PT0-003 Exam Questions and Answers | Exam-Dumps (Page: 3)

QUESTION: 11

[Tools and Code Analysis]
During an assessment, a penetration tester obtains an NTLM hash from a legacy Windows machine.
Which of the following tools should the penetration tester use to continue the attack?

Responder
Hydra
BloodHound
CrackMapExec

Answer(s): D

Explanation:

When a penetration tester obtains an NTLM hash from a legacy Windows machine, they need to use a tool that can leverage this hash for further attacks, such as pass-the-hash attacks, or for cracking the hash. Here's a breakdown of the options:
Option A: Responder
Responder is primarily used for poisoning LLMNR, NBT-NS, and MDNS to capture hashes, but not for leveraging NTLM hashes obtained post-exploitation.
Option B: Hydra
Hydra is a password-cracking tool but not specifically designed for NTLM hashes or pass-the-hash attacks.
Option C: BloodHound
BloodHound is used for mapping out Active Directory relationships and identifying potential attack paths but not for using NTLM hashes directly.
Option D: CrackMapExec
CrackMapExec is a versatile tool that can perform pass-the-hash attacks, execute commands, and more using NTLM hashes. It is designed for post-exploitation scenarios involving NTLM hashes.
Reference from Pentest:
Forge HTB: Demonstrates the use of CrackMapExec for leveraging NTLM hashes to gain further access within a network.
Horizontall HTB: Shows how CrackMapExec can be used for various post-exploitation activities, including using NTLM hashes to authenticate and execute commands.
Conclusion:
Option D, CrackMapExec, is the most suitable tool for continuing the attack using an NTLM hash. It supports pass-the-hash techniques and other operations that can leverage NTLM hashes effectively.

Reveal Solution Next Question

QUESTION: 12

[Attacks and Exploits]
A penetration tester needs to collect information over the network for further steps in an internal assessment.
Which of the following would most likely accomplish this goal?

ntlmrelayx.py -t 192.168.1.0/24 -1 1234
nc -tulpn 1234 192.168.1.2
responder.py -I eth0 -wP
crackmapexec smb 192.168.1.0/24

Answer(s): C

Explanation:

To collect information over the network, especially during an internal assessment, tools that can capture and analyze network traffic are essential. Responder is specifically designed for this purpose, and it can capture NTLM hashes and other credentials by poisoning various network protocols.
Here's a breakdown of the options:
Option A: ntlmrelayx.py -t 192.168.1.0/24 -1 1234
ntlmrelayx.py is used for relaying NTLM authentication but not for broad network information collection.
Option B: nc -tulpn 1234 192.168.1.2
Netcat (nc) is a network utility for reading from and writing to network connections using TCP or UDP but is not specifically designed for comprehensive information collection over a network.
Option C: responder.py -I eth0 -wP
Responder is a tool for LLMNR, NBT-NS, and MDNS poisoning. The -I eth0 option specifies the network interface, and -wP enables WPAD rogue server which is effective for capturing network credentials and other information.
Option D: crackmapexec smb 192.168.1.0/24
CrackMapExec is useful for SMB-related enumeration and attacks but not specifically for broad network information collection.
Reference from Pentest:
Anubis HTB: Highlights the use of Responder to capture network credentials and hashes during internal assessments.
Horizontall HTB: Demonstrates the effectiveness of Responder in capturing and analyzing network traffic for further exploitation.

Reveal Solution Next Question

QUESTION: 13

[Attacks and Exploits]
A penetration tester wants to use the following Bash script to identify active servers on a network:

1 network_addr="192.168.1"
2 for h in {1..254}; do
3 ping -c 1 -W 1 $network_addr.$h > /dev/null
4 if [ $? -eq 0 ]; then
5 echo "Host $h is up"
6 else
7 echo "Host $h is down"
8 fi

9 done

Which of the following should the tester do to modify the script?

Change the condition on line 4.
Add 2>&1 at the end of line 3.
Use seq on the loop on line 2.
Replace $h with ${h} on line 3.

Answer(s): C

Explanation:

The provided Bash script is used to ping a range of IP addresses to identify active hosts in a network. Here's a detailed breakdown of the script and the necessary modification:
Original Script:
1 network_addr="192.168.1"
2 for h in {1..254}; do
3 ping -c 1 -W 1 $network_addr.$h > /dev/null
4 if [ $? -eq 0 ]; then
5 echo "Host $h is up"
6 else
7 echo "Host $h is down"
8 fi
9 done
Analysis:
Line 2: The loop uses {1..254} to iterate over the range of host addresses. However, this notation might not work in all shell environments, especially if not using bash directly or if the script runs in a different shell.
Using seq for Better Compatibility:
The seq command is a more compatible way to generate a sequence of numbers. It ensures the loop works in any POSIX-compliant shell.
Modified Line 2:
for h in $(seq 1 254); do
This change ensures broader compatibility and reliability of the script.

Modified Script:
1 network_addr="192.168.1"
2 for h in $(seq 1 254); do
3 ping -c 1 -W 1 $network_addr.$h > /dev/null
4 if [ $? -eq 0 ]; then
5 echo "Host $h is up"
6 else
7 echo "Host $h is down"
8 fi
9 done

Reveal Solution Next Question

QUESTION: 14

[Tools and Code Analysis]
A penetration tester is attempting to discover vulnerabilities in a company's web application.
Which of the following tools would most likely assist with testing the security of the web application?

OpenVAS
Nessus
sqlmap
Nikto

Answer(s): D

Explanation:

When testing the security of a web application, specific tools are designed to uncover vulnerabilities and issues. Here's an overview of the tools mentioned and why Nikto is the most suitable for this task:
Nikto:
Purpose: Nikto is a web server scanner that performs comprehensive tests against web servers for multiple items, including potentially dangerous files/programs, outdated versions, and other security issues.
Relevance: It is designed specifically for discovering vulnerabilities in web applications, making it the most appropriate choice for a penetration tester targeting a web application.
Comparison with Other Tools:
OpenVAS: A general-purpose vulnerability scanner that targets a wide range of network services and hosts, not specifically tailored for web applications.
Nessus: Similar to OpenVAS, Nessus is a comprehensive vulnerability scanner but is broader in scope and not focused solely on web applications.
sqlmap: This tool is excellent for SQL injection testing but is limited to database vulnerabilities and doesn't cover the full spectrum of web application security issues.

Reveal Solution Next Question

QUESTION: 15

[Information Gathering and Vulnerability Scanning]
A penetration tester needs to launch an Nmap scan to find the state of the port for both TCP and UDP

services.
Which of the following commands should the tester use?

nmap -sU -sW -p 1-65535 example.com
nmap -sU -sY -p 1-65535 example.com
nmap -sU -sT -p 1-65535 example.com
nmap -sU -sN -p 1-65535 example.com

Answer(s): C

Explanation:

To find the state of both TCP and UDP ports using Nmap, the appropriate command should combine both TCP and UDP scan options:
Understanding the Options:
-sU: Performs a UDP scan.
-sT: Performs a TCP connect scan.
Command
Command: nmap -sU -sT -p 1-65535 example.com
This command will scan both TCP and UDP ports from 1 to 65535 on the target example.com. Combining -sU and -sT ensures that both types of services are scanned.
Comparison with Other Options:
-sW: Initiates a TCP Window scan, not relevant for identifying the state of TCP and UDP services. -sY: Initiates a SCTP INIT scan, not relevant for this context. -sN: Initiates a TCP Null scan, which is not used for discovering UDP services.

Reveal Solution Next Question

CompTIA PT0-003 Exam (page: 3) CompTIA PenTest+ Updated on: 12-Jan-2026

QUESTION: 11

Explanation:

QUESTION: 12

Explanation:

QUESTION: 13

Explanation:

QUESTION: 14

Explanation:

QUESTION: 15

Explanation:

CompTIA PT0-003 Exam (page: 3)
CompTIA PenTest+
Updated on: 12-Jan-2026