CompTIA PenTest+ Practice Test (PT0-003)

Unique identifiers tie every test action to a specific, pre-approved asset. This minimizes the chance of accidentally probing out-of-scope hosts, preserves audit-trail clarity, and supports legal and contractual limits defined in the rules of engagement. By contrast, tagging does not bypass defensive tools, remove authorization requirements, or guarantee service continuity during disruptive tests.

This utility is widely recognized for capturing user logon data stored in memory on Windows systems, serving as a common method to move laterally or escalate privileges. Acquiring ephemeral key pairs is not its main function, wiping logs is typically done with other solutions, and vulnerability scanning focuses on detecting flaws rather than retrieving credentials.

By showing how the flaw executes code, there is clear evidence confirming the vulnerability. Renaming or isolating the library does not demonstrate actual exploitation. Concluding it remains safe due to filtering ignores alternative attack vectors. Removing it outright before confirming the exploit might interrupt critical services.

This choice provides configurable modules for multiple architectures and can be easily combined with other well-known tools. The alternatives are more specialized in other areas: one focuses on password trials, another on capturing broadcast requests, and another on simple network connections, so they do not readily offer the same versatile module creation functionality.

A session token functions as proof of an already authenticated and authorized session. If an attacker retrieves a valid token before it expires, the attacker can impersonate the user and carry out any actions the account is permitted to perform, bypassing password and MFA checks until the token is revoked or times out. Tokens are not automatically invalidated by browsers, nor are they inherently encrypted against reuse, so exposure presents an immediate threat. Rapid expiration also does not prevent exploitation, because many critical actions can be executed in seconds.

Adjusting account roles through scheduled audits addresses the root cause by ensuring the principle of least privilege. Increasing passphrase complexity does not correct high-level rights granted by default. Enabling additional checks during authentication strengthens login protocols but does not limit unneeded privileges. Rotating credentials on a routine basis is useful, though it also fails to remove unnecessary rights.

A reverse shell is used to bypass firewalls that block incoming connections. The compromised target machine initiates an outbound connection to a listener on the attacker's machine, granting remote command execution. A bind shell would fail because it requires the attacker to connect to an open port on the target, which is blocked by the firewall. A web shell provides command execution through a web interface but does not inherently describe the method of an outbound connection to a listener for an interactive shell. Pivoting is a technique for moving laterally to other systems within the network after a host has been compromised; it is not the method for establishing the initial shell.

The Wayback Machine is an internet archive that stores historical snapshots of websites. Penetration testers can use it to find old pages, directories, and files that are no longer linked on the current version of a site but may still be accessible on the server. Shodan is used to find internet-connected devices, Nmap is for network scanning and service discovery, and WHOIS is for retrieving domain registration information.

The hashdump command (or the post/windows/gather/smart_hashdump module) is built into Meterpreter and extracts password hashes from the SAM database entirely in memory, avoiding external binaries, scheduled tasks, or registry changes that could alert the user or security tools. Listing processes, enabling WDigest, or uploading an external Mimikatz executable either fails to provide SAM hashes immediately or creates additional artifacts that increase the risk of detection.

This is an example of a false negative, where a valid concern goes undetected by the scanning tool or configuration. This differs from a true positive, which confirms a legitimate finding, or a false positive, which incorrectly flags a harmless service. Connectivity issues that disturb the scan do not necessarily mean a gap remains missed, and confirming a gap means it was ultimately recognized by the testing process.

Confirming exact scope details in writing and excluding anything not specified helps testers avoid unauthorized activities. One option suggests scanning everything, which can exceed boundaries. Another suggests excluding networks based on responsiveness, which risks omitting critical resources. Another recommends investigating new endpoints when discovered, which may overstep the agreement. Ensuring all items match the contract eliminates guesswork and keeps testing within the agreed scope.

Placing public key data in the legitimate user's configuration file maintains a reliable, encryption-based login and reduces the risk of detection by standard security controls. Creating a custom service can be noticed or disabled by administrators, modifying the firewall introduces connection discrepancies, and injecting a Trojan into a library is more complex and more likely to be detected.

RPC/DCOM begins by contacting the RPC Endpoint Mapper on TCP port 135. The mapper returns an ephemeral port-by default chosen from the dynamic range 49152-65535 on modern Windows-and all subsequent RPC/DCOM traffic for that session uses that dynamic port. Therefore, administrators must open a range of high-numbered ports in addition to TCP 135. Options that claim only a single well-known port or the wrong well-known ports are incorrect.

The technique is known as leveraging living-off-the-land binaries (LOLBins). Instead of introducing new malware, the attacker repurposes legitimate, signed utilities that the operating system and security controls inherently trust. Because these binaries blend in with normal administrative activity, signature-based or reputation-based defenses often overlook the malicious behavior. DLL sideloading, zero-day exploitation, and watering-hole attacks involve different mechanisms and do not rely on executing payloads through trusted native utilities.

Re-imaging from a known snapshot taken prior to the test sets the system back to its exact configuration before any changes were introduced. It addresses both manual updates and any inadvertent modifications that might have gone unrecorded, and it avoids the need to track down each change. Other approaches rely significantly on documentation and memory, which increases the chance of leaving some modifications in place.

The most effective initial step is to change the default password and disable the account if possible. This action directly remediates a high-risk vulnerability with minimal to no risk of causing system downtime, adhering to the rules of engagement. While applying patches is also critical, this action carries a risk of service interruption and should be tested and performed during a planned maintenance window, making it a less suitable initial action given the RoE constraints. Placing the server in a quarantined segment is a good compensating control but does not remediate the underlying vulnerability on the host itself. Configuring a host-based intrusion detection system (HIDS) is a detective control; it will only alert on potential breaches rather than preventing them, making it less effective than a direct preventative remediation.

Following each discovered link allows an automated crawler to navigate through all connected pages, revealing elements that might otherwise be missed by incomplete manual checks. Parsing credentials or performing zone transfers do not uncover the site's internal content in a structured manner, and scanning random ports will not list pages that exist on those ports.

Impersonating a known coworker and referencing an ongoing task adds legitimacy, and providing a link that looks similar to the official login page can reduce doubts. Urgent or broad demands typically increase suspicion among recipients, and proposals with unfamiliar motives are less likely to succeed because they stand out as unusual requests.

Using a method that identifies hostnames tied to known addresses can reveal hidden infrastructure not detected by forward lookups. This helps examiners discover additional targets or services. Other choices either involve functions that do not relate to acquiring new information about unknown hosts or are unrealistic outcomes of this type of query.

Scheduled leave periods ensure a rotation of responsibilities, which brings fresh oversight to processes that might mask unauthorized or questionable actions. When others assume those tasks, discrepancies can be spotted. Answers focused on purely morale or cost savings do not address the detection of unusual patterns that might be more apparent when the routine cycle is interrupted.