CompTIA PT0-003 Exam - Topic 2 Question 32 Discussion

Actual exam question for CompTIA's PT0-003 exam

Question #: 32
Topic #: 2

A penetration tester is performing a cloud-based penetration test against a company. Stakeholders have indicated the priority is to see if the tester can get into privileged systems that are not directly accessible from the internet. Given the following scanner information:

Server-side request forgery (SSRF) vulnerability in test.comptia.org

Reflected cross-site scripting (XSS) vulnerability in test2.comptia.org

Publicly accessible storage system named static_comptia_assets

SSH port 22 open to the internet on test3.comptia.org

Open redirect vulnerability in test4.comptia.org

Which of the following attack paths should the tester prioritize first?

ASynchronize all the information from the public bucket and scan it with Trufflehog.

BRun Pacu to enumerate permissions and roles within the cloud-based systems.

CPerform a full dictionary brute-force attack against the open SSH service using Hydra.

DUse the reflected cross-site scripting attack within a phishing campaign to attack administrators.

ELeverage the SSRF to gain access to credentials from the metadata service.

Show Suggested Answer

Suggested Answer: E

Leverage SSRF for Metadata Access:

Server-side request forgery (SSRF) vulnerabilities allow attackers to force a server to send requests to internal resources. In cloud environments, SSRF can often be used to access the metadata service (e.g., AWS EC2 metadata) to retrieve credentials for cloud services.

Once credentials are obtained, they can be used to access privileged systems that are not directly accessible from the internet.

Why Not Other Options?

A (Public bucket): Analyzing the bucket for sensitive data is useful but does not directly lead to privileged system access.

B (Pacu): Pacu is used for AWS exploitation but requires credentials or misconfigured roles. SSRF can provide the credentials needed to run Pacu effectively.

C (SSH brute force): Brute-forcing SSH is noisy and inefficient. Privileged systems are likely better protected than SSH open to the internet.

D (Phishing via XSS): This is a longer-term attack and less direct compared to leveraging SSRF.

CompTIA Pentest+ Reference:

Domain 3.0 (Attacks and Exploits)

SSRF Exploitation and Cloud Metadata Access Techniques

by Yan at Jan 05, 2026, 05:16 AM

Limited Time Offer

25%

2 months ago

Hmm, this looks like a tricky one. I think I'd start by looking at the SSRF vulnerability - that could be a good way to get access to internal systems.

upvoted 0 times

...