93 free CompTIA PenTest+ PT0-003 practice questions from the CertStash pack of 373, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 93 free here, all 373 in the pack, and each step includes the one before it.
Get all 373 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
A penetration tester wants to send a specific network packet with custom flags and sequence numbers to a vulnerable target. Which of the following should the tester use?
Show answer and explanation
Correct answer: C. Scapy
Scapy is a powerful Python library that allows penetration testers to craft, send, and manipulate network packets with custom flags, sequence numbers, and other fields. It provides programmatic control over packet construction at the protocol level, making it ideal for sending specially crafted packets to vulnerable targets.
Why the other options are wrong
- A. tcprelay is a tool for relaying TCP connections, not for crafting custom packets.
- B. Bluecrack is a Bluetooth cracking tool, not relevant for crafting IP-level network packets.
- D. tcpdump is a packet capture and analysis tool, not for creating and sending custom packets.
Question 2
Which of the following explains the reason a tester would opt to use DREAD over PTES during the planning phase of a penetration test?
Show answer and explanation
Correct answer: D. The tester is creating a threat model.
DREAD is a threat modeling methodology used to identify and prioritize threats based on Damage, Reproducibility, Exploitability, Affected users, and Discoverability. PTES is a comprehensive penetration testing execution standard. DREAD is specifically chosen during the planning phase when the goal is to create a threat model and understand potential risks before conducting the actual test.
Why the other options are wrong
- A. Web application testing does not specifically require DREAD over PTES.
- B. Mobile application assessment would use similar methodologies but doesn't distinguish DREAD as the primary reason.
- C. Thick client application testing doesn't specifically mandate DREAD over PTES.
Question 3
A penetration tester is performing a security review of a web application. Which of the following should the tester leverage to identify the presence of vulnerable open-source libraries?
Show answer and explanation
Correct answer: D. SCA
Software Composition Analysis (SCA) is specifically designed to identify vulnerable open-source libraries and dependencies within applications. It scans source code and binaries to locate third-party components and checks them against known vulnerability databases to detect security issues in dependencies.
Why the other options are wrong
- A. VM (Virtual Machine) is an execution environment, not a tool for identifying vulnerable libraries.
- B. IAST (Interactive Application Security Testing) analyzes running applications but is not specialized for open-source library detection.
- C. DAST (Dynamic Application Security Testing) tests running applications but is not optimized for dependency vulnerability identification.
Question 4
A penetration tester is conducting reconnaissance for an upcoming assessment of a large corporate client. The client authorized spear phishing in the rules of engagement. Which of the following should the tester do first when developing the phishing campaign?
Show answer and explanation
Correct answer: C. Social media
Social media is the first step in developing a phishing campaign as it provides publicly available information about target employees, their roles, interests, and relationships. This information is essential for crafting convincing spear phishing emails that appear legitimate and increase the likelihood of success.
Why the other options are wrong
- A. Shoulder surfing is a physical social engineering technique, not part of initial phishing campaign development.
- B. Recon-ng is useful but would be secondary to gathering basic target information from social media.
- D. Password dumps would only be relevant after identifying and targeting specific individuals.
Question 5
During a penetration test, a tester captures information about an SPN account. Which of the following attacks requires this information as a prerequisite to proceed?
Show answer and explanation
Correct answer: B. Kerberoasting
Kerberoasting is an attack that specifically targets Service Principal Names (SPNs). The attacker requests a Kerberos ticket for an SPN account and then attempts to crack the ticket offline. Knowledge of SPN accounts is an absolute prerequisite to launch this attack, as the attacker must know which service accounts to target.
Why the other options are wrong
- A. Golden Ticket attacks require knowledge of the krbtgt password hash, not SPN information.
- C. DCShadow is a domain controller impersonation attack that doesn't require SPN capture as a prerequisite.
- D. LSASS dumping requires access to a compromised system, not SPN information.
Question 6
While performing an internal assessment, a tester uses the following command: crackmapexec smb 192.168.1.0/24 -u user.txt -p Summer123@ Which of the following is the main purpose of the command?
Show answer and explanation
Correct answer: C. To perform password spraying on internal systems
The crackmapexec command with the syntax 'smb 192.168.1.0/24 -u user.txt -p Summer123@' is performing password spraying across a subnet. It attempts to authenticate to multiple SMB endpoints using a list of usernames with a single password, which is the definition of password spraying, trying one password against many accounts.
Why the other options are wrong
- A. Pass-the-hash would use the -H flag for NTLM hashes, not plaintext passwords with -p.
- B. Protocol scanning would use tools like nmap, not credential-based authentication attempts.
- D. Command execution would require the -x flag to specify a command to execute.
Question 7
A penetration testing team needs to determine whether it is possible to disrupt the wireless communications for PCs deployed in the client's offices. Which of the following techniques should the penetration tester leverage?
Show answer and explanation
Correct answer: D. Channel scanning
Channel scanning is the technique used to determine if wireless communications can be disrupted. It involves monitoring and analyzing wireless channels to identify which frequencies are in use and assess vulnerabilities in wireless signal transmission that could be exploited or disrupted.
Why the other options are wrong
- A. Port mirroring is a network switch feature for monitoring traffic, not for assessing wireless disruption.
- B. Sidecar scanning relates to wireless packet capture, not specifically for disruption assessment.
- C. ARP poisoning is a layer 2 attack for wired networks, not applicable to wireless communication disruption.
Question 8
Which of the following tasks would ensure the key outputs from a penetration test are not lost as part of the cleanup and restoration activities?
Show answer and explanation
Correct answer: A. Preserving artifacts
Preserving artifacts ensures that all key outputs, findings, evidence, and documentation from the penetration test are retained and not lost during cleanup and restoration activities. This is critical for maintaining the integrity of the assessment results and supporting compliance and follow-up activities.
Why the other options are wrong
- B. Reverting configuration changes is important for cleanup but doesn't directly preserve test outputs.
- C. Keeping chain of custody relates to evidence handling but is secondary to preserving the actual test artifacts.
- D. Exporting credential data is a security risk and should not be part of post-test activities.
Question 9
A tester gains initial access to a server and needs to enumerate all corporate domain DNS records. Which of the following commands should the tester use?
Show answer and explanation
Correct answer: C. dig afxr @local.dns.server
A zone transfer (AXFR) is the technique used to enumerate all DNS records from a domain. The command 'dig axfr @local.dns.server' requests a full zone transfer from the specified DNS server, which returns all records in the zone. This is the standard method for comprehensive DNS enumeration when permitted.
Why the other options are wrong
- A. dig +short A AAAA only queries specific record types, not all records in the zone
- B. nslookup without AXFR syntax performs standard lookups, not zone transfers
- D. The wildcard (*) syntax in nslookup is incorrect for zone transfers; AXFR requires proper dig syntax
Question 10
A penetration tester is performing network reconnaissance. The tester wants to gather information about the network without causing detection mechanisms to flag the reconnaissance activities. Which of the following techniques should the tester use?
Show answer and explanation
Correct answer: A. Sniffing
Sniffing is a passive reconnaissance technique that captures network traffic without sending probes or generating suspicious network activity. It observes existing traffic on the network, making it the least likely to trigger detection mechanisms. Banner grabbing, TCP/UDP scanning, and ping sweeps all actively probe the network and generate suspicious traffic patterns.
Why the other options are wrong
- B. Banner grabbing requires active connection attempts to services, generating detectable traffic
- C. TCP/UDP scanning actively probes ports and generates numerous connection attempts that IDS/IPS systems detect
- D. Ping sweeps send ICMP packets to multiple hosts, creating obvious reconnaissance traffic
What people say about the full PT0-003 pack 5.0 from 24
Honestly this is legit. Was surprised how many questions I recognised during the exam. Real exam questions in this dump for sure. Makes the nerves much more manageable. Specifically for PenTest+, highly recommend.
Really appreciate this. Incredible value for money, helped with my prep. Would buy again. Highly recommend.
Passed on first attempt cause of this :)
Question 11
Given the following statements: Implement a web application firewall. Upgrade end-of-life operating systems. Implement a secure software development life cycle. In which of the following sections of a penetration test report would the above statements be found?
Show answer and explanation
Correct answer: D. Recommendations
The statements listed are actionable security improvements and remediation steps. These belong in the Recommendations section of a penetration test report, which presents prioritized solutions to address identified vulnerabilities and improve the organization's security posture.
Why the other options are wrong
- A. The Executive Summary provides high-level overview and key findings, not specific remediation steps.
- B. The Attack Narrative describes how vulnerabilities were exploited and the sequence of events during testing.
- C. Detailed Findings presents discovered vulnerabilities, their impact, and technical details, not future improvements.
Question 12
A penetration tester gains access to a Linux computer system. The tester then attempts to enumerate user accounts, including the directories and user default shell. Which of the following commands should the tester use to enumerate user accounts?
Show answer and explanation
Correct answer: D. cat /etc/passwd
The /etc/passwd file contains user account information including usernames, user IDs, home directories, and default shells. The cat command displays this file's contents, providing all the enumeration data requested.
Why the other options are wrong
- A. /etc/shadow contains password hashes and requires root privileges; it doesn't show shell information and is not the standard enumeration file.
- B. /var/usr is not a standard Linux directory path for user information.
- C. ls /home only shows home directory names, not comprehensive user account details like default shells or UIDs.
Question 13
During a web application assessment, a penetration tester identifies an administrative tool that would allow for the production database to be deleted without authorization. Which of the following is most important for the penetration tester to consider before proceeding with testing?
Show answer and explanation
Correct answer: A. Rules of engagement
Rules of engagement are the most critical consideration before proceeding with any testing activity. They define the scope, limitations, authorized targets, and legal boundaries of the assessment. Testing an administrative tool that could delete a production database without explicit authorization in the rules of engagement could result in legal liability, violate laws, and cause unintended harm to the organization.
Why the other options are wrong
- B. Business continuity planning is important but doesn't authorize or restrict testing activities.
- C. Testing hours are a scheduling consideration, not authorization for the type of testing to perform.
- D. Application terms of use are less relevant than contractual rules of engagement for authorized security testing.
Question 14
During an internal penetration test, a tester compromises a Windows OS-based endpoint and bypasses the defensive mechanism on that system. The tester also discovers the endpoint is part of an Active Directory local domain. The tester’s main goal is to leverage credentials to authenticate into other systems within the Active Directory environment. Which of the following steps should the tester take to complete the goal?
Show answer and explanation
Correct answer: A. Use Mimikatz to collect information about the accounts and try to authenticate in other systems.
Mimikatz is a specialized tool designed to extract credentials and authentication tokens from Windows systems, particularly from memory. After compromising an endpoint in an Active Directory environment, Mimikatz is the standard tool to harvest credentials that can then be used for lateral movement and authentication to other systems.
Why the other options are wrong
- B. Hasheat (or hashcat) is used to crack password hashes offline, but the goal is to leverage existing credentials for authentication, not crack them.
- C. Evil-WinRM is a tool for remote command execution, but it requires credentials first; Mimikatz is needed to obtain them.
- D. Metasploit creates payloads for exploitation and lateral movement but is not the primary tool for credential harvesting in this scenario.
Question 15
A penetration tester needs to obtain sensitive data from several executives who regularly work while commuting by train. Which of the following methods should the tester use for this task?
Show answer and explanation
Correct answer: A. Shoulder surfing
Shoulder surfing is the most effective method to obtain sensitive data from executives working on trains, as the tester can observe screen content, documents, or keyboard input from nearby positions without the target's knowledge or cooperation.
Why the other options are wrong
- B. Credential harvesting requires the target to enter credentials on a compromised system, unlikely during commutes.
- C. Bluetooth spamming is indiscriminate and does not target specific sensitive data.
- D. MFA fatigue attacks require prior account compromise and repeated authentication attempts.
Question 16
Which of the following will reduce the possibility of introducing errors or bias in a penetration test report?
Show answer and explanation
Correct answer: B. Peer review
Peer review involves having other qualified professionals independently verify findings, methodology, and conclusions, which directly reduces errors and biases that individual testers might introduce. This is a standard quality assurance practice in penetration testing.
Why the other options are wrong
- A. Secure distribution addresses confidentiality but does not prevent errors or bias in content.
- C. AI-generated content can introduce its own biases and errors without proper validation.
- D. Goal reprioritization changes scope but does not address accuracy or bias in testing.
Question 17
A penetration tester needs to identify all vulnerable input fields on a customer website. Which of the following tools would be best suited to complete this request?
Show answer and explanation
Correct answer: A. DAST
DAST (Dynamic Application Security Testing) tests running applications by sending inputs and observing outputs, making it ideal for identifying vulnerable input fields on a live website without requiring source code access.
Why the other options are wrong
- B. SAST (Static Application Security Testing) analyzes source code but requires code access and cannot dynamically test live web applications
- C. IAST (Interactive Application Security Testing) monitors application behavior during testing but is more complex and typically used in development environments
- D. SCA (Software Composition Analysis) identifies known vulnerabilities in third-party dependencies, not vulnerable input fields in the application itself
Question 18
A penetration tester successfully gained access to manage resources and services within the company’s cloud environment. This was achieved by exploiting poorly secured administrative credentials that had extensive permissions across the network. Which of the following credentials was the tester able to obtain?
Show answer and explanation
Correct answer: A. IAM credentials
IAM (Identity and Access Management) credentials provide extensive permissions across cloud resources and services, making them the most valuable target for an attacker seeking to manage resources and services broadly. IAM roles and credentials grant administrative access across the entire cloud environment.
Why the other options are wrong
- B. SSH keys provide access to individual cloud instances, not comprehensive resource management.
- C. Cloud storage credentials are limited to storage services, not general resource management.
- D. Temporary STS credentials are short-lived and provide limited scope compared to IAM credentials.
Question 19
A penetration tester would like to leverage a CSRF vulnerability to gather sensitive details from an application's end users. Which of the following tools should the tester use for this task?
Show answer and explanation
Correct answer: A. Browser Exploitation Framework
The Browser Exploitation Framework (BeEF) is designed to exploit web browsers and conduct client-side attacks, including CSRF exploitation to capture sensitive information from end users through their browsers.
Why the other options are wrong
- B. Maltego is used for information gathering and data mapping, not for exploiting CSRF vulnerabilities.
- C. Metasploit is primarily for server-side exploitation and payload delivery, not browser-based CSRF attacks.
- D. theHarvester is an OSINT tool for gathering email addresses and subdomains, unrelated to CSRF exploitation.
Question 20
During a security audit, a penetration tester wants to run a process to gather information about a target network's domain structure and associated IP addresses. Which of the following tools should the tester use?
Show answer and explanation
Correct answer: A. Dnsenum
Dnsenum is specifically designed to gather DNS information, including domain structure, subdomains, and associated IP addresses through DNS queries and brute-force techniques. Nmap is a port scanner, Netcat is a network utility, and Wireshark is a packet analyzer, none are optimized for domain structure enumeration like Dnsenum.
Why the other options are wrong
- B. Nmap is primarily a port scanner, not a DNS enumeration tool.
- C. Netcat is a network utility for reading/writing data across networks, not DNS enumeration.
- D. Wireshark is a packet analyzer for viewing network traffic, not for DNS enumeration.
Question 21
A penetration tester has adversely affected a critical system during an engagement, which could have a material impact on the organization. Which of the following should the penetration tester do to address this issue?
Show answer and explanation
Correct answer: C. Follow the escalation process.
When a penetration test has adversely affected a critical system with potential material impact, the tester must immediately follow the escalation process defined in the engagement rules of engagement and contract. This ensures proper notification to stakeholders, incident response procedures, and damage control. Restoring configuration is a remediation step but not the first action. A Business Impact Analysis is a planning tool, not an immediate response. Selecting the target is a pre-engagement activity.
Why the other options are wrong
- A. Restoring configuration is remediation but comes after proper escalation and stakeholder notification.
- B. A BIA is a pre-engagement planning tool, not an emergency response action.
- D. Target selection occurs before the engagement begins, not during incident response.
Question 22
During a security assessment, a penetration tester gains access to an internal server and manipulates some data to hide its presence. Which of the following is the best way for the penetration tester to hide the activities performed?
Show answer and explanation
Correct answer: A. Clear the Windows event logs.
Clearing Windows event logs is the most direct and effective way to hide activities performed on a system. Event logs contain detailed records of system actions, logons, and executed commands. Completely removing these logs eliminates the primary evidence of unauthorized activities, making it the best method for hiding the penetration tester's presence and actions.
Why the other options are wrong
- B. Modifying system time may affect log timestamps but doesn't remove the records of activities themselves.
- C. Altering log permissions doesn't hide activities; it only restricts who can view the logs.
- D. Reducing log retention settings doesn't immediately hide current activities and takes time to take effect.
Question 23
A penetration tester attempts to access an internet-facing web page while conducting research on site. However, the web page is no longer accessible. Which of the following is the best step for the tester to take to continue gathering details?
Show answer and explanation
Correct answer: C. Locate a cached version of the page.
When a website is no longer accessible, locating a cached version of the page is the best approach to continue information gathering. Search engines like Google and Internet Archive (Wayback Machine) maintain cached copies of previously indexed web pages, allowing the tester to review historical content without requiring direct access to the live site.
Why the other options are wrong
- A. Changing proxy settings won't help if the site itself is down or removed.
- B. Changing the user agent doesn't solve the fundamental issue of the page being inaccessible.
- D. Asking to have the site unblocked assumes blocking is the problem, but the question states the site is 'no longer accessible,' indicating it may be permanently down.
Question 24
A penetration tester plans to conduct reconnaissance during an engagement using readily available resources. Which of the following resources would most likely identify hardware and software being utilized by the client?
Show answer and explanation
Correct answer: D. Job boards
Job boards (LinkedIn, Indeed, Glassdoor, etc.) contain detailed information about hardware and software requirements posted in job descriptions. Employees seeking positions often list specific technologies, tools, and infrastructure the company uses, providing valuable reconnaissance data without any active probing.
Why the other options are wrong
- A. Cryptographic flaws are vulnerabilities, not reconnaissance sources for identifying hardware/software inventory.
- B. Protocol scanning is active reconnaissance that directly probes systems, not a passive readily-available resource.
- C. Cached pages may contain some information but are less reliable and comprehensive than job postings for identifying standard tools and hardware.
Question 25
While conducting a reconnaissance activity, a penetration tester extracts the following information: Emails: • j.smith@example.com • a.jones@example.com • admin@example.com Which of the following risks should the tester use to leverage an attack as the next step in the security assessment?
Show answer and explanation
Correct answer: A. Unauthorized access to the network
Extracted email addresses from employee accounts indicate the company's naming convention and user structure, which are valuable for password spraying, phishing, and brute force attacks targeting network access. These discovered user accounts are the foundation for launching attacks to gain unauthorized network access. While data breaches or exposed servers might be indicated by finding such emails in breach databases, the immediate risk and next logical attack step is using these credentials to attempt unauthorized network access.
Why the other options are wrong
- B. The extracted emails alone do not directly indicate exposure of servers to the internet.
- C. Email enumeration does not inherently suggest SQL injection vulnerabilities.
- D. Finding employee emails does not prove an active data breach occurred.
Question 26
While performing a red-team exercise, a penetration tester uses a reading device to extract data from an employee's access badge. The tester creates a copy for unauthorized entry. Which of the following best describes this attack?
Show answer and explanation
Correct answer: B. Card skimming
Card skimming describes the act of using a reading device to extract data from an employee's access badge and creating a duplicate for unauthorized access. This is the standard term for this type of badge cloning attack used in physical security assessments.
Why the other options are wrong
- A. Smurfing refers to network-based DDoS attacks using spoofed packets, not physical badge cloning.
- C. On-path attacks involve intercepting communications between two parties, not extracting data from physical badges.
- D. Credential stuffing involves using known username/password combinations against online services, not physical badge duplication.
Question 27
During an assessment, a penetration tester compromises some machines but finds that none of the accounts have sufficient access to the target HR database server. In order to enumerate accounts with sufficient permissions, the tester wants to model an attack path before taking further action. Which of the following tools should the tester use to meet this objective?
Show answer and explanation
Correct answer: D. BloodHound
BloodHound is specifically designed to map and visualize Active Directory attack paths, relationships, and permissions within an organization. It identifies which accounts have sufficient access to resources like the HR database server by analyzing AD structures, group memberships, and privilege delegation. This is exactly what the tester needs to model attack paths and identify privileged accounts.
Why the other options are wrong
- A. Responder captures LLMNR and NBNS traffic but doesn't enumerate permission structures or attack paths.
- B. Mimikatz extracts credentials from memory but doesn't analyze permission hierarchies or access paths.
- C. Hydra performs credential brute-forcing, not permission enumeration or attack path analysis.
- E. TruffleHog searches for secrets in repositories, unrelated to database access permissions.
Question 28
A penetration tester gains access to a domain member server and wants to identify which potential targets are available to attack. Which of the following tools should the penetration tester use?
Show answer and explanation
Correct answer: C. Nmap
Nmap is the appropriate tool for identifying available targets and their network status after gaining access to a domain member server. It performs network scanning and service enumeration to discover potential attack targets and their open ports and services.
Why the other options are wrong
- A. Netcat is a networking utility for reading/writing network connections, not for network reconnaissance and target discovery.
- B. Wireshark is a packet analyzer for capturing and inspecting network traffic, not for active target scanning and identification.
- D. Responder is a tool for poisoning LLMNR/NBT-NS requests for credential harvesting, not for general target identification.
Question 29
A tester needs to begin capturing WLAN credentials for cracking during an on-site engagement. Which of the following is the best command to capture handshakes?
Show answer and explanation
Correct answer: D. airodump-ng -c 6 --bssid
airodump-ng is the standard tool for capturing wireless traffic and handshakes. The command airodump-ng -c 6 --bssid captures traffic on channel 6 for a specific access point (identified by BSSID), allowing the tester to monitor and capture WPA/WPA2 four-way handshakes needed for offline cracking.
Why the other options are wrong
- A. tcpdump captures network traffic but isn't optimized for wireless handshake capture.
- B. airserv-ng is a virtual access point tool, not designed for capturing handshakes.
- C. aireplay-ng performs replay attacks and deauthentication but isn't the primary handshake capture tool.
Question 30
During a penetration testing exercise, a team decides to use a watering hole strategy. Which of the following is the most effective approach for executing this attack?
Show answer and explanation
Correct answer: A. Compromise a website frequently visited by the organization's employees.
A watering hole attack specifically involves compromising a website that is frequently visited by the target organization's employees. When employees visit the compromised website, they are infected or redirected to malicious content, allowing attackers to infiltrate the organization indirectly. This is the defining characteristic of a watering hole strategy and is more effective than mass phishing because it targets trusted sites employees already visit.
Why the other options are wrong
- B. DDoS attacks are denial of service attacks, not watering hole attacks focused on compromising trusted sites.
- C. Creating fake social media profiles is social engineering or fraud, not a watering hole attack.
- D. Phishing emails are direct email-based attacks, not the indirect trusted-site compromise of watering hole attacks.
Question 31
During an assessment, a penetration tester obtains a low-privilege shell and then runs the following command: findstr /SIM /C:"pass” *.txt *.cfg *.xml Which of the following is the penetration tester trying to enumerate?
Show answer and explanation
Correct answer: D. Secrets
The findstr command with the /C:"pass" flag searches for the string 'pass' across .txt, .cfg, and .xml files. This is a classic technique to enumerate secrets such as hardcoded passwords, API keys, and other sensitive credentials stored in configuration and text files.
Why the other options are wrong
- A. While configuration files are being searched, the goal is not to enumerate the files themselves but their contents for secrets.
- B. Permissions are not determined by searching for the word 'pass' in text files.
- C. Virtual hosts have nothing to do with searching for password strings in local files.
Question 32
Which of the following should a penetration tester do when conducting post-engagement cleanup?
Show answer and explanation
Correct answer: A. Return the system to its original state.
Post-engagement cleanup requires returning systems to their original state, removing any tools, payloads, backdoors, or configuration changes made during the penetration test. This restores the environment and ensures no persistent vulnerabilities or artifacts remain from the assessment.
Why the other options are wrong
- B. Closing ports may be part of cleanup but is too specific; the general principle is restoring original state.
- C. Shutting down systems is not part of standard cleanup; systems should remain operational in their original state.
- D. Deleting activity logs is unethical and potentially illegal; proper documentation and reporting are required instead.
Question 33
A penetration tester needs to evaluate the security of example.com and gather stealthy information using DNS. Which of the following is the best tool for the tester to use?
Show answer and explanation
Correct answer: D. Recon-ng
Recon-ng is a comprehensive reconnaissance framework specifically designed for stealthy information gathering, including DNS reconnaissance. It can perform DNS lookups, zone transfers, and other DNS-based queries to passively enumerate information about a target domain. While Nikto is for web scanning, InSSIDer for wireless networks, and masscan for port scanning, Recon-ng is purpose-built for stealthy DNS reconnaissance and passive information gathering.
Why the other options are wrong
- A. Nikto is a web application vulnerability scanner, not primarily a DNS reconnaissance tool.
- B. InSSIDer is designed for wireless network discovery and analysis, not DNS reconnaissance.
- C. Masscan is a mass port scanner designed for speed, not stealthy DNS information gathering.
Question 34
A penetration tester must identify vulnerabilities within an ICS that is not connected to the internet or enterprise network. Which of the following should the tester utilize to conduct the testing?
Show answer and explanation
Correct answer: D. Manual assessment
For an isolated ICS not connected to the internet or enterprise network, manual assessment is the most appropriate method. Automated scanning tools can cause system crashes or disruptions in critical infrastructure environments. Manual testing allows the tester to carefully interact with systems, understand operational technology safely, and avoid disruptions. Channel scanning, stealth scans, and source code analysis are techniques for IT environments but are less suitable or applicable to isolated ICS environments requiring careful, methodical assessment.
Why the other options are wrong
- A. Channel scanning is a wireless assessment technique not applicable to isolated ICS.
- B. Stealth scans are IT-focused techniques that don't address the safety-critical nature of ICS assessment.
- C. Source code analysis applies to software assessment, not operational technology infrastructure security.
Question 35
During an engagement, a penetration tester needs to break the key for the Wi-Fi network that uses WPA2 encryption. Which of the following attacks would accomplish this objective?
Show answer and explanation
Correct answer: D. KRACK
KRACK (Key Reinstallation Attack) is a specific attack against WPA2 encryption that exploits key reinstallation vulnerabilities in the Wi-Fi Protected Access II protocol. It allows attackers to break WPA2 encryption and decrypt network traffic, making it the appropriate answer for breaking WPA2 keys.
Why the other options are wrong
- A. ChopChop is an attack against WEP encryption, not WPA2.
- B. Replay attacks capture and resend packets but don't break WPA2 encryption directly.
- C. Initialization vectors (IVs) are related to encryption mechanisms but not a WPA2 attack method.
Question 36
During host discovery, a security analyst wants to obtain GeoIP information and a comprehensive summary of exposed services. Which of the following tools is best for this task?
Show answer and explanation
Correct answer: D. Censys.io
Censys.io is a search engine for internet-connected devices that provides comprehensive information about exposed services, GeoIP data, SSL certificates, and detailed asset inventories. It's specifically designed to gather the type of reconnaissance data described. WiGLE.net focuses on wireless networks, WHOIS provides domain registration data, and theHarvester collects email addresses and basic metadata.
Why the other options are wrong
- A. WiGLE.net is focused on wireless network discovery (WiFi), not comprehensive service exposure data.
- B. WHOIS provides domain and IP registration information, not GeoIP or exposed services data.
- C. theHarvester gathers email addresses and basic metadata, not comprehensive service or GeoIP information.
Question 37
A penetration tester performs an assessment on the target company's Kubernetes cluster using kube-hunter. Which of the following types of vulnerabilities could be detected with the tool?
Show answer and explanation
Correct answer: B. Weaknesses and misconfigurations in the Kubernetes cluster
Kube-hunter is designed to scan Kubernetes clusters and identify weaknesses, misconfigurations, and security issues within the cluster infrastructure itself, including exposed services, insecure APIs, and configuration problems.
Why the other options are wrong
- A. While it may detect some network issues, kube-hunter focuses on cluster-level misconfigurations rather than network service configuration specifically
- C. Kube-hunter scans cluster security, not application deployment issues or application-level vulnerabilities
- D. Kube-hunter targets Kubernetes cluster vulnerabilities, not Docker container-specific security vulnerabilities
Question 38
A penetration tester is enumerating a Linux system. The goal is to modify the following script to provide more comprehensive system information: • #!/bin/bash • ps aux >> linux enum.txt Which of the following lines would provide the most comprehensive enumeration of the system?
Show answer and explanation
Correct answer: A. cat /etc/passwd >> linux_enum.txt netstat -tulr >> linux_enum.txt cat /etc/bash.bashrc >> linux_enum. txt
Option A provides the most comprehensive enumeration by collecting critical system information: /etc/passwd reveals user accounts, netstat shows network connections and routing, and bash.bashrc contains shell configuration details. This combination covers user accounts, network topology, and system configuration, essential for thorough enumeration.
Why the other options are wrong
- B. Only shows current user, basic OS info, and network interfaces; misses user accounts and network connections.
- C. Shows only hostname, current user, and external IP; lacks internal system and user enumeration.
- D. Covers open files on network, OS info, and home directories but misses critical user accounts and network routing information.
Question 39
A penetration tester established an initial compromise on a host. The tester wants to pivot to other targets and set up an appropriate relay. The tester needs to enumerate through the compromised host as a relay from the tester's machine. Which of the following commands should the tester use to do this task from the tester's host?
Show answer and explanation
Correct answer: D. attacker_host$ proxychains nmap -sT <target_cidr>
Proxychains is the standard tool for routing traffic through a compromised host (proxy) to enumerate and attack targets on the internal network. The command 'proxychains nmap -sT <target_cidr>' configures nmap to route all its traffic through the relay host specified in the proxychains configuration file, allowing the attacker to perform network reconnaissance on internal targets from their own machine. This is the proper, established methodology for pivoting through a compromised host.
Why the other options are wrong
- A. This attempts to pipe nmap output to netcat, which does not establish a proxy relay for subsequent traffic routing.
- B. This creates a named pipe and attempts netcat chaining but the syntax is malformed and does not properly establish a functional relay for nmap enumeration.
- C. This command syntax is broken; it attempts to listen on port 8000 and pipe to netcat, then separately run nmap against localhost:8000, which does not establish proper relay functionality.
Question 40
An external legal firm is conducting a penetration test of a large corporation. Which of the following would be most appropriate for the legal firm to use in the subject line of a weekly email update?
Show answer and explanation
Correct answer: A. Privileged & Confidential Status Update
When communicating about a penetration test via email, the subject line should clearly indicate the sensitive nature of the content to ensure proper handling and routing to authorized recipients only. 'Privileged & Confidential Status Update' explicitly marks the email as containing sensitive legal and business information, triggering appropriate security controls and ensuring it's treated with the necessary confidentiality protections. This language is standard in legal and professional contexts for protecting sensitive communications.
Why the other options are wrong
- B. Does not indicate the content is confidential or privileged, risking improper disclosure.
- C. Too generic and does not signal the sensitive nature of penetration test findings.
- D. Creates unnecessary alarm and does not properly classify the communication as confidential.
Question 41
A tester is working on an engagement that has evasion and stealth requirements. Which of the following enumeration methods is the least likely to be detected by the IDS?
Show answer and explanation
Correct answer: A. curl https://api.shodan.io/shodan/host/search?key=&query=hostname:
Using Shodan API queries (curl to an external service) appears as legitimate HTTPS traffic to external APIs rather than active scanning. This is passive reconnaissance that mimics normal web traffic and avoids the distinctive packet signatures that IDS systems use to detect port scanning tools like nmap.
Why the other options are wrong
- B. Proxychains with nmap still generates recognizable port scanning patterns despite anonymization.
- C. Looping curl requests against targets generates suspicious repetitive connection patterns.
- D. Direct nmap execution produces characteristic scanning signatures easily detected by IDS systems.
Question 42
Which of the following methods should a physical penetration tester employ to access a rarely used door that has electronic locking mechanisms?
Show answer and explanation
Correct answer: E. Bypassing
Bypassing is the most appropriate method for electronic locking mechanisms on rarely-used doors. This includes techniques like defeating electronic locks, manipulating credentials, or using technical means to circumvent the locking system, more effective than lock picking (which is mechanical) or social engineering approaches for electronic systems.
Why the other options are wrong
- A. Lock picking is designed for mechanical locks, not electronic locking mechanisms.
- B. Impersonating requires sustained social interaction and fails when physical access is actively controlled.
- C. Jamming electronic signals is unreliable and may trigger alarms.
- D. Tailgating requires an authorized person to be present at that specific door, which is unlikely for rarely-used doors.
Question 43
A penetration tester is assessing the overall preparedness of a client's staff for text-message-based attacks. Which of the following most accurately describes the attack technique the tester is assessing?
Show answer and explanation
Correct answer: D. Smishing
Smishing is the social engineering attack technique that uses text messages (SMS) to trick users. The term combines 'SMS' and 'phishing.' The question specifically asks about text-message-based attacks, which directly defines smishing as an attack vector targeting staff through text communications.
Why the other options are wrong
- A. Whaling targets high-level executives, typically via email, not text messages.
- B. Vishing uses voice calls (VoIP) for social engineering, not text messages.
- C. Wardriving involves scanning for wireless networks, not text-message-based attacks.
Question 44
Which of the following is within the scope of proper handling and most crucial when working on a penetration testing report?
Show answer and explanation
Correct answer: D. Making the report clear for all objectives with a precise executive summary
A penetration testing report must be clear, well-organized, and include a precise executive summary so stakeholders at all levels can understand findings and recommendations. The executive summary is crucial for communicating scope, methodology, and key findings to both technical and non-technical audiences. This is a fundamental requirement in proper report handling.
Why the other options are wrong
- A. Recording all activities is not a standard practice and raises privacy/legal concerns; it's not required for proper reporting.
- B. Report length should match complexity and findings, not be artificially limited to 5-10 pages.
- C. Recommendations should be based on business context and impact, not solely on risk scores.
Question 45
A penetration tester discovers data to stage and exfiltrate. The client has authorized movement to the tester’s attacking hosts only. Which of the following would be most appropriate to avoid alerting the SOC?
Show answer and explanation
Correct answer: D. Apply AES-256 to the data and send over a tunnel to TCP port 443.
To avoid alerting the SOC, data should be encrypted with strong encryption (AES-256) and tunneled over a commonly used, trusted port (443/HTTPS). Port 443 is standard for web traffic and blends in with legitimate network activity. AES-256 provides robust encryption, and HTTPS/443 is harder to detect as malicious compared to other options.
Why the other options are wrong
- A. Port 25 is SMTP (email) and UTF-8 is encoding, not encryption; this would be suspicious and lacks proper encryption.
- B. Base64 is encoding, not encryption; it provides no security and can be easily decoded; port 80 is unencrypted HTTP.
- C. 3DES is outdated encryption; UDP port 53 is DNS, which would generate suspicious DNS query patterns for data exfiltration.
Question 46
A penetration tester wants to create a malicious QR code to assist with a physical security assessment. Which of the following tools has the built-in functionality most likely needed for this task?
Show answer and explanation
Correct answer: A. BeEF
BeEF (Browser Exploitation Framework) has built-in functionality for creating and delivering malicious payloads, including QR code generation capabilities for phishing and social engineering attacks during physical security assessments. While BeEF is primarily known as a browser exploitation tool, it includes features for generating attack vectors like QR codes that can be printed and placed physically.
Why the other options are wrong
- B. John the Ripper is a password cracking tool with no QR code generation functionality.
- C. ZAP is a web application security scanner focused on finding vulnerabilities in web applications, not creating QR codes.
- D. Evilginx is a phishing framework focused on credential harvesting through reverse proxies, not QR code generation.
Question 47
Which of the following components should a penetration tester include in an assessment report?
Show answer and explanation
Correct answer: D. Attack narrative
An attack narrative provides a detailed, chronological description of the attacks performed, how they were executed, and their impact. This is a core component of professional penetration testing reports that helps clients understand the attack flow and implications. User activities, customer remediation plans, and key management are either client responsibilities or outside typical report scope.
Why the other options are wrong
- A. User activities during testing are not standard report components.
- B. Customer remediation plan creation is the client's responsibility, not a report component.
- C. Key management details are operational infrastructure concerns, not report content.
Question 48
A penetration tester has found a web application that is running on a cloud virtual machine instance. Vulnerability scans show a potential SSRF for the same application URL path with an injectable parameter. Which of the following commands should the tester run to successfully test for secrets exposure exploitabilty?
Show answer and explanation
Correct answer: A. curl <url>?param=http://169.254.169.254/latest/meta-data/
The AWS metadata endpoint at 169.254.169.254/latest/meta-data/ is the standard target for SSRF attacks against cloud instances. This endpoint exposes sensitive information including IAM credentials, instance metadata, and other secrets. By injecting this URL into the vulnerable parameter, the tester can extract cloud-specific secrets and credentials that demonstrate real exploitability of the SSRF vulnerability.
Why the other options are wrong
- B. 127.0.0.1 targets localhost, not cloud-specific secrets; cloud environments don't expose /etc/passwd in the same way.
- C. This is an XSS payload, not an SSRF exploitation technique.
- D. This URL lacks the metadata path needed to extract actual secrets from the cloud instance.
Question 49
During a penetration test, a tester compromises a Windows computer. The tester executes the following command and receives the following output: • mimikatz # privilege::debug • mimikatz # lsadump::cache • -Output-- lapsUser 27dh9128361tsg264592101387541j --OutputEnd Which of the following best describes what the tester plans to do by executing the command?
Show answer and explanation
Correct answer: C. The tester plans to use the hash collected to perform lateral movement to other computers using a local administrator hash.
The 'lsadump::cache' command in Mimikatz extracts cached credentials and password hashes from the local system. The tester can use the extracted hash (particularly the local administrator hash shown) to perform pass-the-hash attacks for lateral movement to other computers on the network without needing to crack the hash.
Why the other options are wrong
- A. A Golden Ticket attack requires the Kerberos TGT and krbtgt hash from the domain, not local cached credentials.
- B. While hashes are collected, the primary purpose is lateral movement using the administrator hash, not accessing confidential local information.
- D. Kerberoasting targets service account hashes via TGS tickets; this command targets cached LSASS credentials for the local domain.
Question 50
During a security assessment, a penetration tester wants to compromise user accounts without triggering IDS/IPS detection rules. Which of the following is the most effective way for the tester to accomplish this task?
Show answer and explanation
Correct answer: A. Crack user accounts using compromised hashes.
Cracking user accounts using compromised password hashes is the least detectable method because it happens offline and does not trigger network-based IDS/IPS detection rules that monitor login attempts or authentication traffic.
Why the other options are wrong
- B. Brute force dictionary attacks generate multiple failed login attempts that trigger IDS/IPS detection rules
- C. SQL injection attacks generate suspicious database queries visible to IPS/WAF detection mechanisms
- D. XSS attacks send malicious payloads through web requests that are typically detected by IPS/WAF rules
Question 51
A penetration tester needs to complete cleanup activities from the testing lead. Which of the following should the tester do to ensure that reverse shell payloads are no longer running?
Show answer and explanation
Correct answer: A. Run scripts to terminate the implant on affected hosts.
Running scripts to terminate implants on affected hosts ensures that reverse shell payloads and any malicious code are removed from the target systems, which is the primary cleanup objective. This eliminates persistent access and compromised processes.
Why the other options are wrong
- B. Spinning down C2 listeners stops command-and-control communications but does not remove the payloads already running on hosts
- C. Restoring firewall settings addresses network rules but does not terminate active malicious processes on hosts
- D. Exiting from C2 sessions closes connections but does not terminate the underlying implants or payloads executing on affected systems
Question 52
A client recently hired a penetration testing firm to conduct an assessment of their consumer-facing web application. Several days into the assessment, the client's networking team observes a substantial increase in DNS traffic. Which of the following would most likely explain the increase in DNS traffic?
Show answer and explanation
Correct answer: A. Covert data exfiltration
A substantial increase in DNS traffic during a penetration test commonly indicates covert data exfiltration using DNS tunneling techniques. Attackers encode stolen data into DNS queries (or responses) to exfiltrate information through the DNS protocol, which is typically allowed through firewalls and harder to detect than other exfiltration methods.
Why the other options are wrong
- B. URL spidering/crawling generates HTTP traffic, not necessarily a significant increase in DNS traffic.
- C. HTML scraping also generates HTTP traffic patterns, not the characteristic DNS traffic spike.
- D. DoS attacks typically generate traffic on the target service ports, not a notable increase in DNS queries/responses.
Question 53
A penetration tester is performing a cloud-based penetration test against a company. Stakeholders have indicated the priority is to see if the tester can get into privileged systems that are not directly accessible from the internet. Given the following scanner information: Server-side request forgery vulnerability in test.comptia.org Reflected cross-site scripting vulnerability in test2.comptia.org Publicly accessible storage system named static_comptia_assets SSH port 22 open to the intemet on test3.comptia.org Open redirect vulnerability in test4.comptia.org Which of the following of the attack paths should the tester prioritize first?
Show answer and explanation
Correct answer: E. Leverage the SSRF to gain access to credentials from the metadata service.
In cloud environments, SSRF (Server-Side Request Forgery) vulnerabilities in test.comptia.org can be exploited to access the cloud metadata service, which typically runs on an internal IP address (like 169.254.169.254 in AWS). The metadata service contains temporary security credentials that grant access to privileged cloud resources. This is the most direct path to accessing privileged systems not directly internet-accessible.
Why the other options are wrong
- A. Synchronizing public bucket data is useful but doesn't directly lead to privileged system access; Trufflehog scans for secrets but requires having the data first.
- B. Pacu enumeration requires already having some level of cloud access or valid credentials to execute.
- C. Dictionary brute-force against SSH is noisy, slow, and less likely to succeed than exploiting known vulnerabilities.
- D. XSS phishing is indirect and doesn't guarantee access to privileged systems compared to direct SSRF exploitation.
Question 54
A penetration tester attempts unauthorized entry to the company’s server room as part of a security assessment. Which of the following is the best technique to manipulate the lock pins and open the door without the original key?
Show answer and explanation
Correct answer: D. Raking
Raking is a lock picking technique where the attacker manipulates the lock pins by rapidly moving a pick back and forth, causing pins to jump and potentially align at the shear line. This is an effective method for quickly opening locks without the original key during physical penetration testing.
Why the other options are wrong
- A. A plug spinner is used after successful picking to set the lock, not the primary technique for opening
- B. Bypassing refers to circumventing locks entirely rather than picking them
- C. Decoding is not a standard lock opening technique; it relates to analyzing lock mechanics
Question 55
A penetration tester finished a security scan and uncovered numerous vulnerabilities on several hosts. Based on the targets' EPSS and CVSS scores, which of the following targets is the most likely to get attacked?
Show answer and explanation
Correct answer: A. Target 1: EPSS Score = 0.6 and CVSS Score = 4
EPSS (Exploit Prediction Scoring System) indicates the probability that a vulnerability will be exploited in the wild, while CVSS measures severity. Target 1 has the highest EPSS score (0.6), meaning it has the highest likelihood of being attacked. While CVSS score is also important for severity, EPSS is the better predictor of actual attack likelihood, making Target 1 the most probable to be attacked.
Why the other options are wrong
- B. Target 2 has both lower EPSS (0.3) and lower CVSS (2) scores than Target 1.
- C. Target 3 has an equal EPSS to Target 1 but a much lower CVSS score (1), making it less attractive to attackers.
- D. Target 4 has a lower EPSS score (0.4) than Target 1, indicating lower attack probability despite having a higher CVSS score.
Question 56
During an assessment, a penetration tester sends the following request: • POST /services/v1/users/create HTTP/1.1 • Host: target-application.com • Content-Type: application/json • Content-Length: [dynamic] Authorization: Bearer [FUZZE] Which of the following attacks is the penetration tester performing?
Show answer and explanation
Correct answer: B. API abuse
The tester is fuzzing the Authorization Bearer token in an API endpoint for user creation, which is a form of API abuse. This attack tests whether the API properly validates authentication tokens or can be bypassed through token manipulation, representing abuse of the API's intended functionality.
Why the other options are wrong
- A. Directory traversal involves path manipulation in URLs, not token fuzzing.
- C. SSRF involves making the server initiate requests to unintended destinations, not API token manipulation.
- D. Privilege escalation involves gaining higher access levels, not directly fuzzing authentication tokens.
Question 57
A penetration tester aims to exploit a vulnerability in a wireless network that lacks proper encryption. The lack of proper encryption allows malicious content to infiltrate the network. Which of the following techniques would most likely achieve the goal?
Show answer and explanation
Correct answer: A. Packet injection
Packet injection is the technique that allows an attacker to insert malicious packets into an unencrypted wireless network to infiltrate it with malicious content. This directly exploits the lack of encryption by crafting and injecting packets without authentication.
Why the other options are wrong
- B. Bluejacking targets Bluetooth devices, not Wi-Fi networks lacking encryption.
- C. Beacon flooding is a DoS attack creating fake networks, not a method to infiltrate with malicious content.
- D. Signal jamming disrupts communications but doesn't allow malicious content infiltration.
Question 58
Which of the following can an access control vestibule help deter?
Show answer and explanation
Correct answer: D. Tailgating
An access control vestibule (also called a mantrap or airlock) is a small enclosed space requiring authentication at two points, preventing tailgating. It forces each person to authenticate individually before proceeding, blocking attackers from following legitimate users through a single authentication event.
Why the other options are wrong
- A. USB drops are social engineering attacks; vestibules don't specifically deter physical device placement.
- B. Badge cloning is defeated by technology like encryption or biometrics, not by vestibule design.
- C. Lock picking is defeated by lock quality and design, not by vestibule architecture.
Question 59
A penetration tester is conducting an assessment of a web application's log-in page. The tester needs to determine whether there are any hidden form fields of interest. Which of following is the most effective technique?
Show answer and explanation
Correct answer: D. HTML scraping
HTML scraping allows the tester to parse and analyze the login page's HTML source code to identify all form fields, including hidden ones. This technique directly reveals form structure without triggering security mechanisms, making it the most effective way to discover hidden form fields that may contain interesting data like session tokens or CSRF tokens.
Why the other options are wrong
- A. XSS attacks inject malicious scripts but don't directly enumerate hidden form fields.
- B. On-path attacks intercept traffic but require the tester to actively trigger requests containing form data.
- C. SQL injection exploits database queries and is unrelated to discovering hidden HTML form fields.
Question 60
Which of the following elements in a lock should be aligned to a specific level to allow the key cylinder to turn?
Show answer and explanation
Correct answer: B. Pins
Pins in a lock cylinder must be aligned to specific heights (typically six pins in standard locks) to allow the key cylinder to turn and unlock the mechanism. When the correct key is inserted, it raises each pin to the correct shear line.
Why the other options are wrong
- A. Latches are the mechanical components that secure the bolt but are not aligned by the key
- C. The shackle is the U-shaped metal loop on padlocks that holds things closed, not aligned by pins
- D. The plug is the rotating part of the lock cylinder turned by the key, but the pins are what must be aligned for it to turn
Question 61
A penetration tester needs to confirm the version number of a client’s web-application server. Which of the following techniques should the penetration tester use?
Show answer and explanation
Correct answer: C. Banner grabbing
Banner grabbing retrieves the web server's HTTP response headers which typically contain version information (e.g., 'Server: Apache/2.4.41'). This directly reveals the server version number with a simple connection, making it the most straightforward and effective technique for version confirmation.
Why the other options are wrong
- A. SSL certificates contain domain and organization info but typically not web server version numbers.
- B. URL spidering discovers site structure and linked resources, not server version information.
- D. Directory brute forcing identifies accessible paths but doesn't reveal server version numbers.
Question 62
A penetration tester completes a scan and sees the following output on a host: Nmap scan report for victim (10.10.10.10) Host is up (0.0001s latency) PORT STATE SERVICE - 161/udp open|filtered snmp 445/tcp open microsoft-ds 3389/tcp open microsoft-ds Running Microsoft Windows 7 OS CPE: cpe./o.microsoft.windows_7_sp0 The tester wants to obtain shell access. Which of the following related exploits should the tester try first?
Show answer and explanation
Correct answer: C. exploit/windows/smb/ms17_010_eternalblue
Windows 7 with SP0 is vulnerable to EternalBlue (MS17-010), which is a critical remote code execution vulnerability in SMB that allows unauthenticated exploitation. This exploit should be tried first because it requires no authentication and provides immediate shell access. While MS08-067 also affects Windows 7, EternalBlue is more reliable and modern. PSexec requires valid credentials, and SNMP login scanning is unnecessary given the clear SMB vulnerabilities present.
Why the other options are wrong
- A. PsExec requires valid credentials which the tester does not yet have.
- B. MS08-067 is older and less reliable than EternalBlue for Windows 7 exploitation.
- D. SNMP scanning does not directly provide shell access and is not the primary attack vector.
Question 63
During a routine penetration test, the client's security team observes logging alerts that indicate several ID badges were reprinted after working hours without the appropriate authorization. Which of the following is the penetration tester most likely trying to do?
Show answer and explanation
Correct answer: A. Obtain long-term, valid access to the facility.
Reprinting ID badges after working hours without authorization indicates the tester is attempting to create duplicate valid access credentials that will remain functional after the engagement ends. This establishes long-term, persistent access to the physical facility for future unauthorized entry.
Why the other options are wrong
- B. Disrupting availability would involve disabling or damaging the access system itself, not reprinting badges.
- C. Changing access for valid users would require modifying authorization levels, not reprinting badges.
- D. Revoking access would require removing or deactivating existing badges, not reprinting them.
Question 64
While performing a penetration testing exercise, a tester executes the following command: PS c:\tools> c:\hacks\PsExec.exe \\server01.comptia.org -accepteula cmd.exe Which of the following best explains what the tester is trying to do?
Show answer and explanation
Correct answer: B. Perform a lateral movement attack using PsExec.
PsExec is a legitimate Windows administration tool that allows remote command execution on other systems. When used with a remote server name (\server01.comptia.org) and cmd.exe, it enables an attacker to execute commands on that remote system, which is a classic lateral movement technique in penetration testing. The -accepteula flag simply suppresses the EULA prompt.
Why the other options are wrong
- A. While PsExec does test connectivity, the primary objective here is not just connectivity testing but executing commands remotely.
- C. PsExec doesn't send its binary to the target; it executes commands remotely using existing Windows mechanisms.
- D. PsExec doesn't enable CMD.exe; CMD.exe is already available on Windows systems; it simply executes it remotely.
Question 65
A client warns the assessment team that an ICS application is maintained by the manufacturer. Any tampering of the host could void the enterprise support terms of use. Which of the following techniques would be most effective to validate whether the application encrypts communications in transit?
Show answer and explanation
Correct answer: A. Utilizing port mirroring on a firewall appliance
Port mirroring on a firewall appliance allows passive capture of network traffic without directly accessing or modifying the ICS system itself. This non-invasive technique validates encryption in transit without tampering with the host or voiding support agreements.
Why the other options are wrong
- B. Installing software on the server constitutes tampering and would void support terms.
- C. Reconfiguring the application is a modification that could void support and warranty terms.
- D. Requesting to disable certificate pinning is a modification of the application's security configuration and could void support terms.
Question 66
During an assessment, a penetration tester gains access to one of the internal hosts. Given the following command: schtasks /create /tn "Windows Update" /sc onlogon /tr “cmd.exe /c update.exe” Which of the following is the penetration tester trying to do with this code?
Show answer and explanation
Correct answer: B. Establish persistence.
The schtasks command creates a scheduled task named 'Windows Update' that executes update.exe at logon. By disguising malicious code as a legitimate Windows Update task that runs automatically on user logon, the tester establishes persistence on the system.
Why the other options are wrong
- A. Enumeration would use 'schtasks /query', not 'schtasks /create'.
- C. Deactivating Windows Update requires different commands and wouldn't involve creating a new task.
- D. This creates a scheduled task referencing an executable, not a new binary application for system updates.
Question 67
Which of the following post-exploitation activities allows a penetration tester to maintain persistent access in a compromised system?
Show answer and explanation
Correct answer: A. Creating registry keys
Creating registry keys allows a penetration tester to establish persistence by modifying Windows registry entries that execute malicious code at startup or system events, ensuring continued access even after system reboot. Registry modification is a common persistence mechanism.
Why the other options are wrong
- B. A bind shell requires the attacker to connect back to the target, which is not persistent if the connection drops.
- C. Process injection is a technique for code execution, not persistence maintenance.
- D. Reverse SSH requires active connection maintenance and doesn't provide autonomous persistence.
Question 68
A penetration tester gains initial access to a target system by exploiting a recent RCE vulnerability. The patch for the vulnerability will be deployed at the end of the week. Which of the following utilities would allow the tester to reenter the system remotely after the patch has been deployed? (Choose two.)
Show answer and explanation
Correct answer: A, E. schtasks.exe; sc.exe
schtasks.exe allows scheduling of tasks that execute automatically on a regular basis or at system startup, providing persistence after patching. sc.exe manages Windows services, which can be configured to execute malicious code automatically at boot or on demand, ensuring continued access even after the vulnerability is patched. Both utilities enable backdoor access independent of the original RCE vulnerability.
Why the other options are wrong
- B. rundll.exe executes DLL functions but doesn't provide persistent re-entry mechanisms on its own.
- C. cmd.exe is a command interpreter for executing commands but doesn't establish persistence by itself.
- D. chgusr.exe changes user session properties and doesn't create persistence mechanisms.
- F. netsh.exe configures network settings but isn't a primary persistence tool compared to task scheduling or services.
Question 69
A penetration tester is preparing a password-spraying attack against a known list of users for the company "example." The tester is using the following list of commands: 1. pw-inspector -i $allwords | tee $pass 2. spray365.py spray -ep $plan 3. users="~/user.txt"; allwords="~/words.txt"; pass="~/passwords.txt"; plan="~/spray.plan" 4. spray365.py generate --password_file $pass --user file $user --domain "example.com" --execution_plan $plan 5. cewl -m 5 "http://www.example.com" -w $allwords Which of the following is the correct order for the list of the commands?
Show answer and explanation
Correct answer: D. 3, 5, 1, 4, 2
The correct sequence is: (3) Initialize variables pointing to wordlists and output files, (5) Use cewl to extract words from the company website to build a password list, (1) Filter the extracted words through pw-inspector to create valid passwords, (4) Generate the spray plan using spray365.py with passwords and users, and (2) Execute the password spray attack. This logical flow ensures variables are defined, passwords are generated from company-specific data, and then the attack is executed against Office 365 targets.
Why the other options are wrong
- A. Incorrect order; attempt to execute before variables are defined and passwords are generated.
- B. Places cewl too late; should extract words early to build the password list.
- C. Begins with spray execution before variables, word extraction, and password generation are complete.
Question 70
A company wants to perform a BAS to measure the efficiency of the corporate security controls. Which of the following would most likely help the tester with simple command examples?
Show answer and explanation
Correct answer: C. Atomic Red Team
Atomic Red Team provides simple, ready-to-use command examples and test cases mapped to MITRE ATT&CK for executing attack techniques. It's specifically designed for testing security controls with straightforward command-line examples, making it ideal for BAS (Breach and Attack Simulation) testing to measure security control effectiveness.
Why the other options are wrong
- A. Infection Monkey is an automated breach simulation tool but doesn't focus on providing simple command examples.
- B. Exploit-DB is a database of known exploits, not a command repository for BAS testing.
- D. Mimikatz is a credential extraction tool, not a BAS framework with command examples for testing controls.
Question 71
Which of the following frameworks can be used to classify threats?
Show answer and explanation
Correct answer: B. STRIDE
STRIDE is a threat modeling framework specifically designed to classify and categorize threats by type (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege). It is the primary framework used for threat classification.
Why the other options are wrong
- A. PTES is a penetration testing methodology, not a threat classification framework.
- C. OSSTMM is an operational security testing methodology, not a threat classification framework.
- D. OCTAVE is a risk assessment methodology, not specifically designed for threat classification.
Question 72
A penetration tester is evaluating a SCADA system. The tester receives local access to a workstation that is running a single application. While navigating through the application, the tester opens a terminal window and gains access to the underlying operating system. Which of the following attacks is the tester performing?
Show answer and explanation
Correct answer: A. Kiosk escape
A kiosk escape occurs when an attacker breaks out of a restricted single-application environment to access the underlying operating system. The scenario describes exactly this: the tester was confined to a single application but managed to open a terminal and access the OS directly, which is the definition of a kiosk escape.
Why the other options are wrong
- B. Arbitrary code execution refers to running unintended code through an application vulnerability, not escaping an application's restrictions.
- C. Process hollowing involves replacing a legitimate process with malicious code, not escaping application restrictions.
- D. Library injection involves loading malicious libraries into a process, not breaking out of application confinement.
Question 73
During an assessment, a penetration tester plans to gather metadata from various online files, including pictures. Which of the following standards outlines the formats for pictures, audio, and additional tags that facilitate this type of reconnaissance?
Show answer and explanation
Correct answer: A. EXIF
EXIF (Exchangeable Image File Format) is the standard that outlines metadata formats for pictures, audio, and additional tags. It stores information such as camera settings, GPS coordinates, timestamps, and other embedded data that can be extracted during passive reconnaissance on online media files.
Why the other options are wrong
- B. GIF is an image file format, not a standard for metadata tags and information.
- C. COFF is a Common Object File Format used for executable files and object code, not media metadata.
- D. ELF is Executable and Linkable Format for Unix/Linux executables, not a metadata standard for media.
Question 74
A penetration tester compromises a Windows OS endpoint that is joined to an Active Directory local environment. Which of the following tools should the tester use to manipulate authentication mechanisms to move laterally in the network?
Show answer and explanation
Correct answer: A. Rubeus
Rubeus is a specialized tool for Active Directory Kerberos manipulation, allowing penetration testers to craft tickets, perform ticket theft, and manipulate authentication mechanisms to move laterally within an AD environment. It directly targets authentication manipulation needed for lateral movement.
Why the other options are wrong
- B. WinPEAS is an enumeration tool for privilege escalation, not authentication manipulation.
- C. NTLMRelayX is used for NTLM relay attacks but is less versatile than Rubeus for general AD authentication manipulation.
- D. Impacket is a collection of tools for various purposes including AD interaction, but Rubeus is more specialized for Kerberos authentication manipulation.
Question 75
Before starting an assessment, a penetration tester needs to scan a Class B IPv4 network for open ports in a short amount of time. Which of the following is the best tool for this task?
Show answer and explanation
Correct answer: B. masscan
Masscan is specifically designed for rapid large-scale port scanning and can scan entire Class B networks (65,536 addresses) very quickly, making it ideal for this time-constrained task. Nmap is thorough but slower; Burp Suite is a web application proxy, not a network scanner; hping is a packet crafting tool, not optimized for large network scans.
Why the other options are wrong
- A. Burp Suite is a web application testing tool, not designed for network port scanning.
- C. Nmap is capable but significantly slower than masscan for large-scale rapid scans.
- D. hping is primarily used for packet crafting and testing, not efficient port scanning.
Question 76
Which of the following technologies is most likely used with badge cloning? (Choose two.)
Show answer and explanation
Correct answer: A, B. NFC; RFID
NFC (Near Field Communication) and RFID (Radio Frequency Identification) are the technologies commonly used in physical access badges that can be cloned. Both operate on radio frequency principles at short ranges, allowing an attacker to read badge data and duplicate it onto blank cards or devices. Bluetooth, Modbus, Zigbee, and CAN bus are not typically used for badge-based access control systems.
Why the other options are wrong
- C. Bluetooth is typically used for personal devices, not physical access badges
- D. Modbus is an industrial communication protocol, not used in badge systems
- E. Zigbee is used for IoT devices, not physical access badge systems
- F. CAN bus is an automotive/industrial protocol, not related to badge cloning
Question 77
During an engagement, a penetration tester runs the following command against the host system: host -t axfr domain.com dnsl.domain.com Which of the following techniques best describes what the tester is doing?
Show answer and explanation
Correct answer: A. Zone transfer
The 'host -t axfr' command performs a DNS zone transfer (AXFR), which attempts to retrieve all DNS records from a zone. This is a reconnaissance technique used by penetration testers to enumerate all hosts and subdomains within a target domain by requesting a full zone transfer from the DNS server.
Why the other options are wrong
- B. Host enumeration typically refers to discovering active hosts on a network, not transferring entire DNS zones.
- C. DNS poisoning involves corrupting DNS cache with false records, not querying zone information.
- D. A standard DNS query retrieves specific records, whereas AXFR performs a bulk transfer of all zone data.
Question 78
A penetration tester is performing an assessment focused on attacking the authentication identity provider hosted within a cloud provider. During the reconnaissance phase, the tester finds that the system is using OpenID connect with OAuth and has dynamic registration enabled. Which of the following attacks should the tester try first?
Show answer and explanation
Correct answer: C. A replay attack against the authentication flow in the system
With OpenID Connect and OAuth using dynamic registration, a replay attack is the most appropriate first attempt. This scenario suggests the system may have vulnerabilities in token handling or flow validation. Replay attacks can capture and reuse authentication tokens or authorization codes. Password-spraying (A) and brute-force (B) are generic attacks that aren't specifically suited to OAuth/OIDC vulnerabilities. Mask attacks (D) apply to password cracking, not authentication flow attacks.
Why the other options are wrong
- A. Password-spraying is a generic credential attack not specifically targeted at OAuth/OIDC flow vulnerabilities.
- B. Brute-force attacks are inefficient against modern authentication systems and not the first choice for OAuth/OIDC.
- D. Mask attacks are password cracking techniques unrelated to authentication flow vulnerabilities in OAuth/OIDC systems.
Question 79
A penetration tester runs a network scan but has some issues accurately enumerating the vulnerabilities due to the following error: OS identification failed - Which of the following is most likely causing this error?
Show answer and explanation
Correct answer: D. The scan cannot gather one or more fingerprints from the target.
OS identification failures occur when the scanner cannot gather sufficient fingerprints (responses from network probes, TTL values, protocol responses) needed to accurately identify the target operating system.
Why the other options are wrong
- A. A firewall block would prevent the scan from reaching the target entirely, producing connectivity errors rather than OS identification failures
- B. An outdated scanner database affects vulnerability detection accuracy but does not specifically cause OS identification failures
- C. False positives are incorrect vulnerability reports, not OS identification errors
Question 80
During an assessment, a penetration tester runs the following command: setspn.exe -Q */* Which of the following attacks is the penetration tester preparing for?
Show answer and explanation
Correct answer: C. Kerberoasting
The setspn.exe command with the -Q */* flag queries Active Directory for all service principal names (SPNs). This enumeration step is the direct precursor to Kerberoasting, where attackers identify user accounts with SPNs, request Kerberos tickets for those services, and then crack the encrypted tickets offline to retrieve plaintext passwords. Enumerating SPNs is the essential preparation step for executing a Kerberoasting attack.
Why the other options are wrong
- A. LDAP injection involves manipulating LDAP queries, not enumerating SPNs.
- B. Pass-the-hash attacks use captured NTLM hashes directly and don't require SPN enumeration.
- D. Dictionary attacks involve brute-forcing passwords, not specifically targeting Kerberos SPNs.
Question 81
A penetration tester wants to attack a server, exhausting its resources and making it unavailable to legitimate users. Which of the following attacks would be best to achieve this result?
Show answer and explanation
Correct answer: D. SYN flooding
SYN flooding is a Denial of Service attack that overwhelms a server by sending massive numbers of TCP SYN requests, exhausting server resources and making it unavailable to legitimate users. This directly achieves the stated goal of resource exhaustion.
Why the other options are wrong
- A. IP spoofing is used to mask the source address of traffic but doesn't inherently exhaust server resources.
- B. TCP hijacking involves taking over an existing connection but doesn't exhaust resources on the scale needed for DoS.
- C. Port redirection redirects traffic to different ports but doesn't cause resource exhaustion or unavailability.
Question 82
A penetration tester needs to scan a remote infrastructure with Nmap. The tester issues the following command: nmap 10.10.1.0/24 Which of the following is the number of TCP ports that will be scanned?
Show answer and explanation
Correct answer: B. 1,000
When Nmap is run without specifying ports, it defaults to scanning the 1,000 most commonly used TCP ports. The command 'nmap 10.10.1.0/24' will scan this default set of 1,000 ports on each host in the subnet, not all 65,535 possible ports.
Why the other options are wrong
- A. 256 is the number of hosts in a /24 subnet, not the number of ports scanned.
- C. 1,024 is close but incorrect; Nmap's default is 1,000 most common ports.
- D. 65,535 is the total number of TCP ports available, but not Nmap's default scan range.
Question 83
A penetration tester completed a report for a new client. Prior to sharing the report with the client, which of the following should the penetration tester request to complete a review?
Show answer and explanation
Correct answer: D. A team member
A team member should review the report before client delivery to ensure quality, accuracy, and consistency with findings and recommendations. This is standard practice in penetration testing firms. Using AI (A) introduces bias and accuracy concerns. The customer's contact (B) is who receives it, not who reviews before delivery. A peer (C) from outside could introduce confidentiality issues, whereas internal team review maintains proper controls.
Why the other options are wrong
- A. Generative AI assistants can introduce errors, hallucinations, and misrepresentations of technical findings in security reports.
- B. The customer's contact is the recipient of the report, not the appropriate pre-delivery reviewer for quality assurance.
- C. External peers outside the organization could introduce confidentiality and privilege concerns when reviewing client-specific findings.
Question 84
A tester is finishing an engagement and needs to ensure that artifacts resulting from the test are safely handled. Which of the following is the best procedure for maintaining client data privacy?
Show answer and explanation
Correct answer: B. Securely destroy or remove all engagement-related data from testing systems.
Securely destroying or removing all engagement-related data from testing systems is the paramount concern for client data privacy. This encompasses removing tools, data samples, test artifacts, and sensitive information gathered during testing. While option A addresses tool cleanup, option B is more comprehensive and directly addresses data privacy. Options C and D are specific aspects but don't fully address the broader requirement of protecting client data privacy through secure removal.
Why the other options are wrong
- A. Removing only configuration changes and tools doesn't address sensitive data and test artifacts left on systems.
- C. Searching for and removing credentials is important but narrower than securely handling all engagement data.
- D. Shutting down infrastructure addresses attack infrastructure but not engagement data privacy on client systems.
Question 85
During an assessment, a penetration tester obtains access to an internal server and would like to perform further reconnaissance by capturing LLMNR traffic. Which of the following tools should the tester use?
Show answer and explanation
Correct answer: C. Responder
Responder is specifically designed to capture and respond to LLMNR (Link-Local Multicast Name Resolution) and NetBIOS Name Service (NBT-NS) traffic on internal networks. It is the industry-standard tool for this reconnaissance technique.
Why the other options are wrong
- A. Burp Suite is a web application testing tool, not designed for LLMNR capture.
- B. Netcat is a general networking utility without LLMNR-specific functionality.
- D. Nmap is a network scanning tool that does not specifically capture LLMNR traffic.
Question 86
During a preengagement activity with a new customer, a penetration tester looks for assets to test. Which of the following is an example of a target that can be used for testing?
Show answer and explanation
Correct answer: A. API
An API (Application Programming Interface) is a specific, testable asset that a penetration tester can target during an assessment. HTTP and ICMP are protocols, not targets themselves. IPA is not a standard IT term in this context. APIs represent discrete, exploitable attack surfaces that should be included in scope definition.
Why the other options are wrong
- B. HTTP is a protocol used for communication, not a target asset to test.
- C. IPA is not a recognized asset type in penetration testing (possibly India Pale Ale, irrelevant here).
- D. ICMP is a network protocol, not an asset target for testing.
Question 87
A penetration tester wants to use multiple TTPs to assess the reactions (alerted, blocked, and others) by the client's current security tools. The threat-modeling team indicates the TTPs in the list might effect their internal systems and servers. Which of the following actions would the tester most likely take?
Show answer and explanation
Correct answer: A. Use a BAS tool to test multiple TTPs based on the input from the threat-modeling team.
A Breach and Attack Simulation (BAS) tool is specifically designed to safely test multiple TTPs against security controls while measuring detection and response capabilities. BAS tools operate in a controlled manner with predefined scopes, making them ideal when threat modeling has identified potentially risky TTPs. The other approaches either lack scope control, require active exploitation, or don't focus on measuring security tool reactions.
Why the other options are wrong
- B. Vulnerability assessment finds weaknesses but doesn't test security tool reactions to specific TTPs.
- C. Generic scanners lack the precision to test specific TTPs and measure detection responses safely.
- D. Full penetration testing is too broad and uncontrolled given the team's concerns about TTP impacts.
Question 88
A penetration tester gains initial access to an endpoint and needs to execute a payload to obtain additional access. Which of the following commands should the penetration tester use?
Show answer and explanation
Correct answer: D. rundll32.exe c:\path\foo.dll,functName
rundll32.exe is a legitimate Windows utility that executes functions within DLL files, making it an effective method for payload execution. The command rundll32.exe c:\path\foo.dll,functName properly invokes a DLL with a specified function name, which is a common and functional technique for executing malicious payloads while potentially bypassing security controls. This is a standard post-exploitation technique used in penetration testing to gain additional access.
Why the other options are wrong
- A. The command has a syntax error ('impo' instead of 'import') and is not a valid PowerShell execution method for loading and executing scripts.
- B. While certutil.exe can download files, the syntax is incorrect; it should use -urlcache instead of -f, and the command structure doesn't properly execute a payload for obtaining additional access.
- C. The PowerShell command syntax is malformed; it appears to attempt IEX (Invoke-Expression) but lacks proper quotes, structure, and the -encode parameter is not correctly implemented for this use case.
Question 89
A penetration tester is searching for vulnerabilities or misconfigurations on a container environment. Which of the following tools will the tester most likely use to achieve this objective?
Show answer and explanation
Correct answer: B. Trivy
Trivy is a specialized container vulnerability scanner designed specifically for scanning container images, registries, and runtime environments for misconfigurations and known vulnerabilities. Nikto (A) is for web servers. Nessus (C) is a general vulnerability scanner. Nmap (D) is for network discovery. While these could find some issues, Trivy is purpose-built for containers.
Why the other options are wrong
- A. Nikto is a web server scanner, not optimized for container-specific vulnerabilities and misconfigurations.
- C. Nessus is a general vulnerability scanner that works broadly but isn't specifically designed for container environments.
- D. Nmap is a network discovery tool, not suitable for scanning container image vulnerabilities and configurations.
Question 90
A penetration tester is conducting a vulnerability scan. The tester wants to see any vulnerabilities that may be visible from outside of the organization. Which of the following scans should the penetration tester perform?
Show answer and explanation
Correct answer: C. Unauthenticated
An unauthenticated scan simulates an external attacker with no credentials or internal access, showing vulnerabilities visible from outside the organization's perimeter. SAST analyzes source code, sidecar is a deployment pattern, and host-based scans require internal access. Only unauthenticated scanning replicates the external threat perspective.
Why the other options are wrong
- A. SAST (Static Application Security Testing) requires source code analysis, not external network scanning.
- B. Sidecar is a deployment architecture pattern, not a vulnerability scanning method.
- D. Host-based scans require agent installation and internal access, not external visibility.
Question 91
Which of the following elements of a penetration test report can be used to most effectively prioritize the remediation efforts for all the findings?
Show answer and explanation
Correct answer: C. Risk score
Risk scores provide quantitative, prioritized rankings of vulnerabilities based on severity, exploitability, and impact. This enables organizations to allocate remediation resources efficiently by addressing the highest-risk items first, making it the most effective tool for prioritization across all findings.
Why the other options are wrong
- A. Methodology describes testing approach, not vulnerability severity or prioritization.
- B. Detailed findings list provides information but lacks the prioritization mechanism that risk scores provide.
- D. Executive summary is a high-level overview and lacks the granular prioritization needed for remediation planning.
Question 92
During a security audit, a penetration tester wants to exploit a vulnerability in a common network protocol. The protocol allows encrypted communications to be intercepted and manipulated. Which of the following vulnerabilities should the tester exploit?
Show answer and explanation
Correct answer: C. CVE-202X-YYYY: OpenSSL DROWN Attack
CVE-202X-YYYY: OpenSSL DROWN Attack is the correct answer. DROWN (Decryption Oracle On Backward Decryption) is a vulnerability in the SSL/TLS protocol that allows encrypted communications to be intercepted and decrypted. It specifically exploits weaknesses in common encryption protocols to manipulate encrypted communications, matching the exact scenario described in the question.
Why the other options are wrong
- A. The Cisco ASA IKEv2/IPSec Fragmentation Vulnerability is specific to Cisco devices and IPSec, not a general protocol vulnerability allowing interception.
- B. Wireshark SSL/TLS Decryption is a tool capability for authorized analysis, not a vulnerability in the protocol itself.
- D. SMBv1 EternalBlue is a network protocol vulnerability but doesn't specifically involve encrypted communications interception and manipulation.
Question 93
A penetration tester cannot complete a full vulnerability scan because the client's WAF is blocking communications. During which of the following activities should the penetration tester, discuss this issue with the client?
Show answer and explanation
Correct answer: A. Goal reprioritization
Goal reprioritization is the appropriate phase during which to discuss obstacles like a WAF blocking communications. This is a planning-level discussion where the penetration tester and client align on what can realistically be achieved given constraints, and adjust the testing objectives accordingly. This conversation prevents wasted effort and manages client expectations early.
Why the other options are wrong
- B. Peer review is an internal quality assurance process, not a client discussion point.
- C. Client acceptance is the agreement phase before testing starts, not for mid-engagement obstacles.
- D. Stakeholder alignment is broader governance but doesn't specifically address tactical testing obstacles.
That was 93 of 373.
The full CompTIA PenTest+ PT0-003 pack has all 373 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 186 free as one PDF by email. Get the Half Pack →