mediumMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester analyzes a PowerShell script…
A penetration tester analyzes a PowerShell script that uses the 'Invoke-Command' cmdlet to run a command on multiple remote Windows systems. The script checks if the local Administrator account is using a default password. Which phase of the penetration test is this script most directly supporting?
⚠ Common exam trap
Watch out — candidates often confuse the act of checking for default credentials (enumeration of misconfigurations) with the subsequent exploitation step (lateral movement) or the method of extracting stored credentials (credential dumping).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enumeration of misconfigurations
The script uses Invoke-Command to check if the local Administrator account on multiple remote Windows systems uses a default password. This directly supports the enumeration of misconfigurations phase, as it identifies a common security weakness (default credentials) that could be exploited. It does not involve moving between systems (lateral movement) or extracting stored credentials (credential dumping).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Lateral movement
Why it's wrong here
Lateral movement involves using compromised credentials to access other systems. The script is only checking for default passwords, not using them to move laterally. However, it could enable lateral movement if a default password is found.
- ✗
Credential dumping
Why it's wrong here
Credential dumping is the act of extracting stored authentication material, such as password hashes from SAM database or plaintext secrets from LSASS process memory. This PowerShell script does not extract any secrets from a system; it only attempts to authenticate to remote hosts using a known default Administrator password. Merely testing whether a default password works is an authentication attempt, not a credential theft technique, so it cannot be classified as credential dumping.
- ✓
Enumeration of misconfigurations
Why this is correct
This script performs a systematic check across remote systems to determine whether the default Administrator password is still configured. That is a form of enumeration focusing on misconfigurations, specifically insecure default credentials. In the penetration testing methodology, enumeration is the active discovery of weaknesses, and verifying that a default password remains enabled is a classic example of identifying a configuration flaw without yet exploiting it for access or lateral movement.
- ✗
Privilege escalation
Why it's wrong here
Privilege escalation involves increasing the access level of the current user or process on a single system, for example by exploiting a kernel vulnerability or abusing a service running with higher privileges. This script does not elevate privileges on any one host; it simply tests an administrative credential across multiple remote systems. If the default password works, you already have administrator-level access, so no privilege escalation step occurs. The action is better categorized as remote enumeration of an insecure configuration, not as an escalation technique.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
Key term
Enumeration
Enumeration is the systematic process of extracting detailed information about a target system, such as user accounts, network shares, services, and configurations, used during the reconnaissance phase of a security assessment.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.