Get CompTIA PT0-003 Exam Dumps

Answer : B

Penetration testers search for hardcoded credentials, API keys, and authentication tokens in source code repositories to identify secrets leakage.

Secrets scanning (Option B):

The find and egrep command scans all files recursively for sensitive keywords like 'token,' 'key,' and 'login'.

Attackers use tools like TruffleHog and GitLeaks to automate secret discovery.

Incorrect options:

Option A (Data tokenization): Tokenization replaces sensitive data with unique tokens, not scanning for credentials.

Option C (Password spraying): Tries common passwords across multiple accounts, unrelated to scanning source code.

Answer : D

Hidden form fields in web applications can store user roles, session tokens, and security parameters that attackers may exploit.

HTML scraping (Option D):

Involves analyzing HTML source code to find hidden fields like:

<input type='hidden' name='admin_access' value='true'>

Attackers use tools like Burp Suite, ZAP, or browser developer tools (Ctrl+U or Inspect Element) to locate hidden fields.

Incorrect options:

Option A (XSS): Exploits JavaScript injection, not for finding hidden fields.

Option B (On-path attack): Involves MITM interception, not directly analyzing form fields.

Answer : D

OS identification in tools like Nmap relies on fingerprinting techniques, which analyze response characteristics (e.g., TCP/IP stack behavior).

The scan cannot gather one or more fingerprints from the target (Option D):

If the system is configured to block ICMP responses, or if certain ports are closed, fingerprinting fails.

Some modern firewalls and intrusion prevention systems (IPS) interfere with OS fingerprinting by modifying packet responses.

Incorrect options:

Option A (Firewall block rule): A firewall may block the scan, but typically it would result in no response rather than an 'OS identification failed' message.

Option B (Outdated scanner database): While an outdated database might miss vulnerabilities, it does not directly cause OS detection failure.

Option C (False positive): A false positive refers to incorrect detection, but this is an OS detection failure, not a misidentified OS.

Answer : A

The tester identified an HTTPS downgrade attack (e.g., SSL stripping). The best mitigation is to enforce HSTS (HTTP Strict Transport Security).

HSTS (Option A):

HSTS (Strict-Transport-Security) ensures that the browser always uses HTTPS, preventing downgrade attacks.

Example header:

Strict-Transport-Security: max-age=31536000; includeSubDomains

Incorrect options:

Option B (httponly flag): Protects cookies from JavaScript access but does not enforce HTTPS.

Option C (Firewall rule on port 80): Helps, but does not force browsers to use HTTPS.

Option D (Removing x-content-type-options): Unrelated; nosniff prevents MIME-type sniffing.

Answer : C

Penetration testers use OSINT (Open-Source Intelligence) tools to collect and analyze reconnaissance data.

Maltego (Option C):

Maltego is a powerful graph-based OSINT tool that integrates data from multiple sources (e.g., social media, DNS records, leaked credentials).

It automates data correlation and helps visualize connections.

Incorrect options:

Option A (Caldera): Used for adversary emulation, not OSINT.

Option B (SpiderFoot): A reconnaissance tool but lacks data correlation capabilities.