PT0-003 — questions

A client warns the assessment team that an ICS application is maintained by the manufacturer. Any tampering of the host could void the enterprise support terms of use. Which of the following techniques would be most effective to validate whether the application encrypts communications in transit?

While performing a penetration testing exercise, a tester executes the following command: PS c:\tools> c:\hacks\PsExec.exe \\server01.comptia.org -accepteula cmd.exe Which of the following best explains what the tester is trying to do?

During an assessment, a penetration tester obtains a low-privilege shell and then runs the following command: findstr /SIM /C:"pass” *.txt *.cfg *.xml Which of the following is the penetration tester trying to enumerate?

A penetration tester finished a security scan and uncovered numerous vulnerabilities on several hosts. Based on the targets' EPSS and CVSS scores, which of the following targets is the most likely to get attacked?

During a discussion of a penetration test final report, the consultant shows the following payload used to attack a system: ?/<sCRitP>aLeRt("pwned")</ScriPt> Based on the code, which of the following options represents the attack executed by the tester and the associated countermeasure?

A penetration tester gains shell access to a Windows host. The tester needs to permanently turn off protections in order to install additional payload. Which of the following commands is most appropriate?

A penetration tester discovers data to stage and exfiltrate. The client has authorized movement to the tester’s attacking hosts only. Which of the following would be most appropriate to avoid alerting the SOC?

A penetration tester performs a service enumeration process and receives the following result after scanning a server using the Nmap tool: Based on the output, which of the following services provides the best target for launching an attack?

A penetration tester is performing a cloud-based penetration test against a company. Stakeholders have indicated the priority is to see if the tester can get into privileged systems that are not directly accessible from the internet. Given the following scanner information: Server-side request forgery vulnerability in test.comptia.org Reflected cross-site scripting vulnerability in test2.comptia.org Publicly accessible storage system named static_comptia_assets SSH port 22 open to the intemet on test3.comptia.org Open redirect vulnerability in test4.comptia.org Which of the following of the attack paths should the tester prioritize first?

A client recently hired a penetration testing firm to conduct an assessment of their consumer-facing web application. Several days into the assessment, the client's networking team observes a substantial increase in DNS traffic. Which of the following would most likely explain the increase in DNS traffic?

Which of the following could be used to enhance the quality and reliability of a vulnerability scan report?

During a preengagement activity with a new customer, a penetration tester looks for assets to test. Which of the following is an example of a target that can be used for testing?

Before starting an assessment, a penetration tester needs to scan a Class B IPv4 network for open ports in a short amount of time. Which of the following is the best tool for this task?

Which of the following activities should be performed to prevent uploaded web shells from being exploited by others?

A penetration tester writes a Bash script to automate the execution of a ping command on a Class C network: Which of the following pieces of code should the penetration tester use in place of the --MISSING-TEXT-- placeholder?

Which of the following components should a penetration tester include in an assessment report?

A penetration tester writes the following script to enumerate a /24 network: The tester executes the script, but it fails with the following error: -bash: syntax error near unexpected token ‘ping’ Which of the following should the tester do to fix the error?

A penetration tester launches an attack against company employees. The tester clones the company's intranet log-in page and sends the link via email to all employees. Which of the following best describes the objective and tool selected by the tester to perform this activity?

Which of the following techniques is the best way to avoid detection by data loss prevention tools?

During host discovery, a security analyst wants to obtain GeoIP information and a comprehensive summary of exposed services. Which of the following tools is best for this task?