hardMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester has gained a foothold on a…
A penetration tester has gained a foothold on a Linux server through a vulnerable web application. The server has an outbound firewall that blocks all traffic except DNS queries (UDP 53). The tester needs to establish a reverse shell to maintain access. Which technique is most likely to succeed?
⚠ Common exam trap
It's easy for candidates to assume a reverse shell over HTTP (TCP 80) will work because HTTP is commonly allowed, but the question explicitly states the firewall blocks all traffic except DNS queries (UDP 53), making TCP-based reverse shells fail regardless of the port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encode the payload in Base64 and use DNS tunneling to execute commands
DNS tunneling encapsulates non-DNS traffic (e.g., command output) within DNS query and response packets, which are allowed through the firewall on UDP port 53. This technique bypasses the outbound firewall restriction by making the malicious traffic appear as legitimate DNS queries, enabling the tester to execute commands and exfiltrate data without triggering network-level blocks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a bind shell on a high TCP port and connect from the tester's machine
Why it's wrong here
The bind shell would listen on a port, but the outbound firewall on the server does not restrict inbound connections; however, the tester would need to connect to the server. But the firewall allows outbound DNS only, so the server cannot initiate a connection back. This approach is not suitable.
- ✓
Encode the payload in Base64 and use DNS tunneling to execute commands
Why this is correct
DNS tunneling exploits the firewall's allowance for DNS queries by encapsulating command-and-control data within DNS request and response messages. Base64 encoding converts the binary payload into ASCII characters that fit within DNS label constraints, allowing tools like dnscat2 or iodine to establish a bidirectional reverse shell over UDP 53. Because the firewall only permits DNS egress, the server can send queries to the tester's authoritative name server, and the responses carry commands and output, bypassing the TCP egress restriction entirely.
- ✗
Attempt a reverse shell over HTTP using TCP port 80
Why it's wrong here
A reverse shell over HTTP on TCP port 80 is invalid because HTTP operates over TCP, and the firewall's egress policy explicitly blocks all outbound TCP traffic, allowing only DNS on UDP port 53. The tester's attempt to initiate an outbound connection to the listener would fail at the TCP handshake, as the SYN packet is dropped; even if some networks permit HTTP, this scenario's egress filtering prohibits it. Consequently, any tool like Netcat or Meterpreter that relies on a TCP socket cannot work here.
- ✗
Use SSH reverse port forwarding to the tester's server on port 443
Why it's wrong here
SSH reverse port forwarding requires the compromised server to establish an outbound TCP connection to the tester's server, typically on port 22 or 443, which the firewall blocks since only DNS UDP 53 is permitted. While port 443 might be expected to be open for HTTPS, the rule denies all TCP, not just specific ports, so the SSH handshake would never complete. Unlike DNS tunneling, which operates within UDP 53, SSH cannot tunnel through a protocol that is not allowed to initiate TCP, making this technique unsuitable for this environment.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.