CompTIA PenTest + PT0-003 (V3) Exam (New Version) Practice Test 4

Documenting the chain of prerequisites is addressing dependencies within capability selection. Tool selection concerns which tool to use, scope limitations concern boundaries on what can be tested, labeling sensitive systems flags high-risk targets, and exploit customization concerns modifying an exploit for the target.

Decommissioning external attacker-controlled infrastructure like a C2 server or phishing domain is specifically spinning down infrastructure. Removing persistence mechanisms and reverting configuration changes address the client's own systems, preserving artifacts keeps evidence, and secure data destruction concerns properly disposing of collected data.

Pasting data into a public text-sharing site for later retrieval is specifically the text storage sites exfiltration technique. Alternate data streams hide data within a file system, virtual drive mounting creates a local encrypted container, cross-account resources move data between cloud accounts, and a covert DNS channel encodes data within DNS traffic.

rundll32 is a legitimate, signed Windows utility that can be abused to execute malicious code from a DLL, making it a commonly used LOLBin since it avoids dropping a separate flagged executable. Other LOLBins listed in the objectives, such as msbuild or mmc.exe, serve similar purposes through different underlying legitimate functionality.

A malicious browser extension installed to persistently capture data across sessions is specifically the browser extension persistence mechanism. A rootkit hides malicious software at the OS level, a scheduled task and registry key are other Windows-specific persistence techniques, and a backdoor web shell provides access through a web server.

PowerUpSQL is specifically built to discover and attack SQL Server instances within an AD environment. PowerView focuses on broader AD object and trust enumeration, PowerSploit is a general post-exploitation framework, generic AD search scripts are not a specific named tool, and Impacket is a Python library collection.

Modbus is a widely used, often unencrypted and unauthenticated industrial protocol for communicating with PLCs, and crafting commands against it is a Modbus attack. A CAN bus attack targets vehicle and embedded systems, and RFID attacks, NFC attacks, and bluejacking target short-range wireless technologies.

Smishing is SMS-based phishing, exactly as described. Vishing uses voice calls, whaling specifically targets executives, spearphishing is a personalized email attack, and a watering hole attack compromises a website the target frequents.

A service account granted excessive permissions beyond what it needs is an IAM misconfiguration, a common and high-impact cloud security weakness. A metadata service attack targets an instance's credential endpoint, container escape breaks out of container isolation, a workload runtime attack targets a running workload's execution, and logging information exposure concerns sensitive data leaking through logs.

Insecure direct object reference occurs when an application exposes internal references, like a sequential invoice ID, without properly verifying authorization to access that object. Cross-site scripting injects malicious scripts, SSRF tricks the server into making unintended requests, CSRF tricks a victim's browser into unwanted requests, and a deserialization attack exploits unsafe object reconstruction.

Disabling an EDR agent to operate undetected is specifically circumventing security tools. Privilege escalation gains higher-level access, payload obfuscation disguises malicious code's signature, log tampering alters log records, and a shell escape breaks out of a restricted shell environment.

Manipulating a signed assertion for enterprise single sign-on describes a SAML attack, since SAML uses XML-based signed assertions, while exploiting a JSON-token-based identity protocol describes an OIDC attack, since OpenID Connect uses JSON Web Tokens. Kerberos attacks target Windows domain authentication tickets, LDAP injection manipulates directory queries, and pass-the-token reuses a captured token rather than exploiting either protocol's format directly.

A relay attack captures an authentication attempt and forwards it to a different target in real time, authenticating there without knowing the credentials. An on-path attack intercepts traffic without necessarily redirecting authentication elsewhere, VLAN hopping crosses segmentation boundaries, packet crafting builds custom packets, and multihomed host exploitation abuses a dual-connected host.

Technical controls are enforced through technology such as MFA, administrative controls are policy-based such as a password complexity requirement, physical controls are tangible barriers such as biometric scanners, and operational controls govern day-to-day personnel practices such as mandatory vacations, which help surface fraud or misuse by rotating trusted personnel out periodically.

Badge cloning captures and duplicates the data from a proximity access card, exactly as described with the RFID reader. Tailgating follows someone through a door, a site survey observes physical controls, a USB drop leaves malicious media for someone to find, and lock picking manipulates a physical lock mechanism.

Comparing scanned hosts against the full asset inventory to identify gaps in coverage is assessing scan completeness. True and false positive rates concern detection accuracy on hosts actually scanned, public exploit selection concerns choosing an exploit for a confirmed finding, and troubleshooting scan configurations is the subsequent step of fixing the routing issue.

Trivy scans container images for known vulnerabilities in OS packages and application dependencies before deployment. BloodHound maps Active Directory attack paths, Nikto scans web servers, TruffleHog searches for exposed secrets, and PowerSploit is a post-exploitation PowerShell framework.

Extending static application security testing to Infrastructure as Code configuration files, such as Terraform definitions, catches misconfigurations before infrastructure is ever deployed. This differs from scanning a running application or an already-built container image, since IaC scanning happens against the definition files themselves.

Hunter.io is specifically designed to find email address naming patterns and specific addresses associated with a domain. Amass focuses on subdomain and attack surface mapping, and Aircrack-ng, Wireshark, and InSSIDer are wireless or packet-analysis tools.

Importing a pre-built module with ready-made functions is exactly the use of libraries, functions, and classes to avoid rewriting common logic. Loops repeat code, conditionals make decisions, and Boolean and arithmetic operators evaluate logic or perform calculations rather than describing code reuse.

Host discovery identifies which IP addresses have an active, responding host, as a precursor to deeper enumeration. Service discovery identifies what is running on already-discovered hosts, protocol enumeration identifies protocols in use, share enumeration identifies accessible shares, and DNS enumeration identifies domain records.

Reviewing job postings for clues about a target's technology stack is job board analysis, a passive OSINT technique. Password dumps refer to leaked credential databases, cached pages refer to archived web content, certificate transparency logs reveal issued TLS certificates, and network sniffing captures live traffic.

SpiderFoot automates OSINT collection across dozens of public data sources simultaneously, compiling results into a correlated report. Nmap performs network scanning, Wireshark captures packet traffic, and Aircrack-ng and InSSIDer are wireless-focused tools.

Investigating why a finding occurred, including reconciling it against a disputed compensating control, is root cause analysis. Peer review is a quality check by colleagues, goal reprioritization adjusts objectives, business impact analysis assesses organizational consequences, and secure distribution concerns how the report is safely shared.

Under the shared responsibility model for infrastructure-as-a-service, the customer is responsible for patching the guest OS and anything running on top of it, while the provider handles the underlying infrastructure and hypervisor. The provider's responsibility ends at the infrastructure layer, and a third party or the tester are not responsible for OS patching within this framework.