CompTIA PenTest + PT0-003 (V3) Exam (New Version) Practice Test 1

EPSS specifically estimates the probability that a vulnerability will be exploited in the near term, a dimension CVSS's severity score does not capture on its own. When CVSS scores are similar, the higher EPSS score indicates the more realistically threatening and thus higher-priority target.

Secure data destruction ensures sensitive data collected during testing is irrecoverably wiped rather than just deleted, which could otherwise leave residual client data exposed. This is distinct from removing persistence mechanisms or tools from client systems, which addresses artifacts left on the target rather than data the tester collected.

A DNS covert channel encodes data within DNS queries and responses, allowing exfiltration even when only DNS traffic is permitted outbound. Cloud storage and email require broader outbound access this network blocks, alternate data streams hide data within a file system rather than exfiltrating it, and virtual drive mounting is a local technique rather than a network exfiltration method.

Pivoting uses a compromised host as a relay point to route traffic into network segments otherwise unreachable from the tester's original position. Credential dumping extracts stored credentials, service discovery identifies available services, string searches look for sensitive strings in files or memory, and WMI is a Windows management protocol rather than the routing technique itself.

A C2 framework establishes the ongoing communication channel used to issue commands and retrieve results throughout an engagement. A scheduled task or registry key modification are specific persistence techniques rather than the communication channel itself, a rootkit hides malicious software's presence, and a browser extension is one specific persistence vector rather than the broader C2 concept.

Prompt injection crafts input specifically designed to override an AI system's underlying instructions, causing unintended behavior such as disclosing internal details. Model manipulation alters the model itself, jailbreak/rooting applies to mobile devices, permission abuse misuses granted app permissions, and register manipulation is an OT attack technique unrelated to AI chatbots.

Spearphishing targets a specific individual with personalized, contextually relevant content, unlike a generic mass phishing campaign. Vishing and smishing use voice calls and text messages, whaling specifically targets high-profile executives, and a watering hole attack compromises a website the target frequents rather than sending a direct email.

An evil twin attack sets up a rogue access point mimicking a legitimate network's SSID to trick devices into connecting to it instead. Wardriving is scanning for wireless networks while driving, signal jamming disrupts wireless communication broadly, deauthentication forcibly disconnects clients, and a WPS PIN attack targets the WPS PIN mechanism specifically.

Querying a cloud instance's metadata service to retrieve credentials is specifically a metadata service attack, a well-known technique often chained from SSRF. Container escape breaks out of a container, a supply chain attack compromises a trusted upstream component, trust relationship abuse exploits cross-account trust, and a workload runtime attack targets a running workload's execution rather than its metadata endpoint.

SSRF tricks the server itself into making requests on the attacker's behalf, often reaching internal resources not otherwise accessible, exactly as described. CSRF tricks a victim's browser into making unwanted requests, directory traversal accesses files outside an intended directory, insecure direct object reference exposes internal references, and session hijacking steals an active session.

Process hollowing creates a legitimate process in a suspended state, replaces its memory with malicious code, and resumes it so the code runs under a trusted process's identity. Library injection loads a malicious library into a running process, a shell escape breaks out of a restricted shell, log tampering alters logs, and unquoted service path injection exploits unquoted paths in service configurations.

Using a captured NTLM hash directly for authentication is pass-the-hash, while replaying a captured Kerberos ticket is pass-the-ticket. Pass-the-token involves reusing a captured token from a different protocol context, and dictionary and brute-force attacks attempt to recover a plaintext password rather than replaying captured material.

VLAN hopping uses techniques like forged VLAN tags on trunking protocols to access a VLAN that should be isolated from the attacker's segment. An on-path attack intercepts traffic between two parties, a relay attack forwards captured authentication material, multihomed host exploitation abuses a dual-connected host, and share enumeration lists accessible network shares.

Rules of engagement and the statement of work define the authorized boundaries of a test, and testing anything outside that scope exposes the tester to legal and contractual risk even if technically reachable. The correct response is to stay within the defined scope and formally request a scope change if the client wants the endpoint included, rather than unilaterally expanding testing or hiding the activity.

Tailgating involves following an authorized person through a secured entry point without presenting one's own credentials. Badge cloning duplicates a card's data, lock picking manipulates a physical lock, a USB drop leaves malicious media for someone to find, and a site survey observes and documents physical controls rather than bypassing them directly.

A finding that manual verification disproves is a false positive, while a real vulnerability missed because the scan didn't reach the host during its window is a false negative. A true positive would be a correctly confirmed vulnerability, scan completeness concerns overall coverage, and troubleshooting scan configurations concerns diagnosing scanner setup issues rather than describing either individual finding here.

Nessus is a general-purpose vulnerability scanner designed to identify known CVEs and misconfigurations across a broad range of hosts. Nikto focuses specifically on web server vulnerabilities, TruffleHog searches for secrets in code repositories, BloodHound maps Active Directory attack paths, and PowerSploit is a post-exploitation PowerShell framework.

An authenticated scan uses valid credentials to log into the target and inspect locally installed software and patch levels, far beyond what is visible from the network alone. An unauthenticated scan only sees externally exposed services, a stealth scan avoids completing TCP handshakes, a container scan targets containerized workloads, and a wireless scan targets Wi-Fi networks.

Certificate transparency logs are public records of issued TLS certificates, revealing subdomains an organization has secured even if not otherwise linked or indexed. Banner grabbing reveals service information, cached pages show archived content, password dumps reveal leaked credentials, and job board analysis reveals technology clues, none of which reveal certificate-issued subdomains directly.

Shodan indexes internet-connected devices and services, Maltego maps relationships between OSINT data points visually, theHarvester harvests email addresses and subdomains from public sources, and WHOIS looks up domain registration and ownership records, each serving a distinct reconnaissance purpose.

A loop repeats a block of code for each item in a collection, exactly what is needed to test every subdomain with the same logic. A conditional makes a decision, a Boolean operator evaluates true/false logic, a string operator manipulates text, and an arithmetic operator performs calculations, none of which alone drive repetition across a list.

Directory enumeration systematically requests common paths to discover hidden or unlinked web content like admin panels or backups. DNS enumeration targets domain records, share enumeration targets network shares, permission enumeration targets access rights, and wireless enumeration targets Wi-Fi networks.

DNS lookups against public DNS infrastructure are a passive OSINT technique revealing subdomains and mail records without direct interaction with the target. Active scanning, banner grabbing, and directory enumeration all involve direct interaction with target systems, and wireless enumeration is unrelated to domain reconnaissance.

PTES defines a complete phase-by-phase penetration testing process from pre-engagement through reporting. OSSTMM focuses on measurable security testing metrics, OWASP Top 10 lists common web application risks, the Purdue model describes industrial network architecture, and DREAD is a risk-rating framework rather than a full testing methodology.

An escalation path defines how to immediately notify appropriate stakeholders when something urgent outside normal reporting cadence is discovered, such as an active real-world compromise. Goal reprioritization adjusts testing objectives, client acceptance concerns sign-off on results, peer review is quality checking, and business impact analysis assesses broader impact rather than providing an immediate notification mechanism.