hardMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester has exploited a web…
A penetration tester has exploited a web application and found that the server has an outbound firewall that restricts all outbound traffic except for DNS queries (UDP 53). The tester has a reverse shell payload that connects back on TCP 443. Which technique can the tester use to exfiltrate data or establish a channel?
⚠ Common exam trap
Watch out — candidates often assume any protocol can be tunneled over UDP 53 simply by changing the port, but DNS tunneling requires specialized tools that encapsulate data within DNS message formats, not just raw TCP or SSH over UDP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use dnscat2 or other DNS tunneling tool
DNS tunneling tools like dnscat2 encode data within DNS queries and responses, allowing the tester to bypass outbound firewall restrictions that only permit UDP 53 traffic. Since the reverse shell payload uses TCP 443, which is blocked, DNS tunneling provides an alternative covert channel that encapsulates the communication within legitimate DNS lookups, effectively exfiltrating data or establishing a command-and-control channel over the allowed protocol.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use netcat to send data over TCP 53
Why it's wrong here
Netcat sends raw payloads over TCP, but a restrictive outbound firewall that allows DNS typically only permits UDP/53 for name resolution. TCP/53 is reserved for zone transfers and large responses, so egress filtering usually blocks it, and the raw data would not resemble legitimate DNS queries, making it easy to drop or flag.
- ✗
Use an SSH tunnel over UDP 53
Why it's wrong here
SSH is a TCP-based protocol that requires a reliable, ordered byte stream; it cannot natively run over UDP. Encapsulating SSH inside UDP would require an external shim like socat or udp2raw, plus a custom listener on the outside, and any UDP/53 traffic that is not well-formed DNS would likely be rejected by an inspection-capable firewall or a DNS forwarder.
- ✓
Use dnscat2 or other DNS tunneling tool
Why this is correct
DNS tunneling tools like dnscat2, iodine, and dns2tcp encode arbitrary data inside DNS queries and responses, which are allowed outbound on UDP/53 by the firewall. The tester controls an authoritative DNS server for a domain, so every DNS query from the compromised host to that domain carries a payload and the responses carry instructions, establishing a command-and-control channel that blends in with normal DNS traffic.
- ✗
Use a bind shell listening on TCP 443 internally
Why it's wrong here
A bind shell requires the tester to connect to the server from the outside, but the outbound firewall does not affect inbound connections. However, the server's public IP may still be reachable, but the tester would need to know the server's IP and the bind shell port to connect. This does not bypass the outbound restriction for the reverse shell, and the bind shell may be blocked by an inbound firewall as well.
Visual reference
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Reverse shell
A reverse shell is a type of remote access attack where the target machine initiates an outbound connection back to the attacker, allowing the attacker to execute commands on the compromised system.
Key term
Payload
In IT and cybersecurity, a payload is the core data or malicious code delivered within a packet, file, or attack that performs the actual intended action.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.