support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  1. Home
  2. Exams
  3. CompTIA
  4. PT0-003

CompTIA PT0-003 Exam Actual Questions
CompTIA PenTest+ (Page 3 )

Updated On: 11-Aug-2026
Page 3 of 49
PDF with 345 Questions

[Attacks and Exploits]
As part of a security audit, a penetration tester finds an internal application that accepts unexpected user inputs, leading to the execution of arbitrary commands.
Which of the following techniques would the penetration tester most likely use to access the sensitive data?

  1. Logic bomb
  2. SQL injection
  3. Brute-force attack
  4. Cross-site scripting

Answer(s): B

Explanation:

SQL injection (SQLi) is a technique that allows attackers to manipulate SQL queries to execute arbitrary commands on a database. It is one of the most common and effective methods for accessing sensitive data in internal applications that accept unexpected user inputs. Here's why option B is the most likely technique:
Arbitrary Command Execution: The question specifies that the internal application accepts unexpected user inputs leading to arbitrary command execution. SQL injection fits this description as it exploits vulnerabilities in the application's input handling to execute unintended SQL commands on the database.
Data Access: SQL injection can be used to extract sensitive data from the database, modify or delete records, and perform administrative operations on the database server. This makes it a powerful technique for accessing sensitive information.
Common Vulnerability: SQL injection is a well-known and frequently exploited vulnerability in web applications, making it a likely technique that a penetration tester would use to exploit input handling issues in an internal application.
Reference from Pentest:

Luke HTB: This write-up demonstrates how SQL injection was used to exploit an internal application and access sensitive data. It highlights the process of identifying and leveraging SQL injection vulnerabilities to achieve data extraction.
Writeup HTB: Describes how SQL injection was utilized to gain access to user credentials and further exploit the application. This example aligns with the scenario of using SQL injection to execute arbitrary commands and access sensitive data.
Conclusion:
Given the nature of the vulnerability described (accepting unexpected user inputs leading to arbitrary command execution), SQL injection is the most appropriate and likely technique that the penetration tester would use to access sensitive data. This method directly targets the input handling mechanism to manipulate SQL queries, making it the best choice.



[Attacks and Exploits]
A penetration tester identifies an exposed corporate directory containing first and last names and phone numbers for employees.
Which of the following attack techniques would be the most effective to pursue if the penetration tester wants to compromise user accounts?

  1. Smishing
  2. Impersonation
  3. Tailgating
  4. Whaling

Answer(s): A

Explanation:

When a penetration tester identifies an exposed corporate directory containing first and last names and phone numbers, the most effective attack technique to pursue would be smishing. Here's why:
Understanding Smishing:
Smishing (SMS phishing) involves sending fraudulent messages via SMS to trick individuals into revealing personal information or performing actions that compromise security. Since the tester has access to phone numbers, this method is directly applicable.
Why Smishing is Effective:
Personalization: Knowing the first and last names allows the attacker to personalize the messages, making them appear more legitimate and increasing the likelihood of the target responding. Immediate Access: People tend to trust and respond quickly to SMS messages compared to emails, especially if the messages appear urgent or important.
Alternative Attack Techniques:
Impersonation: While effective, it generally requires real-time interaction and may not scale well across many targets.
Tailgating: This physical social engineering technique involves following someone into a restricted area and is not feasible with just names and phone numbers.
Whaling: This targets high-level executives with highly personalized phishing attacks. Although effective, it is more specific and may not be suitable for the broader set of employees in the directory.



A penetration tester is compiling the final report for a recently completed engagement. A junior QA team member wants to know where they can find details on the impact, overall security findings, and high-level statements.
Which of the following sections of the report would most likely contain this information?

  1. Quality control
  2. Methodology
  3. Executive summary
  4. Risk scoring

Answer(s): C

Explanation:

In the final report for a penetration test engagement, the section that most likely contains details on the impact, overall security findings, and high-level statements is the executive summary. Here's why:
Purpose of the Executive Summary:
It provides a high-level overview of the penetration test findings, including the most critical issues, their impact on the organization, and general recommendations. It is intended for executive management and other non-technical stakeholders who need to understand the security posture without delving into technical details.
Contents of the Executive Summary:
Impact: Discusses the potential business impact of the findings. Overall Security Findings: Summarizes the key vulnerabilities identified during the engagement. High-Level Statements: Provides strategic recommendations and a general assessment of the security posture.
Comparison to Other Sections:
Quality Control: Focuses on the measures taken to ensure the accuracy and quality of the testing process.
Methodology: Details the approach and techniques used during the penetration test. Risk Scoring: Provides detailed risk assessments and scoring for specific vulnerabilities but does not offer a high-level overview suitable for executives.



[Reporting and Communication]
A tester completed a report for a new client. Prior to sharing the report with the client, which of the following should the tester request to complete a review?

  1. A generative AI assistant
  2. The customer's designated contact
  3. A cybersecurity industry peer
  4. A team member

Answer(s): B

Explanation:

Before sharing a report with a client, it is crucial to have it reviewed to ensure accuracy, clarity, and completeness. The best choice for this review is a team member. Here's why:
Internal Peer Review:
Familiarity with the Project: A team member who worked on the project or is familiar with the methodologies used can provide a detailed and context-aware review. Quality Assurance: This review helps catch any errors, omissions, or inconsistencies in the report before it reaches the client.
Alternative Review Options:
A Generative AI Assistant: While useful for drafting and checking for language issues, it may not fully understand the context and technical details of the penetration test. The Customer's Designated Contact: Typically, the client reviews the report after the internal review to provide their perspective and request clarifications or additional details. A Cybersecurity Industry Peer: Although valuable, this option might not be practical due to confidentiality concerns and the peer's lack of specific context regarding the engagement. In summary, an internal team member is the most suitable choice for a thorough and contextually accurate review before sharing the report with the client.



[Attacks and Exploits]
During an assessment, a penetration tester exploits an SQLi vulnerability.
Which of the following commands would allow the penetration tester to enumerate password hashes?

  1. sqlmap -u www.example.com/?id=1 --search -T user
  2. sqlmap -u www.example.com/?id=1 --dump -D accounts -T users -C cred
  3. sqlmap -u www.example.com/?id=1 --tables -D accounts
  4. sqlmap -u www.example.com/?id=1 --schema --current-user --current-db

Answer(s): B

Explanation:

To enumerate password hashes using an SQL injection vulnerability, the penetration tester needs to extract specific columns from the database that typically contain password hashes. The --dump command in sqlmap is used to dump the contents of the specified database table. Here's a breakdown of the options:
Option A: sqlmap -u www.example.com/?id=1 --search -T user The --search option is used to search for columns and not to dump data. This would not enumerate password hashes.

Option B: sqlmap -u www.example.com/?id=1 --dump -D accounts -T users -C cred This command uses --dump to extract data from the specified database accounts, table users, and column cred. This is the correct option to enumerate password hashes, assuming cred is the column containing the password hashes.
Option C: sqlmap -u www.example.com/?id=1 --tables -D accounts The --tables option lists all tables in the specified database but does not extract data. Option D: sqlmap -u www.example.com/?id=1 --schema --current-user --current-db The --schema option provides the database schema information, and --current-user and --current-db provide information about the current user and database but do not dump data.
Reference from Pentest:
Writeup HTB: Demonstrates using sqlmap to dump data from specific tables to retrieve sensitive information, including password hashes.

Luke HTB: Shows the process of exploiting SQL injection to extract user credentials and hashes by dumping specific columns from the database.



  PDF
Viewing page 3 of 49
Viewing questions 11 - 15 out of 345 questions


Post your Comments and Discuss CompTIA PT0-003 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!