hardMultiple ChoiceObjective-mapped
PT0-002 Practice Question: During a red team engagement, a penetration…
During a red team engagement, a penetration tester needs to pivot from a compromised internal web server to a database server that is not directly accessible. The web server has two network interfaces: 10.0.1.5 and 192.168.1.5. The database server is at 192.168.1.10. Which technique should the tester use to reach the database?
⚠ Common exam trap
Many candidates confuse pivoting with other network manipulation techniques like ARP spoofing or port knocking, failing to recognize that the dual-homed web server provides a routing path between subnets, which is the core requirement for pivoting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pivoting through the web server
D is correct because the web server has two network interfaces (10.0.1.5 and 192.168.1.5), making it a dual-homed host that can act as a pivot point. The tester can use the compromised web server as a proxy or relay to route traffic from the attacker's machine (reachable via 10.0.1.5) to the database server at 192.168.1.10, which is on a separate subnet not directly accessible. This technique, known as pivoting, typically involves tools like SSH port forwarding, Metasploit's route add, or a SOCKS proxy to forward traffic through the compromised host.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ARP spoofing
Why it's wrong here
ARP spoofing is a Layer 2 attack that only succeeds within the same broadcast domain. Since the tester is not on the database subnet, ARP requests and responses cannot cross the router, so the database's ARP cache cannot be poisoned. Additionally, ARP spoofing enables traffic interception, not the actual network path needed to reach a remote subnet.
- ✗
DNS tunneling
Why it's wrong here
DNS tunneling encodes arbitrary data in DNS queries and responses, which is primarily used for covert data exfiltration or establishing a slow, low-bandwidth command-and-control channel. It does not provide a direct, reliable TCP connection to a database server, and attempting to use it for full database interaction would be too slow and noisy. The tester's goal is to directly reach the database service, which pivoting achieves far more efficiently.
- ✗
Port knocking
Why it's wrong here
Port knocking is an authentication technique that opens a firewall port when a specific sequence of connection attempts is received. It only alters firewall rules on a host, it does not create a network path or route traffic to an entirely different subnet. Even if port knocking were used, the tester would still lack a forwarding mechanism to reach the database from the external position, so it is not a substitute for pivoting.
- ✓
Pivoting through the web server
Why this is correct
Pivoting through the web server is correct because the web server is a dual-homed or multi-connected host that already has routable access to the database subnet. By compromising the web server, the tester can use it as a relay—for example, with SSH dynamic port forwarding, Metasploit's pivot module, or a SOCKS proxy—to send packets to the database server. This effectively extends the attacker's reach into an otherwise inaccessible network segment.
Visual reference
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Red team
A red team is a group of security professionals who simulate real-world attacks on an organization's systems, people, and facilities to test the effectiveness of its defenses.
Key term
Metasploit
Metasploit is a powerful penetration testing framework that helps security professionals find and exploit vulnerabilities in computer systems.
About these practice questions
One of 185 original PT0-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.