CompTIA PenTest+ (PT0-003) — All Questions
5 questions
A tester gathers information about a target organization from public sources such as social media, job postings, and DNS records without sending any packets to the target's systems. Which activity is this?
- a.Active scanning
- b.Exploitation
- c.Passive reconnaissance (OSINT)✓
- d.Privilege escalation
Passive reconnaissance, including open-source intelligence (OSINT), collects information from publicly available sources without directly interacting with the target's systems, making it stealthy. Active scanning sends traffic to the target and is therefore detectable, unlike passive collection.
A tester wants to identify which TCP ports are open on a host and infer the services running behind them. Which tool is most commonly used for this?
- a.Nmap✓
- b.A word processor
- c.A spreadsheet macro
- d.A DNS registrar's billing portal
Nmap is a widely used network scanner for discovering open ports, identifying services, and fingerprinting operating systems. The other options are not scanning tools and cannot enumerate network services.
Which technique attempts to discover valid subdomains and host records for a target domain during reconnaissance?
- a.Password spraying
- b.SQL injection
- c.Buffer overflow
- d.DNS enumeration✓
DNS enumeration queries name-server records to discover subdomains, mail servers, and other hosts, expanding the tester's map of the target's attack surface. The other options are attack techniques against credentials or applications, not reconnaissance of DNS.
A tester uses a search engine that indexes internet-connected devices to find exposed services and their banners for a target's IP ranges. Which resource fits this description?
- a.A word-processing template gallery
- b.Shodan✓
- c.A video streaming service
- d.A spreadsheet pivot table
Shodan indexes internet-connected devices and their service banners, letting testers identify exposed systems and versions during reconnaissance. The other options are unrelated productivity or entertainment tools with no device-discovery capability.
What is the primary purpose of service and operating-system fingerprinting during enumeration?
- a.To permanently delete the target's logs
- b.To encrypt the tester's own hard drive
- c.To identify software versions so known vulnerabilities can be researched✓
- d.To generate an invoice for the client
Fingerprinting identifies the specific services, versions, and operating systems on a target so the tester can research vulnerabilities that apply to those exact versions. It does not delete logs, encrypt disks, or handle billing.