Important CompTIA PT0-003 Exam Questions

Answer: A

Explanation:

EPSS and CVSS Analysis:

EPSS (Exploit Prediction Scoring System) indicates the likelihood of exploitation.

CVSS (Common Vulnerability Scoring System) represents the severity of the vulnerability.

Rationale:

Target 1 has the highest EPSS score (0.6) combined with a moderately high CVSS score (4), making it the most likely to be attacked.

Other options either have lower EPSS or CVSS scores, reducing their likelihood of being exploited.

CompTIA Pentest+ Reference:

Domain 2.0 (Information Gathering and Vulnerability Identification)

Answer: B

Explanation:

The tool and command provided by option B are used to perform passive DNS enumeration, which can uncover subdomains associated with a domain. Here's why option B is correct:

amass enum -passive -d comptia.org: This command uses the Amass tool to perform passive DNS enumeration, effectively identifying subdomains of the target domain. The output provided (subdomains) matches what this tool and command would produce.

nslookup -type=SOA comptia.org: This command retrieves the Start of Authority (SOA) record, which does not list subdomains.

nmap -Pn -sV -vv -A comptia.org: This Nmap command performs service detection and aggressive scanning but does not enumerate subdomains.

shodan host comptia.org: Shodan is an internet search engine for connected devices, but it does not perform DNS enumeration to list subdomains.

Reference from Pentest:

Writeup HTB: Demonstrates the use of DNS enumeration tools like Amass to uncover subdomains during external assessments.

Horizontall HTB: Highlights the effectiveness of passive DNS enumeration in identifying subdomains and associated information.

======

Answer: C

Explanation:

A rootkit is a type of malicious software designed to provide an attacker with unauthorized access to a computer system while concealing its presence. Rootkits achieve this by modifying the host's operating system or other software to hide their existence, allowing the attacker to maintain control over the system without detection.

Definition and Purpose:

Rootkits are primarily used to gain and maintain root access (administrative privileges) on a system.

They disguise themselves as legitimate software or integrate deeply into the operating system to avoid detection.

Mechanisms of Action:

Kernel Mode Rootkits: These operate at the kernel level, which is the core of the operating system, making them very powerful and hard to detect.

User Mode Rootkits: These run in the same space as user applications, intercepting and altering standard system API calls to hide their presence.

Bootkits: These infect the Master Boot Record (MBR) or Volume Boot Record (VBR) and load before the operating system, making them extremely difficult to detect and remove.

Detection and Prevention:

Detection Tools: Tools like RootkitRevealer, Chkrootkit, and rkhunter can help in identifying rootkits.

Prevention: Regular system updates, use of strong antivirus and anti-malware solutions, and integrity checking tools like Tripwire can help in preventing rootkit infections.

Real-World Examples:

Sony BMG Rootkit: In 2005, Sony BMG included a rootkit in their digital rights management (DRM) software on music CDs. The rootkit hid files and processes, leading to a major scandal when it was discovered.

Stuxnet: This sophisticated worm included a rootkit component to hide its presence on infected systems, making it one of the most infamous examples of rootkit use in a cyber attack.

Reference from Pentesting Literature:

In 'Penetration Testing - A Hands-on Introduction to Hacking' by Georgia Weidman, rootkits are discussed in the context of post-exploitation, where maintaining access to the compromised system is crucial.

Various HTB write-ups, such as the analysis of complex attacks involving multiple stages of exploitation, often highlight the use of rootkits in maintaining persistent access.

Step-by-Step ExplanationReference:

Penetration Testing - A Hands-on Introduction to Hacking

HTB Official Writeups on sophisticated attacks

======

Answer: D

Explanation:

Port 443 normally provides HTTPS rather than unencrypted HTTP. A request constructed as http://host:443 can fail because the client initiates an unencrypted HTTP exchange while the service expects a TLS handshake.

The script should select the scheme according to the port, for example:

scheme = 'https' if port == '443' else 'http'

The nesting order of the loops is not the underlying problem. response.status_code can be printed directly. Changing GET to POST does not correct the protocol mismatch.

Reference status: PT0-003-aligned code-analysis concepts involving Python requests, URL construction, HTTP, HTTPS, ports, and error correction.

===========

Answer: B

Explanation:

Port mirroring, also called a SPAN configuration, copies traffic from selected switch ports or VLANs to a monitoring port. The tester can connect a packet-capture system to the monitoring port and passively inspect OT protocols without installing software on the OT endpoints.

Passive observation is particularly important in OT environments because active interference can disrupt fragile or safety-critical systems.

An interception proxy is mainly applicable to proxied application protocols and could alter traffic flow. Redirecting Modbus packets is intrusive and could affect industrial processes. Debug mode would require application or host access.

Reference status: PT0-003-aligned network-analysis and OT-assessment concepts involving passive capture, SPAN ports, and safe testing practices.

===========