CompTIA PenTest+ (PT0-003) Practice Questions with Explanations

Correct answer: B

Masscan is specifically designed for rapid large-scale port scanning and can scan entire Class B networks (65,536 addresses) very quickly, making it ideal for this time-constrained task. Nmap is thorough but slower; Burp Suite is a web application proxy, not a network scanner; hping is a packet crafting tool, not optimized for large network scans.

Why the other options are wrong:

• A. Burp Suite is a web application testing tool, not designed for network port scanning.
• C. Nmap is capable but significantly slower than masscan for large-scale rapid scans.
• D. hping is primarily used for packet crafting and testing, not efficient port scanning.

Correct answer: D

The payload uses mixed-case script tags (sCRitP, ScriPt) and JavaScript alert function to create an XSS attack. This case-variation obfuscation technique is designed to bypass simple pattern-matching filters. The attack is a cross-site scripting vulnerability, and the appropriate countermeasure is input sanitization to remove or escape dangerous HTML/JavaScript before processing user input.

Why the other options are wrong:

• A. This is not arbitrary code execution; it's a client-side script injection attack, not system-level code execution, and perimeter networks don't prevent XSS.
• B. This is not SQL injection; SQL injection targets databases, not client-side script execution, though WAFs could help with XSS too.
• C. This is not CSRF; CSRF involves forging requests on behalf of authenticated users, not injecting malicious scripts into pages.

Correct answer: A

Port mirroring on a firewall appliance allows passive capture of network traffic without directly accessing or modifying the ICS system itself. This non-invasive technique validates encryption in transit without tampering with the host or voiding support agreements.

Why the other options are wrong:

• B. Installing software on the server constitutes tampering and would void support terms.
• C. Reconfiguring the application is a modification that could void support and warranty terms.
• D. Requesting to disable certificate pinning is a modification of the application's security configuration and could void support terms.

Correct answer: B

A false positive is a vulnerability reported by a scanner that does not actually represent a real security risk. In this case, the SAST tool flagged a command injection vulnerability where response is assigned from user input via innerHTML. However, the tester's analysis reveals that response is defined as a constant and is never used elsewhere in the code, meaning the potentially dangerous value has no impact on the application's execution or security posture. Since the vulnerability cannot actually be exploited or cause harm due to the variable's limited scope and usage, this is a false positive-the scanner incorrectly flagged a non-exploitable code pattern.

Why the other options are wrong:

• A. A false negative would be a real vulnerability that the scanner failed to detect, not a vulnerability that was detected but found to be harmless.
• C. A true positive would be a valid, exploitable vulnerability, but this code presents no actual security risk since the variable is unused.
• D. This is not merely low severity; it is a false positive since the vulnerability cannot actually be exploited in practice.

Correct answer: D

NFS (Network File System) on port 2049/tcp is marked as 'open' and typically operates without strong authentication mechanisms by default. NFS is notoriously vulnerable to unauthorized access, privilege escalation, and data exfiltration when improperly configured. SSH on port 22 is hardened by design, SMTP on port 25 is filtered (not open), and RPCbind on port 111 is less directly exploitable than an exposed file sharing service. An open NFS service represents the most straightforward and high-impact attack vector for gaining unauthorized access to files and system resources.

Why the other options are wrong:

• A. No database service (typically port 3306, 5432, 1433) is shown in the open ports.
• B. SSH (port 22) is marked 'open' but is a hardened remote access service with strong cryptographic protections.
• C. SMTP (port 25) is marked 'filtered', not 'open', making it an inaccessible target.

Correct answer: D

Software Composition Analysis (SCA) is specifically designed to identify vulnerable open- source libraries and dependencies within applications. It scans source code and binaries to locate third-party components and checks them against known vulnerability databases to detect security issues in dependencies.

Why the other options are wrong:

• A. VM (Virtual Machine) is an execution environment, not a tool for identifying vulnerable libraries.
• B. IAST (Interactive Application Security Testing) analyzes running applications but is not specialized for open-source library detection.
• C. DAST (Dynamic Application Security Testing) tests running applications but is not optimized for dependency vulnerability identification.

Correct answer: A

curl <url>?param=http://169.254.169.254/latest/meta- data/ The AWS metadata endpoint at 169.254.169.254/latest/meta-data/ is the standard target for SSRF attacks against cloud instances. This endpoint exposes sensitive information including IAM credentials, instance metadata, and other secrets. By injecting this URL into the vulnerable parameter, the tester can extract cloud-specific secrets and credentials that demonstrate real exploitability of the SSRF vulnerability.

Why the other options are wrong:

• B. 127.0.0.1 targets localhost, not cloud-specific secrets; cloud environments don't expose /etc/passwd in the same way.
• C. This is an XSS payload, not an SSRF exploitation technique.
• D. This URL lacks the metadata path needed to extract actual secrets from the cloud instance.

Correct answer: C

Encryption is the most effective technique to avoid detection by data loss prevention (DLP) tools because encrypted data cannot be inspected by signature-based or content-based detection mechanisms. DLP tools rely on analyzing data content, and encryption renders this analysis impossible. Encoding and compression can be decoded, and obfuscation may still be analyzed by advanced DLP systems.

Why the other options are wrong:

• A. Encoding can typically be decoded by DLP tools during inspection.
• B. Compression can be decompressed and analyzed by DLP systems.
• D. Obfuscation may evade simple pattern matching but advanced DLP tools can still detect it.

Correct answer: D

The /etc/passwd file contains user account information including usernames, user IDs, home directories, and default shells. The cat command displays this file's contents, providing all the enumeration data requested.

Why the other options are wrong:

• A. /etc/shadow contains password hashes and requires root privileges; it doesn't show shell information and is not the standard enumeration file.
• B. /var/usr is not a standard Linux directory path for user information.
• C. ls /home only shows home directory names, not comprehensive user account details like default shells or UIDs.

Correct answer: C

The client is specifically concerned about availability of its consumer-facing production application. Server 3 (Perimeter network web server) is the only server that directly supports consumer-facing production functionality, as it serves as the external-facing web server. Despite having only 14 high-severity vulnerabilities compared to other servers, it is the critical asset that could impact customer availability if compromised or exploited. The other servers (development sandbox, back office file transfer, and developer QA) are internal infrastructure that would not directly affect consumer availability.

Why the other options are wrong:

• A. Development sandbox server is internal infrastructure not directly involved in consumer-facing production services.
• B. Back office file transfer server is internal infrastructure used for administrative purposes, not consumer-facing production.
• D. Developer QA server is an internal testing environment, not a consumer-facing production asset.

Correct answer: A

TruffleHog is specifically designed to scan Git repositories for secrets and hard-coded credentials by analyzing commit history and file contents. Given the short assessment timeline and thousands of code files, an automated tool purpose-built for secret detection is far more effective than manual code review. TruffleHog will systematically search through the local repository clone and identify patterns matching common credential formats.

Why the other options are wrong:

• B. Nikto scans live web applications for web vulnerabilities, not source code for embedded credentials.
• C. Manual code review of thousands of files is impractical within a short timeline.
• D. SCA (Software Composition Analysis) tools focus on dependency vulnerabilities and license compliance, not hard-coded credentials.

Correct answer: A

Eavesdropping is the passive or active interception of communications to gather information. The scenario describes a tester discovering details from a company-wide meeting announcement, which is most consistent with overhearing or listening to communications. This is a direct information gathering technique that requires no technical exploitation.

Why the other options are wrong:

• B. Bluesnarfing targets Bluetooth devices specifically, not company meetings or general communications.
• C. Credential harvesting is used to obtain login credentials, not to gather product information.
• D. SQL injection attacks target databases and require network access to vulnerable applications, irrelevant to discovering announced product details.

Correct answer: D

Channel scanning is the technique used to determine if wireless communications can be disrupted. It involves monitoring and analyzing wireless channels to identify which frequencies are in use and assess vulnerabilities in wireless signal transmission that could be exploited or disrupted.

Why the other options are wrong:

• A. Port mirroring is a network switch feature for monitoring traffic, not for assessing wireless disruption.
• B. Sidecar scanning relates to wireless packet capture, not specifically for disruption assessment.
• C. ARP poisoning is a layer 2 attack for wired networks, not applicable to wireless communication disruption.

Correct answer: B

MSBuild.exe is a Windows legitimate tool that can execute arbitrary code from XML project files. When shellcode is embedded in a .csproj file structure and executed via MSBuild, it represents a living-off-the-land technique that leverages trusted system binaries. The C# shellcode format from msfvenom is compatible with MSBuild's native code execution capabilities.

Why the other options are wrong:

• A. regsvr32 is designed to register/unregister DLL files, not execute code from XML files.
• C. mshta.exe executes HTML/HTA files, not XML project files.
• D. AppInstaller.exe is for installing MSIX application packages, not for executing embedded shellcode from XML.

Correct answer: D

The findstr command with the /C:"pass" flag searches for the string 'pass' across .txt, .cfg, and .xml files. This is a classic technique to enumerate secrets such as hardcoded passwords, API keys, and other sensitive credentials stored in configuration and text files.

Why the other options are wrong:

• A. While configuration files are being searched, the goal is not to enumerate the files themselves but their contents for secrets.
• B. Permissions are not determined by searching for the word 'pass' in text files.
• C. Virtual hosts have nothing to do with searching for password strings in local files.

Correct answer: B

Kerberoasting is an attack that specifically targets Service Principal Names (SPNs). The attacker requests a Kerberos ticket for an SPN account and then attempts to crack the ticket offline. Knowledge of SPN accounts is an absolute prerequisite to launch this attack, as the attacker must know which service accounts to target.

Why the other options are wrong:

• A. Golden Ticket attacks require knowledge of the krbtgt password hash, not SPN information.
• C. DCShadow is a domain controller impersonation attack that doesn't require SPN capture as a prerequisite.
• D. LSASS dumping requires access to a compromised system, not SPN information.

Correct answer: D

An attack narrative provides a detailed, chronological description of the attacks performed, how they were executed, and their impact. This is a core component of professional penetration testing reports that helps clients understand the attack flow and implications. User activities, customer remediation plans, and key management are either client responsibilities or outside typical report scope.

Why the other options are wrong:

• A. User activities during testing are not standard report components.
• B. Customer remediation plan creation is the client's responsibility, not a report component.
• C. Key management details are operational infrastructure concerns, not report content.

Correct answer: D

DREAD is a threat modeling methodology used to identify and prioritize threats based on Damage, Reproducibility, Exploitability, Affected users, and Discoverability. PTES is a comprehensive penetration testing execution standard. DREAD is specifically chosen during the planning phase when the goal is to create a threat model and understand potential risks before conducting the actual test.

Why the other options are wrong:

• A. Web application testing does not specifically require DREAD over PTES.
• B. Mobile application assessment would use similar methodologies but doesn't distinguish DREAD as the primary reason.
• C. Thick client application testing doesn't specifically mandate DREAD over PTES.

Correct answer: C

Scapy is a powerful Python library that allows penetration testers to craft, send, and manipulate network packets with custom flags, sequence numbers, and other fields. It provides programmatic control over packet construction at the protocol level, making it ideal for sending specially crafted packets to vulnerable targets.

Why the other options are wrong:

• A. tcprelay is a tool for relaying TCP connections, not for crafting custom packets.
• B. Bluecrack is a Bluetooth cracking tool, not relevant for crafting IP-level network packets.
• D. tcpdump is a packet capture and analysis tool, not for creating and sending custom packets.

Correct answer: A

EPSS (Exploit Prediction Scoring System) indicates the probability that a vulnerability will be exploited in the wild, while CVSS measures severity. Target 1 has the highest EPSS score (0.6), meaning it has the highest likelihood of being attacked. While CVSS score is also important for severity, EPSS is the better predictor of actual attack likelihood, making Target 1 the most probable to be attacked.

Why the other options are wrong:

• B. Target 2 has both lower EPSS (0.3) and lower CVSS (2) scores than Target 1.
• C. Target 3 has an equal EPSS to Target 1 but a much lower CVSS score (1), making it less attractive to attackers.
• D. Target 4 has a lower EPSS score (0.4) than Target 1, indicating lower attack probability despite having a higher CVSS score.

Correct answer: B

Peer review is a quality assurance process where independent reviewers examine the vulnerability scan report for accuracy, completeness, and clarity before delivery. This directly enhances both quality and reliability by catching errors and ensuring the report meets professional standards. While risk analysis, root cause analysis, and client acceptance are related to vulnerability management, they don't specifically enhance the scan report quality itself.

Why the other options are wrong:

• A. Risk analysis interprets findings but doesn't directly enhance the technical quality of the scan report.
• C. Root cause analysis addresses underlying causes of vulnerabilities but isn't a report quality mechanism.
• D. Client acceptance is an outcome, not a process that enhances report quality.

Correct answer: B

PsExec is a legitimate Windows administration tool that allows remote command execution on other systems. When used with a remote server name (\server01.comptia.org) and cmd.exe, it enables an attacker to execute commands on that remote system, which is a classic lateral movement technique in penetration testing. The -accepteula flag simply suppresses the EULA prompt.

Why the other options are wrong:

• A. While PsExec does test connectivity, the primary objective here is not just connectivity testing but executing commands remotely.
• C. PsExec doesn't send its binary to the target; it executes commands remotely using existing Windows mechanisms.
• D. PsExec doesn't enable CMD.exe; CMD.exe is already available on Windows systems; it simply executes it remotely.

Correct answer: A

A kiosk escape occurs when an attacker breaks out of a restricted single-application environment to access the underlying operating system. The scenario describes exactly this: the tester was confined to a single application but managed to open a terminal and access the OS directly, which is the definition of a kiosk escape.

Why the other options are wrong:

• B. Arbitrary code execution refers to running unintended code through an application vulnerability, not escaping an application's restrictions.
• C. Process hollowing involves replacing a legitimate process with malicious code, not escaping application restrictions.
• D. Library injection involves loading malicious libraries into a process, not breaking out of application confinement.

Correct answer: D

SYN flooding is a Denial of Service attack that overwhelms a server by sending massive numbers of TCP SYN requests, exhausting server resources and making it unavailable to legitimate users. This directly achieves the stated goal of resource exhaustion.

Why the other options are wrong:

• A. IP spoofing is used to mask the source address of traffic but doesn't inherently exhaust server resources.
• B. TCP hijacking involves taking over an existing connection but doesn't exhaust resources on the scale needed for DoS.
• C. Port redirection redirects traffic to different ports but doesn't cause resource exhaustion or unavailability.

Correct answer: A

The testing window (the timeframe during which testing activities are permitted) is a critical element specified in the rules of engagement document. This defines when the penetration tester can conduct their activities without disrupting business operations. The rules of engagement establish the scope, authorization boundaries, and operational parameters for the assessment.

Why the other options are wrong:

• B. Terms of service are general policies, not specific to rules of engagement for a particular assessment.
• C. An authorization letter is a separate document proving consent, not a component of the rules of engagement document itself.
• D. While responsibilities may be mentioned, shared responsibilities are not typically a primary specification of the rules of engagement.

Correct answer: C

The crackmapexec command with the syntax 'smb 192.168.1.0/24 -u user.txt -p Summer123@' is performing password spraying across a subnet. It attempts to authenticate to multiple SMB endpoints using a list of usernames with a single password, which is the definition of password spraying-trying one password against many accounts.

Why the other options are wrong:

• A. Pass-the-hash would use the -H flag for NTLM hashes, not plaintext passwords with -p.
• B. Protocol scanning would use tools like nmap, not credential-based authentication attempts.
• D. Command execution would require the -x flag to specify a command to execute.

Correct answer: D

Proxychains is the standard tool for routing traffic through a compromised host (proxy) to enumerate and attack targets on the internal network. The command 'proxychains nmap -sT <target_cidr>' configures nmap to route all its traffic through the relay host specified in the proxychains configuration file, allowing the attacker to perform network reconnaissance on internal targets from their own machine. This is the proper, established methodology for pivoting through a compromised host.

Why the other options are wrong:

• A. This attempts to pipe nmap output to netcat, which does not establish a proxy relay for subsequent traffic routing.
• B. This creates a named pipe and attempts netcat chaining but the syntax is malformed and does not properly establish a functional relay for nmap enumeration.
• C. This command syntax is broken; it attempts to listen on port 8000 and pipe to netcat, then separately run nmap against localhost:8000, which does not establish proper relay functionality.

Correct answer: A

After inserting a wireless USB dongle, the next logical step is to enable monitoring mode using Aircrack-ng, which allows the adapter to capture wireless traffic and handshakes. Monitoring mode is a prerequisite for capturing WPA2 handshakes needed for further analysis.

Why the other options are wrong:

• B. While Kismet can automate monitor mode enablement, Aircrack-ng is the standard and more direct tool for this specific task in penetration testing.
• C. KARMA is not a standard wireless security tool and is irrelevant to the capture phase.
• D. WIGLE.net is used for researching previously discovered networks but has no role in capturing handshakes from a specific assessment.

Correct answer: A

Sniffing is a passive reconnaissance technique that captures network traffic without sending probes or generating suspicious network activity. It observes existing traffic on the network, making it the least likely to trigger detection mechanisms. Banner grabbing, TCP/UDP scanning, and ping sweeps all actively probe the network and generate suspicious traffic patterns.

Why the other options are wrong:

• B. Banner grabbing requires active connection attempts to services, generating detectable traffic
• C. TCP/UDP scanning actively probes ports and generates numerous connection attempts that IDS/IPS systems detect
• D. Ping sweeps send ICMP packets to multiple hosts, creating obvious reconnaissance traffic

Correct answer: A

A bash for loop requires the 'do' keyword to open the loop body: 'for i in {1..254}; do ... done'. Because the script goes straight from the 'for' line to the 'ping' command, bash reaches an unexpected token where it expected 'do', producing the error '-bash: syntax error near unexpected token `ping''. Adding 'do' after line 2 (either at the end of the for line or on its own line) completes the loop construct and lets the script run.

Why the other options are wrong:

• B. Brace expansion {1..254} works fine in bash; the range is not what triggers the syntax error.
• C. Switching shells does not supply the missing loop keyword - zsh also requires 'do' in a for loop.
• D. $i is the correct variable expansion for concatenating the octet; $[i] would not resolve the missing 'do' error.

Correct answer: A

A substantial increase in DNS traffic during a penetration test commonly indicates covert data exfiltration using DNS tunneling techniques. Attackers encode stolen data into DNS queries (or responses) to exfiltrate information through the DNS protocol, which is typically allowed through firewalls and harder to detect than other exfiltration methods.

Why the other options are wrong:

• B. URL spidering/crawling generates HTTP traffic, not necessarily a significant increase in DNS traffic.
• C. HTML scraping also generates HTTP traffic patterns, not the characteristic DNS traffic spike.
• D. DoS attacks typically generate traffic on the target service ports, not a notable increase in DNS queries/responses.

Correct answer: A

Removing persistence mechanisms from uploaded web shells prevents attackers or other threat actors from exploiting the shells left behind after the assessment. This is a critical cleanup step to avoid leaving backdoors that could compromise the client's security. While infrastructure cleanup and data preservation are important, removing persistence directly addresses the security risk posed by the test artifacts.

Why the other options are wrong:

• B. Spinning down infrastructure is part of cleanup but doesn't specifically prevent shell exploitation.
• C. Preserving artifacts is important for documentation but conflicts with preventing exploitation.
• D. Secure data destruction is valuable but doesn't address active persistence mechanisms.

Correct answer: D

SAST (Static Application Security Testing) analyzes source code and dependencies without executing the application, making it ideal for identifying outdated libraries and components within the codebase. This directly identifies vulnerable library versions in the application.

Why the other options are wrong:

• A. IAST (Interactive AST) analyzes applications during runtime but is more focused on application behavior than library inventory.
• B. SBOM (Software Bill of Materials) is a list of components but not a scanning technique that identifies vulnerabilities.
• C. DAST (Dynamic AST) tests running applications from the outside but is less effective at identifying specific outdated libraries in the codebase.

Correct answer: B

Wireshark is a network packet analyzer that captures and displays packet data in real- time, including plaintext credentials transmitted over unencrypted protocols. It can sniff network traffic and extract credentials from captured packets. While Burp Suite and ZAP are web testing tools and Metasploit is an exploitation framework, Wireshark is specifically designed for capturing and analyzing network traffic including credentials.

Why the other options are wrong:

• A. Burp Suite is a web application testing tool, not a packet sniffer
• C. Zed Attack Proxy is a web application security scanner, not a network packet capture tool
• D. Metasploit is an exploitation framework, not designed for credential capture via packet sniffing

Correct answer: C

Social media is the first step in developing a phishing campaign as it provides publicly available information about target employees, their roles, interests, and relationships. This information is essential for crafting convincing spear phishing emails that appear legitimate and increase the likelihood of success.

Why the other options are wrong:

• A. Shoulder surfing is a physical social engineering technique, not part of initial phishing campaign development.
• B. Recon-ng is useful but would be secondary to gathering basic target information from social media.
• D. Password dumps would only be relevant after identifying and targeting specific individuals.

Correct answer: B

Channel scanning involves systematically scanning Wi-Fi channels to detect wireless networks and their SSIDs. When a phone cannot identify an SSID, it may be hidden or the device needs to scan all channels to locate it. This technique actively searches across channels to enumerate available networks.

Why the other options are wrong:

• A. Sidecar scanning refers to using external devices to analyze traffic, not discovering hidden SSIDs
• C. Stealth scanning is about avoiding detection during reconnaissance, not discovering SSIDs
• D. Static analysis scanning examines code or binaries, not wireless networks

Correct answer: C

Responder.py is a tool that listens for and captures LLMNR, NBT-NS, and MDNS queries on a network, effectively collecting and analyzing network traffic. The -I eth0 flag specifies the network interface and -wP options enable verbose output and WPAD proxy responses. This tool is specifically designed to passively collect network information transmitted over the network for assessment purposes.

Why the other options are wrong:

• A. ntlmrelayx.py is used for NTLM relay attacks, not general network traffic collection.
• B. netcat listening mode does not actively collect protocol-level network information from the subnet.
• D. CrackMapExec is used for active enumeration and exploitation of SMB hosts, not passive traffic collection.

Correct answer: A

Mimikatz is a specialized tool designed to extract credentials and authentication tokens from Windows systems, particularly from memory. After compromising an endpoint in an Active Directory environment, Mimikatz is the standard tool to harvest credentials that can then be used for lateral movement and authentication to other systems.

Why the other options are wrong:

• B. Hasheat (or hashcat) is used to crack password hashes offline, but the goal is to leverage existing credentials for authentication, not crack them.
• C. Evil-WinRM is a tool for remote command execution, but it requires credentials first; Mimikatz is needed to obtain them.
• D. Metasploit creates payloads for exploitation and lateral movement but is not the primary tool for credential harvesting in this scenario.

Correct answer: A

The 'sc config <svc_name> start=disabled' command is used to permanently disable a Windows service so it no longer starts automatically or runs. This allows an attacker to disable security protections like antivirus or firewall services before installing additional payloads.

Why the other options are wrong:

• B. sc query state=all lists services and their states but does not disable them.
• C. pskill terminates a process but only temporarily; the service can restart, and it doesn't permanently disable protection.
• D. net config is not a valid command for disabling services; net commands are typically for network configuration.

Correct answer: C

The SET (Social Engineer Toolkit) is specifically designed to create fake login pages and conduct credential harvesting attacks through phishing. The scenario describes cloning a login page and sending it via email-a textbook SET use case for harvesting credentials. BeEF is for browser exploitation, theHarvester gathers email addresses, and Gophish is a phishing framework (though SET is more accurate for this specific scenario).

Why the other options are wrong:

• A. BeEF is used for browser exploitation post-compromise, not credential harvesting via cloned pages.
• B. theHarvester collects email addresses and metadata, not related to this attack.
• D. While Gophish can conduct phishing, SET is the more specific tool for cloning login pages and harvesting credentials.

Correct answer: A

Preserving artifacts ensures that all key outputs, findings, evidence, and documentation from the penetration test are retained and not lost during cleanup and restoration activities. This is critical for maintaining the integrity of the assessment results and supporting compliance and follow-up activities.

Why the other options are wrong:

• B. Reverting configuration changes is important for cleanup but doesn't directly preserve test outputs.
• C. Keeping chain of custody relates to evidence handling but is secondary to preserving the actual test artifacts.
• D. Exporting credential data is a security risk and should not be part of post-test activities.

Correct answer: E

In cloud environments, SSRF (Server-Side Request Forgery) vulnerabilities in test.comptia.org can be exploited to access the cloud metadata service, which typically runs on an internal IP address (like 169.254.169.254 in AWS). The metadata service contains temporary security credentials that grant access to privileged cloud resources. This is the most direct path to accessing privileged systems not directly internet- accessible.

Why the other options are wrong:

• A. Synchronizing public bucket data is useful but doesn't directly lead to privileged system access; Trufflehog scans for secrets but requires having the data first.
• B. Pacu enumeration requires already having some level of cloud access or valid credentials to execute.
• C. Dictionary brute-force against SSH is noisy, slow, and less likely to succeed than exploiting known vulnerabilities.
• D. XSS phishing is indirect and doesn't guarantee access to privileged systems compared to direct SSRF exploitation.

Correct answer: A

An API (Application Programming Interface) is a specific, testable asset that a penetration tester can target during an assessment. HTTP and ICMP are protocols, not targets themselves. IPA is not a standard IT term in this context. APIs represent discrete, exploitable attack surfaces that should be included in scope definition.

Why the other options are wrong:

• B. HTTP is a protocol used for communication, not a target asset to test.
• C. IPA is not a recognized asset type in penetration testing (possibly India Pale Ale, irrelevant here).
• D. ICMP is a network protocol, not an asset target for testing.

Correct answer: D

To avoid alerting the SOC, data should be encrypted with strong encryption (AES-256) and tunneled over a commonly used, trusted port (443/HTTPS). Port 443 is standard for web traffic and blends in with legitimate network activity. AES-256 provides robust encryption, and HTTPS/443 is harder to detect as malicious compared to other options.

Why the other options are wrong:

• A. Port 25 is SMTP (email) and UTF-8 is encoding, not encryption; this would be suspicious and lacks proper encryption.
• B. Base64 is encoding, not encryption; it provides no security and can be easily decoded; port 80 is unencrypted HTTP.
• C. 3DES is outdated encryption; UDP port 53 is DNS, which would generate suspicious DNS query patterns for data exfiltration.

Correct answer: C

The setspn.exe command with the -Q */* flag queries Active Directory for all service principal names (SPNs). This enumeration step is the direct precursor to Kerberoasting, where attackers identify user accounts with SPNs, request Kerberos tickets for those services, and then crack the encrypted tickets offline to retrieve plaintext passwords. Enumerating SPNs is the essential preparation step for executing a Kerberoasting attack.

Why the other options are wrong:

• A. LDAP injection involves manipulating LDAP queries, not enumerating SPNs.
• B. Pass-the-hash attacks use captured NTLM hashes directly and don't require SPN enumeration.
• D. Dictionary attacks involve brute-forcing passwords, not specifically targeting Kerberos SPNs.

Correct answer: A

Root cause analysis is the process of investigating why something failed or is not performing as expected. When a vulnerability scanner is not providing expected results, conducting a root cause analysis investigates the underlying reasons-whether due to scanner misconfiguration, network issues, firewall blocking, insufficient permissions, or other factors. This is the standard methodology for troubleshooting assessment tool problems.

Why the other options are wrong:

• B. Secure distribution refers to safely delivering software or updates, not diagnosing scanner issues.
• C. Peer review is a quality assurance process, not a diagnostic methodology for scanner problems.
• D. Goal reprioritization involves changing assessment priorities, not determining why a tool isn't functioning.

Correct answer: C

This is a classic example of XSS (Cross-Site Scripting). The attacker injected JavaScript code into an input field that executes in the browser, resulting in a prompt dialog. XSS occurs when untrusted user input is rendered as executable code in the browser context without proper sanitization.

Why the other options are wrong:

• A. SQL injection involves injecting SQL commands into database queries, not JavaScript execution
• B. SSRF (Server-Side Request Forgery) involves making the server send requests, not client-side JavaScript
• D. Server-side template injection occurs in server-side template engines, not client-side JavaScript execution

Correct answer: D

Raking is a lock picking technique where the attacker manipulates the lock pins by rapidly moving a pick back and forth, causing pins to jump and potentially align at the shear line. This is an effective method for quickly opening locks without the original key during physical penetration testing.

Why the other options are wrong:

• A. A plug spinner is used after successful picking to set the lock, not the primary technique for opening
• B. Bypassing refers to circumventing locks entirely rather than picking them
• C. Decoding is not a standard lock opening technique; it relates to analyzing lock mechanics

Correct answer: C

A zone transfer (AXFR) is the technique used to enumerate all DNS records from a domain. The command 'dig axfr @local.dns.server' requests a full zone transfer from the specified DNS server, which returns all records in the zone. This is the standard method for comprehensive DNS enumeration when permitted.

Why the other options are wrong:

• A. dig +short A AAAA only queries specific record types, not all records in the zone
• B. nslookup without AXFR syntax performs standard lookups, not zone transfers
• D. The wildcard (*) syntax in nslookup is incorrect for zone transfers; AXFR requires proper dig syntax

Correct answer: A

The Browser Exploitation Framework (BeEF) is designed to exploit web browsers and conduct client-side attacks, including CSRF exploitation to capture sensitive information from end users through their browsers.

Why the other options are wrong:

• B. Maltego is used for information gathering and data mapping, not for exploiting CSRF vulnerabilities.
• C. Metasploit is primarily for server-side exploitation and payload delivery, not browser- based CSRF attacks.
• D. theHarvester is an OSINT tool for gathering email addresses and subdomains, unrelated to CSRF exploitation.