PT0-003 Exam Questions and Answers | Exam-Dumps (Page: 7)

QUESTION: 31

[Information Gathering and Vulnerability Scanning]
A penetration tester cannot find information on the target company's systems using common OSINT methods. The tester's attempts to do reconnaissance against internet-facing resources have been blocked by the company's WAF. Which of the following is the best way to avoid the WAF and gather information about the target company's systems?

HTML scraping
Code repository scanning
Directory enumeration
Port scanning

Answer(s): B

Explanation:

When traditional reconnaissance methods are blocked, scanning code repositories is an effective method to gather information. Here's why:
Code Repository Scanning:
Leaked Information: Code repositories (e.g., GitHub, GitLab) often contain sensitive information, including API keys, configuration files, and even credentials that developers might inadvertently commit.
Accessible: These repositories can often be accessed publicly, bypassing traditional defenses like WAFs.
Comparison with Other Methods:
HTML Scraping: Limited to the data present on web pages and can still be blocked by WAF. Directory Enumeration: Likely to be blocked by WAF as well and might not yield significant internal information.
Port Scanning: Also likely to be blocked or trigger alerts on WAF or IDS/IPS systems. Scanning code repositories allows gathering a wide range of information that can be critical for further penetration testing effort

Reveal Solution Next Question

QUESTION: 32

[Information Gathering and Vulnerability Scanning]
During a penetration test, the tester uses a vulnerability scanner to collect information about any possible vulnerabilities that could be used to compromise the network. The tester receives the results and then executes the following command:

snmpwalk -v 2c -c public 192.168.1.23

Which of the following is the tester trying to do based on the command they used?

Bypass defensive systems to collect more information.
Use an automation tool to perform the attacks.
Script exploits to gain access to the systems and host.
Validate the results and remove false positives.

Answer(s): D

Explanation:

The command snmpwalk -v 2c -c public 192.168.1.23 is used to query SNMP (Simple Network Management Protocol) data from a device. Here's the purpose in the context provided:
SNMP Enumeration:
Function: snmpwalk is used to retrieve a large amount of information from the target device using SNMP.
Version: -v 2c specifies the SNMP version.
Community String: -c public specifies the community string, which is essentially a password for SNMP queries.
Purpose of the Command:
Validate Results: The tester uses SNMP to gather detailed information about the network devices to confirm the findings of the vulnerability scanner and remove any false positives. Detailed Information: SNMP can provide detailed information about device configurations, network interfaces, and other settings that can validate the scanner's results.
Comparison with Other Options:
Bypassing Defensive Systems (A): Not directly related to SNMP enumeration. Using Automation Tools (B): While SNMPwalk is automated, the primary purpose here is validation. Script Exploits (C): SNMPwalk is not used for scripting exploits but for information gathering. By using snmpwalk, the tester is validating the results from the vulnerability scanner and removing any false positives, ensuring accurate reporting.

Reveal Solution Next Question

QUESTION: 33

[Attacks and Exploits]
A penetration tester is working on a security assessment of a mobile application that was developed in-house for local use by a hospital. The hospital and its customers are very concerned about disclosure of information.
Which of the following tasks should the penetration tester do first?

Set up Drozer in order to manipulate and scan the application.
Run the application through the mobile application security framework.
Connect Frida to analyze the application at runtime to look for data leaks.
Load the application on client-owned devices for testing.

Answer(s): B

Explanation:

When performing a security assessment on a mobile application, especially one concerned with information disclosure, it is crucial to follow a structured approach to identify vulnerabilities comprehensively. Here's why option B is correct:
Mobile Application Security Framework: This framework provides a structured methodology for assessing the security of mobile applications. It includes various tests such as static analysis, dynamic analysis, and reverse engineering, which are essential for identifying vulnerabilities related to information disclosure.
Initial Steps: Running the application through a security framework allows the tester to identify a broad range of potential issues systematically. This initial step ensures that all aspects of the application's security are covered before delving into more specific tools like Drozer or Frida.
Reference from Pentest:
Writeup HTB: Demonstrates the use of structured methodologies to ensure comprehensive coverage of security assessments.
Horizontall HTB: Emphasizes the importance of following a structured approach to identify and address security issues.

Reveal Solution Next Question

QUESTION: 34

[Tools and Code Analysis]
Before starting an assessment, a penetration tester needs to scan a Class B IPv4 network for open ports in a short amount of time.
Which of the following is the best tool for this task?

Burp Suite
masscan
Nmap
hping

Answer(s): B

Explanation:

When needing to scan a large network for open ports quickly, the choice of tool is critical. Here's why option B is correct:
masscan: This tool is designed for high-speed port scanning and can scan entire networks much faster than traditional tools like Nmap. It can handle large ranges of IP addresses and ports with high efficiency.
Nmap: While powerful and versatile, Nmap is generally slower than masscan for scanning very large networks, especially when speed is crucial.
Burp Suite: This tool is primarily for web application security testing and not optimized for network- wide port scanning.

hping: This is a network tool used for packet crafting and network testing, but it is not designed for high-speed network port scanning.
Reference from Pentest:
Luke HTB: Highlights the use of efficient tools for large-scale network scanning to identify open ports quickly.
Anubis HTB: Demonstrates scenarios where high-speed scanning tools like masscan are essential for large network assessments.

Reveal Solution Next Question

QUESTION: 35

[Attacks and Exploits]

A penetration tester is performing an authorized physical assessment. During the test, the tester observes an access control vestibule and on-site security guards near the entry door in the lobby.
Which of the following is the best attack plan for the tester to use in order to gain access to the facility?

Clone badge information in public areas of the facility to gain access to restricted areas.
Tailgate into the facility during a very busy time to gain initial access.
Pick the lock on the rear entrance to gain access to the facility and try to gain access.
Drop USB devices with malware outside of the facility in order to gain access to internal machines.

Answer(s): B

Explanation:

In an authorized physical assessment, the goal is to test physical security controls. Tailgating is a common and effective technique in such scenarios. Here's why option B is correct:
Tailgating: This involves following an authorized person into a secure area without proper credentials. During busy times, it's easier to blend in and gain access without being noticed. It tests the effectiveness of physical access controls and security personnel. Cloning Badge Information: This can be effective but requires proximity to employees and specialized equipment, making it more complex and time-consuming.
Picking Locks: This is a more invasive technique that carries higher risk and is less stealthy compared to tailgating.
Dropping USB Devices: This tests employee awareness and response to malicious devices but does not directly test physical access controls.
Reference from Pentest:
Writeup HTB: Demonstrates the effectiveness of social engineering and tailgating techniques in bypassing physical security measures.
Forge HTB: Highlights the use of non-invasive methods like tailgating to test physical security without causing damage or raising alarms.
Conclusion:
Option B, tailgating into the facility during a busy time, is the best attack plan to gain access to the facility in an authorized physical assessment.

Reveal Solution Next Question

CompTIA PT0-003 Exam (page: 7) CompTIA PenTest+ Updated on: 12-Jan-2026

QUESTION: 31

Explanation:

QUESTION: 32

Explanation:

QUESTION: 33

Explanation:

QUESTION: 34

Explanation:

QUESTION: 35

Explanation:

CompTIA PT0-003 Exam (page: 7)
CompTIA PenTest+
Updated on: 12-Jan-2026