Free CompTIA PT0-003 Exam Dumps Questions & Answers

A penetration tester cannot use Nmap and must perform port discovery and banner grabbing for potential vulnerable SSH services. Given the following script:

Which of the following commands will best help the tester achieve this objective?

• A.  ping -c 22 "$ip_address$i"
• B.  nc "$ip_address$i" ":22"
• C.  curl scp://"$ip_address$i" ":22"
• D.  arp "$ip_address$i" ":22"

SIMULATION 13
A penetration tester performs several Nmap scans against the web application for a client.
INSTRUCTIONS
Click on the WAF and servers to review the results of the Nmap scans. Then click on each tab to select the appropriate vulnerability and remediation options.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

Correct Answer:

The scan shows App01.example.com has ports 80 and 443 open directly to the tester, meaning traffic can reach the application server without passing through the CDN/WAF. Restricting access to only the CDN/WAF and requiring a shared/authenticated header helps ensure requests must come through the approved front-end path.

A tester wants to pivot from a compromised host to another network with encryption and the least amount of interaction with the compromised host. Which of the following is the best way to accomplish this objective?

• A.  Set up a Metasploit listener on the compromised computer and create a reverse shell on the target network.
• B.  Configure a VNC server on the target network and access the VNC server from the compromised computer.
• C.  Create an SSH tunnel using sshuttle to forward all the traffic to the compromised computer.
• D.  Create a Netcat connection to the compromised computer and forward all the traffic to the target network.

During the reconnaissance phase, a penetration tester collected the following information from the DNS records:
A-----> www
A-----> host
TXT --> vpn.comptia.org
SPF---> ip =2.2.2.2
Which of the following DNS records should be in place to avoid phishing attacks using spoofing domain techniques?

• A.  MX
• B.  CNAME
• C.  SOA
• D.  DMARC

Which of the following should a penetration tester do when conducting post-engagement cleanup?

• A.  Return the system to its original state.
• B.  Shut down the infected system.
• C.  Close any open ports.
• D.  Delete all activity logs.