Pass the CompTIA PenTest+ PT0-003 Questions and answers with CertsForce

Comprehensive and Detailed Explanation From Exact Extract:

net.exe is the classic Windows networking utility that includes commands for enumerating domain resources and accounts from a compromised host where the tester has any authenticated domain context. Typical commands used by penetration testers to enumerate domain users with net.exe include:

net user /domain — lists domain user accounts (name and some properties).

net group "Domain Users" /domain — lists members of the Domain Users group.

net view /domain — lists computers in the domain (useful to find targets for further enumeration).

Why net.exe is the best option here:

It is installed by default on Windows systems and works with the current authenticated domain credentials (common after gaining a foothold).

It provides a quick, low-noise way to enumerate user accounts and groups without requiring additional tooling or elevated privileges beyond an authenticated domain user.

Results can be scripted and parsed for further enumeration and pivoting.

Why the other options are not appropriate:

A. pwd.exe — Not a standard Windows tool for domain enumeration (and not present by default).

C. sc.exe — Service Controller tool for managing services; not used to enumerate domain users.

D. msconfig.exe — System configuration GUI utility for startup/services; not for domain account enumeration.

Related alternatives (contextual, commonly used in pentests):

dsquery user -limit 0 (on systems with RSAT/AD tools) to query AD directly.

Get-ADUser -Filter * (PowerShell, requires the ActiveDirectory module and appropriate rights).

Tools like PowerView (PowerShell) or BloodHound (collection phase) can provide richer AD enumeration, but net.exe is the simplest built-in option to enumerate domain users from an authenticated foothold.

CompTIA PT0-003 Objective Mapping (summary):

Domain 2.0 Information Gathering and Vulnerability Scanning — enumerate network and Active Directory objects using native tools and scripts (e.g., net.exe for domain user enumeration).

The EPSS (Exploit Prediction Scoring System) estimates how likely a vulnerability is to be exploited. Higher EPSS scores indicate a higher likelihood of exploitation.

Option A (Target 1) ✅:

EPSS 0.6 (60% chance of exploitation)

CVSS 4 (Medium severity)

✅ Best candidate since it has the highest likelihood of exploitation.

Option B (Target 2) ❌: EPSS 0.3 (30%) is lower, making it less likely to be attacked.

Option C (Target 3) ❌: EPSS 0.6 is high, but CVSS 1 is very low, meaning the vulnerability is not critical.

Option D (Target 4) ❌: CVSS 4.5 is higher, but EPSS 0.4 is lower, meaning attackers are less likely to exploit it.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Vulnerability Prioritization with EPSS & CVSS

The tester gained information by listening to a private discussion, which is eavesdropping (passive reconnaissance).

Option A (Eavesdropping) ✅: Correct.

Involves intercepting conversations via audio, network traffic, or wireless signals.

Option B (Bluesnarfing) ❌: Stealing data via Bluetooth, which is not mentioned.

Option C (Credential harvesting) ❌: No password collection occurred.

Option D (SQL injection) ❌: SQLi affects databases, not voice communications.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – OSINT & Eavesdropping Techniques

The logs indicate that the penetration testing team’s objective was to create persistence in the network.

Log Analysis:

schtasks /query: This command lists all the scheduled tasks on the system. It is often used to understand what tasks are currently scheduled and running.

schtasks /CREATE /SC DAILY: This command creates a new scheduled task that runs daily. Creating such a task can be used to ensure that a script or program runs regularly, maintaining a foothold in the system.

Persistence:

Definition: Persistence refers to techniques used to maintain access to a compromised system even after reboots or other interruptions.

Scheduled Tasks: One common method of achieving persistence on Windows systems is by creating scheduled tasks that execute malicious payloads or scripts at regular intervals.

Other Options:

Enumerate Current Users: The logs do not show commands related to user enumeration.

Determine Users' Permissions: Commands like whoami or net user would be more relevant for checking user permissions.

View Scheduled Processes: While schtasks /query can view scheduled tasks, the addition of the schtasks /CREATE command indicates the intent to create new scheduled tasks, which aligns with creating persistence.

Pentest References:

Post-Exploitation: Establishing persistence is a key objective after gaining initial access to ensure continued access.

Scheduled Tasks: Utilizing Windows Task Scheduler to run scripts or programs automatically at specified times as a method for maintaining access.

By creating scheduled tasks, the penetration testing team aims to establish persistence, ensuring they can retain access to the system over time.

=================

Command Explanation:

The sc config command is used to configure service startup settings in Windows. Using start=disabled will permanently disable a specific service, effectively turning off protections such as antivirus or other monitoring services.

Why Not Other Options?

B (sc query state= all): This command lists all services and their states but does not disable or modify any service.

C (pskill): This command is used to terminate a process temporarily, but it does not permanently disable the service.

D (net config): This command is used for configuring network settings, not for managing services.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)

Windows Service Exploitation Guidelines

Comprehensive and Detailed Explanation:

The environment contains no Windows hosts (so Windows-specific credential-capture tools like Responder are ineffective). The tester needs credentials on non-Windows servers (likely SSH). The SOC only monitors endpoints (not servers), meaning aggressive credential guessing against servers may go unnoticed. hydra is a parallelized remote-auth brute-force tool that targets services such as SSH and can iterate a username list (-L) and password list (-P) across multiple targets (-M). This makes option D the most direct tool to attempt credential discovery on non-Windows hosts (SSH brute-force).

Why not the others:

A: pwinspector is Windows-focused/unknown in this context.

B: responder targets LLMNR/NetBIOS broadcasts on Windows networks — not applicable.

C: nmap will enumerate services (helpful), but it does not obtain credentials.

PT0-003 mapping: Domain 3 — post-compromise credential discovery and use of appropriate tools given OS/service mix.

Understanding netsh.exe:

Purpose: Configures network settings, including IP addresses, DNS, and firewall settings.

Firewall Management: Can enable, disable, or modify firewall rules.

Disabling the Firewall:

Command: Use netsh.exe to disable the firewall.

netsh advfirewall set allprofiles state off

Usage in Penetration Testing:

Pivoting: Disabling the firewall can help the penetration tester pivot from one system to another by removing network restrictions.

Command Execution: Ensure the command is executed with appropriate privileges.

References from Pentesting Literature:

netsh.exe is commonly mentioned in penetration testing guides for configuring network settings and managing firewalls.

HTB write-ups often reference the use of netsh.exe for managing firewall settings during network-based penetration tests.

XSS Attack Explanation:

The payload exploits Cross-Site Scripting (XSS) by injecting obfuscated JavaScript into the application. When rendered, the browser executes the malicious code (e.g., alert('pwned')).

Obfuscation ( instead of <script>) attempts to bypass naive input filters.

Countermeasure:

Implement input sanitization to ensure all user inputs are properly validated and escaped before being processed or rendered.

Other measures include using Content Security Policies (CSP) and output encoding.

Why Not Other Options?

A: This is not arbitrary code execution; it is a browser-based attack.

B: XSS is unrelated to SQL injection.

C: Cross-Site Request Forgery (CSRF) is a different vulnerability targeting session handling, not script injection.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)

OWASP XSS Prevention Cheat Sheet

A screenshot of a computer Description automatically generated

A screenshot of a computer Description automatically generated

A screenshot of a computer Description automatically generated

Encoding to Evade DLP:

Encoding (e.g., Base64) transforms data into a format that may bypass data loss prevention (DLP) tools.

DLP solutions often look for specific patterns (e.g., sensitive keywords, file headers) and may not recognize encoded data.

Why Not Other Options?

B (Compression): Compression reduces file size but does not typically bypass DLP detection mechanisms.

C (Encryption): Encrypted data is detectable by DLP tools, though its contents may not be readable.

D (Obfuscation): While obfuscation hides intent, encoding is more effective for bypassing automated detection.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)