CompTIA CompTIA Certifications PT0-003 Questions & Answers

• Question 151:

  During an engagement, a penetration tester needs to break the key for the Wi-Fi network that uses WPA2 encryption. Which of the following attacks would accomplish this objective?

  A. ChopChop

  B. Replay

  C. Initialization vector

  D. KRACK

  Correct Answer: D

  KRACK (Key Reinstallation Attack) exploits a vulnerability in the WPA2 protocol to decrypt and inject packets, potentially allowing an attacker to break the encryption key and gain access to the Wi-Fi network.

  Understanding KRACK:

  Attack Steps:

  Impact:

  Mitigation:

  References from Pentesting Literature:

  Step-by-Step ExplanationReferences:

  Penetration Testing - A Hands-on Introduction to Hacking HTB Official Writeups

• Question 152:

  Which of the following protocols would a penetration tester most likely utilize to exfiltrate data covertly and evade detection?

  A. FTP

  B. HTTPS

  C. SMTP

  D. DNS

  Correct Answer: D

  Covert data exfiltration is a crucial aspect of advanced penetration testing. Penetration testers often need to move data out of a network without being detected by the organization's security monitoring tools. Here's a breakdown of the

  potential methods and why DNS is the preferred choice for covert data exfiltration:

  FTP (File Transfer Protocol) (Option A):

  HTTPS (Hypertext Transfer Protocol Secure) (Option B):

  SMTP (Simple Mail Transfer Protocol) (Option C):

  DNS (Domain Name System) (Option D):

  Conclusion: DNS tunneling stands out as the most effective method for covert data exfiltration due to its ability to blend in with normal network traffic and avoid detection by conventional security mechanisms. Penetration testers utilize this

  method to evade scrutiny while exfiltrating data.

• Question 153:

  A penetration tester needs to collect information over the network for further steps in an internal assessment. Which of the following would most likely accomplish this goal?

  A. ntlmrelayx.py -t 192.168.1.0/24 -1 1234

  B. nc -tulpn 1234 192.168.1.2

  C. responder.py -I eth0 -wP

  D. crackmapexec smb 192.168.1.0/24

  Correct Answer: C

  To collect information over the network, especially during an internal assessment, tools that can capture and analyze network traffic are essential. Responder is specifically designed for this purpose, and it can capture NTLM hashes and other

  credentials by poisoning various network protocols. Here's a breakdown of the options:

  Option A: ntlmrelayx.py -t 192.168.1.0/24 -1 1234 Option B: nc -tulpn 1234 192.168.1.2

  Option C: responder.py -I eth0 -wP

  Option D: crackmapexec smb 192.168.1.0/24

  References from Pentest:

  Anubis HTB: Highlights the use of Responder to capture network credentials and hashes during internal assessments.

  Horizontall HTB: Demonstrates the effectiveness of Responder in capturing and analyzing network traffic for further exploitation.

• Question 154:

  A penetration tester is attempting to discover vulnerabilities in a company's web application. Which of the following tools would most likely assist with testing the security of the web application?

  A. OpenVAS

  B. Nessus

  C. sqlmap

  D. Nikto

  Correct Answer: D

  When testing the security of a web application, specific tools are designed to uncover vulnerabilities and issues. Here's an overview of the tools mentioned and why Nikto is the most suitable for this task:

  Nikto:

  Comparison with Other Tools:

• Question 155:

  During a security assessment, a penetration tester needs to exploit a vulnerability in a wireless network's authentication mechanism to gain unauthorized access to the network. Which of the following attacks would the tester most likely perform to gain access?

  A. KARMA attack

  B. Beacon flooding

  C. MAC address spoofing

  D. Eavesdropping

  Correct Answer: A

  To exploit a vulnerability in a wireless network's authentication mechanism and gain unauthorized access, the penetration tester would most likely perform a KARMA attack.

  KARMA Attack:

  Purpose:

  Other Options:

  Pentest References:

  Wireless Security Assessments: Understanding common attack techniques such as KARMA is crucial for identifying and exploiting vulnerabilities in wireless networks. Rogue Access Points: Setting up rogue APs to capture credentials or

  perform man-in-the-middle attacks is a common tactic in wireless penetration testing. By performing a KARMA attack, the penetration tester can exploit the wireless network's authentication mechanism and gain unauthorized access to the

  network.

• Question 156:

  During an engagement, a penetration tester needs to break the key for the Wi-Fi network that uses WPA2 encryption. Which of the following attacks would accomplish this objective?

  A. ChopChop

  B. Replay

  C. Initialization vector

  D. KRACK

  Correct Answer: D

  To break the key for a Wi-Fi network that uses WPA2 encryption, the penetration tester should use the KRACK (Key Reinstallation Attack) attack.

  KRACK (Key Reinstallation Attack):

  Other Attacks:

  Pentest References:

  Wireless Security: Understanding vulnerabilities in Wi-Fi encryption protocols, such as WPA2, and how they can be exploited.

  KRACK Attack: A significant vulnerability in WPA2 that requires specific techniques to exploit.

  By using the KRACK attack, the penetration tester can break WPA2 encryption and gain unauthorized access to the Wi-Fi network.

  Top of Form

  Bottom of Form

• Question 157:

  During a security assessment, a penetration tester needs to exploit a vulnerability in a wireless network's authentication mechanism to gain unauthorized access to the network. Which of the following attacks would the tester most likely perform to gain access?

  A. KARMA attack

  B. Beacon flooding

  C. MAC address spoofing

  D. Eavesdropping

  Correct Answer: A

  To exploit a vulnerability in a wireless network's authentication mechanism and gain unauthorized access, the penetration tester would most likely perform a KARMA attack.

  KARMA Attack:

  Purpose:

  Other Options:

  Pentest References:

  Wireless Security Assessments: Understanding common attack techniques such as KARMA is crucial for identifying and exploiting vulnerabilities in wireless networks. Rogue Access Points: Setting up rogue APs to capture credentials or

  perform man-in-the-middle attacks is a common tactic in wireless penetration testing. By performing a KARMA attack, the penetration tester can exploit the wireless network's authentication mechanism and gain unauthorized access to the

  network.

• Question 158:

  A penetration tester needs to test a very large number of URLs for public access. Given the following code snippet:

  1 import requests

  2 import pathlib

  4 for url in pathlib.Path("urls.txt").read_text().split("\n"):

  5 response = requests.get(url)

  6 if response.status == 401:

  7 print("URL accessible")

  Which of the following changes is required?

  A. The condition on line 6

  B. The method on line 5

  C. The import on line 1

  D. The delimiter in line 3

  Correct Answer: A

  Script Analysis:

  Error Identification:

  Correct Condition:

  Corrected Script:

  Pentest References:

  In penetration testing, checking the accessibility of multiple URLs is a common task, often part of reconnaissance. Identifying publicly accessible resources can reveal potential entry points for further testing. The requests library in Python is

  widely used for making HTTP requests and handling responses. Understanding HTTP status codes is crucial for correctly interpreting the results of these requests. By changing the condition to check for a 200 status code, the script will

  correctly identify and print URLs that are publicly accessible.

• Question 159:

  After a recent penetration test was conducted by the company's penetration testing team, a systems administrator notices the following in the logs:

  2/10/2023 05:50AM C:\users\mgranite\schtasks /query

  2/10/2023 05:53AM C:\users\mgranite\schtasks /CREATE /SC DAILY

  Which of the following best explains the team's objective?

  A. To enumerate current users

  B. To determine the users' permissions

  C. To view scheduled processes

  D. To create persistence in the network

  Correct Answer: D

  The logs indicate that the penetration testing team's objective was to create persistence in the network.

  Log Analysis:

  Persistence:

  Other Options:

  Pentest References:

  Post-Exploitation: Establishing persistence is a key objective after gaining initial access to ensure continued access.

  Scheduled Tasks: Utilizing Windows Task Scheduler to run scripts or programs automatically at specified times as a method for maintaining access. By creating scheduled tasks, the penetration testing team aims to establish persistence,

  ensuring they can retain access to the system over time.

• Question 160:

  A penetration tester assesses an application allow list and has limited command-line access on the Windows system. Which of the following would give the penetration tester information that could aid in continuing the test?

  A. mmc.exe

  B. icacls.exe

  C. nltest.exe

  D. rundll.exe

  Correct Answer: C

  When a penetration tester has limited command-line access on a Windows system, the choice of tool is critical for gathering information to aid in furthering the test. Here's an explanation for each option:

  mmc.exe (Microsoft Management Console):

  icacls.exe:

  nltest.exe:

  rundll.exe:

  Conclusion: nltest.exe is the best choice among the given options as it provides valuable information about the network, domain controllers, and trust relationships. This information is crucial for a penetration tester to plan further actions and

  understand the domain environment.