{"id":17060,"date":"2026-09-21T06:13:47","date_gmt":"2026-09-21T06:13:47","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=17060"},"modified":"2026-09-21T06:13:47","modified_gmt":"2026-09-21T06:13:47","slug":"comptia-pentest-pt0-003-practice-test-questions-and-exam-dumps-part20-q381-400","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/comptia-pentest-pt0-003-practice-test-questions-and-exam-dumps-part20-q381-400\/","title":{"rendered":"CompTIA Pentest+ PT0-003 Practice Test Questions and Exam Dumps Part20 Q381-400"},"content":{"rendered":"

View Full <\/b>CompTIA PT0-003 Exam Dumps<\/b><\/a> and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 381<\/b><\/h3>\n

Before testing a production application that restricts access by source IP address, what should the penetration tester confirm?<\/b><\/p>\n

    \n
  1. The application’s logo<\/span><\/li>\n
  2. The authorized testing source IP<\/span><\/li>\n
  3. The database table names<\/span><\/li>\n
  4. The server’s screen resolution<\/span><\/li>\n<\/ol>\n

    Correct Answer: 2<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    Source-IP restrictions can prevent legitimate testing traffic from reaching an application or can cause unexpected security events if testing originates from an unauthorized location. Before beginning the assessment, the penetration tester should confirm which source IP addresses, VPN connections, or approved jump hosts are authorized by the engagement documentation. This ensures that testing traffic follows the agreed network path and remains within scope. Verifying the testing source also helps the client distinguish authorized penetration-testing activity from potentially suspicious external traffic.<\/span><\/p>\n

    Question 382<\/b><\/h3>\n

    Which DNS record creates an alias that points one domain name to another canonical hostname?<\/b><\/p>\n

      \n
    1. CNAME<\/span><\/li>\n
    2. AAAA<\/span><\/li>\n
    3. PTR<\/span><\/li>\n
    4. MX<\/span><\/li>\n<\/ol>\n

      Correct Answer: 1<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      A CNAME, or Canonical Name, record creates an alias from one DNS name to another hostname. It is commonly used when multiple names should resolve through a shared canonical destination. An AAAA record maps a hostname to an IPv6 address, a PTR record supports reverse DNS lookups, and an MX record identifies mail servers responsible for receiving email. During authorized reconnaissance, identifying CNAME relationships can help testers understand how different publicly accessible names are connected to shared infrastructure or external service providers.<\/span><\/p>\n

      Question 383<\/b><\/h3>\n

      A security assessment identifies a public DNS zone containing internal hostnames that should not be exposed externally. Which issue should the tester document?<\/b><\/p>\n

        \n
      1. DNS information exposure<\/span><\/li>\n
      2. Session fixation<\/span><\/li>\n
      3. Password spraying<\/span><\/li>\n
      4. Container escape<\/span><\/li>\n<\/ol>\n

        Correct Answer: 1<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        Publicly accessible DNS information can reveal internal naming conventions, infrastructure roles, development systems, management hosts, or other details that were not intended for external disclosure. During an authorized assessment, testers should document the exposed information and explain how it could assist reconnaissance without assuming that disclosure automatically represents a critical vulnerability. The appropriate severity depends on the sensitivity of the information and the organization’s architecture. Session fixation, password spraying, and container escape are unrelated security issues.<\/span><\/p>\n

        Question 384<\/b><\/h3>\n

        Which DNS security mechanism uses cryptographic signatures to provide authenticity and integrity for DNS responses?<\/b><\/p>\n

          \n
        1. DHCP<\/span><\/li>\n
        2. SNMP<\/span><\/li>\n
        3. DNSSEC<\/span><\/li>\n
        4. FTP<\/span><\/li>\n<\/ol>\n

          Correct Answer: 3<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          DNSSEC, or Domain Name System Security Extensions, uses digital signatures to help validate the authenticity and integrity of DNS data. It is designed to reduce certain DNS manipulation risks by allowing validating resolvers to verify that responses originate from an authorized DNS hierarchy and have not been altered. DHCP assigns network configuration, SNMP is used for network management, and FTP transfers files. During an authorized assessment, reviewing DNSSEC configuration can help identify weaknesses in an organization’s DNS security architecture.<\/span><\/p>\n

          Question 385<\/b><\/h3>\n

          A tester discovers that a web application processes serialized objects received from users without adequately validating their contents. Which vulnerability class may be involved?<\/b><\/p>\n

            \n
          1. Insecure deserialization<\/span><\/li>\n
          2. Network segmentation failure<\/span><\/li>\n
          3. Password spraying<\/span><\/li>\n
          4. Certificate expiration<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            Insecure deserialization occurs when an application reconstructs serialized objects from untrusted or insufficiently validated input. Depending on the technology and implementation, unsafe deserialization can lead to unauthorized actions, data manipulation, or other serious security consequences. During an authorized assessment, testers should determine whether serialized data is trusted, whether integrity controls exist, and whether the application restricts accepted object types. Network segmentation, password spraying, and certificate expiration address different security areas and do not describe unsafe object reconstruction.<\/span><\/p>\n

            Question 386<\/b><\/h3>\n

            Which web security weakness occurs when a server uses a user-controlled URL to make requests to another resource without adequately restricting the destination?<\/b><\/p>\n

              \n
            1. CORS misconfiguration<\/span><\/li>\n
            2. SSRF<\/span><\/li>\n
            3. Clickjacking<\/span><\/li>\n
            4. Session fixation<\/span><\/li>\n<\/ol>\n

              Correct Answer: 2<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              Server-Side Request Forgery, or SSRF, occurs when an application causes its server to make requests based on attacker-controlled or insufficiently restricted input. The security concern is that the server may have network access or privileges that the external requester does not possess. During an authorized assessment, testers should evaluate whether destination controls, network segmentation, and request validation are properly implemented. CORS misconfiguration concerns browser-origin policies, clickjacking involves deceptive framing, and session fixation concerns session identifiers.<\/span><\/p>\n

              Question 387<\/b><\/h3>\n

              An API accepts requests from arbitrary websites and exposes sensitive authenticated data through browser-based requests. Which configuration should the tester investigate?<\/b><\/p>\n

                \n
              1. CORS policy<\/span><\/li>\n
              2. DNS TTL<\/span><\/li>\n
              3. SMTP banner<\/span><\/li>\n
              4. NTP configuration<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                Cross-Origin Resource Sharing, or CORS, controls which web origins are permitted to interact with resources through browser-based cross-origin requests. An overly permissive CORS configuration can expose sensitive API responses when combined with authentication and other conditions. During an authorized assessment, testers should review allowed origins, credential handling, and whether sensitive endpoints are unnecessarily accessible cross-origin. DNS TTL controls caching duration, SMTP banners identify mail services, and NTP configuration concerns time synchronization. CORS should be evaluated in the context of the application’s actual authentication model.<\/span><\/p>\n

                Question 388<\/b><\/h3>\n

                Which web vulnerability can occur when an application includes a local server file based on insufficiently validated user input?<\/b><\/p>\n

                  \n
                1. VLAN hopping<\/span><\/li>\n
                2. Local file inclusion<\/span><\/li>\n
                3. Password spraying<\/span><\/li>\n
                4. DNS poisoning<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 2<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  Local File Inclusion, or LFI, occurs when an application incorporates or processes files from the local server based on user-controlled input without adequate validation. Depending on the application and server configuration, this can expose sensitive files or affect application behavior. During an authorized assessment, testers should determine whether file paths are constrained to intended resources and whether strong allowlisting is used. VLAN hopping affects network segmentation, password spraying targets authentication systems, and DNS poisoning manipulates name resolution.<\/span><\/p>\n

                  Question 389<\/b><\/h3>\n

                  A web application redirects users after login based on a URL supplied by the client. What should the tester verify to reduce OAuth-related redirect abuse?<\/b><\/p>\n

                    \n
                  1. Whether the redirect URI is strictly validated<\/span><\/li>\n
                  2. Whether DNS uses short TTL values<\/span><\/li>\n
                  3. Whether the server supports IPv6<\/span><\/li>\n
                  4. Whether SMTP uses encryption<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    OAuth implementations should carefully validate redirect URIs so authorization responses are returned only to approved destinations. Weak or overly flexible redirect validation can create opportunities for authorization information to be sent to an unintended location. During an authorized assessment, testers should review whether registered redirect URIs are exact or appropriately constrained and whether wildcard behavior introduces unnecessary risk. DNS TTL, IPv6 support, and SMTP encryption do not directly address OAuth redirect validation. Proper redirect handling is an important part of secure authorization-flow design.<\/span><\/p>\n

                    Question 390<\/b><\/h3>\n

                    Which network attack can exploit insufficient separation between VLANs by causing traffic from one VLAN to reach another?<\/b><\/p>\n

                      \n
                    1. Session fixation<\/span><\/li>\n
                    2. XXE<\/span><\/li>\n
                    3. VLAN hopping<\/span><\/li>\n
                    4. Credential stuffing<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 3<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      VLAN hopping refers to techniques that can allow network traffic to cross VLAN boundaries when switch configuration or trunking controls are improperly implemented. This can weaken intended network segmentation and potentially expose systems that should be isolated from one another. During an authorized internal assessment, testers should evaluate VLAN configuration and segmentation controls according to the engagement’s scope. Session fixation affects web sessions, XXE concerns XML processing, and credential stuffing involves reused credentials. Proper switch configuration and segmentation reduce the risk of unintended VLAN traversal.<\/span><\/p>\n

                      Question 391<\/b><\/h3>\n

                      Which protocol is commonly associated with authentication in enterprise wireless networks using centralized identity services?<\/b><\/p>\n

                        \n
                      1. 802.1X<\/span><\/li>\n
                      2. FTP<\/span><\/li>\n
                      3. Telnet<\/span><\/li>\n
                      4. POP3<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        IEEE 802.1X provides port-based network access control and is commonly used with enterprise wireless authentication. It can work with an authentication server to validate users or devices before granting network access. During an authorized wireless assessment, testers may review whether enterprise authentication is properly configured and whether appropriate authentication methods and certificate validation are used. FTP and Telnet are older application-layer protocols, while POP3 is primarily used for retrieving email. Enterprise wireless security generally benefits from centralized authentication rather than shared credentials.<\/span><\/p>\n

                        Question 392<\/b><\/h3>\n

                        A tester observes that Windows hosts are resolving names through a legacy local-name-resolution protocol that could expose authentication information. Which protocol should receive attention?<\/b><\/p>\n

                          \n
                        1. HTTPS<\/span><\/li>\n
                        2. LLMNR<\/span><\/li>\n
                        3. SFTP<\/span><\/li>\n
                        4. DNSSEC<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 2<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          Link-Local Multicast Name Resolution, or LLMNR, is a legacy name-resolution mechanism used in some Windows environments. If improperly configured, name-resolution behavior can create opportunities for credential-related information exposure during an authorized internal assessment. Organizations can reduce unnecessary exposure by disabling legacy protocols where they are not required and using appropriately secured name-resolution services. HTTPS protects web communications, SFTP provides secure file transfer, and DNSSEC adds integrity protections to DNS. The exact risk should be evaluated against the organization’s configuration and security controls.<\/span><\/p>\n

                          Question 393<\/b><\/h3>\n

                          Which attack technique attempts to use captured NTLM authentication material against another service without requiring the original password?<\/b><\/p>\n

                            \n
                          1. NTLM relay<\/span><\/li>\n
                          2. Clickjacking<\/span><\/li>\n
                          3. SQL injection<\/span><\/li>\n
                          4. Open redirect<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            NTLM relay involves forwarding captured NTLM authentication exchanges to another service that accepts NTLM authentication. The security concern is that an attacker may potentially authenticate to a service using relayed authentication material without knowing the user’s plaintext password. During authorized testing, organizations can assess whether protections such as SMB signing, appropriate authentication configurations, and network segmentation reduce this risk. Clickjacking, SQL injection, and open redirects involve different application-layer weaknesses and do not describe authentication relay behavior.<\/span><\/p>\n

                            Question 394<\/b><\/h3>\n

                            A tester identifies an Active Directory service account associated with a service principal name and wants to assess whether its password is susceptible to offline cracking. Which technique is relevant?<\/b><\/p>\n

                              \n
                            1. Kerberoasting<\/span><\/li>\n
                            2. VLAN hopping<\/span><\/li>\n
                            3. DNS tunneling<\/span><\/li>\n
                            4. Clickjacking<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 1<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              Kerberoasting is an Active Directory attack technique involving service accounts associated with service principal names. Authentication-related material can be obtained in a form that may permit offline password-strength assessment. During an authorized penetration test, the objective is to determine whether service-account passwords are sufficiently strong and whether unnecessary service-account privileges increase risk. VLAN hopping concerns network segmentation, DNS tunneling concerns use of DNS communications for data transfer, and clickjacking targets web interfaces. Service accounts should use strong credentials and appropriate privilege restrictions.<\/span><\/p>\n

                              Question 395<\/b><\/h3>\n

                              During an authorized wireless assessment, which technique can test whether clients properly respond to unexpected wireless management-frame activity?<\/b><\/p>\n

                                \n
                              1. Password spraying<\/span><\/li>\n
                              2. Wireless deauthentication testing<\/span><\/li>\n
                              3. SQL injection<\/span><\/li>\n
                              4. Local file inclusion<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 2<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                Wireless deauthentication testing can be used in an authorized assessment to evaluate how wireless clients and infrastructure respond to deauthentication-related management traffic. The purpose may include determining whether protections such as Protected Management Frames are properly implemented and whether clients reconnect securely. Because wireless testing can disrupt connectivity, it must be explicitly authorized and carefully controlled. Password spraying targets authentication systems, SQL injection targets database-driven applications, and local file inclusion concerns server-side file handling.<\/span><\/p>\n

                                Question 396<\/b><\/h3>\n

                                A cloud-hosted virtual machine can access a metadata service that exposes sensitive temporary credentials because application access is not restricted. What should the tester investigate?<\/b><\/p>\n

                                  \n
                                1. Cloud metadata service exposure<\/span><\/li>\n
                                2. Email forwarding rules<\/span><\/li>\n
                                3. DNS zone expiration<\/span><\/li>\n
                                4. Browser cache settings<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 1<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  Cloud metadata services can provide information about the workload environment and, depending on the platform and configuration, temporary credentials or other sensitive data. If applications can access metadata unnecessarily, a compromised workload may potentially obtain information beyond what it requires. During an authorized cloud assessment, testers should review metadata-service protections, workload identity permissions, and network access controls. Email forwarding, DNS expiration, and browser caching do not directly address this cloud-specific risk. Restricting unnecessary metadata access can reduce credential exposure.<\/span><\/p>\n

                                  Question 397<\/b><\/h3>\n

                                  Which practice helps ensure that software packages used in a penetration-testing environment or client application originate from a trusted source?<\/b><\/p>\n

                                    \n
                                  1. Image or package provenance verification<\/span><\/li>\n
                                  2. Disabling all logging<\/span><\/li>\n
                                  3. Sharing administrator credentials<\/span><\/li>\n
                                  4. Removing version information<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    Package and image provenance verification helps establish that software originates from an expected and trusted source. This can involve signed packages, trusted repositories, verified container images, or other integrity mechanisms. During security assessments, supply-chain controls are relevant because malicious or tampered components can introduce vulnerabilities before software reaches production. Disabling logging, sharing administrator credentials, and removing version information do not establish software authenticity. Organizations should maintain trusted sources and verify integrity where practical, particularly for security-sensitive workloads.<\/span><\/p>\n

                                    Question 398<\/b><\/h3>\n

                                    A container platform permits a workload to run with unnecessary administrative privileges. Which security concern should the tester prioritize?<\/b><\/p>\n

                                      \n
                                    1. Container escape risk<\/span><\/li>\n
                                    2. DNS record expiration<\/span><\/li>\n
                                    3. Email spoofing<\/span><\/li>\n
                                    4. Browser history exposure<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 1<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      Excessive container privileges can increase the consequences of a compromised workload and may weaken isolation from the host environment. A container escape risk becomes particularly important when privileged configurations, excessive capabilities, or dangerous host access are present. During an authorized assessment, testers should review runtime privileges and isolation controls without performing disruptive actions outside the agreed scope. DNS expiration, email spoofing, and browser history exposure are separate security concerns. Strong container isolation and minimal runtime privileges reduce the potential impact of workload compromise.<\/span><\/p>\n

                                      Question 399<\/b><\/h3>\n

                                      A penetration tester is given authorization to assess a partner-owned application. What additional documentation should the tester verify before testing the partner’s systems?<\/b><\/p>\n

                                        \n
                                      1. The tester’s preferred operating system<\/span><\/li>\n
                                      2. Explicit authorization from the partner or system owner<\/span><\/li>\n
                                      3. The application’s programming language<\/span><\/li>\n
                                      4. The office printer configuration<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 2<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        Testing a third-party or partner-owned system requires explicit authorization from the organization that owns or controls the relevant infrastructure. The tester should verify that the authorization clearly identifies the systems, testing activities, timing, and applicable restrictions. A client’s permission alone may not automatically authorize actions against infrastructure owned by another organization. Operating-system preferences, programming languages, and printer configurations do not establish legal or operational authorization. Confirming third-party approval protects both the tester and participating organizations from unauthorized activity.<\/span><\/p>\n

                                        Question 400<\/b><\/h3>\n

                                        After completing an engagement, what is the most appropriate approach to sensitive evidence collected during the penetration test?<\/b><\/p>\n

                                          \n
                                        1. Keep every file indefinitely<\/span><\/li>\n
                                        2. Publish interesting findings publicly<\/span><\/li>\n
                                        3. Protect, retain, and securely dispose of evidence according to the engagement requirements<\/span><\/li>\n
                                        4. Send all evidence to unrelated employees<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 3<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          Penetration-testing evidence can contain credentials, personal information, configuration details, screenshots, logs, and other sensitive material. Testers should protect this evidence throughout the engagement and retain it only for the period and purposes authorized by the client or applicable requirements. When retention is no longer necessary, evidence should be securely disposed of according to the agreed procedures. Indefinite retention, public disclosure, or distribution to unrelated personnel increases confidentiality and privacy risks and is inconsistent with responsible evidence handling.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full CompTIA PT0-003 Exam Dumps and Practice Test Dumps.   Question 381 Before testing a production application that restricts access by source IP address, what should the penetration tester confirm? The application’s logo The authorized testing source IP The database table names The server’s screen resolution Correct Answer: 2 Explanation Source-IP restrictions can prevent […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17060"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=17060"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17060\/revisions"}],"predecessor-version":[{"id":17061,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17060\/revisions\/17061"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=17060"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=17060"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=17060"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}