Free Practice Questions for CompTIA PT0-003 Exam

Encoding to Evade DLP:

Encoding (e.g., Base64) transforms data into a format that may bypass data loss prevention (DLP) tools.

DLP solutions often look for specific patterns (e.g., sensitive keywords, file headers) and may not recognize encoded data.

Why Not Other Options?

B (Compression): Compression reduces file size but does not typically bypass DLP detection mechanisms.

C (Encryption): Encrypted data is detectable by DLP tools, though its contents may not be readable.

D (Obfuscation): While obfuscation hides intent, encoding is more effective for bypassing automated detection.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)

Session fixation occurs when an application accepts a session identifier provided by the client (or set before authentication) and continues to use that same identifier after the user authenticates. In this scenario the server issues the same cookie value both before and after login, indicating the session ID is set pre-authentication and not rotated/renewed on successful authentication — a classic session fixation vulnerability. An attacker could force or coerce a victim to use a known session ID, then log in and hijack the authenticated session.

Why not the others:

A. JWT manipulation: Would involve JSON Web Tokens (signed tokens with predictable structure); the cookie shown has no JWT structure.

B. Cookie poisoning: Usually refers to unauthorized modification of cookie contents to change application behavior — not the primary issue here.

D. Collision attack: Cryptographic collision attacks are not relevant to identical session cookies before/after login.

CompTIA PT0-003 Mapping:

Domain 3.0 Attacks and Exploits — web application session management vulnerabilities (session fixation, improper session handling).

An HTTP 403 Forbidden response indicates the server understood the request but is refusing to authorize it. In PenTest+ web assessment context, a common cause is an access control requirement at the web server or reverse proxy layer—such as mutual TLS (mTLS) / client certificate authentication, IP allowlisting, or other authorization gates—preventing the tester from reaching the application content. When a site is configured to require a client certificate, the server may return a 403-class error if the request does not include a trusted certificate chain, because the client cannot be authenticated to an approved identity. Therefore, obtaining and presenting a valid X.509 client certificate (issued by a trusted CA for that environment or provided by the client as part of the engagement) is the appropriate step to satisfy the access requirement and proceed with testing.

Resetting server file permissions is an administrative remediation action outside a tester’s role and scope. Spoofing a server MAC address is not meaningful for HTTP access and typically not possible across routed networks. Using a legacy browser addresses client-side compatibility, not server-side authorization decisions that produce 403.

The given statements are actionable steps aimed at improving security. They fall under the recommendations section of a penetration test report. Here’s why option D is correct:

Recommendations: This section of the report provides specific actions that should be taken to mitigate identified vulnerabilities and improve the overall security posture. Implementing a WAF, upgrading operating systems, and implementing a secure SDLC are recommendations to enhance security.

Executive Summary: This section provides a high-level overview of the findings and their implications, intended for executive stakeholders.

Attack Narrative: This section details the steps taken during the penetration test, describing the attack vectors and methods used.

Detailed Findings: This section provides an in-depth analysis of each identified vulnerability, including evidence and technical details.

References from Pentest:

Forge HTB: The report ' s recommendations section suggests specific measures to address the identified issues, similar to the given statements​​.

Writeup HTB: Highlights the importance of the recommendations section in providing actionable steps to improve security based on the findings from the assessment​​.

Conclusion:

Option D, recommendations, is the correct section where the given statements would be found in a penetration test report.

======

This system most likely functions as a Domain Controller because the service combination strongly matches Active Directory infrastructure. The presence of TCP 88 for Kerberos and TCP 389 for LDAP is the clearest indicator, since these are core authentication and directory services used by Windows domain controllers. Port 53 also supports this conclusion because domain controllers commonly host DNS for internal domain name resolution. Port 445 is consistent with SMB services used in Windows environments, and the output references a NetBIOS domain name and DNS domain name ending in .LOCAL, which further points to an AD domain role. Although SMTP, HTTPS, and proxy-related services also appear, those can coexist on multi-purpose systems. The decisive evidence is the presence of Kerberos, LDAP, DNS, and Windows domain naming details together, which most strongly identifies a Domain Controller.

The Wayback Machine is an online tool that archives web pages over time, allowing users to see how a website looked at various points in its history. This can be extremely useful for penetration testers looking to explore potential security weaknesses by searching for subdomains that might have existed in the past.

Accessing the Wayback Machine:

Go to the Wayback Machine website: archive.org/web.

Enter the URL of the target website you want to explore.

Navigating Archived Pages:

The Wayback Machine provides a timeline and calendar interface to browse through different snapshots taken over time.

Select a snapshot to view the archived version of the site. Look for links, subdomains, and resources that may no longer be available in the current version of the website.

Identifying Subdomains:

Examine the archived pages for references to subdomains, which might be visible in links, scripts, or embedded content.

Use the information gathered to identify potential entry points or older versions of web applications that might still be exploitable.

Tool Integration:

Tools like Burp Suite or SpiderFoot can integrate with the Wayback Machine to automate the discovery process of archived subdomains and resources.

Real-World Example:

During a penetration test, a tester might find references to oldadmin.targetsite.com in an archived page from several years ago. This subdomain might no longer be listed in DNS but could still be accessible, leading to potential security vulnerabilities.

References from Pentesting Literature:

In various penetration testing guides and HTB write-ups, using the Wayback Machine is a common technique for passive reconnaissance, providing historical context and revealing past configurations that might still be exploitable.

Step-by-Step ExplanationReferences:

HTB Official Writeups

======

Configuring and Registering a Service:

Registering a malicious service ensures that it starts automatically with the system, providing persistence even after reboots.

This method is stealthier than others and is commonly used in advanced persistent threat (APT) scenarios.

Why Not Other Options?

B (Remote desktop software): Installing such software is noisy and can easily be detected by monitoring tools.

C (User logon script): While it provides persistence, it is less reliable and more detectable than a system service.

D (Kerberoasting): This is a credential-stealing technique and does not establish persistence.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)

Domain 4.0 (Penetration Testing Tools)

Penetration testers use OSINT (Open-Source Intelligence) tools to collect and analyze reconnaissance data.

Maltego (Option C):

Maltego is a powerful graph-based OSINT tool that integrates data from multiple sources (e.g., social media, DNS records, leaked credentials).

It automates data correlation and helps visualize connections.

The command appends PHP code to a web-accessible file, effectively creating a simple web shell. By adding system($_GET[ " c " ]); into index.php, the tester can later execute operating system commands remotely through the web server by passing a parameter in the URL. This is most closely associated with establishing persistence, because it gives the tester a reusable method to regain command execution even if the original reverse shell session is lost. It is not primarily lateral movement, since the action is being performed on the already compromised host rather than expanding to another system. It is also not mainly about avoiding detection or bypassing a specific security control. The key objective is maintaining durable access through an alternate remote execution channel.

==============

To see any vulnerabilities that may be visible from outside of the organization, the penetration tester should perform an unauthenticated scan.

Unauthenticated Scan:

Definition: An unauthenticated scan is conducted without providing any credentials to the scanning tool. It simulates the perspective of an external attacker who does not have any prior access to the system.

Purpose: Identifies vulnerabilities that are exposed to the public and can be exploited without authentication. This includes open ports, outdated software, and misconfigurations visible to the outside world.

Comparison with Other Scans:

SAST (Static Application Security Testing): Analyzes source code for vulnerabilities, typically used during the development phase and not suitable for external vulnerability scanning.

Sidecar: This term is generally associated with microservices architecture and is not relevant to the context of vulnerability scanning.

Host-based: Involves scanning from within the network and often requires authenticated access to the host to identify vulnerabilities. It is not suitable for determining external vulnerabilities.

Pentest References:

External Vulnerability Assessment: Conducting unauthenticated scans helps identify the attack surface exposed to external threats and prioritizes vulnerabilities that are accessible from the internet.

Tools: Common tools for unauthenticated scanning include Nessus, OpenVAS, and Nmap.

By performing an unauthenticated scan, the penetration tester can identify vulnerabilities that an external attacker could exploit without needing any credentials or internal access.

======