CompTIA PenTest + PT0-003 (V3) Exam (New Version) Practice Test 2

Creating a low-level diagram of planned actions is a documentation activity specifically aimed at mapping the attack path before execution. Tool selection concerns choosing a tool, exploit customization concerns modifying an exploit, dependency analysis concerns what a plan relies on, and labeling sensitive systems flags high-risk targets rather than diagramming the sequence.

Reverting configuration changes made during testing, such as re-enabling a temporarily disabled firewall rule, ensures the client's environment returns to its pre-engagement security posture. Leaving it disabled or only documenting it would leave the client weaker than before, and converting it into a recommendation confuses a testing artifact with an actual remediation suggestion.

Alternate data streams are an NTFS feature allowing additional data to be attached to a file without appearing in its visible size or standard directory listing. Steganography hides data within another file's content, virtual drive mounting creates a mountable encrypted container, cloud storage staging uses external cloud services, and a covert DNS channel encodes data within DNS traffic.

Port 445 is associated with SMB, used for Windows file and printer sharing and a common target for lateral movement techniques like share enumeration and credential relay. RDP uses port 3389, SSH uses port 22, LDAP is used for directory services, and RPC is a broader remote procedure call protocol.

A reverse shell has the compromised host initiate the outbound connection, which typically bypasses inbound firewall restrictions since outbound connections are often less restricted. A bind shell instead listens for an inbound connection, which blocking rules would prevent, and a rootkit, scheduled task, and registry key are different persistence or concealment mechanisms.

PowerView is a PowerShell module specifically designed for enumerating AD objects, trusts, and group memberships to find privilege escalation paths. PowerSploit is a broader post-exploitation framework PowerView is often bundled within, PowerUpSQL focuses on SQL Server enumeration, and Impacket is a Python library collection rather than a PowerShell AD enumeration module.

Vishing is voice-based social engineering, such as this phone call to the help desk. Phishing and smishing use email and text messages, a watering hole attack compromises a website the target frequents, and dumpster diving involves physically searching discarded materials.

Setting up a rogue access point with the same SSID is the evil twin attack, while forcibly disconnecting devices with deauthentication frames pushes them toward reconnecting to the rogue one. Signal jamming broadly disrupts communication rather than steering devices to a specific rogue AP, a WPS PIN attack targets a different mechanism, and wardriving is a reconnaissance activity.

A publicly accessible storage bucket containing data that should be restricted is a resource misconfiguration, specifically an exposed storage bucket. A metadata service attack targets an instance's credential endpoint, container escape breaks out of isolation, trust relationship abuse exploits cross-account trust, and a workload runtime attack targets a running workload's execution.

A deserialization attack crafts a malicious serialized object that triggers unintended code execution when the server reconstructs it without proper validation. Cross-site scripting injects malicious scripts, directory traversal accesses files outside an intended directory, SQL injection manipulates database queries, and session hijacking steals an active session token.

Mimikatz is purpose-built to extract plaintext passwords, hashes, and Kerberos tickets directly from Windows memory, making it the standard tool for this task. Other post-exploitation tools like Rubeus or Seatbelt focus on more specific Kerberos abuse or host reconnaissance rather than this broad credential extraction capability.

Using a captured NTLM hash directly for authentication is pass-the-hash, while replaying a captured Kerberos ticket is pass-the-ticket. Pass-the-token involves reusing a captured token from a different protocol context, and password spraying and credential stuffing both involve attempting passwords rather than replaying captured hashes or tickets.

Responder specifically poisons LLMNR and NBT-NS broadcast name resolution requests to capture authentication hashes. Netcat is a general networking utility, msfvenom generates payloads, Impacket is a protocol manipulation library collection, and CrackMapExec is used for lateral movement rather than name resolution poisoning.

The attack narrative tells the story of how the tester progressed step by step, including specific commands and pivots. The executive summary is a high-level overview, detailed findings list vulnerabilities discretely, recommendations describe remediation steps, and methodology describes the general approach rather than the specific narrative of this test.

A site survey observes and documents physical security controls as a reconnaissance step before attempting any bypass. Tailgating, badge cloning, lock picking, and USB drops are all active bypass or delivery techniques rather than this observational documentation step.

A false negative occurs when a real vulnerability exists but the scan fails to detect it, exactly as described with the offline server. A true positive would be a correctly detected real vulnerability, a false positive an incorrectly flagged non-issue, public exploit selection concerns choosing an exploit for a confirmed finding, and troubleshooting scan configurations concerns diagnosing scanner setup rather than describing this missed detection.

BloodHound is purpose-built to map Active Directory relationships and permission chains, visually identifying attack paths to privileged accounts. Nikto scans web servers, TruffleHog searches for secrets, OpenVAS is a general vulnerability scanner, and Trivy scans containers and images.

A stealth scan, such as a TCP SYN scan, avoids completing the full three-way handshake to reduce its detection footprint in logs and IDS alerts. This distinguishes it from a full connect scan, which completes the handshake and is more easily logged by the target.

WAF enumeration specifically aims to uncover the origin server's real IP, often through historical DNS records or misconfigured subdomains, bypassing the WAF entirely. DNS enumeration is broader domain record discovery, directory enumeration finds hidden web paths, and share and permission enumeration find shares and access rights rather than unmasking an origin server.

Network sniffing passively captures live network traffic, including IoT and OT protocol traffic like Modbus and BACnet. Banner grabbing captures service banners from direct connections, certificate transparency review examines TLS certificates, search engine enumeration uses public indexes, and HTML scraping extracts content from web pages.

Amass focuses on in-depth subdomain and attack surface mapping, Recon-ng is a modular OSINT framework similar in concept to Metasploit, SpiderFoot automates aggregation across dozens of sources into one report, and Censys.io indexes internet-wide scan data, each serving a distinct reconnaissance role.

A Boolean operator such as AND combines or evaluates true/false conditions, exactly as this AND combines two conditions that both must be true. A loop repeats code, a string operator manipulates text, an arithmetic operator performs calculations, and a class defines a reusable object structure rather than combining conditions.

Discovering cloud access keys, passwords, API keys, or session tokens exposed in code is specifically secrets enumeration. Permission enumeration identifies access rights, share enumeration identifies accessible network shares, local user enumeration identifies host accounts, and attack path mapping charts routes to a goal rather than finding exposed credentials.

An authorization letter explicitly grants permission for the testing activities and is carried during testing to prove legitimacy if questioned. An NDA protects confidential information, an MSA and SoW define broader business and project terms, and terms of service define usage rules for a product rather than authorizing this test.

Network segmentation divides a flat network into isolated zones, limiting how easily the tester moved laterally to sensitive systems. MFA strengthens authentication, patch management addresses software vulnerabilities, and key rotation and certificate management address cryptographic material rather than network architecture.