PT0-003無料更新100%試験合格率保証 [2026]
[2026年01月] 認証されたCompTIA試験問題集でPT0-003試験学習ガイド
質問 # 64
A penetration tester discovered a vulnerability that provides the ability to upload to a path via directory traversal. Some of the files that were discovered through this vulnerability are:
Which of the following is the BEST method to help an attacker gain internal access to the affected machine?
- A. Download the smb.conf file and look at configurations
- B. Download .pl files and look for usernames and passwords
- C. Edit the smb.conf file and upload it to the server
- D. Edit the discovered file with one line of code for remote callback
正解：C
質問 # 65
During an assessment, a penetration tester obtains a low-privilege shell and then runs the following command:
findstr /SIM /C:"pass" *.txt *.cfg *.xml
Which of the following is the penetration tester trying to enumerate?
- A. Permissions
- B. Configuration files
- C. Secrets
- D. Virtual hosts
正解：C
解説：
By running the command findstr /SIM /C:"pass" *.txt *.cfg *.xml, the penetration tester is trying to enumerate secrets.
Command Analysis:
findstr: A command-line utility in Windows used to search for specific strings in files.
/SIM: Combination of options; /S searches for matching files in the current directory and all subdirectories, /I specifies a case-insensitive search, and /M prints only the filenames with matching content.
/C:"pass": Searches for the literal string "pass".
***.txt .cfg .xml: Specifies the file types to search within.
Objective:
The command is searching for the string "pass" within .txt, .cfg, and .xml files, which is indicative of searching for passwords or other sensitive information (secrets).
These file types commonly contain configuration details, credentials, and other sensitive data that might include passwords or secrets.
Other Options:
Configuration files: While .cfg and .xml files can be configuration files, the specific search for "pass" indicates looking for secrets like passwords.
Permissions: This command does not check or enumerate file permissions.
Virtual hosts: This command is not related to enumerating virtual hosts.
Pentest Reference:
Post-Exploitation: Enumerating sensitive information like passwords is a common post-exploitation activity after gaining initial access.
Credential Discovery: Searching for stored credentials within configuration files and documents to escalate privileges or move laterally within the network.
By running this command, the penetration tester aims to find stored passwords or other secrets that could help in further exploitation of the target system.
質問 # 66
In a file stored in an unprotected source code repository, a penetration tester discovers the following line of code:
sshpass -p donotchange ssh [email protected]
Which of the following should the tester attempt to do next to take advantage of this information? (Select two).
- A. Run a password-spraying attack with Hydra against all the SSH servers.
- B. Investigate to find whether other files containing embedded passwords are in the code repository.
- C. Use an external exploit through Metasploit to compromise host 192.168.6.14.
- D. Confirm whether the server 192.168.6.14 is up by sending ICMP probes.
- E. Use Nmap to identify all the SSH systems active on the network.
- F. Take a screen capture of the source code repository for documentation purposes.
正解：B、F
解説：
When a penetration tester discovers hard-coded credentials in a file within an unprotected source code repository, the next steps should focus on documentation and further investigation to identify additional security issues.
* Taking a Screen Capture (Option B):
* Documentation: It is essential to document the finding for the final report. A screen capture provides concrete evidence of the discovered hard-coded credentials.
* Audit Trail: This ensures that there is a record of the vulnerability and can be used to communicate the issue to stakeholders, such as the development team or the client.
* Investigating for Other Embedded Passwords (Option C):
* Thorough Search: Finding one hard-coded password suggests there might be others. A thorough investigation can reveal additional credentials, which could further compromise the security of the system.
* Automation Tools: Tools like truffleHog, git-secrets, and grep can be used to scan the repository for other instances of hard-coded secrets.
Pentest References:
* Initial Discovery: Discovering hard-coded credentials often occurs during source code review or automated scanning of repositories.
* Documentation: Keeping detailed records of all findings is a critical part of the penetration testing process. This ensures that all discovered vulnerabilities are reported accurately and comprehensively.
* Further Investigation: After finding a hard-coded credential, it is best practice to look for other security issues within the same repository. This might include other credentials, API keys, or sensitive information.
Steps to Perform:
* Take a Screen Capture:
* Use a screenshot tool to capture the evidence of the hard-coded credentials. Ensure the capture includes the context, such as the file path and relevant code lines.
* Investigate Further:
* Use tools and manual inspection to search for other embedded passwords.
* Commands such as grep can be helpful:
grep -r 'password' /path/to/repository
* Tools like truffleHog can search for high entropy strings indicative of secrets:
trufflehog --regex --entropy=True /path/to/repository
By documenting the finding and investigating further, the penetration tester ensures a comprehensive assessment of the repository, identifying and mitigating potential security risks effectively.
質問 # 67
During an assessment, a penetration tester wants to extend the vulnerability search to include the use of dynamic testing. Which of the following tools should the tester use?
- A. ZAP
- B. SonarQube
- C. OllyDbg
- D. Mimikatz
正解：A
解説：
Dynamic Application Security Testing (DAST):
Definition: DAST involves testing the application in its running state to identify vulnerabilities that could be exploited by an attacker.
Purpose: Simulates attacks on a live application, examining how it behaves and identifying security weaknesses.
ZAP (Zed Attack Proxy):
Description: An open-source DAST tool developed by OWASP.
Features: Capable of scanning web applications for vulnerabilities, including SQL injection, XSS, CSRF, and other common web application vulnerabilities.
Usage: Ideal for dynamic testing as it interacts with the live application and identifies vulnerabilities that may not be visible in static code analysis.
Other Tools:
Mimikatz: Used for post-exploitation activities, specifically credential dumping on Windows systems.
OllyDbg: A debugger used for reverse engineering and static analysis of binary files, not suitable for dynamic testing.
SonarQube: A static code analysis tool used for SAST (Static Application Security Testing), not for dynamic testing.
Pentest Reference:
Web Application Security Testing: Utilizing DAST tools like ZAP to dynamically test and find vulnerabilities in running web applications.
OWASP Tools: Leveraging open-source tools recommended by OWASP for comprehensive security testing.
By using ZAP, the penetration tester can perform dynamic testing to identify runtime vulnerabilities in web applications, extending the scope of the vulnerability search.
質問 # 68
A tester is performing an external phishing assessment on the top executives at a company. Two- factor authentication is enabled on the executives' accounts that are in the scope of work. Which of the following should the tester do to get access to these accounts?
- A. Configure Gophish to use an external domain. Clone the email portal web page from the company and get the two
- B. Configure an external domain using a typosquatting technique. Configure Evilginx to bypass two- factor authentica
- C. Configure Gophish to use an external domain. Clone the email portal web page from the company and get the two
- D. Configure an external domain using a typosquatting technique. Configure SET to bypass two-factor authentication
正解：B
解説：
To bypass two-factor authentication (2FA) and gain access to the executives' accounts, the tester should use Evilginx with a typosquatting domain. Evilginx is a man-in-the-middle attack framework used to bypass 2FA by capturing session tokens.
質問 # 69
A penetration tester gains access to a Windows machine and wants to further enumerate users with native operating system credentials. Which of the following should the tester use?
- A. route.exe print
- B. strings.exe -a
- C. net.exe commands
- D. netstat.exe -ntp
正解：C
解説：
The net.exe commands are native to the Windows operating system and are used to manage and enumerate network resources, including user accounts.
Step-by-Step Explanation
Using net.exe Commands:
User Enumeration: The net user command lists all user accounts on the system.
net user
Detailed User Information: To get detailed information about a specific user.
net user <username>
Additional net.exe Commands:
Groups: Enumerate groups and group memberships.
net localgroup
net localgroup <groupname>
Sessions: List active sessions.
net session
Advantages:
Native Tool: No need to install additional software.
Comprehensive: Provides detailed information about users and groups.
Reference from Pentesting Literature:
The use of net.exe commands for user enumeration is a standard practice discussed in various penetration testing guides.
HTB write-ups often include net.exe commands as part of the enumeration phase on Windows systems.
Reference:
Penetration Testing - A Hands-on Introduction to Hacking
HTB Official Writeups
質問 # 70
A penetration tester needs to evaluate the order in which the next systems will be selected for testing. Given the following output:
Which of the following targets should the tester select next?
- A. hrdatabase
- B. fileserver
- C. financesite
- D. legaldatabase
正解：B
解説：
Evaluation Criteria:
CVSS (Common Vulnerability Scoring System): Indicates the severity of vulnerabilities, with higher scores representing more critical vulnerabilities.
EPSS (Exploit Prediction Scoring System): Estimates the likelihood of a vulnerability being exploited in the wild.
Analysis:
hrdatabase: CVSS = 9.9, EPSS = 0.50
financesite: CVSS = 8.0, EPSS = 0.01
legaldatabase: CVSS = 8.2, EPSS = 0.60
fileserver: CVSS = 7.6, EPSS = 0.90
Selection Justification:
fileserver has the highest EPSS score of 0.90, indicating a high likelihood of exploitation despite having a slightly lower CVSS score compared to other targets.
This makes it a critical target for immediate testing to mitigate potential exploitation risks.
Pentest Reference:
Risk Prioritization: Balancing between severity (CVSS) and exploitability (EPSS) is crucial for effective vulnerability management.
Risk Assessment: Evaluating both the impact and the likelihood of exploitation helps in making informed decisions about testing priorities.
By selecting the fileserver, the penetration tester focuses on a target that is highly likely to be exploited, addressing the most immediate risk based on the given scores.
Top of Form
Bottom of Form
質問 # 71
A company has recruited a penetration tester to conduct a vulnerability scan over the network. The test is confirmed to be on a known environment. Which of the following would be the BEST option to identify a system properly prior to performing the assessment?
- A. Full scan
- B. Web-application scan
- C. Asset inventory
- D. DNS records
正解：C
質問 # 72
A consultant just performed a SYN scan of all the open ports on a remote host and now needs to remotely identify the type of services that are running on the host. Which of the following is an active reconnaissance tool that would be BEST to use to accomplish this task?
- A. Netstat
- B. Fuzzer
- C. Snort
- D. tcpdump
- E. Nmap
正解：E
質問 # 73
A penetration tester creates a list of target domains that require further enumeration. The tester writes the following script to perform vulnerability scanning across the domains:
line 1: #!/usr/bin/bash
line 2: DOMAINS_LIST = "/path/to/list.txt"
line 3: while read -r i; do
line 4: nikto -h $i -o scan-$i.txt &
line 5: done
The script does not work as intended. Which of the following should the tester do to fix the script?
- A. Change line 3 to while true; read -r i; do.
- B. Change line 2 to {"domain1", "domain2", "domain3", }.
- C. Change line 5 to done < "$DOMAINS_LIST".
- D. Change line 4 to nikto $i | tee scan-$i.txt.
正解：C
解説：
The issue with the script lies in how the while loop reads the file containing the list of domains.
The current script doesn't correctly redirect the file's content to the loop. Changing line 5 to done
< "$DOMAINS_LIST" correctly directs the loop to read from the file.
質問 # 74
A penetration tester is performing an assessment focused on attacking the authentication identity provider hosted within a cloud provider. During the reconnaissance phase, the tester finds that the system is using OpenID Connect with OAuth and has dynamic registration enabled. Which of the following attacks should the tester try first?
- A. A password-spraying attack against the authentication system
- B. A replay attack against the authentication flow in the system
- C. A mask attack against the authentication system
- D. A brute-force attack against the authentication system
正解：B
解説：
OpenID Connect (OIDC) with OAuth allows applications to authenticate users using third-party identity providers (IdPs). If dynamic registration is enabled, attackers can abuse this feature to capture and replay authentication requests.
Replay attack (Option C):
Attackers capture legitimate authentication tokens and reuse them to impersonate users.
OIDC uses JWTs (JSON Web Tokens), which may not expire quickly, making replay attacks highly effective.
Reference: CompTIA PenTest+ PT0-003 Official Study Guide - "Attacking Identity Providers and OAuth" Incorrect options:
Option A (Password spraying): Effective against user accounts, but this attack targets authentication tokens.
Option B (Brute-force attack): Less effective against OAuth-based authentication since tokens replace passwords.
Option D (Mask attack): Related to password cracking, not OAuth authentication attacks.
質問 # 75
A penetration tester finished a security scan and uncovered numerous vulnerabilities on several hosts. Based on the targets' EPSS and CVSS scores, which of the following targets is the most likely to get attacked?
- A. Target 4: EPSS Score = 0.4 and CVSS Score = 4.5
- B. Target 2: EPSS Score = 0.3 and CVSS Score = 2
- C. Target 1: EPSS Score = 0.6 and CVSS Score = 4
- D. Target 3: EPSS Score = 0.6 and CVSS Score = 1
正解：C
解説：
EPSS and CVSS Analysis:
EPSS (Exploit Prediction Scoring System) indicates the likelihood of exploitation.
CVSS (Common Vulnerability Scoring System) represents the severity of the vulnerability.
Rationale:
Target 1 has the highest EPSS score (0.6) combined with a moderately high CVSS score (4), making it the most likely to be attacked.
Other options either have lower EPSS or CVSS scores, reducing their likelihood of being exploited.
CompTIA Pentest+ Reference:
Domain 2.0 (Information Gathering and Vulnerability Identification)
質問 # 76
Which of the following situations would MOST likely warrant revalidation of a previous security assessment?
- A. After a merger or an acquisition
- B. When an organization updates its network firewall configurations
- C. When most of the vulnerabilities have been remediated
- D. After detection of a breach
正解：C
質問 # 77
A penetration tester runs the following command on a system:
find / -user root -perm -4000 -print 2>/dev/null
Which of the following is the tester trying to accomplish?
- A. Find files with the SUID bit set
- B. Find the /root directory on the system
- C. Find files that were created during exploitation and move them to /dev/null
- D. Set the SGID on all files in the / directory
正解：A
解説：
the 2>/dev/null is output redirection, it simply sends all the error messages to infinity and beyond preventing any error messages to appear in the terminal session.
The tester is trying to find files with the SUID bit set on the system. The SUID (set user ID) bit is a special permission that allows a file to be executed with the privileges of the file owner, regardless of who runs it.
This can be used to perform privileged operations or access restricted resources. A penetration tester can use the find command with the -user and -perm options to search for files owned by a specific user (such as root) and having a specific permission (such as 4000, which indicates the SUID bit is set).
質問 # 78
While conducting a peer review for a recent assessment, a penetration tester finds the debugging mode is still enabled for the production system. Which of the following is most likely responsible for this observation?
- A. A full backup restoration is required for the server.
- B. The penetration tester was locked out of the system.
- C. The penetration test was not completed on time.
- D. Configuration changes were not reverted.
正解：D
解説：
Debugging Mode:
Purpose: Debugging mode provides detailed error messages and debugging information, useful during development.
Risk: In a production environment, it exposes sensitive information and vulnerabilities, making the system more susceptible to attacks.
Common Causes:
Configuration Changes: During testing or penetration testing, configurations might be altered to facilitate debugging. If not reverted, these changes can leave the system in a vulnerable state.
Oversight: Configuration changes might be overlooked during deployment.
Best Practices:
Deployment Checklist: Ensure a checklist is followed that includes reverting any debug configurations before moving to production.
Configuration Management: Use configuration management tools to track and manage changes.
Reference from Pentesting Literature:
The importance of reverting configuration changes is highlighted in penetration testing guides to prevent leaving systems in a vulnerable state post-testing.
HTB write-ups often mention checking and ensuring debugging modes are disabled in production environments.
Reference:
Penetration Testing - A Hands-on Introduction to Hacking
HTB Official Writeups
質問 # 79
A penetration tester is conducting reconnaissance for an upcoming assessment of a large corporate client. The client authorized spear phishing in the rules of engagement. Which of the following should the tester do first when developing the phishing campaign?
- A. Recon-ng
- B. Social media
- C. Shoulder surfing
- D. Password dumps
正解：B
解説：
When developing a phishing campaign, the tester should first use social media to gather information about the targets.
Social Media:
Purpose: Social media platforms like LinkedIn, Facebook, and Twitter provide valuable information about individuals, including their job roles, contact details, interests, and connections.
Reconnaissance: This information helps craft convincing and targeted phishing emails, increasing the likelihood of success.
Process:
Gathering Information: Collect details about the target employees, such as their names, job titles, email addresses, and any personal information that can make the phishing email more credible.
Crafting Phishing Emails: Use the gathered information to personalize phishing emails, making them appear legitimate and relevant to the recipients.
質問 # 80
A penetration tester is trying to restrict searches on Google to a specific domain. Which of the following commands should the penetration tester consider?
- A. intitle:
- B. link:
- C. inurl:
- D. site:
正解：D
解説：
The site: command can be used to restrict searches on Google to a specific domain. For example, site:company.com will return only results from the company.com domain. This can help the penetration tester to find information or pages related to the target domain.
質問 # 81
SIMULATION
A penetration tester has been provided with only the public domain name and must enumerate additional information for the public-facing assets.
INSTRUCTIONS
Select the appropriate answer(s), given the output from each section.
Output 1
正解：
解説：
See all the solutions below in Explanation
Explanation:
質問 # 82
A penetration tester is performing a network security assessment. The tester wants to intercept communication between two users and then view and potentially modify transmitted data. Which of the following types of on- path attacks would be best to allow the penetration tester to achieve this result?
- A. DNS spoofing
- B. SYN flooding
- C. ARP poisoning
- D. VLAN hopping
正解：C
解説：
An on-path attack (previously known as MITM - Man-in-the-Middle) allows an attacker to intercept and modify communication between two parties.
* ARP poisoning (Option B):
* Attackers send fake ARP replies to associate their MAC address with the IP address of a legitimate device (e.g., gateway).
* This forces traffic to flow through the attacker's system, enabling packet capture and manipulation.
* Tools like Ettercap, Bettercap, and ARP spoofing scripts are commonly used.
質問 # 83
Which of the following post-exploitation activities allows a penetration tester to maintain persistent access in a compromised system?
- A. Installing a bind shell
- B. Executing a process injection
- C. Setting up a reverse SSH connection
- D. Creating registry keys
正解：D
解説：
Creating registry keys (often referred to as "persistence mechanisms") is a method used to ensure that malicious code or access methods are re-established every time the system is restarted. By adding specific entries to the registry, an attacker can make sure that their code is executed automatically, thereby maintaining access over an extended period.
質問 # 84
You are a penetration tester reviewing a client's website through a web browser.
INSTRUCTIONS
Review all components of the website through the browser to determine if vulnerabilities are present.
Remediate ONLY the highest vulnerability from either the certificate, source, or cookies.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
正解：
解説：
質問 # 85
A company is concerned that its cloud VM is vulnerable to a cyberattack and proprietary data may be stolen.
A penetration tester determines a vulnerability does exist and exploits the vulnerability by adding a fake VM instance to the IaaS component of the client's VM. Which of the following cloud attacks did the penetration tester MOST likely implement?
- A. Credential harvesting
- B. Direct-to-origin
- C. Malware injection
- D. Cross-site scripting
正解：C
解説：
Malware injection is the most likely cloud attack that the penetration tester implemented, as it involves adding a fake VM instance to the IaaS component of the client's VM. Malware injection is a type of attack that exploits vulnerabilities in cloud services or applications to inject malicious code or data into them. The injected malware can then compromise or control the cloud resources or data.
質問 # 86
A tester performs a vulnerability scan and identifies several outdated libraries used within the customer SaaS product offering. Which of the following types of scans did the tester use to identify the libraries?
- A. SBOM
- B. IAST
- C. SAST
- D. DAST
正解：C
解説：
kube-hunter is a tool designed to perform security assessments on Kubernetes clusters. It identifies various vulnerabilities, focusing on weaknesses and misconfigurations. Here's why option B is correct:
Kube-hunter: It scans Kubernetes clusters to identify security issues, such as misconfigurations, insecure settings, and potential attack vectors.
Network Configuration Errors: While kube-hunter might identify some network-related issues, its primary focus is on Kubernetes-specific vulnerabilities and misconfigurations.
Application Deployment Issues: These are more related to the applications running within the cluster, not the cluster configuration itself.
Security Vulnerabilities in Docker Containers: Kube-hunter focuses on the Kubernetes environment rather than Docker container-specific vulnerabilities.
Reference from Pentest:
Forge HTB: Highlights the use of specialized tools to identify misconfigurations in environments, similar to how kube-hunter operates within Kubernetes clusters.
Anubis HTB: Demonstrates the importance of identifying and fixing misconfigurations within complex environments like Kubernetes clusters.
Conclusion:
Option B, weaknesses and misconfigurations in the Kubernetes cluster, accurately describes the type of vulnerabilities that kube-hunter is designed to detect.
質問 # 87
......
正真正銘のベスト試験材料はPT0-003オンライン練習試験：https://www.jpntest.com/shiken/PT0-003-mondaishu
PT0-003テストエンジン練習試験：https://drive.google.com/open?id=1PRCnvoR9_K-B_pk9qF6FLn37Cj1wl1lU