CompTIA CompTIA Certifications PT0-003 Questions & Answers

• Question 201:

  During a penetration test, the tester gains full access to the application's source code. The application repository includes thousands of code files. Given that the assessment timeline is very short, which of the following approaches would allow the tester to identify hard- coded credentials most effectively?

  A. Run TruffleHog against a local clone of the application

  B. Scan the live web application using Nikto

  C. Perform a manual code review of the Git repository

  D. Use SCA software to scan the application source code

  Correct Answer: A

  Given a short assessment timeline and the need to identify hard-coded credentials in a large codebase, using an automated tool designed for this specific purpose is the most effective approach. Here's an explanation of each option:

  Run TruffleHog against a local clone of the application (Answer: A):

  Scan the live web application using Nikto (Option B):

  Perform a manual code review of the Git repository (Option C):

  Use SCA software to scan the application source code (Option D):

  Conclusion: Running TruffleHog against a local clone of the application is the most effective approach for quickly identifying hard-coded credentials in a large codebase within a limited timeframe.

• Question 202:

  A penetration tester is conducting reconnaissance on a target network. The tester runs the following Nmap command: nmap -sv -sT -p - 192.168.1.0/24. Which of the following describes the most likely purpose of this scan?

  A. OS fingerprinting

  B. Attack path mapping

  C. Service discovery

  D. User enumeration

  Correct Answer: C

  The Nmap command nmap -sv -sT -p- 192.168.1.0/24 is designed to discover services on a network. Here is a breakdown of the command and its purpose:

  Command Breakdown:

  Purpose of the Scan:

  Conclusion: The nmap -sv -sT -p- 192.168.1.0/24 command is most likely used for service discovery, as it aims to identify all running services and their versions on the target subnet.

• Question 203:

  A penetration tester gains access to a Windows machine and wants to further enumerate users with native operating system credentials. Which of the following should the tester use?

  A. route.exe print

  B. netstat.exe -ntp

  C. net.exe commands

  D. strings.exe -a

  Correct Answer: C

  To further enumerate users on a Windows machine using native operating system commands, the tester should use net.exe commands. The net command is a versatile tool that provides various network functionalities, including user

  enumeration.

  net.exe:

  net user

  uk.co.certification.simulator.questionpool.PList@a43cf82 net localgroup administrators

  Enumerating Users:

  Pentest References:

  Using net.exe commands, the penetration tester can effectively enumerate user accounts and group memberships on the compromised Windows machine, aiding in further exploitation and privilege escalation.

• Question 204:

  A penetration tester would like to leverage a CSRF vulnerability to gather sensitive details from an application's end users. Which of the following tools should the tester use for this task?

  A. Browser Exploitation Framework

  B. Maltego

  C. Metasploit

  D. theHarvester

  Correct Answer: A

  Cross-Site Request Forgery (CSRF) vulnerabilities can be leveraged to trick authenticated users into performing unwanted actions on a web application. The right tool for this task would help in exploiting web-based vulnerabilities, particularly

  those related to web browsers and interactions.

  Browser Exploitation Framework (BeEF) (Answer: A):

  Maltego (Option B):

  Metasploit (Option C):

  theHarvester (Option D):

  Conclusion: The Browser Exploitation Framework (BeEF) is the most suitable tool for leveraging a CSRF vulnerability to gather sensitive details from an application's end users. It is specifically designed for browser-based exploitation, making

  it the best choice for this task.

• Question 205:

  A penetration tester needs to complete cleanup activities from the testing lead. Which of the following should the tester do to validate that reverse shell payloads are no longer running?

  A. Run scripts to terminate the implant on affected hosts.

  B. Spin down the C2 listeners.

  C. Restore the firewall settings of the original affected hosts.

  D. Exit from C2 listener active sessions.

  Correct Answer: A

  To ensure that reverse shell payloads are no longer running, it is essential to actively terminate any implanted malware or scripts. Here's why option A is correct:

  Run Scripts to Terminate the Implant: This ensures that any reverse shell payloads or malicious implants are actively terminated on the affected hosts. It is a direct and effective method to clean up after a penetration test. Spin Down the C2

  Listeners: This stops the command and control listeners but does not remove the implants from the hosts.

  Restore the Firewall Settings: This is important for network security but does not directly address the termination of active implants. Exit from C2 Listener Active Sessions: This closes the current sessions but does not ensure that implants are

  terminated.

  References from Pentest:

  Anubis HTB: Demonstrates the process of cleaning up and ensuring that all implants are removed after an assessment.

  Forge HTB: Highlights the importance of thoroughly cleaning up and terminating any payloads or implants to leave the environment secure post-assessment.

• Question 206:

  A tester performs a vulnerability scan and identifies several outdated libraries used within the customer SaaS product offering. Which of the following types of scans did the tester use to identify the libraries?

  A. IAST

  B. SBOM

  C. DAST

  D. SAST

  Correct Answer: D

  kube-hunter is a tool designed to perform security assessments on Kubernetes clusters. It identifies various vulnerabilities, focusing on weaknesses and misconfigurations. Here's why option B is correct:

  Kube-hunter: It scans Kubernetes clusters to identify security issues, such as misconfigurations, insecure settings, and potential attack vectors. Network Configuration Errors: While kube-hunter might identify some network- related issues, its

  primary focus is on Kubernetes-specific vulnerabilities and misconfigurations.

  Application Deployment Issues: These are more related to the applications running within the cluster, not the cluster configuration itself. Security Vulnerabilities in Docker Containers: Kube-hunter focuses on the Kubernetes environment rather

  than Docker container-specific vulnerabilities.

  References from Pentest:

  Forge HTB: Highlights the use of specialized tools to identify misconfigurations in environments, similar to how kube-hunter operates within Kubernetes clusters. Anubis HTB: Demonstrates the importance of identifying and fixing

  misconfigurations within complex environments like Kubernetes clusters.

  Conclusion:

  Option B, weaknesses and misconfigurations in the Kubernetes cluster, accurately describes the type of vulnerabilities that kube-hunter is designed to detect.

• Question 207:

  A penetration tester cannot find information on the target company's systems using common OSINT methods. The tester's attempts to do reconnaissance against internet- facing resources have been blocked by the company's WAF. Which of the following is the best way to avoid the WAF and gather information about the target company's systems?

  A. HTML scraping

  B. Code repository scanning

  C. Directory enumeration

  D. Port scanning

  Correct Answer: B

  When traditional reconnaissance methods are blocked, scanning code repositories is an effective method to gather information. Here's why:

  Code Repository Scanning:

  Comparison with Other Methods:

  Scanning code repositories allows gathering a wide range of information that can be critical for further penetration testing effort

• Question 208:

  A penetration tester writes the following script to enumerate a 1724 network:

  1 #!/bin/bash

  2 for i in {1..254}; do

  3 ping -c1 192.168.1.$i

  4 done

  The tester executes the script, but it fails with the following error:

  -bash: syntax error near unexpected token 'ping'

  Which of the following should the tester do to fix the error?

  A. Add do after line 2.

  B. Replace {1..254} with $(seq 1 254).

  C. Replace bash with tsh.

  D. Replace $i with ${i}.

  Correct Answer: A

  The error in the script is due to a missing do keyword in the for loop. Here's the corrected script and explanation: Original Script: 1 #!/bin/bash 2 for i in {1..254}; do 3 ping -c1 192.168.1.$i 4 done Error Explanation: Corrected Script: 1 #!/bin/bash 2 for i in {1..254}; do 3 ping -c1 192.168.1.$i 4 done Adding do after line 2 corrects the syntax error and allows the script to execute properly.

• Question 209:

  Which of the following elements in a lock should be aligned to a specific level to allow the key cylinder to turn?

  A. Latches

  B. Pins

  C. Shackle

  D. Plug

  Correct Answer: B

  In a pin tumbler lock, the key interacts with a series of pins within the lock cylinder. Here's a detailed breakdown:

  Components of a Pin Tumbler Lock:

  Operation:

  Why Pins Are the

• Question 210:

  A penetration tester attempts to run an automated web application scanner against a target URL. The tester validates that the web page is accessible from a different device. The tester analyzes the following HTTP request header logging output:

  200; GET /login.aspx HTTP/1.1 Host: foo.com; User-Agent: Mozilla/5.0

  200; GET /login.aspx HTTP/1.1 Host: foo.com; User-Agent: Mozilla/5.0

  No response; POST /login.aspx HTTP/1.1 Host: foo.com; User-Agent: curl 200; POST /login.aspx HTTP/1.1 Host: foo.com; User-Agent: Mozilla/5.0

  No response; GET /login.aspx HTTP/1.1 Host: foo.com; User-Agent: python Which of the following actions should the tester take to get the scans to work properly?

  A. Modify the scanner to slow down the scan.

  B. Change the source IP with a VPN.

  C. Modify the scanner to only use HTTP GET requests.

  D. Modify the scanner user agent.

  Correct Answer: D