CompTIA PenTest+ Exam PT0-003 Practice Questions

Answer : A

In the scenario where a penetration tester uses the PrintNightmare exploit to create a new user with administrative privileges but still experiences low-privilege access, the tester should log off and log on with the new 'hacker' account to escalate privileges correctly.

PrintNightmare Exploit:

PrintNightmare (CVE-2021-34527) is a vulnerability in the Windows Print Spooler service that allows remote code execution and local privilege escalation.

The provided commands are intended to exploit this vulnerability to create a new user with administrative privileges.

Commands Breakdown:

Import-Module .\PrintNightmare.ps1: Loads the PrintNightmare exploit script.

Invoke-Nightmare -NewUser 'hacker' -NewPassword 'Password123!' -DriverName 'Print': Executes the exploit, creating a new user 'hacker' with administrative privileges.

Issue:

The tester still experiences low privileges despite running the exploit successfully.

This could be due to the current session not reflecting the new privileges.

Solution:

Logging off and logging back on with the new 'hacker' account will start a new session with the updated administrative privileges.

This ensures that the new privileges are applied correctly.

Pentest Reference:

Privilege Escalation: After gaining initial access, escalating privileges is crucial to gain full control over the target system.

Session Management: Understanding how user sessions work and ensuring that new privileges are recognized by starting a new session.

The use of the PrintNightmare exploit highlights a specific technique for privilege escalation within Windows environments.

By logging off and logging on with the new 'hacker' account, the penetration tester can ensure the new administrative privileges are fully applied, allowing for further enumeration and exploitation of the target system.

======

Answer : B, E

Data Loss Prevention (DLP) tools monitor sensitive data and prevent unauthorized exfiltration. The two best options to bypass DLP are:

Compress and encrypt the data (Option B):

Compression reduces file size, making detection harder. Encryption further protects the data by making it unreadable without a key.

DLP tools often inspect content based on known patterns (e.g., credit card numbers, sensitive keywords). Encrypted files bypass content inspection since DLP cannot analyze encrypted data.

Encode the data as Base64 (Option E):

Base64 encoding disguises data by converting it into ASCII text, making it less likely to trigger DLP signature-based detection.

Many DLP systems do not analyze encoded text deeply, assuming it is non-sensitive.

Incorrect options:

Option A (USB flash drive): Physical exfiltration is risky and easily detectable in enterprise environments.

Option C (Rename file extensions): DLP systems analyze content, not just filenames.

Option D (FTP for exfiltration): FTP is monitored by security tools and is a high-risk method.

Option F (Trusted service): Many organizations monitor outbound traffic to cloud storage or email services.

Answer : A

The tester identified an HTTPS downgrade attack (e.g., SSL stripping). The best mitigation is to enforce HSTS (HTTP Strict Transport Security).

HSTS (Option A):

HSTS (Strict-Transport-Security) ensures that the browser always uses HTTPS, preventing downgrade attacks.

Example header:

Strict-Transport-Security: max-age=31536000; includeSubDomains

Incorrect options:

Option B (httponly flag): Protects cookies from JavaScript access but does not enforce HTTPS.

Option C (Firewall rule on port 80): Helps, but does not force browsers to use HTTPS.

Option D (Removing x-content-type-options): Unrelated; nosniff prevents MIME-type sniffing.

Answer : C

Since the client is worried about the availability of their consumer-facing application, the perimeter network web server (Server 3) is the most critical because:

It is internet-facing, making it a prime target for attackers.

A compromise could lead to data breaches, downtime, or service disruptions.

Even though it has fewer vulnerabilities (14 vs. 92 on QA server), its exposure is higher.

Option A (Development sandbox server) : Internal and not publicly accessible.

Option B (Back-office file transfer server) : Important, but not consumer-facing.

Option C (Perimeter web server) : Correct. Publicly accessible and critical to operations.

Option D (Developer QA server) : May have more vulnerabilities, but it's less critical.

Reference: CompTIA PenTest+ PT0-003 Official Guide -- Prioritizing Vulnerability Testing

Answer : B

The most effective next action is to investigate /cgi-bin/debug.sh because it is a direct, high-signal finding: a server-side script in a CGI-enabled directory that is reachable without authentication. In PenTest+ enumeration methodology, testers prioritize items that are both accessible and likely to yield immediate impact, such as unauthenticated administrative/debug endpoints, exposed scripts, and functionality that could enable command execution or information disclosure. A debug shell script exposed through cgi-bin is a classic candidate for sensitive data leakage (paths, environment variables, credentials) or unsafe parameter handling that can lead to remote command execution---especially when mod_cgi is enabled and the file is callable over HTTP.

By comparison, uploading an msfvenom payload assumes a write primitive to /admin and an execution path, neither of which is established by the findings. Nikto can be useful, but it is redundant compared to the specific, actionable lead already identified. Brute-forcing SSH is noisy, may violate rules of engagement, and is less efficient than testing an unauthenticated web-exposed script first.

Answer : B

The command creates a scheduled task that executes a reverse shell payload at logon, ensuring persistence.

Option A (Enumerate tasks) : This command creates a task, not lists tasks (schtasks /query is used for enumeration).

Option B (Establish persistence) : Correct.

The attacker ensures a reverse shell opens every time a user logs in.

Option C (Deactivate Windows Update) : The task is named 'Windows Update' but does not disable updates.

Option D (Create a Windows Update binary) : This executes a reverse shell, not a system update.

Reference: CompTIA PenTest+ PT0-003 Official Guide -- Windows Persistence Techniques

Answer : C

When testing the security of a web application, specific tools are designed to uncover vulnerabilities and issues. Here's an overview of the tools mentioned and why Nikto is the most suitable for this task:

Nikto:

Purpose: Nikto is a web server scanner that performs comprehensive tests against web servers for multiple items, including potentially dangerous files/programs, outdated versions, and other security issues.

Relevance: It is designed specifically for discovering vulnerabilities in web applications, making it the most appropriate choice for a penetration tester targeting a web application.

Comparison with Other Tools:

OpenVAS: A general-purpose vulnerability scanner that targets a wide range of network services and hosts, not specifically tailored for web applications.

Nessus: Similar to OpenVAS, Nessus is a comprehensive vulnerability scanner but is broader in scope and not focused solely on web applications.

sqlmap: This tool is excellent for SQL injection testing but is limited to database vulnerabilities and doesn't cover the full spectrum of web application security issues.

======