Free Practice Questions for CompTIA PT0-003 Exam

Burp Suite Community Edition imposes limitations that can slow high-volume Intruder activities, particularly when performing repetitive request mutation such as parameter fuzzing, directory/file discovery, or input testing with wordlists. In PenTest+ tooling guidance, testers are expected to select alternative tools when a platform constraint reduces efficiency while still keeping the testing objective the same. Wfuzz is designed specifically for fast web fuzzing: it can rapidly send large volumes of HTTP requests while varying parameters, headers, paths, or payload positions using wordlists, and it supports filtering/matching responses (status codes, response size, strings) to identify interesting results—functionally similar to many Intruder use cases.

TruffleHog focuses on discovering exposed secrets in repositories and artifacts, not accelerating web request fuzzing. Postman is primarily an API client for building and replaying requests, but it is not optimized as a high-speed fuzzing engine. WPScan targets WordPress-specific enumeration and vulnerability checks and won’t provide general-purpose Intruder-like fuzzing across arbitrary web applications. Therefore, Wfuzz is the best option to speed up and achieve comparable fuzzing outcomes.

kube-hunter is a tool designed to perform security assessments on Kubernetes clusters. It identifies various vulnerabilities, focusing on weaknesses and misconfigurations. Here’s why option B is correct:

Kube-hunter: It scans Kubernetes clusters to identify security issues, such as misconfigurations, insecure settings, and potential attack vectors.

Network Configuration Errors: While kube-hunter might identify some network-related issues, its primary focus is on Kubernetes-specific vulnerabilities and misconfigurations.

Application Deployment Issues: These are more related to the applications running within the cluster, not the cluster configuration itself.

Security Vulnerabilities in Docker Containers: Kube-hunter focuses on the Kubernetes environment rather than Docker container-specific vulnerabilities.

References from Pentest:

Forge HTB: Highlights the use of specialized tools to identify misconfigurations in environments, similar to how kube-hunter operates within Kubernetes clusters​​.

Anubis HTB: Demonstrates the importance of identifying and fixing misconfigurations within complex environments like Kubernetes clusters​​.

Conclusion:

Option B, weaknesses and misconfigurations in the Kubernetes cluster, accurately describes the type of vulnerabilities that kube-hunter is designed to detect.

======

The best next step is to load the captured hash into John the Ripper for offline cracking. The tester already has a username and associated hash material, so the most practical action is to attempt to recover the plaintext password. Offline cracking is efficient because it does not directly interact with the target authentication service, which reduces noise and avoids account lockout risks compared with brute-force attempts using Hydra. NTLM relay would require an active relay opportunity and is not the clearest next move from the information shown. secretsdump is generally used after valid credentials or appropriate hash material are available for remote extraction, and the snippet provided does not indicate sufficient privilege or a full credential set for that step. Therefore, cracking the captured hash is the most appropriate immediate action to expand access.

In a cloud-hosted VDI scenario, the highest-value next step is typically to identify cloud credentials and configuration artifacts that enable access beyond the single desktop instance. The .aws directory is a well-known location where AWS command-line tooling stores sensitive material such as credential profiles and configuration details (for example, access keys, session tokens, default regions, and named profiles). PenTest+ emphasizes post-exploitation enumeration that targets credential sources capable of expanding access and impact, especially in cloud environments where a single set of keys may permit interacting with storage, compute, identity, and management APIs.

While .ssh can contain private keys useful for pivoting to other servers, in many cloud deployments SSH keys are scoped to specific hosts, whereas cloud access keys can unlock broader control-plane capabilities depending on attached permissions. .zsh_history is valuable for discovering commands and potentially leaked secrets, but it is less direct than immediately checking for structured cloud credentials. User folders like Documents are lower priority compared to credential repositories that can rapidly escalate the assessment’s scope of access.

Understanding netsh.exe:

Purpose: Configures network settings, including IP addresses, DNS, and firewall settings.

Firewall Management: Can enable, disable, or modify firewall rules.

Disabling the Firewall:

Command: Use netsh.exe to disable the firewall.

netsh advfirewall set allprofiles state off

Usage in Penetration Testing:

Pivoting: Disabling the firewall can help the penetration tester pivot from one system to another by removing network restrictions.

Command Execution: Ensure the command is executed with appropriate privileges.

References from Pentesting Literature:

netsh.exe is commonly mentioned in penetration testing guides for configuring network settings and managing firewalls.

HTB write-ups often reference the use of netsh.exe for managing firewall settings during network-based penetration tests.

Based on the findings, the focus should be on addressing vulnerabilities in libraries and ensuring their security. Here’s why options D and E are correct:

Implement an SCA Tool:

SCA (Software Composition Analysis) tools are designed to analyze and manage open-source components in an application. Implementing an SCA tool would help in identifying and managing vulnerabilities in libraries, aligning with the finding of vulnerable libraries in the secure SDLC process.

This recommendation addresses the high-risk finding related to the Secure SDLC by providing a systematic approach to manage and mitigate vulnerabilities in software dependencies.

Obtain the Latest Library Version:

Keeping libraries up to date is a fundamental practice in maintaining the security of an application. Ensuring that the latest, most secure versions of libraries are used directly addresses the high-risk finding related to vulnerable libraries.

This recommendation is a direct and immediate action to mitigate the identified vulnerabilities.

Other Options Analysis:

Develop a Secure Encryption Algorithm: This is not practical or necessary given that the issue is with the use of a weak algorithm, not the need to develop a new one.

Deploy an Asset Management System: While useful, this is not directly related to the identified high-risk issue of vulnerable libraries.

Write an SDLC Policy: While helpful, the more immediate and effective actions involve implementing tools and processes to manage and update libraries.

References from Pentest:

Horizontall HTB: Demonstrates the importance of managing software dependencies and using tools to identify and mitigate vulnerabilities in libraries​​.

Writeup HTB: Highlights the need for keeping libraries updated to ensure application security and mitigate risks​​.

Conclusion:

Options D and E, implementing an SCA tool and obtaining the latest library version, are the most appropriate recommendations to address the high-risk finding related to vulnerable libraries in the Secure SDLC process.

======

If a wireless network lacks proper encryption, attackers can inject malicious packets into the traffic stream.

Packet injection (Option A):

Attackers forge and transmit fake packets to manipulate network behavior.

Common in WEP/WPA attacks to force IV collisions or spoof DHCP responses.

The correct answer is D. To gather data to prepare for lateral movement

These commands are commonly used during post-exploitation enumeration to understand the compromised host, network connectivity, active users, login history, and possible privilege escalation paths. This information helps the tester determine where and how to move next inside the environment.

sudo -l checks what commands the current user can run with elevated privileges.

route displays the system routing table and can reveal reachable internal networks.

netstat -a shows active connections and listening services, which may identify connected hosts or services useful for pivoting.

last shows previous login activity and can reveal user accounts, source systems, and administrative access patterns.

who shows currently logged-in users.

A is incorrect because some commands may reveal information about other systems, but the full set of commands is broader and supports post-exploitation planning.

B is incorrect because the commands do not primarily enumerate all users and services. They collect privilege, network, session, and login information.

C is incorrect because persistence would involve creating or modifying access mechanisms, such as users, SSH keys, startup scripts, cron jobs, or services. These commands are reconnaissance and enumeration commands, not persistence actions.

In PenTest+ terms, this falls under Attacks and Exploits, specifically post-exploitation enumeration and lateral movement preparation.

The scenario highlights a Windows host where “many applications load at startup and run as SYSTEM,” which points directly to Windows services and auto-start components executing with high privileges. In PenTest+ privilege escalation techniques, unquoted service path injection is a common and effective method when a service runs as SYSTEM and its executable path contains spaces but is not enclosed in quotes. Windows may parse the path incorrectly and attempt to execute a malicious binary placed earlier in the interpreted path (for example, C:\Program.exe), as long as the attacker has write permissions to a directory in that search order. This can result in the attacker’s payload being executed as SYSTEM on service start/restart, achieving privilege escalation reliably and with clear evidentiary output.

Credential dumping may help lateral movement, but it does not inherently escalate privileges if the tester already lacks higher-privileged credentials. Local file inclusion is a web vulnerability and not applicable to host startup services. Process hijacking can work in some cases, but unquoted service paths are a specifically documented, high-probability Windows misconfiguration when many SYSTEM services exist.

Bottom of Form

A DNS zone transfer attack occurs when a misconfigured DNS server allows attackers to retrieve the entire DNS record set.

Zone transfer (Option A):

The command host -t axfr domain.com dnsl.domain.com requests an AXFR (authoritative transfer) of the DNS records.

This provides subdomains, email servers, and internal DNS records, which attackers can use for reconnaissance.