CompTIA PenTest + PT0-003 (V3) Exam (New Version) Practice Test 5

The presence or absence of detection and defensive measures like EDR, SIEM logging, and host firewalls is the defensive capabilities factor, since a weakly defended target allows more stealthy testing. Running services concern what is actively listening, default configurations concern unchanged factory settings, vulnerable encryption concerns weak cryptography, and end-of-life software concerns unsupported systems.

Securely archiving evidence like screenshots, command output, and captured credentials before disposing of anything else is preserving artifacts, ensuring the report can be properly substantiated. Removing tools and reverting configuration changes address the client's systems, secure data destruction happens after artifacts are preserved, and spinning down infrastructure concerns the tester's own external systems.

Staging data inside an encrypted container mounted as a virtual drive only when needed is virtual drive mounting. Alternate data streams hide data within NTFS file attributes, text storage sites paste data to public websites, cross-account resources move data between cloud accounts, and steganography hides data within another file's content such as an image.

Proxychains routes arbitrary tools through a proxy chain, sshuttle creates a transparent tunnel over SSH, CrackMapExec automates authentication and enumeration across many hosts at once, and Netcat is a flexible general-purpose networking utility, each serving a distinct role in lateral movement tooling.

Using a captured legitimate credential to regain access repeatedly, without installing additional software, is the persistence technique of obtaining valid account credentials. A backdoor and rootkit both involve installing something on the target system, and a scheduled task and registry key are other Windows-specific persistence mechanisms.

Impacket is a Python library collection specifically providing low-level access to construct and manipulate protocols like SMB and Kerberos. Scapy is a more general packet crafting library not specific to these Windows protocols, PowerSploit and PowerView are PowerShell-based tools, and Caldera is a breach and attack simulation orchestration platform.

Bluejacking sends unsolicited messages to nearby Bluetooth devices without pairing or extracting data. NFC and RFID attacks target different short-range wireless technologies, Bluetooth spamming typically refers to overwhelming a device or channel with excessive traffic, and register manipulation is an OT attack technique unrelated to Bluetooth.

A watering hole attack compromises a site the target is known to frequent rather than attacking them directly. Phishing and spearphishing involve direct email-based deception, impersonation involves posing as a trusted person or entity directly, and credential harvesting collects login information through a fake portal.

Broadcasting radio frequency noise to degrade or disrupt wireless communication broadly is signal jamming. Deauthentication forcibly disconnects specific clients using crafted management frames, an evil twin attack sets up a rogue access point, a WPS PIN attack targets a specific authentication mechanism, and wardriving is a reconnaissance activity.

A collision attack finds two different inputs that produce the same hash output under a weak hashing algorithm, undermining systems relying on hash uniqueness. A brute-force attack systematically tries combinations to find a specific match, session hijacking steals an active session, directory traversal accesses files outside an intended directory, and arbitrary code execution runs attacker-controlled code.

Breaking out of a restricted kiosk application's locked-down interface to reach the underlying OS is specifically kiosk escape. A shell escape breaks out of a restricted command shell rather than a kiosk GUI application specifically, library injection loads malicious code into a running process, process hollowing replaces a suspended process's memory, and log tampering alters log records.

Manipulating login input to alter a directory service query's logic is LDAP injection, while forging a ticket-granting ticket to impersonate any domain user is a Kerberos attack. SAML and OIDC attacks target different federated identity protocols, and a dictionary attack tries candidate passwords rather than manipulating query syntax or forging tickets.

Exploiting a host connected to multiple network segments to route traffic between them, bridging networks that should be isolated, is multihomed host exploitation. VLAN hopping crosses trunking-based boundaries specifically, an on-path attack intercepts traffic between two parties, a relay attack forwards captured authentication material, and share enumeration lists accessible network shares.

The Purdue model describes hierarchical levels in industrial control environments, from field devices up through enterprise systems, used to understand segmentation boundaries. MITRE ATT&CK catalogs adversary techniques, OWASP Top 10 lists web application risks, CREST is a professional accreditation body, and OCTAVE is a broader organizational risk assessment methodology.

Lock picking manipulates a physical lock's internal mechanism to open it without the correct key or credential. Tailgating follows an authorized person through a door, badge cloning duplicates access card data, a USB drop leaves malicious media for someone to find, and a site survey observes and documents physical security controls.

Diagnosing and fixing the underlying cause of a scan problem, such as expired credentials, is troubleshooting scan configurations. Public exploit selection concerns choosing an exploit for a confirmed finding, scan completeness assessment identifies the coverage gap itself, false positive review concerns individual finding accuracy, and scripting to validate results uses code to confirm specific findings.

TruffleHog is specifically designed to scan Git repository history, including old commits, for accidentally committed secrets. Nikto scans web servers, Kube-hunter hunts for Kubernetes cluster weaknesses, Grype scans container images for vulnerabilities, and BloodHound maps Active Directory attack paths.

Software composition analysis identifies third-party open-source components and flags known vulnerabilities among them, without analyzing custom code. SAST analyzes the organization's own source code, DAST tests a running application, IAST combines static and dynamic techniques during runtime, and a mobile scan targets mobile-specific concerns.

Using advanced search engine operators to find indexed content on a target's domain is search engine analysis or enumeration. Network sniffing captures live traffic, banner grabbing captures service information from direct connections, HTML scraping extracts content from pages already being visited, and certificate transparency logs reveal issued TLS certificates.

Censys.io indexes internet-wide scan results, including certificate data, making it well suited to finding hosts with a specific outdated TLS configuration. Aircrack-ng, InSSIDer, and WiGLE.net are wireless-focused tools, and Wireshark captures live packet traffic rather than searching pre-indexed scan data.

A conditional executes a specific action only if a condition, such as the port being 443, evaluates as true, which is exactly the branching behavior described. This differs from a loop, which repeats an action across a collection regardless of a specific condition on each item.

Systematically checking what access rights an account has to specific resources is permission enumeration. Share enumeration identifies which network shares exist, local user enumeration identifies accounts on a host, secrets enumeration searches for exposed credentials, and attack path mapping charts a broader route to a goal.

Searching public breach databases for previously leaked credentials associated with a domain is the password dumps OSINT category. Cached pages refer to archived web content, certificate transparency logs reveal issued TLS certificates, job board analysis extracts clues from postings, and network sniffing captures live network traffic.

Key rotation periodically replaces cryptographic keys, limiting the window during which a compromised key remains exploitable. Network segmentation restricts network paths, system hardening reduces attack surface broadly, MFA strengthens user authentication, and role-based access control governs permission assignment.

Documenting what was not tested, such as an excluded site or credentials never received, is the test limitations and assumptions section. The executive summary is a high-level overview, methodology describes the general approach, the attack narrative walks through the specific attack path, and recommendations describe remediation steps.