CompTIA PenTest+ (PT0-003) PT0-003 Questions 151–185 | Page 3/3

151

MCQeasy

During a penetration test, the tester identifies a low-risk information disclosure vulnerability in a public-facing web server. The tester includes this finding in the final report. Which component of the risk rating should the tester use to justify the low severity?

A.CVSS base score

B.Exploitability metrics

C.Impact metrics

D.Temporal score

AnswerA

The CVSS base score is the standardized, intrinsic measure of vulnerability severity, computed from a weighted combination of exploitability metrics (attack vector, complexity, privileges, user interaction) and impact metrics (confidentiality, integrity, availability) into a single 0–10 score. Because it is derived without temporal or environmental adjustments, it provides a stable, vendor-neutral baseline for prioritization. A low base score directly reflects that the vulnerability's intrinsic severity is minor, which is why the penetration tester classifies it as low risk. Unlike sub-metrics or optional adjusted scores, the base score is the industry-accepted primary reference for severity ratings.

Why this answer

The CVSS base score is the correct component to justify the low severity because it represents the intrinsic and fundamental characteristics of a vulnerability that are constant over time and across user environments. In this case, the information disclosure vulnerability has a low base score due to factors such as low attack complexity and low impact on confidentiality, which are captured in the base metrics. The base score is the standard starting point for communicating severity, making it the appropriate justification for the low-risk rating in the report.

Exam trap

CompTIA often tests the misconception that exploitability metrics or impact metrics alone determine the severity, when in fact the CVSS base score is the aggregate of both and is the authoritative component for justifying the risk rating in a report.

How to eliminate wrong answers

Option B is wrong because exploitability metrics (e.g., attack vector, attack complexity, privileges required, user interaction) are sub-components of the CVSS base score that influence the overall severity, but they alone do not define the final risk rating; they must be combined with impact metrics to produce the base score. Option C is wrong because impact metrics (e.g., confidentiality, integrity, availability) are also sub-components of the base score and do not independently justify the low severity; the base score integrates both exploitability and impact. Option D is wrong because the temporal score adjusts the base score based on factors that change over time (e.g., exploit code maturity, remediation level, report confidence), but the question asks for the component to justify the low severity at the time of the test, not a future-adjusted score.

Full explanation →

152

MCQmedium

During a penetration test, a tester has access to a Windows domain-joined machine. The tester finds that the machine is running a service that uses named pipes for interprocess communication. The tester wants to perform a relay attack to capture authentication credentials. Which of the following conditions is necessary for an SMB relay attack to succeed?

A.SMB signing must be disabled or not enforced

B.The attacker must be on the same subnet

C.The target must have a publicly available SMB share

D.The attacker must have admin privileges on the relay machine

AnswerA

SMB signing must be disabled or not enforced. When SMB signing is enforced, every message is cryptographically signed using the session key derived from the NTLM handshake; a relayed authentication packet can be forwarded, but the subsequent signed traffic from the attacker cannot be validated by the target server because the attacker never learns the session key. If signing is disabled or only opt-in (not enforced), the server accepts unsigned messages, allowing the attacker to relay the authentication and then freely modify or inject SMB commands. Therefore, this is the primary technical condition that must exist for an NTLM relay to a Windows target to succeed.

Why this answer

SMB relay attacks work by intercepting an authentication attempt and forwarding it to a target server. For the relay to succeed, the target server must not require SMB signing, because signing ensures that the relayed authentication packet is cryptographically bound to the original session, preventing the attacker from replaying it. When SMB signing is disabled or not enforced, the relayed authentication is accepted as valid, allowing credential capture.

Exam trap

CompTIA often tests the misconception that SMB relay requires the attacker to be on the same subnet or have admin privileges, but the critical technical condition is the absence of SMB signing enforcement on the target server.

How to eliminate wrong answers

Option B is wrong because SMB relay attacks can be performed across subnets as long as the attacker can route the traffic between the victim and the target server; being on the same subnet is not a requirement. Option C is wrong because the target does not need a publicly available SMB share; the relay works against any SMB server that accepts authentication, even if no shares are accessible. Option D is wrong because the attacker does not need admin privileges on the relay machine; the relay is performed from the attacker's machine or a controlled system, and the attack succeeds based on network position and protocol weaknesses, not local administrative rights.

Full explanation →

153

MCQhard

A penetration tester is performing passive reconnaissance on a target organization. The tester wants to identify internal IP address ranges used by the organization without interacting directly with their network. Which of the following techniques would be most effective for this purpose?

A.Querying public BGP route databases and looking up the organization's autonomous system (AS) number

B.Performing a DNS zone transfer against the target's authoritative DNS servers

C.Using Shodan to search for devices from the target organization

D.Sending ARP requests on the local network segment to discover hosts

AnswerA

Public BGP route databases such as RADb, BGPMon, or Hurricane Electric's BGP toolkit aggregate the routing announcements made by organizations' autonomous systems. By identifying the target's ASN, a tester can enumerate all public IP prefixes the organization advertises into the global routing table, including netblocks for data centers, WAN links, or cloud-hosted segments. This method is fully passive because it only queries third-party public data stores and never sends packets to the target's own infrastructure.

Why this answer

Querying public BGP route databases (e.g., RADB, ARIN) using the organization's AS number allows a tester to retrieve IP prefixes announced by the target. This is passive reconnaissance because it uses publicly available routing data without sending any packets to the target's network, making it ideal for identifying internal IP ranges from an external perspective.

Exam trap

CompTIA often tests the distinction between passive and active reconnaissance, and the trap here is that candidates confuse DNS zone transfers (which are active and often restricted) with passive DNS lookups, or assume Shodan is always passive when it actually relies on active scanning data from the past.

How to eliminate wrong answers

Option B is wrong because a DNS zone transfer (AXFR) is an active technique that requires direct interaction with the target's authoritative DNS servers; it is not passive and often fails due to security restrictions. Option C is wrong because using Shodan involves querying a search engine that has previously scanned the target's public-facing devices, which is technically passive but relies on historical scan data and may not reveal internal IP ranges not exposed to the internet. Option D is wrong because sending ARP requests is an active, link-local discovery method that requires being on the same broadcast domain as the target, which is not passive and not feasible during external reconnaissance.

Full explanation →

154

MCQhard

During a penetration test, a tester gains access to a Linux server as a low-privileged user. The server has a cron job that executes a script owned by root but writable by the tester's group. Which privilege escalation technique should the tester use?

A.Kernel exploit

B.Misconfigured sudo permissions

C.Cron job exploitation via script modification

D.Path hijacking in the cron job

AnswerC

The cron job runs as root and executes a script that is owned by root but writable by the tester's group. Because the tester can modify the script's contents, they can inject an attacker-controlled command (e.g., a reverse shell or a command to modify /etc/passwd) that will be executed with root privileges when the cron job next triggers. This direct file modification bypasses any restrictions on interactive login and provides identical privileges to the cron job's owner, making it a simple, reliable privilege escalation path.

Why this answer

The cron job executes a script owned by root but writable by the tester's group. This means the tester can modify the script's contents. When the cron job runs (as root), the modified script executes with root privileges, allowing the tester to gain a root shell or execute arbitrary commands as root.

This is a classic cron job exploitation via script modification.

Exam trap

The trap here is that candidates may confuse path hijacking (which exploits an unqualified command in the script) with direct script modification (which exploits writable permissions on the script file itself), but the question explicitly states the script is writable, making modification the correct choice.

How to eliminate wrong answers

Option A is wrong because a kernel exploit targets vulnerabilities in the Linux kernel itself, but the scenario describes a misconfigured file permission (writable script) rather than a kernel bug. Option B is wrong because misconfigured sudo permissions would require the tester to have sudo access or a sudoers entry, which is not mentioned; the attack vector here is a writable cron script, not sudo. Option D is wrong because path hijacking in a cron job involves manipulating the PATH environment variable to execute a malicious binary instead of the intended one, but the scenario explicitly states the script itself is writable, so modifying the script directly is the more direct and reliable technique.

Full explanation →

155

MCQhard

A penetration tester is analyzing a Python script that imports the 'scapy' library. The script defines a function that sends a series of TCP SYN packets to a target IP and port range, and then waits for SYN-ACK responses. Which attack is the script performing?

A.TCP SYN flood

B.Port scanning

C.ARP poisoning

D.DNS spoofing

AnswerB

The script's behavior aligns with a TCP SYN scan (half-open scan), a core port scanning technique that sends a SYN packet to each target port and listens for a SYN-ACK (open) or RST (closed). By never sending the final ACK, the scanner avoids establishing a full connection, reducing its footprint and speed while still identifying listening services. This is a standard reconnaissance method in penetration testing, as it maps the exposed attack surface and reveals which TCP ports warrant further probing or vulnerability analysis.

Why this answer

The script sends TCP SYN packets to a range of ports and waits for SYN-ACK responses. This is the classic behavior of a SYN scan, a type of port scanning that identifies open ports by observing which ports respond with a SYN-ACK. The use of Scapy to craft and send these packets confirms the script is performing port scanning, not a denial-of-service attack.

Exam trap

The trap here is confusing a TCP SYN flood (a denial-of-service attack that sends many SYN packets without completing handshakes) with a SYN scan (a reconnaissance technique that sends SYN packets and analyzes responses to identify open ports).

How to eliminate wrong answers

Option A is wrong because a TCP SYN flood aims to overwhelm a target with a high volume of SYN packets, exhausting resources and causing denial of service; the script described waits for SYN-ACK responses, which is not characteristic of a flood attack. Option C is wrong because ARP poisoning involves sending forged ARP replies to associate the attacker's MAC address with the IP of another host on a local network, which is unrelated to sending TCP SYN packets to a range of ports. Option D is wrong because DNS spoofing involves corrupting DNS responses to redirect traffic to malicious sites, which does not involve sending TCP SYN packets to a target IP and port range.

Full explanation →

156

MCQhard

A vulnerability scanner reports a reflected XSS vulnerability in a web application. Manual testing confirms that the application HTML-encodes all user input in the response. Which scanner misconfiguration is MOST likely causing this false positive?

A.The scanner used a POST request instead of a GET request for the payload

B.The scanner's payload was reflected in a different context not subject to HTML encoding

C.The scanner used a payload with special characters that were truncated by the server

D.The scanner's payload triggered a server error that echoed back the input without encoding

AnswerD

When a scanner payload triggers an unhandled exception, the application's error handler may render a stack trace or generic error page that echoes back the offending input without applying the output encoding used by normal templates. The scanner observes its payload reflected verbatim in the response and flags it as XSS, but the vulnerability exists only in the error-handling path, which may not be reachable or exploitable under normal conditions. This is a well-known source of false positives because error pages often bypass security headers and encoding filters. Manual testing shows the normal pages encode all output, so this anomalous reflection is the likely explanation for the scanner's report.

Why this answer

A server error that echoes back the unencoded input bypasses the application's normal HTML-encoding logic. In this scenario, the vulnerability scanner detects the reflected payload in the error response, which is not subject to the same encoding as the application's standard output. This creates a false positive because the reflected XSS is not exploitable through the normal application flow, but only through an error condition that the scanner inadvertently triggered.

Exam trap

CompTIA often tests the distinction between a vulnerability being present in an error response versus the normal application flow, tricking candidates into thinking any reflection of input confirms XSS without considering the response context.

How to eliminate wrong answers

Option A is wrong because the HTTP method (POST vs GET) does not affect whether input is HTML-encoded in the response; encoding is applied server-side regardless of the request method. Option B is wrong because if the payload were reflected in a different context not subject to HTML encoding, the finding would be a true positive, not a false positive. Option C is wrong because truncation of special characters would likely prevent the payload from being reflected at all, or would break the XSS vector, leading to a false negative rather than a false positive.

Full explanation →

157

MCQhard

During an internal penetration test, a tester compromises a server that is part of a Kubernetes cluster. The tester has access to the node's operating system but not to the cluster's administrative credentials. Which of the following techniques would most likely allow the tester to escalate privileges to cluster-admin or access sensitive resources within the cluster?

A.Extracting a service account token from a running container and using it to access the Kubernetes API

B.Exploiting a kernel vulnerability on the node to escape to the host and then compromise the Kubernetes API server

C.Searching for a kubeconfig file on the node that contains a cluster-admin token

D.Modifying a ConfigMap to inject a malicious pod that runs with elevated privileges

AnswerA

Inside the compromised container, a JWT-bearing service account token is automatically mounted at /var/run/secrets/kubernetes.io/serviceaccount/token along with the CA certificate and namespace. Reading these files lets the tester authenticate to the kube-apiserver using the pod's service account identity. If that service account is bound to an RBAC ClusterRoleBinding (e.g., cluster-admin), the attacker immediately gains full cluster control, making this the most direct and reliable escalation path from a compromised pod.

Why this answer

Service account tokens are automatically mounted into pods at /var/run/secrets/kubernetes.io/serviceaccount/token. An attacker with node-level access can extract this token from a running container's filesystem and use it to authenticate to the Kubernetes API server. Since service accounts are often granted broad permissions via RBAC bindings, this token may allow the tester to access sensitive resources or even escalate to cluster-admin if the service account has such privileges.

Exam trap

The trap here is that candidates may assume kernel exploits (Option B) are always the best escalation path, but in Kubernetes, the service account token is a simpler and more direct method to access the API server from a compromised node.

How to eliminate wrong answers

Option B is wrong because exploiting a kernel vulnerability to escape to the host is unnecessary—the tester already has node-level OS access. Even after escaping, compromising the API server would require network access and authentication, which is not directly achieved by a kernel exploit. Option C is wrong because kubeconfig files on a node typically contain only node-level credentials (e.g., kubelet client certificates), not cluster-admin tokens; cluster-admin tokens are rarely stored on worker nodes.

Option D is wrong because modifying a ConfigMap cannot directly inject a pod; ConfigMaps store configuration data, not pod definitions. To create a malicious pod, the tester would need API server access, which is the goal, not the method.

Full explanation →

158

MCQhard

During an internal penetration test, a tester gains access to a domain-joined Windows 10 workstation as a local administrator. The tester wants to escalate privileges to Domain Admin. Which attack involves requesting Kerberos service tickets that can be cracked offline to reveal the plaintext password of a service account?

A.Pass-the-hash

B.Kerberoasting

C.Golden ticket

D.Silver ticket

AnswerB

This attack requests and cracks Kerberos service tickets to obtain service account passwords.

Why this answer

Kerberoasting is the correct attack because it involves requesting Kerberos service tickets (TGS-REP) for service accounts registered with Service Principal Names (SPNs) in Active Directory. These tickets are encrypted with the service account's NTLM hash, which can be cracked offline to reveal the plaintext password. Since the tester has local administrator access on a domain-joined workstation, they can use tools like Rubeus or Impacket to request these tickets without needing domain admin privileges initially.

Exam trap

CompTIA often tests Kerberoasting by contrasting it with pass-the-hash, where candidates mistakenly think pass-the-hash involves cracking hashes offline, but it actually reuses the hash directly for authentication without offline cracking.

How to eliminate wrong answers

Option A (Pass-the-hash) is wrong because it reuses an NTLM hash to authenticate without cracking it, not requesting Kerberos service tickets for offline cracking. Option C (Golden ticket) is wrong because it forges a Kerberos Ticket Granting Ticket (TGT) using the KRBTGT account hash, not requesting service tickets for offline cracking. Option D (Silver ticket) is wrong because it forges a service ticket for a specific service using the service account's hash, not requesting and cracking tickets offline.

Full explanation →

159

MCQhard

During a Windows privilege escalation attempt, a tester finds that the current user has the SeImpersonatePrivilege enabled. Which tool can be used to exploit this privilege to gain SYSTEM access?

A.PrintSpoofer

B.PowerUp

C.CrackMapExec

D.Mimikatz

AnswerA

PrintSpoofer leverages SeImpersonatePrivilege to get SYSTEM.

Why this answer

PrintSpoofer exploits SeImpersonatePrivilege to escalate to SYSTEM.

Full explanation →

160

MCQmedium

A penetration tester is writing a Bash script to automate enumeration of a Linux system after gaining a shell. The script needs to extract user information from the /etc/passwd file. Which command would be most efficient for listing only the usernames?

A.cat /etc/passwd | cut -d: -f1

B.cat /etc/passwd | awk '{print $1}'

C.cat /etc/passwd | head

D.grep 'user' /etc/passwd

AnswerA

This correctly splits each line by colon and outputs the first field (username).

Why this answer

The `cut` command with `-d: -f1` splits each line of /etc/passwd on the colon delimiter and extracts the first field, which is the username. This is the most efficient and purpose-built approach for parsing colon-delimited files in Linux, avoiding unnecessary overhead from other tools.

Exam trap

The trap here is that candidates often assume `awk` with default field splitting works for colon-delimited files, but they forget to specify the `-F:` flag, leading to incorrect output that includes the entire line or unexpected fields.

How to eliminate wrong answers

Option B is wrong because `awk '{print $1}'` defaults to whitespace field splitting, but /etc/passwd uses colons as delimiters, so it would print the entire line (since the line has no spaces before the first colon) rather than just the username. Option C is wrong because `head` outputs the first 10 lines of the file by default, not just usernames, and does not parse or extract specific fields at all.

Full explanation →

161

MCQhard

A penetration tester is analyzing a Python script that performs a buffer overflow attack. The script imports the struct module and the socket module. It constructs a payload by packing a pattern of characters, then overwriting a return address with a specific offset. Which of the following is the most critical piece of information the tester must determine before running this script against the target?

A.The IP address and port of the target service

B.The exact location of a JMP ESP instruction in memory

C.The version of the operating system running on the target

D.The username and password for the target service

AnswerB

For a buffer overflow where the shellcode is placed in the stack, overwriting the return address with the address of a JMP ESP instruction (which must be at a fixed, predictable address) will redirect execution to the shellcode. Determining this address is crucial for a reliable exploit.

Why this answer

The script performs a buffer overflow attack by overwriting a return address. To redirect execution to attacker-controlled shellcode, the tester must overwrite the return address with the address of a JMP ESP instruction (or equivalent) that is reliably located in memory. Without this address, the overwritten return pointer will cause a crash or unpredictable behavior, making exploitation impossible.

Exam trap

The trap here is that candidates often focus on network connectivity (IP/port) or OS version, overlooking that the core technical challenge in a buffer overflow exploit is controlling execution flow via a reliable return address like JMP ESP.

How to eliminate wrong answers

Option A is wrong because while the IP address and port are necessary to connect to the target service, they are not the most critical piece of information for the exploitation phase; the script already imports socket and presumably has connection details. Option C is wrong because the OS version can help in selecting appropriate offsets or shellcode, but the immediate critical requirement is the address of a JMP ESP instruction, which depends on the specific executable or loaded DLL, not just the OS version.

Full explanation →

162

Multi-Selectmedium

A penetration tester is preparing to present findings to the client's technical team. Which TWO practices are most effective for this audience?

Select 2 answers

A.Focus on the return on investment for fixing vulnerabilities.

B.Use analogies to explain vulnerabilities in everyday terms.

C.Include proof-of-concept code and remediation commands.

D.Explain the technical details of each vulnerability, including exploit steps.

E.Provide high-level business impact summaries only.

AnswersC, D

This provides actionable information for the technical team.

Why this answer

Technical audiences benefit from detailed explanations and evidence, including proof-of-concept code and remediation steps.

Full explanation →

163

MCQeasy

A client is planning a penetration test of their AWS cloud environment. They will provide the tester with an IAM user account with limited permissions. Which of the following scoping restrictions is most important to include in the rules of engagement to avoid unexpected costs?

A.The tester must not create any new AWS resources that incur costs.

B.The tester must use only premium AWS services for testing.

C.The tester must request permission from AWS Support before each test.

D.The tester must avoid testing in the us-east-1 region due to higher costs.

AnswerA

The restriction that the tester must not create any new AWS resources that incur costs is a core cost-control measure in cloud penetration testing. Launching EC2 instances, RDS databases, or even ephemeral resources for vulnerability scanning can rack up charges rapidly, especially if left running. This constraint forces the tester to work within the client's existing environment, using serverless functions or pre-provisioned test instances, and to rely on AWS budget alerts and billing monitoring to avoid financial surprise.

Why this answer

Creating new AWS resources (e.g., EC2 instances, RDS databases, Lambda functions) can incur direct costs under the tester's IAM user account, even with limited permissions. The rules of engagement must explicitly prohibit resource creation to prevent unexpected billing, as AWS charges for resources provisioned regardless of the test's purpose. This scoping restriction aligns with the principle of cost containment in penetration testing engagements.

Exam trap

The trap here is that candidates may focus on technical restrictions like service tiers or support permissions, overlooking the direct financial risk of resource creation, which is the most critical scoping concern in cloud penetration testing.

How to eliminate wrong answers

Option B is wrong because requiring the use of only premium AWS services would increase costs unnecessarily and contradicts the goal of avoiding unexpected expenses; premium services are more expensive and not required for effective testing. Option C is wrong because requesting permission from AWS Support before each test is impractical and not a standard scoping restriction; AWS Support does not authorize individual penetration tests, and the tester should rely on the client's authorization and the AWS Acceptable Use Policy.

Full explanation →

164

MCQeasy

A penetration tester is preparing the final report. The client's CEO needs to understand the overall risk level and the business impact of the findings. Which of the following should be included in the executive summary?

A.A detailed list of all vulnerabilities with CVSS scores

B.The exact commands and payloads used during exploitation

C.A quantitative risk analysis including annualized loss expectancy

D.A high-level summary of the test's scope, overall risk rating, and business impact

AnswerD

The executive summary is precisely designed for a high-level overview of the test's scope, overall risk rating, and business impact, enabling non-technical leaders to grasp the risk posture without drowning in technical jargon. This approach helps management prioritize remediation investments and understand potential consequences, such as regulatory fines or reputational damage. By omitting CVSS scores, raw commands, and financial calculations, the summary stays concise, actionable, and aligned with the decision-making needs of executives.

Why this answer

The executive summary is designed for senior management, such as the CEO, who needs a concise overview of the penetration test's scope, overall risk rating, and business impact to make informed decisions. Detailed technical data, such as CVSS scores or exploitation commands, is inappropriate for this audience and belongs in the technical report. Option D directly addresses the requirement for a high-level, business-focused summary.

Exam trap

The trap here is that candidates often confuse the executive summary with the technical report, mistakenly thinking that including detailed CVSS scores or exploitation commands demonstrates thoroughness, when in fact the exam expects a clear separation of audience-specific content.

How to eliminate wrong answers

Option A is wrong because a detailed list of all vulnerabilities with CVSS scores is too granular for an executive summary; CVSS scores are technical metrics that require context and are better placed in the technical findings section. Option B is wrong because exact commands and payloads used during exploitation are operational details intended for the technical team, not for a CEO who needs business impact analysis. Option C is wrong because while quantitative risk analysis (e.g., ALE) can be useful, it is not always feasible or required in a penetration test report; the executive summary should focus on qualitative risk ratings and business impact, not specific financial calculations that may rely on assumptions not validated by the test.

Full explanation →

165

MCQhard

A penetration tester has compromised a Linux server and wants to move laterally to a Windows server. The Linux server has network access to the Windows server on port 445. The tester has a captured NTLM hash of a domain administrator account. Which technique is most likely to allow the tester to authenticate and execute commands on the Windows server?

A.Pass-the-hash using Impacket's psexec

B.Kerberos Golden Ticket attack

C.SMB relay attack using the hash

D.Brute-force password cracking of the hash

AnswerA

Pass-the-hash (PtH) with Impacket's psexec.py allows the tester to authenticate to remote Windows hosts by providing the NTLM hash instead of the plaintext password. Since the Linux server is compromised, the tester can extract hashes from memory or local files, then use psexec to execute commands over SMB via the ADMIN$ share. This is a direct lateral movement technique that does not require cracking, and it works against any Windows target that has NTLM authentication enabled.

Why this answer

The tester has a captured NTLM hash of a domain administrator account and network access to the Windows server on port 445 (SMB). Pass-the-hash (PtH) allows authentication using the NTLM hash directly without needing the plaintext password. Impacket's psexec uses the SMB protocol to authenticate with the hash and execute commands remotely, making it the most direct and effective technique for lateral movement in this scenario.

Exam trap

The trap here is that candidates may confuse pass-the-hash with SMB relay, but relay requires intercepting a live authentication attempt, whereas pass-the-hash directly uses the captured hash to authenticate without any relay.

How to eliminate wrong answers

Option B is wrong because a Kerberos Golden Ticket attack requires forging a Ticket Granting Ticket (TGT) using the KRBTGT account's hash, which is not captured here; the captured hash is for a domain administrator account, not the KRBTGT account, and the attack also requires domain controller access, not just SMB to a Windows server. Option C is wrong because an SMB relay attack requires the tester to intercept and relay authentication attempts from a client to a server, but the tester already possesses the hash and does not need to relay it; relay attacks are used when the hash cannot be directly used (e.g., with NTLMv2 and no local admin rights), but here the hash is directly usable for pass-the-hash.

Full explanation →

166

MCQmedium

A penetration testing firm is contracted to test a cloud-based infrastructure. The client uses a shared responsibility model. Which of the following should be clarified in the rules of engagement to avoid legal issues?

A.Who is responsible for patching the operating system

B.Whether the tester needs authorization from the cloud provider

C.The encryption method for data at rest

D.The backup strategy for logs

AnswerB

Cloud providers like AWS, Azure, and GCP often require explicit written authorization before penetration testing, and testing without it can violate the provider's acceptable use policy or the Computer Fraud and Abuse Act (CFAA). Obtaining provider approval is a legal prerequisite that also ensures the tester's activities are recognized as authorized, protecting against claims of unauthorized access. This authorization is independent of the customer's consent and must be secured before testing the cloud infrastructure.

Why this answer

In a shared responsibility model, the cloud provider is responsible for the security of the cloud, while the customer is responsible for security in the cloud. However, penetration testing activities may violate the cloud provider's terms of service or acceptable use policy, potentially triggering legal action. Therefore, obtaining explicit authorization from the cloud provider is critical to ensure the tester's actions are legally permitted and to avoid liability for unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA).

Exam trap

CompTIA often tests the misconception that operational security tasks like patching or encryption are the primary legal concerns in a shared responsibility model, when in fact the critical legal issue is obtaining explicit authorization from the cloud provider to avoid violating their terms of service or anti-hacking laws.

How to eliminate wrong answers

Option A is wrong because patching the operating system is a shared responsibility that varies by service model (e.g., IaaS vs. PaaS), but it is an operational security task, not a legal authorization issue that must be clarified in the rules of engagement to avoid legal issues. Option C is wrong because encryption methods for data at rest are a security control configuration, not a legal authorization requirement; while important for data protection, they do not address the legal risk of unauthorized testing against the cloud provider's infrastructure.

Full explanation →

167

MCQmedium

A client with a hybrid on-premises and cloud infrastructure requests a penetration test. The client uses an IaaS provider for some servers. Which of the following is the MOST important aspect to clarify in the rules of engagement regarding the cloud environment?

A.The list of operating systems used in the cloud

B.The authorization from the cloud provider for testing

C.The public IP addresses of the cloud servers

D.The budget allocated for cloud testing

AnswerB

Correct. Under shared responsibility, the customer must ensure they have permission from the cloud provider to test certain components; the ROE should specify that this authorization has been obtained.

Why this answer

The most critical aspect to clarify in the rules of engagement for a cloud environment is obtaining explicit authorization from the IaaS provider. Without this authorization, the penetration test may violate the provider's acceptable use policy or terms of service, potentially leading to legal action or service termination. This is a foundational scoping requirement because the client does not own the underlying infrastructure; the cloud provider retains control over the network and hypervisor layers.

Exam trap

The trap here is that candidates focus on technical scoping details like IP addresses or OS lists, overlooking the critical legal and contractual prerequisite of obtaining the cloud provider's explicit authorization, which is a unique requirement for cloud environments compared to on-premises testing.

How to eliminate wrong answers

Option A is wrong because the list of operating systems used in the cloud is a technical detail that can be discovered during reconnaissance or provided in the scope, but it is not the most important legal or contractual aspect to clarify in the rules of engagement. Option C is wrong because while public IP addresses are necessary for targeting, they are operational details that can be scoped later; the primary concern is obtaining the cloud provider's written permission to test, as testing without it could be considered unauthorized access under laws like the Computer Fraud and Abuse Act (CFAA).

Full explanation →

168

MCQeasy

During a penetration test, a tester discovers a web application that reflects user input in the HTTP response without proper escaping or encoding. The input is not sanitized and is included in the page's HTML. Which type of vulnerability is most likely present?

A.SQL injection

B.Cross-Site Scripting (XSS)

C.Stored XSS

D.Cross-Site Request Forgery (CSRF)

AnswerB

Reflected Cross-Site Scripting (XSS) occurs when a web application echoes user-supplied input directly into the HTTP response without proper sanitization or encoding. In this scenario, the tester observed the application reflecting input in the response, which is the primary indicator of a reflected XSS flaw because an attacker can craft a URL containing a malicious script payload that gets rendered in the victim's browser. This enables session hijacking, keylogging, or other client-side attacks, and it specifically aligns with the description of input reflection rather than persistence or server-side logic manipulation.

Why this answer

The vulnerability is reflected Cross-Site Scripting (XSS) because the web application immediately echoes user-supplied input in the HTTP response without proper escaping or encoding, allowing an attacker to inject arbitrary HTML or JavaScript that executes in the victim's browser. This matches the classic definition of reflected XSS, where the payload is part of the request and reflected back, not stored on the server.

Exam trap

The trap here is that candidates confuse reflected XSS with stored XSS because both involve injecting script into a web page, but the key differentiator is whether the payload is persisted on the server (stored) or immediately reflected in the response (reflected).

How to eliminate wrong answers

Option A is wrong because SQL injection requires user input to be incorporated into a database query without proper sanitization, not simply reflected in the HTTP response; the description lacks any mention of database interaction or query construction. Option C is wrong because stored XSS requires the malicious input to be persisted on the server (e.g., in a database or file) and later served to other users, whereas the scenario describes input being reflected immediately in the response without storage.

Full explanation →

169

MCQmedium

A penetration tester is writing the technical report for a client. The client's security team needs detailed, step-by-step instructions on how to reproduce each vulnerability found. In which section of the report should this information be placed?

A.Executive summary

B.Risk rating section

C.Findings and recommendations

D.Appendix

AnswerC

The findings and recommendations section is the core technical narrative of a penetration test report, where each vulnerability is fully detailed. It provides a structured breakdown including the affected asset, CVSS score, description, root cause, step-by-step reproduction instructions, evidence, and prioritized remediation guidance. This is the standard location for reproduction steps because it gives the client's technical staff the precise, contextual information they need to validate and fix the issue, while also linking each step to the associated risk and recommended action.

Why this answer

The 'Findings and recommendations' section is the correct location for detailed, step-by-step reproduction instructions because it provides the technical depth needed for the client's security team to validate and remediate each vulnerability. This section typically includes exact commands, payloads, and sequences used during testing, aligning with the PT0-002 objective of delivering actionable technical details.

Exam trap

The trap here is that candidates confuse the 'Executive summary' (which summarizes findings for management) with the 'Findings and recommendations' section, mistakenly thinking step-by-step instructions belong in the high-level overview due to a misunderstanding of report audience segmentation.

How to eliminate wrong answers

Option A is wrong because the executive summary is a high-level overview for non-technical stakeholders, focusing on business impact and risk posture, not step-by-step technical reproduction steps. Option B is wrong because the risk rating section assigns severity scores (e.g., CVSS v3.1 base scores) and prioritizes findings, but does not contain the granular procedural instructions needed to replicate vulnerabilities.

Full explanation →

170

MCQmedium

A penetration tester is analyzing a Python script that uses the 'requests' library to send HTTP requests with a custom header that mimics a mobile device. The script also uses 'beautifulsoup4' to parse the response and extract specific data. Which task is this script most likely performing?

A.Web scraping to gather publicly available information.

B.Fuzzing for SQL injection.

C.Performing a brute-force attack on a login form.

D.Testing for directory traversal vulnerabilities.

AnswerA

This combination of requests and BeautifulSoup is the canonical web-scraping stack: requests fetches the raw HTML over HTTP, and BeautifulSoup parses it into a navigable tree to extract elements like links, meta tags, or table rows. The mobile User-Agent mimics a smartphone browser, which helps bypass simple bot-detection rules and retrieve the exact responsive markup a normal visitor would see. Gathering publicly available information this way is a low-risk, passive OSINT technique, and the script's design shows no active attack payloads, making web scraping the only fitting purpose.

Why this answer

The script uses the 'requests' library to send HTTP requests with a custom header mimicking a mobile device, and 'beautifulsoup4' to parse the HTML response and extract data. This combination is specifically designed for web scraping, where the custom header helps avoid bot detection by making the request appear to come from a mobile browser, and BeautifulSoup extracts targeted information from the page structure.

Exam trap

The trap here is that candidates may confuse the use of a custom header with security testing (e.g., fuzzing or brute-forcing), but the presence of BeautifulSoup for HTML parsing clearly indicates data extraction, not injection or authentication bypass.

How to eliminate wrong answers

Option B is wrong because fuzzing for SQL injection typically involves sending malformed input (e.g., special characters, SQL keywords) in parameters or form fields, not setting a custom User-Agent header or parsing HTML with BeautifulSoup; tools like Burp Suite Intruder or custom loops with 'requests' are used, but the focus is on injecting payloads, not extracting data from responses. Option C is wrong because a brute-force attack on a login form requires iterating through username/password combinations and analyzing response status codes or error messages, not simply setting a mobile User-Agent and parsing HTML for data extraction; BeautifulSoup is unnecessary for brute-force logic, which typically checks for login success indicators like redirects or specific text.

Full explanation →

171

MCQmedium

A penetration tester is analyzing a Python script that uses the 'scapy' library to craft custom network packets. The relevant code is: ```python from scapy.all import * packet = IP(dst="192.168.1.1")/TCP(dport=80, flags="S") response = sr1(packet, timeout=2) if response.haslayer(TCP): print(response.getlayer(TCP).flags) ``` What is the primary goal of this script?

A.To perform a TCP connect scan by completing the three-way handshake

B.To perform a SYN scan and determine if port 80 is open

C.To send an HTTP GET request and capture the web page

D.To perform a UDP scan on port 80

AnswerB

This script correctly implements a SYN scan: it crafts a TCP packet with the SYN flag set, sends it to port 80, and then reads the response flags to infer the port's state. If the target replies with a SYN-ACK, the port is open, because the target is willing to begin a handshake; if it replies with an RST, the port is closed or filtered. The script does not send the final ACK, so it never completes the handshake—confirming that it is a half-open SYN scan designed solely to detect open ports such as TCP 80.

Why this answer

The script uses Scapy to craft a TCP SYN packet (flags='S') to port 80 and sends it with sr1(), which waits for a single response. If a TCP layer is present in the reply, it prints the flags. This is the classic behavior of a SYN scan (half-open scan): it sends a SYN and analyzes the response to determine if the port is open (SYN-ACK) or closed (RST), without completing the handshake.

Option B correctly identifies this as a SYN scan to check if port 80 is open.

Exam trap

The trap here is that candidates may confuse a SYN scan with a full connect scan (Option A) because both involve sending a SYN, but the key difference is that a SYN scan never sends the final ACK, making it stealthier and not a full handshake.

How to eliminate wrong answers

Option A is wrong because a TCP connect scan completes the full three-way handshake (SYN, SYN-ACK, ACK), whereas this script only sends a SYN and does not send the final ACK, making it a half-open SYN scan. Option C is wrong because the script sends a raw TCP SYN packet, not an HTTP GET request; it does not include any HTTP payload or application-layer data, so it cannot retrieve a web page.

Full explanation →

172

MCQmedium

A penetration tester is analyzing a PowerShell script that uses Invoke-WebRequest and Invoke-RestMethod to interact with a target web service. The script parses JSON responses to extract session tokens and then uses those tokens in subsequent requests. Which attack technique is this script most likely performing?

A.Brute-forcing web application login credentials.

B.Exploiting an API by manipulating request parameters and observing responses.

C.Performing a SQL injection attack on a web form.

D.Conducting a directory traversal attack to read arbitrary files.

AnswerB

Exploiting an API by manipulating request parameters and observing responses is the correct interpretation. The script dynamically extracts session tokens from prior responses, then reuses them to make authenticated requests while altering parameters such as resource IDs, role fields, or JSON payloads. By analyzing status codes, response bodies, and error messages, the tester can identify authorization flaws (e.g., IDOR), mass assignment, or business logic issues—without needing to bypass authentication itself.

Why this answer

The script uses Invoke-WebRequest and Invoke-RestMethod to interact with a web service, parsing JSON responses to extract session tokens and reusing them in subsequent requests. This pattern is characteristic of API manipulation, where an attacker modifies request parameters (e.g., headers, query strings, or payload) and observes how the API responds to infer vulnerabilities or escalate privileges, rather than directly attacking authentication or injecting SQL.

Exam trap

The trap here is that candidates confuse the use of Invoke-WebRequest and Invoke-RestMethod with brute-force attacks, but the script's focus on token extraction and reuse points to API parameter manipulation, not credential guessing.

How to eliminate wrong answers

Option A is wrong because brute-forcing login credentials would involve repeatedly submitting different username/password pairs, not parsing JSON session tokens from responses and using them in subsequent requests; the script's focus on token extraction indicates session management exploitation, not credential guessing. Option C is wrong because SQL injection requires injecting SQL syntax into input fields to manipulate database queries, whereas the script uses Invoke-WebRequest and Invoke-RestMethod to handle structured JSON data and tokens, with no mention of SQL payloads or database error responses.

Full explanation →

173

MCQmedium

A penetration tester is performing active reconnaissance on a target network. The tester wants to identify all live hosts in the 192.168.1.0/24 subnet and determine which ones have port 80 open. Which technique is most efficient for this task?

A.Perform a full TCP connect scan on all 65535 ports for each IP address.

B.Use a ping sweep to identify live hosts, then run a SYN scan on port 80 for those hosts.

C.Run a SYN scan on port 80 for every IP in the subnet without ping probing.

D.Use ARP requests to map the subnet and then check for port 80 on each host.

AnswerB

A ping sweep quickly identifies which IPs in the subnet are responsive, allowing the tester to focus scanning effort on live targets only. A SYN scan sends a single SYN packet and evaluates the response without completing the handshake, making it faster and less likely to be logged than a full connect scan. Running the SYN scan on only port 80 for the discovered live hosts is efficient and directly addresses the objective of finding web servers, minimizing traffic and detection risk.

Why this answer

It combines two efficient steps: first, a ping sweep (ICMP Echo Request or ARP scan) identifies live hosts in the 192.168.1.0/24 subnet, reducing the number of targets; second, a SYN scan on port 80 for only those live hosts is faster and less intrusive than scanning all ports or all IPs without prior host discovery. This approach minimizes network traffic and scan time while accurately identifying hosts with HTTP services.

Exam trap

The trap here is that candidates often choose option C, thinking that skipping ping probing saves time, but they overlook the inefficiency of scanning all 256 IPs (including many dead hosts) versus first identifying live hosts to reduce the scan scope.

How to eliminate wrong answers

Option A is wrong because performing a full TCP connect scan on all 65535 ports for each IP in a /24 subnet is highly inefficient, generating massive traffic and taking excessive time, and it does not focus on the specific goal of identifying hosts with port 80 open. Option C is wrong because running a SYN scan on port 80 for every IP in the subnet without ping probing wastes time and resources scanning inactive or non-existent hosts, and it may also trigger intrusion detection systems more aggressively due to scanning dead IPs.

Full explanation →

174

MCQhard

A penetration tester is tasked with performing vulnerability scanning on a target organization that uses a web application firewall (WAF) and an intrusion prevention system (IPS). The tester wants to avoid being blocked while still gathering comprehensive data. Which scanning approach is most effective?

A.Use a slow, distributed scan from multiple IP addresses with random delays

B.Perform an aggressive scan with a high thread count to complete before the WAF adapts

C.Only perform passive reconnaissance and avoid active scanning

D.Use known WAF bypass techniques for each request

AnswerA

A slow, distributed scan from multiple IP addresses with random delays evades rate-based and behavioral detection by mimicking organic traffic patterns. Modern IPS/WAF platforms correlate request frequency, source entropy, and timing signatures; spreading the load across a botnet-like source pool with jittered intervals keeps the aggregate request rate under the alert threshold while still enumerating services. This approach is the standard for stealthy active scanning in high-security environments, as it trades speed for reliability and avoids the self-defeating burst that triggers countermeasures.

Why this answer

A slow, distributed scan from multiple IP addresses with random delays is most effective because it evades rate-based detection mechanisms in WAFs and IPSs. By spreading the scan across many sources and introducing jitter, the traffic appears as normal user activity rather than a coordinated attack, allowing comprehensive data collection without triggering blocks.

Exam trap

The trap here is that candidates assume a fast, aggressive scan will 'beat' the WAF/IPS before it adapts, but in reality these systems use real-time rate limiting and signature detection that will block the source IP almost immediately, making the slow distributed approach the only viable option.

How to eliminate wrong answers

Option B is wrong because an aggressive scan with a high thread count will rapidly generate a high volume of requests, which WAFs and IPSs are specifically designed to detect and block as a denial-of-service or scanning pattern, likely resulting in the tester being blocked before completion. Option C is wrong because passive reconnaissance alone cannot gather comprehensive vulnerability data such as open ports, service versions, or missing patches, which require active probing to identify.

Full explanation →

175

MCQmedium

A penetration tester is writing the findings section of a report. The tester discovered a cross-site scripting vulnerability that allows session hijacking. The technical team wants to understand exactly how to reproduce it, while the business owner wants to know the risk it poses to customer data. Which approach best addresses both audiences?

A.Include a single detailed description with both technical and business impact

B.Write two separate sections: one for technical details and one for risk analysis

C.Place technical details in an appendix and include only risk ratings in the main body

D.Provide a video demonstration separately from the written report

AnswerB

Separation allows the technical team to quickly find reproduction steps and the business owner to focus on risk and impact.

Why this answer

It separates the technical reproduction steps (for the technical team) from the business impact analysis (for the business owner), ensuring each audience receives the information in the format they need. This aligns with the PT0-002 objective of tailoring communication to different stakeholders, avoiding confusion or information overload. A single combined description (Option A) would likely be too technical for the business owner or too vague for the technical team.

Exam trap

The trap here is that candidates may choose Option A, thinking a single comprehensive section is efficient, but the PT0-002 exam emphasizes that different stakeholders require different levels of detail—technical teams need exact reproduction steps, while business owners need risk context—so separating them is the correct approach.

How to eliminate wrong answers

Option A is wrong because a single detailed description mixing technical steps and business impact risks confusing both audiences—the technical team may find the risk language irrelevant, while the business owner may be overwhelmed by technical jargon like 'XSS payload injection via unescaped user input in the HTTP GET parameter.' Option C is wrong because placing technical details in an appendix and only risk ratings in the main body fails to provide the technical team with the step-by-step reproduction steps they need, and the business owner may not understand the context of the risk ratings without supporting explanation. Option D is wrong because a video demonstration alone does not replace a written report; it lacks the structured, searchable documentation required for compliance and audit trails, and it may not be accessible to all stakeholders (e.g., those with visual impairments or network restrictions).

Full explanation →

176

MCQhard

A penetration testing firm is contracted to perform an external test of a company's web applications. During the scoping meeting, the client mentions that they use a CDN and WAF provided by a third party. The client wants the test to accurately reflect the security of their backend servers behind these protections. What should the tester recommend?

A.Test the CDN and WAF as part of the scope

B.Obtain the backend server IPs from the client and test them directly

C.Include a plan to bypass the WAF in the rules of engagement

D.Only test the public-facing URLs as they are

AnswerB

Obtaining the backend server IPs from the client allows the tester to directly assess the origin servers the client wants evaluated. This approach stays within the authorized scope because the client has explicit ownership and control over these systems, and bypassing the CDN/WAF is done with the client's knowledge and permission. It also avoids third-party infrastructure entirely, preventing legal and technical issues while providing accurate backend security results.

Why this answer

The client wants the test to accurately reflect the security of their backend servers behind the CDN and WAF. By obtaining the backend server IPs directly, the tester can bypass the third-party protections and assess the actual security posture of the origin servers, which is the true target of the external test. This approach ensures that vulnerabilities not mitigated by the CDN/WAF are identified, aligning with the client's goal of evaluating backend security.

Exam trap

The trap here is that candidates may assume bypassing the WAF is the correct approach (Option C), but the ethical and practical method is to test the backend servers directly with client permission, not to actively circumvent security controls during the test.

How to eliminate wrong answers

Option A is wrong because testing the CDN and WAF as part of the scope would evaluate the third-party provider's security, not the client's backend servers, and may violate the terms of service or contractual agreements with the provider. Option C is wrong because including a plan to bypass the WAF in the rules of engagement is risky, potentially illegal, and could disrupt the WAF's operation or trigger false positives; the proper approach is to test the backend IPs directly with client authorization. Option D is wrong because only testing public-facing URLs would leave the backend servers untested, as the CDN and WAF may mask vulnerabilities or block malicious traffic, failing to meet the client's requirement to assess backend security.

Full explanation →

177

MCQmedium

A client wants to test a web application that uses multiple third-party APIs for payment processing, shipping, and customer relationship management. The client states that the APIs are critical for operations but cannot be taken offline. Which scoping consideration is most important to include in the rules of engagement?

A.The tester must use only non-intrusive scanning techniques on the APIs.

B.The tester must exclude all API endpoints from testing.

C.The tester must coordinate testing schedules with the API vendors.

D.The tester must provide a list of all API calls to be made prior to testing.

AnswerA

Non-intrusive scanning techniques—such as passive traffic analysis, carefully rate-limited read-only GET requests, and benign parameter fuzzing that avoids destructive payloads—are essential when testing third-party APIs because aggressive testing could trigger rate limiting, WAF blocks, or even degrade the shared API infrastructure that other applications depend on. This approach preserves the availability of the target application and its dependencies while still allowing the tester to identify misconfigurations, broken authentication, or improper error handling. Non-intrusive methods also reduce the chance of committing to an expensive or legally problematic action, especially when the API provider is not directly part of the tested scope.

Why this answer

The client explicitly stated that the APIs are critical for operations and cannot be taken offline. Non-intrusive scanning techniques, such as passive traffic analysis or read-only API calls with safe HTTP methods (GET, HEAD), minimize the risk of service disruption, data corruption, or rate-limit triggering. This aligns with the scoping requirement to maintain availability while still allowing security testing of the API layer.

Exam trap

The trap here is that candidates may assume 'non-intrusive' means only using automated scanners or that coordinating with vendors (Option C) is necessary for third-party APIs, but the core scoping principle is to avoid impacting production availability while still testing the API attack surface.

How to eliminate wrong answers

Option B is wrong because excluding all API endpoints would leave the most critical attack surface (third-party integrations for payment, shipping, and CRM) completely untested, violating the client's goal of a comprehensive security assessment. Option C is wrong because coordinating schedules with API vendors is impractical and unnecessary; the tester only needs to coordinate with the client, and the APIs are consumed by the web app, not owned by the tester. Option D is wrong because providing a list of all API calls prior to testing is overly restrictive and unrealistic for dynamic testing; it would prevent the tester from discovering undocumented endpoints or chaining calls in ways an attacker would, and it violates the principle of simulating real-world adversarial behavior.

Full explanation →

178

MCQmedium

A penetration tester is preparing a report for a client that includes both a technical security team and an executive leadership team. The executive team needs to understand the overall risk posture, while the technical team requires detailed reproduction steps. Which reporting structure best serves both audiences?

A.A single report with an executive summary and technical appendices

B.Two completely separate reports: one for executives and one for technical staff

C.Only an executive summary, omitting technical details

D.Only a technical report with all details

AnswerA

A single report with an executive summary and technical appendices is the industry-standard structure because it creates a single source of truth while serving both audiences. The executive summary translates technical vulnerabilities into business risk terms, enabling leadership to prioritize remediation, while the technical appendices contain the raw findings, request/response data, reproduction steps, and CVSS scores that security engineers need to validate and fix issues. This format eliminates the risk of version mismatch between separate documents and ensures regulatory or compliance reviewers can trace a high-level risk statement directly to its concrete technical evidence.

Why this answer

A single report with an executive summary and technical appendices is the correct structure because it satisfies both audiences: the executive summary provides a high-level risk posture overview (e.g., CVSS scores, business impact), while the technical appendices contain detailed reproduction steps (e.g., exact commands, payloads, and packet captures) for the technical team. This approach aligns with the PT0-002 objective of tailoring communication to stakeholders without losing technical rigor.

Exam trap

The trap here is that candidates think separate reports are more 'professional' or 'targeted,' but the PT0-002 exam expects a single cohesive report with layered detail to ensure consistency and traceability between the executive summary and technical findings.

How to eliminate wrong answers

Option B is wrong because two completely separate reports can lead to misalignment between the executive summary and technical details, causing executives to miss critical context or technical staff to lack business impact understanding. Option C is wrong because omitting technical details prevents the technical team from validating or reproducing findings, violating the reporting requirement for actionable remediation steps. Option D is wrong because a purely technical report overwhelms executives with jargon and lacks the risk posture summary they need for decision-making, failing the communication objective.

Full explanation →

179

MCQhard

A penetration tester has obtained a TGT from a domain controller by cracking the krbtgt hash. Which attack can the tester now perform to gain persistent administrative access to any resource in the domain?

A.Pass-the-Hash

B.Silver Ticket

C.Golden Ticket

D.DCSync

AnswerC

The Golden Ticket attack is the correct answer because it uses the krbtgt hash to forge a TGT, granting the attacker the ability to impersonate any user, including domain admins, for any service in the domain. With a forged TGT signed by the krbtgt account, the attacker can request access to any resource without requiring credentials for each target service. This attack provides the strongest persistence and domain-wide compromise, which aligns with the scenario of having obtained a TGT from a domain controller.

Why this answer

A Golden Ticket attack is the correct answer because the tester has cracked the krbtgt hash, which is the key used by the Key Distribution Center (KDC) to sign all Ticket Granting Tickets (TGTs). With this hash, the tester can forge a TGT for any user (including a domain admin) with an arbitrary long validity period, granting persistent administrative access to any resource in the domain without needing to interact with the domain controller again.

Exam trap

The trap here is that candidates confuse the scope of a Silver Ticket (limited to a single service) with a Golden Ticket (full domain compromise), often picking Silver Ticket because they think 'service ticket' sounds broader, but the krbtgt hash specifically enables TGT forgery, not service ticket forgery.

How to eliminate wrong answers

Option A is wrong because Pass-the-Hash (PtH) uses an NTLM hash of a user's password to authenticate, not the krbtgt hash, and it does not provide persistent access to all resources—it only allows impersonation of that specific user until the hash changes. Option B is wrong because a Silver Ticket forges a service ticket (TGS) using the hash of a service account (e.g., for a specific service like HTTP or CIFS), not the krbtgt hash, and it only grants access to that specific service, not to any resource in the domain.

Full explanation →

180

MCQmedium

A penetration tester has identified a critical misconfiguration in a cloud storage bucket that exposes sensitive customer data. The client's technical team has already applied a fix, but the tester wants to ensure the report accurately reflects the risk and the remediation. Which section of the report should include the steps to reproduce the vulnerability?

A.Executive summary

B.Findings and risk rating

C.Technical details and proof of concept

D.Remediation recommendations

AnswerC

This is the correct section, as it contains the exact commands, screenshots, and steps needed to reproduce the vulnerability for technical staff.

Why this answer

The technical details and proof of concept (POC) section is the correct place to include step-by-step reproduction steps because it provides the client's technical team with the exact commands, API calls, or configuration checks needed to verify the vulnerability and the fix. This section is distinct from the executive summary (which targets non-technical stakeholders) and the findings and risk rating (which focuses on impact and severity). By including reproduction steps here, the tester ensures the remediation can be validated without ambiguity.

Exam trap

The trap here is that candidates confuse the 'findings and risk rating' section with the 'technical details' section, assuming reproduction steps belong with the risk description, when in fact the PT0-002 exam expects a clear separation: risk rating is for impact, technical details is for replication.

How to eliminate wrong answers

Option A is wrong because the executive summary is intended for management and non-technical stakeholders, providing a high-level overview of risks and business impact, not detailed reproduction steps. Option B is wrong because the findings and risk rating section describes the vulnerability's nature, impact, and CVSS score, but does not include the procedural steps to replicate the issue; those steps belong in the technical details section.

Full explanation →

181

MCQmedium

A penetration tester is performing passive reconnaissance on a target organization. The tester wants to gather information about the target's technology stack, including web server software and frameworks, without directly interacting with the target systems. Which technique is most effective?

A.Running Nmap with the -A flag against the target's public IP range

B.Using theHarvester to search for email addresses and subdomains

C.Querying public records with BuiltWith

D.Performing a DNS zone transfer

AnswerC

BuiltWith is a technology-profile lookup service that aggregates data from its own web crawlers, DNS records, and other public repositories. By querying BuiltWith's API or website, the tester retrieves detailed information about a target's web server, JavaScript frameworks, content management system, analytics tools, and other technology components without sending any packets to the target's infrastructure. This makes it a passive reconnaissance technique because the target never sees direct traffic from the tester, even though a third party (BuiltWith) may have actively scanned the site previously.

Why this answer

BuiltWith is a passive reconnaissance tool that queries public web data and DNS records to identify a target's technology stack, such as web server software (e.g., Apache, Nginx) and frameworks (e.g., React, Django), without sending any packets to the target's systems. This makes it ideal for passive information gathering, as it relies on third-party databases and cached information rather than direct interaction.

Exam trap

The trap here is that candidates often confuse passive reconnaissance with low-interaction active tools like Nmap's -A flag, failing to recognize that any direct network probing constitutes active reconnaissance, even if it's just a single scan.

How to eliminate wrong answers

Option A is wrong because running Nmap with the -A flag performs active reconnaissance by sending probes directly to the target's IP range, which can be detected by intrusion detection systems and violates the passive requirement. Option B is wrong because theHarvester focuses on gathering email addresses and subdomains from search engines and public sources, not on identifying the technology stack like web server software or frameworks.

Full explanation →

182

MCQmedium

A penetration tester is analyzing the results of a vulnerability scan against a web application. The scanner reports a potential SQL injection vulnerability in a login form parameter. However, manual testing with the same payload does not produce any error messages or changes in behavior. Which of the following is the most likely reason for the false positive?

A.The scanner used a payload that was not URL-encoded

B.The web application is using a parameterized query that sanitizes input

C.The scanning engine is outdated and does not support the latest SQL syntax

D.The login form is protected by a CAPTCHA that blocks automated scanning

AnswerB

Parameterized queries (also known as prepared statements) separate the SQL query structure from the user-supplied data by pre-compiling the SQL statement and then binding parameters as values, never as executable code. When the scanner sends an injection payload such as ' OR 1=1 --, the database treats the entire string as a literal value, not as SQL logic, so the query executes safely and returns no error or behavioral difference. The scanner may still flag the entry point because it detects the presence of the payload in the request or a generic reflection, but the application's response remains benign, producing a false positive. This is precisely the most common reason why automated vulnerability scanners report SQL injection on modern, well-coded applications.

Why this answer

The use of parameterized queries (prepared statements) separates SQL logic from user input, preventing SQL injection even if the input contains malicious payloads. The scanner's payload triggered a false positive because the application's database layer safely handles the input, so no error or behavioral change occurs during manual testing.

Exam trap

The trap here is that candidates often assume a vulnerability scanner's report is always accurate and overlook the possibility of false positives due to input handling mechanisms like parameterized queries, instead focusing on payload encoding or scanner version issues.

How to eliminate wrong answers

Option A is wrong because URL-encoding is a standard practice for transmitting special characters in HTTP requests; if the scanner's payload were not URL-encoded, the web server would likely reject or truncate the request, not produce a false positive. Option C is wrong because an outdated scanning engine might miss new SQL syntax or produce false negatives, but it would not cause a false positive; the scanner reported a vulnerability that manual testing disproves, which is a false positive, not a false negative.

Full explanation →

183

MCQmedium

During a Windows privilege escalation attempt, the tester finds that the current user has the SeImpersonatePrivilege enabled. Which tool is commonly used to exploit this privilege to gain SYSTEM?

A.PrintSpoofer

B.SharpUp

C.Mimikatz

D.PowerUp

AnswerA

PrintSpoofer leverages SeImpersonatePrivilege to escalate to SYSTEM.

Why this answer

PrintSpoofer exploits SeImpersonatePrivilege to impersonate SYSTEM and spawn a shell.

Full explanation →

184

MCQeasy

A penetration tester wants to identify live hosts on a large internal network. Which Nmap option would be the FASTEST for initial host discovery?

A.-sV (Version detection)

B.-sS (SYN stealth scan)

C.-sn (Ping sweep)

D.-A (Aggressive scan)

AnswerC

-sn (Ping sweep) is the correct option because it performs host discovery only, sending minimal probes such as ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests (depending on Nmap version and privileges) to determine which hosts respond without scanning any open ports. This makes it the fastest and most efficient method for identifying live hosts across a large subnet, as it does not wait for service banners or full port scans. The -sn flag is designed exactly for this purpose, replacing the old -sP behavior in Nmap.

Why this answer

The -sn option performs a ping sweep, sending ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests by default. It does not perform port scanning, making it the fastest method for initial host discovery on a large internal network because it only checks for host availability without enumerating services.

Exam trap

The trap here is that candidates often confuse host discovery with port scanning, assuming that a SYN scan (-sS) is the fastest because it is stealthy, but they overlook that -sn is designed specifically for host discovery and avoids the overhead of port scanning entirely.

How to eliminate wrong answers

Option A is wrong because -sV performs version detection, which requires an open port to be found first and then sends additional probes to determine service versions, making it significantly slower and not suitable for initial host discovery. Option B is wrong because -sS performs a SYN stealth scan, which scans for open ports on each host, requiring multiple packet exchanges per port and per host, which is much slower than a simple ping sweep for just identifying live hosts.

Full explanation →

185

MCQhard

A penetration testing firm is engaged to assess a cloud infrastructure hosted in multiple AWS regions. The client specifies that only systems in US-based regions should be tested due to data sovereignty concerns. Which of the following is the MOST critical documentation to include in the rules of engagement (ROE) to ensure compliance?

A.Statement of Work (SOW)

B.List of allowed AWS regions and associated VPC CIDR ranges

C.Data Processing Agreement (DPA)

D.Penetration testing methodology document

AnswerB

This explicitly defines the geographic scope, preventing tests in non-US regions and ensuring compliance with data sovereignty laws.

Why this answer

The rules of engagement (ROE) must explicitly define the authorized scope to prevent testing outside US-based regions, which could violate data sovereignty laws. Listing allowed AWS regions and their associated VPC CIDR ranges provides a precise technical boundary for the penetration test, ensuring that only in-scope systems are targeted. Without this, the testing team might inadvertently access resources in non-US regions, leading to legal and compliance breaches.

Exam trap

The trap here is that candidates often confuse the SOW (which defines high-level scope) with the ROE (which requires specific technical boundaries like region and CIDR lists), leading them to select Option A instead of the more precise Option B.

How to eliminate wrong answers

Option A is wrong because a Statement of Work (SOW) describes the overall project objectives, deliverables, and timelines, but it does not provide the granular technical scope (e.g., specific AWS regions and IP ranges) required to enforce data sovereignty restrictions during testing. Option C is wrong because a Data Processing Agreement (DPA) governs how personal data is processed and protected between parties, but it does not define the operational boundaries (e.g., which AWS regions or VPCs are permitted) for a penetration test; it is a legal document, not a scoping control.

Full explanation →

CompTIA PenTest+ (PT0-003) (PT0-003) — Questions 151–185