      3. VLAN hopping<\/span><\/li>\n
      4. Account enumeration<\/span><\/li>\n<\/ol>\n

        Correct Answer: 1<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        Remote File Inclusion occurs when an application dynamically includes or processes a remote resource based on insufficiently validated user-controlled input. Depending on the application technology and configuration, this can potentially allow unintended external content to influence application behavior. During authorized testing, the tester should determine whether remote inclusion is actually supported and whether input validation prevents unauthorized resource locations. NTP misconfiguration affects time synchronization, VLAN hopping concerns network segmentation, and account enumeration exposes information about valid users.<\/span><\/p>\n

        Question 324<\/b><\/h3>\n

        A web application accepts user-controlled input in a database query without using appropriate parameterization. Which defensive control should the tester expect to find?<\/b><\/p>\n

          \n
        1. Prepared statements<\/span><\/li>\n
        2. DNSSEC<\/span><\/li>\n
        3. VLAN tagging<\/span><\/li>\n
        4. NTP synchronization<\/span><\/li>\n<\/ol>\n

          Correct Answer: 1<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          Prepared statements, also called parameterized queries, separate SQL instructions from user-supplied data and are a primary defense against SQL injection. They prevent input from being interpreted as part of the SQL command structure when implemented correctly. During an authorized assessment, testers can review application behavior and source or configuration evidence where available to determine whether parameterization is consistently used. DNSSEC protects DNS integrity, VLAN tagging supports network separation, and NTP synchronizes system clocks. Input handling should be reinforced with appropriate validation and database permissions.<\/span><\/p>\n

          Question 325<\/b><\/h3>\n

          Which web vulnerability can occur when an application reflects user-controlled input into an HTTP response without proper output encoding?<\/b><\/p>\n

            \n
          1. Reflected XSS<\/span><\/li>\n
          2. VLAN hopping<\/span><\/li>\n
          3. DNS poisoning<\/span><\/li>\n
          4. Password spraying<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            Reflected cross-site scripting occurs when user-controlled input is immediately returned in a web response and is interpreted by the browser as executable content because appropriate output encoding or contextual handling is missing. Unlike stored XSS, the malicious input is generally included in the request rather than persistently stored by the application. During authorized testing, testers should determine whether the affected context safely encodes output. VLAN hopping and DNS poisoning affect networks, while password spraying targets authentication systems.<\/span><\/p>\n

            Question 326<\/b><\/h3>\n

            A tester is reviewing a web application that embeds user-supplied content inside HTML attributes. Which defense is especially important?<\/b><\/p>\n

              \n
            1. Context-appropriate output encoding<\/span><\/li>\n
            2. DNS recursion restrictions<\/span><\/li>\n
            3. NTP synchronization<\/span><\/li>\n
            4. Wireless channel selection<\/span><\/li>\n<\/ol>\n

              Correct Answer: 1<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              Output encoding must match the context in which untrusted data is inserted. HTML attributes can require different handling from ordinary HTML text, JavaScript, CSS, or URL contexts. Context-appropriate encoding helps prevent user-controlled content from being interpreted as executable markup or code. During an authorized assessment, testers should review how the application handles untrusted values at each output location. DNS recursion, NTP synchronization, and wireless channel selection do not directly protect browser output from injection-based attacks.<\/span><\/p>\n

              Question 327<\/b><\/h3>\n

              Which browser security control can reduce the ability of an injected script to access cookies marked appropriately?<\/b><\/p>\n

                \n
              1. HttpOnly<\/span><\/li>\n
              2. MX<\/span><\/li>\n
              3. PTR<\/span><\/li>\n
              4. AAAA<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                The HttpOnly cookie attribute prevents client-side scripts from directly accessing the associated cookie through standard browser scripting interfaces. This can reduce the risk of cookie theft in certain cross-site scripting scenarios, although it does not prevent XSS itself or protect against every form of session abuse. MX, PTR, and AAAA are DNS record types serving different purposes. During web application testing, testers should review cookie attributes alongside session management, transport security, and application authorization controls.<\/span><\/p>\n

                Question 328<\/b><\/h3>\n

                A tester discovers that an application does not properly restrict which domains can embed its pages in frames. Which attack should be considered?<\/b><\/p>\n

                  \n
                1. Clickjacking<\/span><\/li>\n
                2. DNS tunneling<\/span><\/li>\n
                3. Password spraying<\/span><\/li>\n
                4. Kerberoasting<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 1<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  Clickjacking involves misleading users into interacting with an application through a hidden or deceptive frame. If a sensitive application can be embedded by untrusted websites without appropriate restrictions, an attacker may attempt to manipulate the user’s visual context and actions. Controls such as suitable frame-ancestors policies in CSP or other appropriate browser protections can reduce this risk. DNS tunneling concerns communication through DNS, password spraying targets authentication, and Kerberoasting involves Kerberos service accounts.<\/span><\/p>\n

                  Question 329<\/b><\/h3>\n

                  Which HTTP response header can help control whether a browser permits a page to be displayed within a frame?<\/b><\/p>\n

                    \n
                  1. X-Frame-Options<\/span><\/li>\n
                  2. MX<\/span><\/li>\n
                  3. ETag<\/span><\/li>\n
                  4. Accept-Encoding<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    X-Frame-Options is an HTTP response header that can instruct compatible browsers whether a page may be rendered inside a frame. It has traditionally been used as a defense against clickjacking. Modern applications can also use the <\/span>frame-ancestors<\/span> directive in Content-Security-Policy for more flexible framing control. MX is a DNS record, ETag supports cache validation, and Accept-Encoding indicates supported content encodings. During a penetration test, testers should review framing behavior for sensitive pages and confirm that protections match the application’s requirements.<\/span><\/p>\n

                    Question 330<\/b><\/h3>\n

                    A web application exposes a sensitive API endpoint through an HTTP GET request even though the operation changes account information. Which design concern should be reviewed?<\/b><\/p>\n

                      \n
                    1. Unsafe use of HTTP methods<\/span><\/li>\n
                    2. DNS zone transfer<\/span><\/li>\n
                    3. Password hash format<\/span><\/li>\n
                    4. Wireless authentication<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 1<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      HTTP methods communicate the intended semantics of web requests. Using GET for a state-changing operation can create security and reliability concerns because GET requests are generally expected to be safe and retrievable rather than modify server state. Such requests may also be triggered unintentionally by links, crawlers, or browser behavior. During an authorized assessment, testers should review whether state-changing operations use suitable methods and appropriate protections. DNS transfers, password hashes, and wireless authentication do not address HTTP method semantics.<\/span><\/p>\n

                      Question 331<\/b><\/h3>\n

                      A tester finds that an API accepts requests without checking whether the token was issued for the intended application or service. Which token property should be examined?<\/b><\/p>\n

                        \n
                      1. Audience<\/span><\/li>\n
                      2. File extension<\/span><\/li>\n
                      3. DNS TTL<\/span><\/li>\n
                      4. MAC address<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        The audience claim in a token identifies the intended recipient or service for which the token was issued. If an API accepts a token without validating that claim, a token intended for another service may potentially be accepted where it should not be. During authorized API testing, testers should review token validation requirements, including issuer, audience, signature, expiration, and other relevant claims. File extensions, DNS TTL values, and MAC addresses do not determine whether an authentication token is intended for a particular service.<\/span><\/p>\n

                        Question 332<\/b><\/h3>\n

                        Which API security issue occurs when an application exposes excessive fields in a response that the client does not need?<\/b><\/p>\n

                          \n
                        1. Excessive data exposure<\/span><\/li>\n
                        2. VLAN hopping<\/span><\/li>\n
                        3. NTP drift<\/span><\/li>\n
                        4. DNS poisoning<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 1<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          Excessive data exposure occurs when an API returns more information than the client or user actually requires. Sensitive fields may then become visible through browser developer tools, mobile applications, or other clients even if the interface does not display them directly. During an authorized assessment, testers should compare API responses with the application’s intended data requirements and identify unnecessary sensitive fields. VLAN hopping, NTP drift, and DNS poisoning concern network or infrastructure security rather than API response design.<\/span><\/p>\n

                          Question 333<\/b><\/h3>\n

                          A tester notices that an API allows a user to submit a request containing a large number of object fields that were not intended to be controlled by that user. Which weakness should be investigated?<\/b><\/p>\n

                            \n
                          1. Mass assignment<\/span><\/li>\n
                          2. DNS enumeration<\/span><\/li>\n
                          3. Wireless deauthentication<\/span><\/li>\n
                          4. Port scanning<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            Mass assignment can occur when an application automatically binds client-provided fields to internal object properties without adequately restricting which attributes users are permitted to modify. If sensitive properties such as roles or account states can be influenced through unexpected fields, authorization boundaries may be weakened. During authorized testing, testers should determine which fields are intended to be writable and whether server-side allowlists or equivalent controls are enforced. DNS enumeration, wireless deauthentication, and port scanning address different assessment activities.<\/span><\/p>\n

                            Question 334<\/b><\/h3>\n

                            A tester discovers that an API reveals whether a resource exists even when the requester lacks permission to access it. Which security concern should be evaluated?<\/b><\/p>\n

                              \n
                            1. Resource existence disclosure<\/span><\/li>\n
                            2. NTP synchronization<\/span><\/li>\n
                            3. VLAN tagging<\/span><\/li>\n
                            4. Certificate renewal<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 1<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              Resource existence disclosure occurs when an application reveals information about protected resources even though the requester is not authorized to access their contents. Differences in status codes, error messages, response timing, or metadata may allow users to determine whether a particular object exists. During authorized testing, the tester should examine whether responses unnecessarily distinguish protected and nonexistent resources. NTP synchronization, VLAN tagging, and certificate renewal are unrelated controls. Consistent access-control responses can help reduce unnecessary information leakage.<\/span><\/p>\n

                              Question 335<\/b><\/h3>\n

                              Which mobile application security control helps ensure that only necessary device capabilities and information are accessible to the application?<\/b><\/p>\n

                                \n
                              1. Least-privilege permissions<\/span><\/li>\n
                              2. DNS recursion<\/span><\/li>\n
                              3. HTTP redirection<\/span><\/li>\n
                              4. VLAN trunking<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                Least-privilege permissions limit a mobile application to the device capabilities and information it actually needs. Excessive permissions can increase privacy and security exposure if the application or its data is compromised. During an authorized mobile assessment, testers can review requested permissions against the application’s documented functionality and determine whether unnecessary access is granted. DNS recursion, HTTP redirection, and VLAN trunking serve different technical purposes. Applying least privilege at the mobile platform level helps reduce the potential impact of application compromise.<\/span><\/p>\n

                                Question 336<\/b><\/h3>\n

                                A tester discovers that a mobile application communicates with an API endpoint that is not documented in the application’s normal interface. What should the tester do first?<\/b><\/p>\n

                                  \n
                                1. Determine whether the endpoint is within scope and assess its intended function<\/span><\/li>\n
                                2. Immediately attempt destructive requests<\/span><\/li>\n
                                3. Publish the endpoint publicly<\/span><\/li>\n
                                4. Delete the application<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 1<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  Undocumented API endpoints may represent legacy functionality, internal services, testing interfaces, or legitimate application operations. The tester should first establish whether the endpoint belongs to the authorized application and engagement scope, then understand its intended function before performing security tests. Immediately conducting destructive activity could disrupt services or violate the rules of engagement. Publishing the endpoint or deleting the application is inappropriate. Controlled endpoint discovery allows testers to expand assessment coverage without exceeding authorization or causing unnecessary impact.<\/span><\/p>\n

                                  Question 337<\/b><\/h3>\n

                                  Which cloud security control can limit communication between workloads based on defined network rules?<\/b><\/p>\n

                                    \n
                                  1. Security group<\/span><\/li>\n
                                  2. Password blocklist<\/span><\/li>\n
                                  3. Certificate transparency<\/span><\/li>\n
                                  4. Web archive<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    A cloud security group can act as a virtual network access-control mechanism, allowing or denying traffic according to defined rules. Depending on the cloud platform, these rules may apply to inbound, outbound, or workload-specific communication. During an authorized assessment, testers can determine whether security groups expose services more broadly than intended and whether administrative interfaces are appropriately restricted. Password blocklists protect account credentials, certificate transparency supports certificate visibility, and web archives preserve historical content. Proper cloud network controls help reduce unnecessary workload exposure.<\/span><\/p>\n

                                    Question 338<\/b><\/h3>\n

                                    A tester discovers that a cloud storage resource containing sensitive information is publicly accessible without authentication. What should be assessed first?<\/b><\/p>\n

                                      \n
                                    1. Access permissions and intended exposure<\/span><\/li>\n
                                    2. Browser font configuration<\/span><\/li>\n
                                    3. DNS TTL values<\/span><\/li>\n
                                    4. Wireless channel width<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 1<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      Publicly accessible cloud storage should be reviewed to determine whether the exposure is intentional and whether the permissions are broader than required. The tester should identify what data is accessible, while minimizing unnecessary access to sensitive information, and document the relevant configuration. Appropriate cloud storage permissions should restrict access according to business requirements. Browser fonts, DNS TTL values, and wireless channel width do not determine whether a cloud storage resource is publicly exposed.<\/span><\/p>\n

                                      Question 339<\/b><\/h3>\n

                                      Which security weakness can occur when a container process has unnecessary access to the host operating system?<\/b><\/p>\n

                                        \n
                                      1. Excessive container privileges<\/span><\/li>\n
                                      2. DNS MX misconfiguration<\/span><\/li>\n
                                      3. Session timeout<\/span><\/li>\n
                                      4. Password spraying<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 1<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        Containers should operate with only the privileges and host access required for their intended functions. Excessive privileges, unnecessary host mounts, or powerful capabilities can increase the potential impact of a compromised container and may weaken isolation between the workload and host system. During an authorized assessment, testers should review container permissions and runtime configuration against operational requirements. DNS MX configuration concerns email routing, session timeout affects application authentication, and password spraying targets accounts. Restricting container privileges is an important cloud-native security practice.<\/span><\/p>\n

                                        Question 340<\/b><\/h3>\n

                                        A security team wants to identify known vulnerabilities in packages installed inside container images before deployment. Which process is most appropriate?<\/b><\/p>\n

                                          \n
                                        1. Container image vulnerability scanning<\/span><\/li>\n
                                        2. DNS enumeration<\/span><\/li>\n
                                        3. Wireless channel analysis<\/span><\/li>\n
                                        4. Password spraying<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 1<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          Container image vulnerability scanning analyzes software packages and dependencies contained within an image against known vulnerability information. Performing this assessment before deployment can help organizations identify outdated or vulnerable components and rebuild images using maintained versions. The process can be integrated into development and deployment pipelines so that vulnerable images are identified earlier. DNS enumeration gathers infrastructure information, wireless analysis examines wireless networks, and password spraying evaluates authentication weaknesses. Image scanning should be combined with timely patching and controlled image lifecycle management.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.   Question 321 Which technique is used to determine whether a system can be reached through IPv6 when only IPv4 addresses were initially identified? IPv6 reconnaissance Password spraying Cookie analysis File fuzzing Correct Answer: 1 Explanation IPv6 reconnaissance helps identify IPv6-enabled hosts, addresses, services, and […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17053"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=17053"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17053\/revisions"}],"predecessor-version":[{"id":17054,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17053\/revisions\/17054"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=17053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=17053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=17053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}