CompTIA PenTest + PT0-003 (V3) Exam (New Version) Practice Test 3

A system running an unsupported, unpatched OS version is an end-of-life software or system, a high-priority target since it will never receive further fixes. Default configurations concern unchanged factory settings, running services concern what is listening, vulnerable encryption concerns weak cryptography, and defensive capabilities concern detection posture.

Deleting exploitation frameworks, scripts, and binaries uploaded to client systems is specifically the removal of tools. Preserving artifacts keeps evidence rather than deleting it, secure data destruction concerns data the tester collected, spinning down infrastructure concerns the tester's own external systems, and reverting configuration changes addresses altered settings.

Uploading data to a personal cloud storage account, blending in with legitimate traffic, is cloud storage exfiltration. Alternate data streams hide data within a file system, virtual drive mounting creates a local encrypted container, text storage sites paste data to public services, and a DNS covert channel encodes data within DNS traffic.

WinRM is a native Windows remote management protocol built on HTTP/HTTPS that allows remote command and PowerShell session execution. RDP provides graphical remote desktop access, SMB is used for file and printer sharing, LDAP is used for directory service queries, and RPC is a broader remote procedure call mechanism.

A cron job schedules a command to run automatically at fixed intervals on Linux, ensuring the backdoor re-establishes hourly even after a reboot. A registry key is a Windows-specific persistence location, a rootkit hides malicious software, a browser extension is a different vector, and a bind shell describes a listening connection method rather than a scheduling mechanism.

Caldera is a breach and attack simulation platform that orchestrates automated, repeatable adversary emulation exercises from a library of techniques. Impacket is a protocol manipulation library collection, Scapy is a packet crafting library, PowerSploit is a PowerShell post-exploitation framework, and PowerUpSQL focuses on SQL Server enumeration.

Jailbreaking (iOS) or rooting (Android) removes manufacturer and carrier restrictions to gain root-level file system access. Permission abuse misuses granted application permissions, information disclosure describes unintentional exposure of sensitive data, and prompt injection and model manipulation are AI-specific attack techniques unrelated to mobile devices.

Exploiting the flawed WPS PIN validation design is the WPS PIN attack, while sending malformed frames to find crashes is protocol fuzzing. An evil twin attack sets up a rogue access point, signal jamming disrupts communication broadly, and wardriving is a reconnaissance activity rather than either of these two techniques.

A supply chain attack compromises a trusted upstream component, such as a base container image, that propagates into downstream deployments. Container escape breaks out of a container's isolation, trust relationship abuse exploits cross-account permissions, a workload runtime attack targets a running workload's execution, and a metadata service attack targets an instance's credential endpoint.

JWT manipulation exploits a token whose signature is not properly verified, allowing an attacker to alter claims like a user role. Session hijacking steals an existing valid session, API abuse covers broader misuse of API functionality, insecure direct object reference exposes internal references through parameters, and CSRF tricks a victim's browser into unwanted requests.

Unquoted service path injection exploits how Windows parses unquoted paths containing spaces, potentially executing an attacker-placed file instead. Library injection loads a malicious library into a running process, process hollowing replaces a suspended process's memory, a shell escape breaks out of a restricted shell, and log tampering alters log records.

Trying one password across many accounts to avoid lockouts is password spraying, while using previously breached username/password pairs is credential stuffing. A dictionary attack tries many passwords against one account, a mask attack uses a defined pattern, and a brute-force attack systematically tries all combinations rather than relying on breached data.

Using factory-set, never-changed credentials to gain access is specifically the default credentials attack type. An on-path attack intercepts traffic, a relay attack forwards captured authentication material, packet crafting builds custom packets, and multihomed host exploitation abuses a dual-connected host.

Stakeholder alignment ensures testing priorities and expectations remain synchronized between tester and client as new information emerges. Peer review is a quality check among testers, root cause analysis investigates why an issue occurred, business impact analysis assesses organizational consequences, and client acceptance is formal sign-off on final results.

A USB drop leaves malicious removable media where a target is likely to find and use it. Tailgating follows someone through a secured door, a site survey observes physical security controls, badge cloning duplicates access card data, and lock picking manipulates a physical lock mechanism.

A finding that manual verification confirms as accurate is a true positive. A false positive would be an incorrectly flagged non-issue, a false negative a missed real vulnerability, scan completeness concerns coverage, and public exploit selection concerns choosing an exploit for this confirmed finding.

Kube-hunter is specifically designed to hunt for security weaknesses in Kubernetes cluster configurations, such as exposed dashboards. Grype scans container images for known vulnerabilities, TruffleHog searches for exposed secrets, Nikto scans web servers, and OpenVAS is a general-purpose vulnerability scanner.

A sidecar scan specifically targets the auxiliary containers running alongside a main application container. A host-based scan targets a full OS host, a wireless scan targets Wi-Fi networks, a secrets scan searches for exposed credentials, and SAST analyzes source code.

An arithmetic operator performs mathematical calculations such as subtraction. A Boolean operator evaluates true/false logic, a string operator manipulates text, a loop repeats code, and a conditional makes decisions rather than performing a calculation.

Email account enumeration specifically identifies which email addresses at a domain are valid and active. Local user enumeration identifies accounts on a host, share enumeration identifies accessible network shares, wireless enumeration identifies Wi-Fi networks, and permission enumeration identifies access rights.

Sensitive internal information unintentionally exposed to the public is classified as information disclosure. Cached pages refer to archived web content, password dumps refer to leaked credential databases, job board analysis extracts clues from postings, and search engine enumeration uses search engines to systematically find indexed content.

Recon-ng is a modular OSINT reconnaissance framework, conceptually similar to Metasploit, with plugins covering different data sources. Wireshark captures packet traffic, Nmap performs network scanning, and Aircrack-ng and InSSIDer are wireless-focused tools.

A string operator performs operations on text values, such as checking whether one string contains a substring like 'Apache.' An arithmetic operator performs calculations, a Boolean operator evaluates true/false logic, and a loop repeats code, none of which directly perform text pattern matching.

Requiring human verification of AI-generated content against actual evidence is a quality control measure addressing the AI reporting consideration. Legal and ethical considerations concern broader compliance and conduct obligations, format alignment concerns matching an agreed template, and risk scoring concerns how findings are numerically rated.

DREAD produces a numeric score across five risk categories, STRIDE categorizes threats into six named types, OCTAVE is a broader organizational risk assessment methodology focused on critical assets, and MITRE ATT&CK catalogs real-world adversary techniques mapped to known threat groups.