[Jan-2025] The Best CompTIA PenTest+ PT0-003 Professional Exam Questions [Q24-Q48]

NO.24 While conducting a reconnaissance activity, a penetration tester extracts the following information:
Emails: – [email protected] – [email protected] – [email protected]
Which of the following risks should the tester use to leverage an attack as the next step in the security assessment?

NO.25 A penetration tester needs to confirm the version number of a client’s web application server.
Which of the following techniques should the penetration tester use?

NO.26 A penetration tester downloads a JAR file that is used in an organization’s production environment. The tester evaluates the contents of the JAR file to identify potentially vulnerable components that can be targeted for exploit. Which of the following describes the tester’s activities?

NO.27 A penetration tester discovers passwords in a publicly available data breach during the reconnaissance phase of the penetration test. Which of the following is the best action for the tester to take?

NO.28 During a penetration test, the domain names, IP ranges, hosts, and applications are defined in the:

NO.29 A penetration tester is performing reconnaissance for a web application assessment. Upon investigation, the tester reviews the robots.txt file for items of interest.
INSTRUCTIONS
Select the tool the penetration tester should use for further investigation.
Select the two entries in the robots.txt file that the penetration tester should recommend for removal.

NO.30 Which of the following describes the reason why a penetration tester would run the command sdelete mimikatz. * on a Windows server that the tester compromised?

NO.31 Which of the following is the most efficient way to infiltrate a file containing data that could be sensitive?

NO.32 A penetration tester has established an on-path position between a target host and local network services but has not been able to establish an on-path position between the target host and the Internet. Regardless, the tester would like to subtly redirect HTTP connections to a spoofed server IP. Which of the following methods would BEST support the objective?

NO.33 A company conducted a simulated phishing attack by sending its employees emails that included a link to a site that mimicked the corporate SSO portal. Eighty percent of the employees who received the email clicked the link and provided their corporate credentials on the fake site. Which of the following recommendations would BEST address this situation?

NO.34 During a security assessment, a penetration tester needs to exploit a vulnerability in a wireless network’s authentication mechanism to gain unauthorized access to the network. Which of the following attacks would the tester most likely perform to gain access?

NO.35 A penetration tester discovered a code repository and noticed passwords were hashed before they were stored in the database with the following code? salt = ‘123’ hash = hashlib.pbkdf2_hmac(‘sha256’, plaintext, salt,
10000) The tester recommended the code be updated to the following salt = os.urandom(32) hash = hashlib.pbkdf2_hmac(‘sha256’, plaintext, salt, 10000) Which of the following steps should the penetration tester recommend?

NO.36 A private investigation firm is requesting a penetration test to determine the likelihood that attackers can gain access to mobile devices and then exfiltrate data from those devices. Which of the following is a social-engineering method that, if successful, would MOST likely enable both objectives?

NO.37 During a penetration test of a server application, a security consultant found that the application randomly crashed or remained stable after opening several simultaneous connections to the application and always submitting the same packets of data. Which of the following is the best sequence of steps the tester should use to understand and exploit the vulnerability?

NO.38 A penetration tester is attempting to discover vulnerabilities in a company’s web application. Which of the following tools would most likely assist with testing the security of the web application?

NO.39 A penetration tester wants to check the security awareness of specific workers in the company with targeted attacks. Which of the following attacks should the penetration tester perform?

NO.40 Which of the following techniques is the best way to avoid detection by data loss prevention tools?

NO.41 During a vulnerability scan a penetration tester enters the following Nmap command against all of the non-Windows clients:
nmap -sX -T4 -p 21-25, 67, 80, 139, 8080 192.168.11.191
The penetration tester reviews the packet capture in Wireshark and notices that the target responds with an RST packet flag set for all of the targeted ports. Which of the following does this information most likely indicate?

NO.42 A penetration tester obtains password dumps associated with the target and identifies strict lockout policies. The tester does not want to lock out accounts when attempting access. Which of the following techniques should the tester use?

NO.43 A potential reason for communicating with the client point of contact during a penetration test is to provide resolution if a testing component crashes a system or service and leaves them unavailable for both legitimate users and further testing. Which of the following best describes this concept?

NO.44 A penetration tester finished a security scan and uncovered numerous vulnerabilities on several hosts.
Based on the targets’ EPSS and CVSS scores, which of the following targets is the most likely to get attacked?

NO.45 Which of the following explains the reason a tester would opt to use DREAD over PTES during the planning phase of a penetration test?

NO.46 A penetration testing team needs to determine whether it is possible to disrupt the wireless communications for PCs deployed in the client’s offices. Which of the following techniques should the penetration tester leverage?

NO.47 A penetration tester performs an assessment on the target company’s Kubernetes cluster using kube-hunter.
Which of the following types of vulnerabilities could be detected with the tool?

NO.48 A penetration tester is developing the rules of engagement for a potential client. Which of the following would most likely be a function of the rules of engagement?