support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. CompTIA
  4. PT0-003

CompTIA PT0-003 Exam Prep
CompTIA PenTest+ (Page 13 )

Updated On: 3-Oct-2026
Page 8 of 44
PDF with 345 Questions

A penetration tester is performing a cloud-based penetration test against a company. Stakeholders have indicated the priority is to see if the tester can get into privileged systems that are not directly accessible from the internet. Given the following scanner information: Server-side request forgery vulnerability in test.comptia.org Reflected cross-site scripting vulnerability in test2.comptia.org Publicly accessible storage system named static_comptia_assets SSH port 22 open to the intemet on test3.comptia.org Open redirect vulnerability in test4.comptia.org Which of the following of the attack paths should the tester prioritize first?

  1. Synchronize all the information from the public bucket and scan it with Trufflehog.
  2. Run Pacu to enumerate permissions and roles within the cloud-based systems.
  3. Perform a full dictionary brute-force attack against the open SSH service using Hydra.
  4. Use the reflected cross-site scripting attack within a phishing campaign to attack administrators.
  5. Leverage the SSRF to gain access to credentials from the metadata service.

Answer(s): E

Explanation:

The most effective initial attack path is leveraging the Server-Side Request Forgery (SSRF) vulnerability to access credentials from the metadata service (Option E). Here's why:
Cloud environments, like AWS, Azure, and GCP, utilize metadata services to provide instances with information about themselves, including temporary credentials (API keys, tokens) needed to interact with other cloud services. This is a common and efficient way for applications to access resources without hardcoding credentials.
SSRF allows an attacker to force the server to make HTTP requests to arbitrary destinations. By exploiting the SSRF vulnerability at test.comptia.org , the penetration tester can make the server request the metadata endpoint (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE-NAME in AWS).
Successfully obtaining credentials from the metadata service grants the attacker a significant privilege escalation foothold. These credentials, often associated with powerful roles, can provide immediate access to internal systems and data, bypassing external facing security controls. This aligns perfectly with the stakeholders' priority of accessing privileged systems not directly exposed to the internet.
The other options are less likely to provide immediate, impactful results:
A: Analyzing the public bucket might reveal sensitive information but requires time and effort. The information discovered may or may not lead to immediate privilege escalation. B: Pacu enumeration is useful for understanding cloud configurations, but requires existing credentials or access to the environment to start, which we don't initially have. C: Brute-forcing SSH is noisy, slow, and easily detected. It's also less likely to succeed if proper security measures are in place. D: While phishing can be effective, it relies on user interaction, making it less reliable and more time-consuming than directly exploiting the SSRF.
The SSRF attack offers a direct route to potentially high-value credentials within the cloud environment, making it the highest priority for quickly achieving the penetration testing objective. It exploits a common cloud misconfiguration that directly leads to privilege escalation.
Further Reading:
OWASP SSRF: https://owasp.org/www-community/attacks/Server_Side_Request_Forgery AWS EC2 Instance Metadata: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html Azure Instance Metadata Service: https://learn.microsoft.com/en-us/azure/virtual-machines/instance-metadata-service GCP Metadata Server: https://cloud.google.com/compute/docs/metadata/



A client recently hired a penetration testing firm to conduct an assessment of their consumer-facing web application. Several days into the assessment, the client's networking team observes a substantial increase in DNS traffic.
Which of the following would most likely explain the increase in DNS traffic?

  1. Covert data exfiltration
  2. URL spidering
  3. HTML scrapping
  4. DoS attack

Answer(s): B

Explanation:

The correct answer is B: URL spidering. Here's why:
URL spidering, also known as web crawling, involves systematically exploring a website by following all the hyperlinks on a page and then recursively following the links on those pages. Penetration testers often use spidering tools to map out the application's structure, identify hidden pages, and uncover potential vulnerabilities.
This process generates a significant amount of DNS traffic because each unique URL discovered by the spider needs to have its domain name resolved to an IP address via DNS lookups. This resolution is necessary for the spidering tool to access and analyze the content at that URL.
Covert data exfiltration (A) might involve DNS, but it's less likely to be the primary cause of a sudden and substantial increase in DNS traffic early in the assessment.
While data exfiltration can use DNS tunneling, it typically aims to be stealthy and would be deployed later in the engagement after a vulnerability is exploited,
not as an initial reconnaissance step.
HTML scraping (C) is extracting data from websites.
While it involves web requests, the DNS impact wouldn't be as significant as spidering. Scraping focuses on specific data elements within known pages, not the broader discovery of new pages.
A DoS attack (D) would indeed cause a substantial increase in network traffic, including DNS, but it's unlikely that a penetration testing firm would initiate a DoS attack as part of a standard web application assessment. Such an action is generally out of scope and would be considered unethical and potentially illegal without explicit authorization. Moreover, DoS attacks typically involve flooding a server with requests, not necessarily resolving a large number of unique domain names.
Therefore, the significant increase in DNS traffic during the initial days of a penetration test is most plausibly explained by the penetration tester's use of URL spidering to map the web application's structure. This is a common reconnaissance technique.
Authoritative links for further research:
OWASP (Open Web Application Security Project): Provides resources on web application security testing, including reconnaissance techniques like spidering: https://owasp.org/ NIST (National Institute of Standards and Technology): NIST publications often cover penetration testing methodologies and best practices: https://www.nist.gov/



Which of the following could be used to enhance the quality and reliability of a vulnerability scan report?

  1. Risk analysis
  2. Peer review
  3. Root cause analysis
  4. Client acceptance

Answer(s): B

Explanation:

The correct answer is B. Peer review. Here's why:
Peer review significantly enhances the quality and reliability of a vulnerability scan report by providing an objective, second set of eyes to examine the findings, methodology, and overall conclusions. A peer reviewer, ideally another experienced penetration tester or security analyst, can identify errors, omissions, or inconsistencies in the report that the original author might have missed. This collaborative approach helps ensure the report is accurate, comprehensive, and clearly communicates the potential risks to stakeholders. By comparing the report against industry best practices, such as the OWASP Testing Guide, and established vulnerability scoring systems like CVSS, a reviewer can further validate the findings and ensure consistent application of standards.
Why the other options are less suitable:

A: Risk analysis: While risk analysis is informed by the vulnerability scan report, it's a separate activity that assesses the impact of the identified vulnerabilities on the business. It doesn't inherently improve the quality of the report itself.
C: Root cause analysis: Root cause analysis delves into the underlying reasons why vulnerabilities exist in the first place (e.g., insecure coding practices, misconfiguration). This is valuable for remediation, but it's not directly involved in verifying or improving the quality of the vulnerability scan report. Root cause analysis is a follow-up step to addressing the findings in the report.
D: Client acceptance: Client acceptance is the formal acknowledgment from the client that the deliverable (in this case, the vulnerability scan report) meets their requirements.
While important for project management, it doesn't inherently improve the technical accuracy or completeness of the report itself. Client acceptance is based on the understanding of the report, but peer review ensures its accuracy.
Authoritative Links for further research:
OWASP Testing Guide: https://owasp.org/www-project-web-security-testing-guide/ (Provides a structured framework for vulnerability assessment and penetration testing.)
Common Vulnerability Scoring System (CVSS): https://www.first.org/cvss/ (Industry standard for assessing the severity of vulnerabilities.)



During a preengagement activity with a new customer, a penetration tester looks for assets to test.
Which of the following is an example of a target that can be used for testing?

  1. API
  2. HTTP
  3. IPA
  4. ICMP

Answer(s): A

Explanation:

The correct answer is A. API (Application Programming Interface). Here's why:
Penetration testing aims to identify vulnerabilities in a system's security posture. During the pre-engagement phase, defining the scope and targets is crucial. APIs are a critical target for penetration testing because they often expose backend functionality and data to external applications and users. A poorly secured API can provide attackers with a direct entry point to sensitive information or system control.
API Vulnerabilities: APIs often have weaknesses related to authentication, authorization, input validation, and data handling. Common API vulnerabilities include injection flaws, broken authentication, excessive data exposure, and lack of resource limiting.
Attack Vectors: Penetration testers can use various techniques to test APIs, such as fuzzing, parameter tampering, and exploiting known vulnerabilities. Testing should assess the API's ability to resist various attack scenarios.
Impact of Compromise: A successful API attack can lead to data breaches, service disruption, and reputational damage. Therefore, testing APIs is essential for securing applications.
HTTP (Hypertext Transfer Protocol) is a protocol used for transferring data over the web, but it's not a specific asset to test directly.
While web applications using HTTP are targets, HTTP itself is not the target. IPA (iOS App Package) is a file format for iOS apps, but the API associated with the application is more the target in context of this question. ICMP (Internet Control Message Protocol) is a protocol used for network diagnostics, such as ping.
While ICMP vulnerabilities exist, they are less of a critical target compared to APIs when focusing on application-level security testing during a penetration test pre-engagement phase focused on defining the testing scope.
In essence, APIs represent a direct attack surface that penetration testers must evaluate to ensure the security of applications and the data they access.
Supporting Links:
OWASP API Security Project: https://owasp.org/www-project-api-security/ NIST Guidelines on API Security: (While NIST doesn't have a single document solely on API security, their publications on application security and cloud security are highly relevant). NIST SP 800-190 "Application Container Security Guide" provides information for securing containers which are commonly used to host APIs. https://csrc.nist.gov/publications/detail/sp/800-190/final



Before starting an assessment, a penetration tester needs to scan a Class B IPv4 network for open ports in a short amount of time.
Which of the following is the best tool for this task?

  1. Burp Suite
  2. masscan
  3. Nmap
  4. hping

Answer(s): B

Explanation:

Masscan is the best tool for quickly scanning a large network like a Class B IPv4 network for open ports. Its primary design goal is speed, allowing it to transmit TCP SYN packets much faster than traditional port scanners like Nmap. This speed advantage stems from its asynchronous, stateless approach to scanning. Masscan doesn't track connection state meticulously, reducing overhead and increasing scanning throughput. For a Class B network, which has a substantial address space, speed is critical.
While Nmap is a versatile and powerful port scanner, its comprehensive feature set and stateful scanning make it slower than Masscan for a simple open port detection task on a large network. Burp Suite is a web application security testing tool, not designed for general network port scanning. Hping is a packet crafting tool useful for advanced network testing, but not optimized for the rapid port scanning required in this scenario. The objective is to quickly identify listening services. Masscan excels by rapidly sending out probe packets and identifying which hosts respond, indicating open ports, making it optimal for the specified short timeframe.
Here's an example command masscan 172.16.0.0/16 -p0-65535 --rate=10000 . This commands the masscan tool to scan the 172.16.0.0/16 network (a Class B network) across all ports (0-65535) at a rate of 10000 packets per second.Authoritative links:
Masscan homepage and documentation: https://github.com/robertdavidgraham/masscan Nmap homepage and documentation: https://nmap.org/



Which of the following activities should be performed to prevent uploaded web shells from being exploited by others?

  1. Remove the persistence mechanisms.
  2. Spin down the infrastructure.
  3. Preserve artifacts.
  4. Perform secure data destruction.

Answer(s): A

Explanation:

A: Remove the persistence mechanisms is correct because it directly addresses the need to eliminate avenues through which an attacker can maintain access to a compromised system.
Removing persistence mechanisms prevents an attacker from easily re-establishing a foothold within the environment, thereby mitigating the risks posed by uploaded web shells. Web shells can exploit vulnerable applications to execute arbitrary commands, and persistence mechanisms, such as cron jobs or modified startup scripts, can reintroduce those exploits after remediation efforts. By effectively removing these mechanisms, organizations can sever the continuous link to the exploited system, significantly lowering the risk of further exploitation.
Critical Evaluation of Other Options:
B: Spin down the infrastructure: While this might seem like a viable option for preventing exploitation, it is not practical in all scenarios. Disabling infrastructure can disrupt legitimate operations and may fail to address underlying vulnerabilities that allowed the initial compromise. It is a temporary measure that does not resolve the core issues.
C: Preserve artifacts: Preserving artifacts is crucial for forensic analysis and understanding the attack vector, but it does not directly prevent exploitation. This option focuses on retaining evidence rather than eliminating the attack surface, which is less effective in preventing further attacks.
D: Perform secure data destruction: Although securely destroying data can prevent data leaks, it doesn't specifically address web shell exploitation. Destroying data could hinder recovery efforts and eliminate useful information needed for forensic investigations, thus failing to combat ongoing threats efficiently.
References:
https://www.us-cert.cisa.gov/ncas/tips/ST06-001 https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2021_Special_Considerations#Secure_Web_Application_Deployment https://www.sans.org/white-papers/45581/


Reference:

References:
https://www.us-cert.cisa.gov/ncas/tips/ST06-001 https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2021_Special_Considerations#Secure_Web_Application_Deployment https://www.sans.org/white-papers/45581/



A penetration tester writes a Bash script to automate the execution of a ping command on a Class C network:

Which of the following pieces of code should the penetration tester use in place of the --MISSING-TEXT--placeholder?

  1. crunch 1 254 loop
  2. seq 1 254
  3. echo 1-254
  4. 1..254

Answer(s): B

Explanation:

A: crunch 1 254 loop
• crunch is for wordlists, not a Bash loop.
B: seq 1 254
• Could work if used like for var in $(seq 1 254) (but in this snippet, no $() shown).
C: echo 1-254
• Produces the literal string 1-254, not numbers 1–254.
D: 1..254
• Standard Bash range expansion.
• Fits perfectly in the placeholder.



Which of the following components should a penetration tester include in an assessment report?

  1. User activities
  2. Customer remediation plan
  3. Key management
  4. Attack narrative

Answer(s): D

Explanation:

The correct answer is D, Attack Narrative, because a penetration test report's core purpose is to document how vulnerabilities were exploited. An attack narrative meticulously details the steps taken by the penetration tester, mirroring a real-world attacker's path. It chronologically outlines the exploitation process,
including the vulnerabilities identified, the tools used, commands executed, and the data accessed. This narrative allows the client to understand the severity and impact of the vulnerabilities and how they were chained together to compromise the system. Without it, the report lacks crucial context and actionable insights.
Option A, User Activities, might be relevant for incident response or insider threat investigations but is not the primary focus of a penetration test report. Option B, Customer Remediation Plan, is a separate deliverable based on the penetration test report, not an inherent component within it.
While the report highlights vulnerabilities, the remediation plan outlines the specific steps the customer needs to take to fix them. Option C, Key Management, although important in security assessments, is usually discussed in sections related to authentication or encryption weaknesses found during the attack narrative. The narrative provides the context of how weak key management led to successful exploitation.
The attack narrative helps clients understand the realistic attack vectors against their systems. It provides tangible evidence of how a threat actor could exploit vulnerabilities, allowing the organization to prioritize remediation efforts and improve their overall security posture. The narrative needs to be clear, concise, and easily understandable by both technical and non-technical stakeholders. It should also include supporting evidence like screenshots, command outputs, and code snippets to reinforce the findings.
For further research on penetration testing reports and their components, refer to:
SANS Institute: They offer various courses and whitepapers on penetration testing, including guidance on report writing. https://www.sans.org/ OWASP (Open Web Application Security Project): OWASP provides resources on web application security and penetration testing methodologies, often including report templates and best practices. https://owasp.org/ NIST (National Institute of Standards and Technology): NIST publishes standards and guidelines on cybersecurity, including penetration testing and vulnerability management. https://www.nist.gov/



  PDF
Viewing page 13 of 44
Viewing questions 97 - 104 out of 345 questions


Post your Comments and Discuss CompTIA PT0-003 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!