CompTIA PenTest+ Exam PT0-003 Practice Questions

Answer : D

Importance of a Clear Executive Summary:

The executive summary is essential because it provides decision-makers with a concise overview of the findings, risks, and recommendations without requiring deep technical knowledge.

Clarity in objectives ensures that all stakeholders understand the purpose, scope, and outcomes of the test.

Why Not Other Options?

A: Keeping video and audio records is helpful during testing but not typically included in the final report for handling purposes.

B: Limiting the report to 5--10 pages may compromise its comprehensiveness and omit critical details.

C: Recommendations based solely on the risk score may not address the broader context or organizational priorities.

CompTIA Pentest+ Reference:

Domain 5.0 (Reporting and Communication)

Answer : D

The system is most likely a Domain Controller because the exposed services strongly match Active Directory infrastructure. Kerberos on TCP 88 is a core authentication service used by Active Directory domains. LDAP on TCP 389 is used for directory queries, authentication-related lookups, and domain object enumeration. SMB on TCP 445 is commonly present on Windows servers and is heavily used by domain controllers for SYSVOL, NETLOGON, policy distribution, and administrative operations. The scan also exposes NetBIOS domain information and a DNS domain name, which further indicates that the host participates in domain identity services. DNS is also commonly hosted on domain controllers because Active Directory relies heavily on DNS records for domain location and service discovery. While SMTP and HTTPS may be present, they do not override the significance of Kerberos, LDAP, SMB, and domain metadata appearing together. A stand-alone web server would not normally expose Kerberos and LDAP domain services. A mail server would emphasize SMTP/IMAP/POP services. A honeypot is possible in theory, but there is no explicit deception indicator. This maps to study-guide topics covering Nmap interpretation, service fingerprinting, Active Directory enumeration, and infrastructure role identification.

Answer : B

Shodan is a search engine that specializes in finding internet-connected devices, including ICS, IoT, webcams, routers, and servers. Attackers and security professionals use Shodan to scan for publicly accessible systems that may be vulnerable.

Option A (theHarvester) : theHarvester is primarily used for OSINT (Open-Source Intelligence) gathering, such as email addresses, subdomains, and hostnames, but it does not specialize in ICS/IoT discovery.

Option B (Shodan) : Correct. Shodan scans the internet for connected devices and services, allowing penetration testers to find ICS/IoT systems that are exposed.

Option C (Amass) : Amass is used for subdomain enumeration and DNS reconnaissance, not for ICS or IoT discovery.

Option D (Nmap) : Nmap is a port scanner that can identify live hosts and open ports, but it does not search for publicly available systems on a large scale like Shodan.

Reference: CompTIA PenTest+ PT0-003 Official Guide -- OSINT and Reconnaissance

Answer : B

Risk scoring is the report element that most directly enables an organization to prioritize remediation work because it translates technical findings into an ordered view of business risk. In PenTest+ reporting guidance, testers are expected to communicate not only what is vulnerable but also how severe the issue is and how likely it is to be exploited, often incorporating factors such as exploitability, impact, exposure, and the presence of compensating controls. This produces a defensible ranking that helps stakeholders decide what to fix first when time and resources are limited.

Proof of concept supports validation by demonstrating that exploitation is possible, but it does not inherently provide comparative urgency across multiple findings. An attack narrative explains the path the tester used to achieve objectives (useful for understanding chaining and scope impact), but it is typically descriptive rather than a prioritization mechanism. The executive summary is aimed at leadership-level communication and overall posture, yet it usually depends on underlying risk ratings to justify what should be addressed first. Therefore, risk scoring most directly drives remediation prioritization.

Answer : A

The rpcclient prompt indicates that the tester has connected to a system using an RPC client, commonly associated with Samba/SMB enumeration. From this interface, a tester can query information exposed through Microsoft RPC interfaces, including users, groups, domain information, shares, privileges, and security identifiers, depending on the level of access granted. Commands such as enumdomusers, queryuser, enumdomgroups, and related RPC calls are commonly used for account and domain enumeration. This makes ''query local users on the system'' the best answer. The tool does not inherently dump the SAM database or extract password hashes; that would require privileged file or registry access and different tooling, such as hash dumping utilities or post-exploitation frameworks. Enumerating session tokens is a local privilege/post-exploitation activity, not the primary purpose of rpcclient. Changing Resultant Set of Policy would require administrative control over Group Policy infrastructure and is not a normal RPC enumeration function. This aligns with study-guide topics covering SMB/RPC enumeration, network service discovery, account enumeration, and authenticated versus unauthenticated information gathering.

Answer : C

Installation:

Nmap can be installed on various operating systems. For example, on a Debian-based system:

sudo apt-get install nmap

Basic Network Scanning:

To scan a range of IP addresses in the network:

nmap -sP 192.168.1.0/24

Service and Version Detection:

To scan for open ports and detect the service versions running on a specific host:

nmap -sV 192.168.1.10

Enumerating Domain Systems:

Use Nmap with additional scripts to enumerate domain systems. For example, using the --script option:

nmap -p 445 --script=smb-enum-domains 192.168.1.10

Advanced Scanning Options:

Stealth Scan: Use the -sS option to perform a stealth scan:

nmap -sS 192.168.1.10

Aggressive Scan: Use the -A option to enable OS detection, version detection, script scanning, and traceroute:

nmap -A 192.168.1.10

Real-World Example:

A penetration tester uses Nmap to enumerate the systems within a domain by scanning the network for live hosts and identifying the services running on each host. This information helps in identifying potential vulnerabilities and entry points for further exploitation.

Reference from Pentesting Literature:

In 'Penetration Testing - A Hands-on Introduction to Hacking,' Nmap is extensively discussed for various stages of the penetration testing process, from reconnaissance to vulnerability assessment.

HTB write-ups often illustrate the use of Nmap for network enumeration and discovering potential attack vectors.

Penetration Testing - A Hands-on Introduction to Hacking

HTB Official Writeups

======

Answer : B

The missing do keyword is the reason for the syntax error. Bash for loops must include a do statement before executing commands within the loop.

Corrected script:

#!/bin/bash

for i in {1..254}; do

ping -c1 192.168.1.$i

done

From the CompTIA PenTest+ PT0-003 Official Study Guide (Chapter 4 -- Scanning and Enumeration):

''In Bash scripting, control structures like for-loops require correct syntax, including the 'do' keyword for loop logic to execute properly.''