CompTIA PT0-003 CompTIA PenTest+ Exam Online Training

Question #21

During a penetration test, a tester captures information about an SPN account.

Which of the following attacks requires this information as a prerequisite to proceed?

A . Golden Ticket
B . Kerberoasting
C . DCShadow
D . LSASS dumping

Reveal Solution Hide Solution

Question #22

A penetration tester attempts to run an automated web application scanner against a target URL. The tester validates that the web page is accessible from a different device.

The tester analyzes the following HTTP request header logging output:

200; GET /login.aspx HTTP/1.1 Host: foo.com; User-Agent: Mozilla/5.0

200; GET /login.aspx HTTP/1.1 Host: foo.com; User-Agent: Mozilla/5.0

No response; POST /login.aspx HTTP/1.1 Host: foo.com; User-Agent: curl

200; POST /login.aspx HTTP/1.1 Host: foo.com; User-Agent: Mozilla/5.0

No response; GET /login.aspx HTTP/1.1 Host: foo.com; User-Agent: python

Which of the following actions should the tester take to get the scans to work properly?

A . Modify the scanner to slow down the scan.
B . Change the source IP with a VPN.
C . Modify the scanner to only use HTTP GET requests.
D . Modify the scanner user agent.

Reveal Solution Hide Solution

Question #23

During a penetration test, a junior tester uses Hunter.io for an assessment and plans to review the information that will be collected.

Which of the following describes the information the junior tester will receive from the Hunter.io tool?

A . A collection of email addresses for the target domain that is available on multiple sources on the internet
B . DNS records for the target domain and subdomains that could be used to increase the external attack surface
C . Data breach information about the organization that could be used for additional enumeration
D . Information from the target’s main web page that collects usernames, metadata, and possible data exposures

Reveal Solution Hide Solution

Question #24

A penetration tester downloads a JAR file that is used in an organization’s production environment. The tester evaluates the contents of the JAR file to identify potentially vulnerable components that can be targeted for exploit.

Which of the following describes the tester’s activities?

A . SAST
B . SBOM
C . ICS
D . SCA

Reveal Solution Hide Solution

Question #25

During a penetration testing engagement, a tester targets the internet-facing services used by the client.

Which of the following describes the type of assessment that should be considered in this scope of work?

A . Segmentation
B . Mobile
C . External
D . Web

Reveal Solution Hide Solution

Question #26

A penetration tester has just started a new engagement. The tester is using a framework that breaks the life cycle into 14 components.

Which of the following frameworks is the tester using?

A . OWASP MASVS
B . OSSTMM
C . MITRE ATT&CK
D . CREST

Reveal Solution Hide Solution

Question #27

A penetration tester is evaluating a SCADA system. The tester receives local access to a workstation that is running a single application. While navigating through the application, the tester opens a terminal window and gains access to the underlying operating system.

Which of the following attacks is the tester performing?

A . Kiosk escape
B . Arbitrary code execution
C . Process hollowing
D . Library injection

Reveal Solution Hide Solution

Question #28

A penetration tester presents the following findings to stakeholders:

Control | Number of findings | Risk | Notes

Encryption | 1 | Low | Weak algorithm noted

Patching | 8 | Medium | Unsupported systems

System hardening | 2 | Low | Baseline drift observed

Secure SDLC | 10 | High | Libraries have vulnerabilities

Password policy | 0 | Low | No exceptions noted

Based on the findings, which of the following recommendations should the tester make? (Select two).

A . Develop a secure encryption algorithm.
B . Deploy an asset management system.
C . Write an SDLC policy.
D . Implement an SCA tool.
E . Obtain the latest library version.
F . Patch the libraries.

Reveal Solution Hide Solution

Correct Answer: D, E
D, E

Explanation:

Based on the findings, the focus should be on addressing vulnerabilities in libraries and ensuring their security. Here’s why options D and E are correct: Implement an SCA Tool:

SCA (Software Composition Analysis) tools are designed to analyze and manage open-source components in an application. Implementing an SCA tool would help in identifying and managing vulnerabilities in libraries, aligning with the finding of vulnerable libraries in the secure SDLC process. This recommendation addresses the high-risk finding related to the Secure SDLC by providing a systematic approach to manage and mitigate vulnerabilities in software dependencies. Obtain the Latest Library Version:

Keeping libraries up to date is a fundamental practice in maintaining the security of an application. Ensuring that the latest, most secure versions of libraries are used directly addresses the high-risk finding related to vulnerable libraries.

This recommendation is a direct and immediate action to mitigate the identified vulnerabilities.

Other Options Analysis:

Develop a Secure Encryption Algorithm: This is not practical or necessary given that the issue is with the use of a weak algorithm, not the need to develop a new one.

Deploy an Asset Management System: While useful, this is not directly related to the identified high-risk issue of vulnerable libraries.

Write an SDLC Policy: While helpful, the more immediate and effective actions involve implementing tools and processes to manage and update libraries. Reference from Pentest:

Horizontall HTB: Demonstrates the importance of managing software dependencies and using tools to identify and mitigate vulnerabilities in libraries.

Writeup HTB: Highlights the need for keeping libraries updated to ensure application security and

mitigate risks.

Conclusion:

Options D and E, implementing an SCA tool and obtaining the latest library version, are the most appropriate recommendations to address the high-risk finding related to vulnerable libraries in the Secure SDLC process.

Question #29

While conducting a reconnaissance activity, a penetration tester extracts the following information:

Emails: – [email protected] – [email protected] – [email protected]

Which of the following risks should the tester use to leverage an attack as the next step in the security assessment?

A . Unauthorized access to the network
B . Exposure of sensitive servers to the internet
C . Likelihood of SQL injection attacks
D . Indication of a data breach in the company

Reveal Solution Hide Solution

Question #30

A penetration tester gains access to a host but does not have access to any type of shell.

Which of the following is the best way for the tester to further enumerate the host and the environment in which it resides?

A . ProxyChains
B . Netcat
C . PowerShell ISE
D . Process IDs

Reveal Solution Hide Solution