A tester compromises a target host and then wants to maintain persistent access. Which of the following is the best way for the attacker to accomplish the objective?

Configure and register a service.

Install and run remote desktop software.

Set up a script to be run when users log in.

Perform a Kerberoasting attack on the host.

A penetration tester is performing an assessment focused on attacking the authentication identity provider hosted within a cloud provider. During the reconnaissance phase, the tester finds that the system is using OpenID Connect with OAuth and has dynamic registration enabled. Which of the following attacks should the tester try first?

A replay attack against the authentication flow in the system

A password-spraying attack against the authentication system

A brute-force attack against the authentication system

A replay attack against the authentication flow in the system

A mask attack against the authentication system

A penetration tester runs a network scan but has some issues accurately enumerating the vulnerabilities due to the following error:OS identification failedWhich of the following is most likely causing this error?

The scan cannot gather one or more fingerprints from the target.

The scan did not reach the target because of a firewall block rule.

The scanner database is out of date.

The scan is reporting a false positive.

The scan cannot gather one or more fingerprints from the target.

A penetration tester is trying to get unauthorized access to a web application and executes the following command:GET /foo/images/file?id=2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswdWhich of the following web application attacks is the tester performing?

Insecure Direct Object Reference

A penetration tester has discovered sensitive files on a system. Assuming exfiltration of the files is part of the scope of the test, which of the following is most likely to evade DLP systems?

Encoding the data and pushing through DNS to the tester's controlled server.

Padding the data and uploading the files through an external cloud storage service.

Obfuscating the data and pushing through FTP to the tester's controlled server.

Hashing the data and emailing the files to the tester's company inbox.

Which of the following is the most efficient way to exfiltrate a file containing data that could be sensitive?

Encrypt and send the file over HTTPS.

Use steganography and send the file over FTP.

Compress the file and send it using TFTP.

Split the file in tiny pieces and send it over dnscat.

Encrypt and send the file over HTTPS.

[Attacks and Exploits]A tester gains initial access to a server and needs to enumerate all corporate domain DNS records. Which of the following commands should the tester use?

nslookup -server local.dns.server local.domain *

[Information Gathering and Vulnerability Scanning]A penetration tester observes the following output from an Nmap command while attempting to troubleshoot connectivity to a Linux server:Starting Nmap 7.91 ( https://nmap.org ) at 2024-01-10 12:00 UTCNmap scan report for example.com (192.168.1.10)Host is up (0.001s latency).Not shown: 9999 closed portsPORT STATE SERVICE21/tcp open ftp80/tcp open http135/tcp open msrpc139/tcp open netbios-ssn443/tcp open https2222/tcp open ssh444/tcp open microsoft-dsNmap done: 1 IP address (1 host up) scanned in 0.23 secondsWhich of the following is the most likely reason for the connectivity issue?

The SSH service is running on a different port.

The SSH service is blocked by a firewall.

The SSH service requires certificate authentication.

[Information Gathering and Vulnerability Scanning]A penetration tester is enumerating a Linux system. The goal is to modify the following script to provide more comprehensive system information:#!/bin/bashps aux >> linux_enum.txtWhich of the following lines would provide the most comprehensive enumeration of the system?

cat /etc/passwd >> linux_enum.txt; netstat -tuln >> linux_enum.txt; cat /etc/bash.bashrc >> linux_enum.txt

whoami >> linux_enum.txt; uname -a >> linux_enum.txt; ifconfig >> linux_enum.txt

hostname >> linux_enum.txt; echo $USER >> linux_enum.txt; curl ifconfig.me >> linux_enum.txt

lsof -i >> linux_enum.txt; uname -a >> linux_enum.txt; ls /home/ >> linux_enum.txt

A company hires a penetration tester to perform an external attack surface review as part of a security engagement. The company informs the tester that the main company domain to investigate is comptia.org. Which of the following should the tester do to accomplish the assessment objective?

Perform information-gathering techniques to review internet-facing assets for the company.

Perform a phishing assessment to try to gain access to more resources and users' computers.

Perform a physical security review to identify vulnerabilities that could affect the company.

Perform a vulnerability assessment over the main domain address provided by the client.

[Attacks and Exploits]A penetration tester finishes an initial discovery scan for hosts on a /24 customer subnet. The customer states that the production network is composed of Windows servers but no container clusters. The following are the last several lines from the scan log:Line 1: 112 hosts found... trying portsLine 2: FOUND 22 with OpenSSH 1.2p2 open on 99 hostsLine 3: FOUND 161 with UNKNOWN banner open on 110 hostsLine 4: TCP RST received on ports 21, 3389, 80Line 5: Scan complete.Which of the following is the most likely reason for the results?

Multiple honeypots were encountered

A tester is working on an engagement that has evasion and stealth requirements. Which of the following enumeration methods is the least likely to be detected by the IDS?

curl https://api.shodan.io/shodan/host/search?key=<API_KEY>&query=hostname:<target>

proxychains nmap -sV -T2 <target>

for i in <target>; do curl -k $i; done

[Attacks and Exploits]A penetration tester successfully gained access to manage resources and services within the company's cloud environment. This was achieved by exploiting poorly secured administrative credentials that had extensive permissions across the network. Which of the following credentials was the tester able to obtain?

Temporary security credentials (STS)

CompTIA PT0-003 Practice Test 6 - Free Online Exam Questions 201-240

A penetration tester identifies the following open ports during a network enumeration scan:

PORT STATE SERVICE

22/tcp open ssh

80/tcp open http

111/tcp open rpcbind

443/tcp open https

27017/tcp open mongodb

50123/tcp open ms-rpc

Which of the following commands did the tester use to get this output?

Become a Premium Member for full access

Unlock Premium Member

CompTIA PT0-003 Practice Test 6

Question

CompTIA PT0-003 Practice Tests

Practice Tests