hardMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester gains a low-privileged shell…
A penetration tester gains a low-privileged shell on a Linux server and discovers that the user is a member of the 'docker' group. The tester wants to escalate privileges to root. Which technique is most effective?
⚠ Common exam trap
CompTIA often tests the misconception that kernel exploits are always the fastest path to root, but the trap here is that membership in the 'docker' group is a trivial and reliable escalation vector that bypasses the need for kernel exploitation or other complex techniques.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run a Docker container with the host filesystem mounted and access it as root
Members of the 'docker' group can run Docker containers with the `-v /:/mnt` flag to mount the host filesystem into the container. Inside the container, the user effectively has root privileges (since the container runs as root by default) and can access the host's `/mnt` directory, allowing them to modify files like `/mnt/etc/shadow` or add an SSH key to `/mnt/root/.ssh/authorized_keys` to gain root access on the host.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use cron job misconfigurations to execute a reverse shell
Why it's wrong here
Cron job misconfigurations can yield root access, but only when a root-scheduled task references a user-writable script or directory, or uses insecure wildcards such as `tar *`. Without prior reconnaissance identifying a specific vulnerable cron entry, this vector is speculative and may waste time. In contrast, membership in the `docker` group is a direct, deterministic path: issuing `docker run -v /:/mnt -it alpine chroot /mnt` immediately spawns a root shell on the host.
- ✗
Exploit kernel vulnerabilities using a local exploit suggester
Why it's wrong here
Exploiting kernel vulnerabilities requires a known, unpatched flaw in the kernel itself, but the user’s membership in the 'docker' group provides a direct, reliable privilege-escalation path via container escape or Docker socket abuse, making kernel exploitation unnecessary and less effective. This technique is tempting because it is a generic, widely applicable method for privilege escalation on outdated or unpatched systems, and would be the correct choice if the user lacked group memberships like 'docker' or 'sudo' that offer a more direct vector.
- ✓
Run a Docker container with the host filesystem mounted and access it as root
Why this is correct
By running a Docker container with the host filesystem mounted (e.g., `docker run -v /:/mnt -it alpine chroot /mnt`), the user can access all host files as root because Docker effectively runs as root. This bypasses normal privilege restrictions.
- ✗
Abuse SETUID binaries to execute commands as root
Why it's wrong here
Exploiting SETUID binaries is a viable escalation technique, but it requires a root-owned executable with the setuid bit that also contains an exploitable flaw, such as a buffer overflow, insecure environment variable handling, or a call to user-controllable paths. On a modern, patched system such binaries are rare, and blindly running a local exploit suggester to find them is opportunistic. Docker group membership, however, is an immediate and guaranteed root equivalent—the docker CLI can mount the host filesystem into a privileged container, bypassing the need to locate any vulnerable binary.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.