CompTIA PenTest+ (PT0-003) — All Questions

An application concatenates untrusted user input directly into a database query, allowing an attacker to alter the query's logic. Which vulnerability class is this?

• a.SQL injection✓
• b.Cross-site scripting
• c.Denial of service
• d.Physical tailgating

SQL injection occurs when untrusted input is placed into a database query without proper parameterization, letting an attacker change the query's logic. The defense is to use parameterized queries and input validation. Cross-site scripting targets the browser, not the database.

A web application reflects unsanitized user input back into a page so that attacker-supplied script runs in other users' browsers. Which vulnerability is this?

• a.SQL injection
• b.Cross-site scripting (XSS)✓
• c.ARP spoofing
• d.Password spraying

Cross-site scripting (XSS) occurs when an application includes unsanitized input in a page, causing attacker-controlled script to execute in victims' browsers. Proper output encoding and input validation mitigate it. SQL injection targets the database rather than the browser.

An attacker sends a crafted email impersonating the IT help desk to trick an employee into revealing their password. Which category does this attack fall under?

• a.Buffer overflow
• b.SQL injection
• c.Port scanning
• d.Social engineering (phishing)✓

Phishing is a social-engineering technique that manipulates people into disclosing information or taking unsafe actions, rather than exploiting a technical flaw. Security-awareness training and email controls are key defenses. The other options are purely technical attacks.

During a test, a captured password is stored only as a hash. Which approach would a tester conceptually use to recover the plaintext for weak passwords?

• a.Sending the hash back to the login form unchanged
• b.Emailing the hash to the user for confirmation
• c.Running an offline cracking tool that hashes guesses and compares them✓
• d.Rebooting the domain controller repeatedly

Password cracking works offline by hashing candidate guesses and comparing them to the captured hash, so weak or common passwords are recovered quickly, which is why strong, unique passwords and slow hashing algorithms matter. The other options do not recover the plaintext.

A tester positions themselves between a client and server to intercept and potentially alter traffic that is not properly encrypted. Which attack concept is this?

• a.On-path (man-in-the-middle) attack✓
• b.Cross-site request forgery
• c.SQL injection
• d.Directory brute forcing

An on-path, or man-in-the-middle, attack places the attacker between two communicating parties to intercept or modify traffic, which strong encryption and certificate validation defend against. The other options target applications rather than the communication path itself.

Which tool is a widely used exploitation framework that helps testers develop and execute modules against known vulnerabilities in an authorized engagement?

• a.Nessus
• b.Metasploit✓
• c.Wireshark alone
• d.A spreadsheet application

Metasploit is a popular framework for developing and running exploit modules against known vulnerabilities during authorized testing. Nessus is a vulnerability scanner, Wireshark is a packet analyzer, and a spreadsheet has no exploitation capability.

A tester exploits a low-privileged account and then abuses a misconfigured service to gain administrative rights on the same host. What is this step called?

• a.Reconnaissance
• b.Scoping
• c.Privilege escalation✓
• d.Reporting

Privilege escalation is the act of gaining higher permissions than initially obtained, such as moving from a standard user to administrator, often by abusing misconfigurations. It follows initial access and precedes deeper post-exploitation activity.