Free Preparation Discussions
MENU
CompTIA PT0-003 Exam Questions
Free CompTIA PT0-003 Exam Actual Questions
Note: Premium Questions for PT0-003 were last updated On Jul. 06, 2026 (see below)
A penetration tester is conducting an assessment of a web application's login page. The tester needs to determine whether there are any hidden form fields of interest. Which of the following is the most effective technique?
Hidden form fields in web applications can store user roles, session tokens, and security parameters that attackers may exploit.
HTML scraping (Option D):
Involves analyzing HTML source code to find hidden fields like:
<input type='hidden' name='admin_access' value='true'>
Attackers use tools like Burp Suite, ZAP, or browser developer tools (Ctrl+U or Inspect Element) to locate hidden fields.
Incorrect options:
Option A (XSS): Exploits JavaScript injection, not for finding hidden fields.
Option B (On-path attack): Involves MITM interception, not directly analyzing form fields.
Option C (SQL injection): Targets databases, not HTML forms
A penetration tester is enumerating a Linux system. The goal is to modify the following script to provide more comprehensive system information:
#!/bin/bash
ps aux >> linux_enum.txt
Which of the following lines would provide the most comprehensive enumeration of the system?
This command gathers:
/etc/passwd -- lists all local user accounts.
netstat -tuln -- lists listening ports and associated services.
/etc/bash.bashrc -- contains environment variables and configurations that could reveal system behaviors or hidden persistence mechanisms.
This provides a much broader and deeper enumeration compared to other options.
While performing a penetration test, a tester executes the following command:
PS c:\tools> c:\hacks\PsExec.exe \\server01.cor.ptia.org -accepteula cmd.exe
Which of the following best explains what the tester is trying to do?
PsExec is a Windows Sysinternals tool that allows users to execute commands on a remote system without needing an interactive login session. The command above is executing cmd.exe on a remote Windows Active Directory domain machine (server01.cor.ptia.org).
Option A (Test connectivity using PsExec) : The command does not check connectivity; it executes a command remotely.
Option B (Perform a lateral movement attack) : Correct. Lateral movement occurs when an attacker moves from one compromised machine to another within a network, using valid credentials. PsExec is often used for this purpose.
Option C (Send the PsExec binary) : The command runs cmd.exe remotely, but it does not transfer PsExec itself.
Option D (Enable cmd.exe) : cmd.exe is already enabled by default on most Windows systems.
Reference: CompTIA PenTest+ PT0-003 Official Guide -- Lateral Movement with PsExec
A penetration tester gained a foothold within a network. The penetration tester needs to enumerate all users within the domain. Which of the following is the best way to accomplish this task?
Comprehensive and Detailed Explanation From Exact Extract:
net.exe is the classic Windows networking utility that includes commands for enumerating domain resources and accounts from a compromised host where the tester has any authenticated domain context. Typical commands used by penetration testers to enumerate domain users with net.exe include:
net user /domain --- lists domain user accounts (name and some properties).
net group 'Domain Users' /domain --- lists members of the Domain Users group.
net view /domain --- lists computers in the domain (useful to find targets for further enumeration).
Why net.exe is the best option here:
It is installed by default on Windows systems and works with the current authenticated domain credentials (common after gaining a foothold).
It provides a quick, low-noise way to enumerate user accounts and groups without requiring additional tooling or elevated privileges beyond an authenticated domain user.
Results can be scripted and parsed for further enumeration and pivoting.
Why the other options are not appropriate:
A . pwd.exe --- Not a standard Windows tool for domain enumeration (and not present by default).
C . sc.exe --- Service Controller tool for managing services; not used to enumerate domain users.
D . msconfig.exe --- System configuration GUI utility for startup/services; not for domain account enumeration.
Related alternatives (contextual, commonly used in pentests):
dsquery user -limit 0 (on systems with RSAT/AD tools) to query AD directly.
Get-ADUser -Filter * (PowerShell, requires the ActiveDirectory module and appropriate rights).
Tools like PowerView (PowerShell) or BloodHound (collection phase) can provide richer AD enumeration, but net.exe is the simplest built-in option to enumerate domain users from an authenticated foothold.
CompTIA PT0-003 Objective Mapping (summary):
Domain 2.0 Information Gathering and Vulnerability Scanning --- enumerate network and Active Directory objects using native tools and scripts (e.g., net.exe for domain user enumeration).
[Attacks and Exploits]
A penetration tester assesses an application allow list and has limited command-line access on the Windows system. Which of the following would give the penetration tester information that could aid in continuing the test?
When a penetration tester has limited command-line access on a Windows system, the choice of tool is critical for gathering information to aid in furthering the test. Here's an explanation for each option:
mmc.exe (Microsoft Management Console):
Primarily used for managing Windows and its services. It's not typically useful for gathering information about the system from the command line in a limited access scenario.
icacls.exe:
This tool is used for modifying file and folder permissions. While useful for modifying security settings, it does not directly aid in gathering system information or enumeration.
nltest.exe:
This is a powerful command-line utility for network testing and gathering information about domain controllers, trusts, and replication status. Key functionalities include:
Listing domain controllers: nltest /dclist:<DomainName>
Querying domain trusts: nltest /domain_trusts
Checking secure channel: nltest /sc_query:<DomainName>
These capabilities make nltest very useful for understanding the network environment, especially in a domain context, which is essential for penetration testing.
rundll.exe:
This utility is used to run DLLs as programs. While it can be used for executing code, it does not provide direct information about the system or network environment.
Conclusion: nltest.exe is the best choice among the given options as it provides valuable information about the network, domain controllers, and trust relationships. This information is crucial for a penetration tester to plan further actions and understand the domain environment.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Brian Walker
17 days agoRonald Hernandez
26 days agoHarold Smith
2 months agoSarah Baker
2 months agoDennis Phillips
2 months agoDonna Mitchell
3 months agoChristopher Lopez
3 months agoRachel Hill
3 months agoRyan Campbell
3 months agoPaul Ramirez
3 months agoElizabeth Stewart
2 months agoBroderick
3 months agoBuddy
4 months agoPaulina
4 months agoAmber
4 months agoFrancis
4 months agoMarguerita
5 months agoEladia
5 months agoColetta
5 months agoDorothy
5 months agoCorrina
6 months agoCristina
6 months agoSharika
6 months agoBarabara
6 months agoSharen
7 months agoRessie
7 months agoCarey
7 months agoCarmen
7 months agoEmogene
8 months agoBuck
8 months agoLashawn
8 months agoMelissa
8 months agoMaryrose
9 months agoKristian
9 months agoRasheeda
9 months agoHuey
9 months agoLeslee
10 months agoAlishia
10 months agoDomitila
10 months agoAudra
10 months agoStephen
10 months agoCaitlin
1 year agoJerilyn
1 year agoMarion
1 year agoCorrina
1 year agoMel
1 year agoLindsey
1 year agoRachael
1 year agoDaren
1 year agoFrederick
1 year agoSunshine
1 year agoBoris
1 year agoMelita
1 year agoNieves
1 year agoVeronica
1 year agoJosefa
1 year agoOmer
1 year agoWillow
1 year agoYoulanda
2 years agoNorah
2 years agoAngelica
2 years agoKattie
2 years agoQueen
2 years agoJannette
2 years agoVirgina
2 years agoTheola
2 years agoYuki
2 years agoElmer
2 years agoCatarina
2 years agoCheryl
2 years agoViva
2 years agoMalcolm
2 years agoHelga
2 years agoGlory
2 years agoMee
2 years agoMaxima
2 years agoDacia
2 years agoNoah
2 years agoAlexia
2 years agoTracie
2 years agoJade
2 years agoDwight
2 years ago