easyMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester has physical access to a…
A penetration tester has physical access to a small office. The network switch is in a locked cabinet, but the tester notices the lock is broken. The switch has multiple ports, and the tester wants to connect to the internal network. The tester has a laptop with an Ethernet port. However, the tester suspects that port security is enabled on the switch ports, which would block the connection if the MAC address is not authorized. Which action should the tester take first to gain network access?
⚠ Common exam trap
It's easy for candidates to assume physical access to a switch port means they can simply plug in (Option C), but Cisco exams emphasize that port security is a common Layer 2 control that must be bypassed via management access first, not by attacking the data plane.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Connect to the switch's console port and attempt default credentials.
The tester has physical access to the switch and the lock is broken, allowing direct console access. If port security is enabled, plugging into a data port (Option C) would be blocked. The fastest first step is to connect to the console port and try default credentials (e.g., cisco/cisco) to gain administrative control of the switch, which can then be used to disable port security or add the tester's MAC address to the allowed list.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform a MAC flooding attack to fill the switch's MAC table.
Why it's wrong here
A MAC flooding attack works by sending thousands of spoofed MAC addresses to overflow the switch's Content-Addressable Memory (CAM) table, forcing it to fail open and broadcast frames like a hub. However, modern switches with port security keep the CAM table per-port and often have violation modes that shut down the port or drop packets when an unknown MAC appears, so flooding is noisy, easily detected, and not a reliable method to bypass port security. Furthermore, even if the switch floods traffic, the tester's laptop would need to sniff and potentially spoof a legitimate MAC to actually gain network access, which is complex and uncertain.
- ✗
Use a DHCP starvation attack to exhaust IP addresses.
Why it's wrong here
A DHCP starvation attack involves sending a flood of DHCPDISCOVER messages with spoofed MAC addresses to exhaust the DHCP server's address pool, denying legitimate clients their own IP addresses. This is a denial-of-service (DoS) technique that does not grant the attacker network access or bypass port security; the attacker's laptop would still be blocked by 802.1X or MAC-based port security. Additionally, if the DHCP server has a large or dynamic pool, starvation may take a long time, and the attack is disruptive and easily noticed, making it a poor choice for gaining access in a small office environment.
- ✗
Plug the laptop into an available switch port.
Why it's wrong here
Simply plugging a laptop into an available switch port is the most direct approach, but it will almost certainly fail if port security is configured. Port security typically limits the number of MAC addresses allowed on a port and denies or shuts down the port for any unknown MAC, and the tester's laptop has a new, untrusted MAC address that is not in the allowed list. Even if the port is in 'restrict' mode (just drops frames), the tester gets no network connectivity, and if it's in 'shutdown' mode, the switch disables the port entirely, creating a physical outage that draws attention. Thus, this option does not provide access unless port security is absent or misconfigured, which is not a safe assumption.
- ✓
Connect to the switch's console port and attempt default credentials.
Why this is correct
Connecting to the switch's console port provides direct, out-of-band management access that bypasses all network-based security controls, including port security and 802.1X. If the default credentials (e.g., cisco/cisco, admin/admin, or blank passwords) have not been changed, the tester can log in to the management interface and alter the configuration. From there, they could disable port security, add their laptop's MAC address as authorized, create a VLAN hopping rule, or even capture traffic — effectively gaining full control over the switch and, by extension, network access. Default credentials are extremely common on legacy or poorly maintained equipment, making this a high-probability attack vector when physical access is available.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This PT0-003 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.