PT0-003 Exam Dumps : CompTIA PenTest+ Exam

The find command shown here recursively searches the entire filesystem (/) for files (-type f) and lists them with detailed information (-ls), including file ownership, group, size, and permissions. The results are then redirected into /tmp/recon.txt.

This is typically performed as part of post-exploitation local enumeration to gather information on:

Files and their permission settings.

Potential world-writable or sensitive files (e.g., /etc/shadow, SSH keys, config files).

Misconfigurations that could lead to privilege escalation.

Thus, the tester’s main objective is permission enumeration — identifying files and directories with insecure permissions that could be exploited.

Why not the others:

B. Secrets enumeration: While secrets might later be found in files, the command’s intent is general permission/file listing, not targeted secret extraction.

C. User enumeration: The command doesn’t list users or accounts (no /etc/passwd or who queries).

D. Service enumeration: This doesn’t inspect running services or open ports.

CompTIA PT0-003 Objective Mapping:

Domain 2.0: Information Gathering and Vulnerability Scanning

2.5: Perform local enumeration on compromised hosts (e.g., file and permission enumeration).

When the client indicates that the scope ' s hosts and assets are not included in the vulnerability scan results, it suggests that the tester may have missed discovering all the devices in the scope. Here’s the best course of action:

Performing a Discovery Scan:

Purpose: A discovery scan identifies all active devices on the network before running a detailed vulnerability scan. It ensures that all in-scope devices are included in the assessment.

Process: The discovery scan uses techniques like ping sweeps, ARP scans, and port scans to identify active hosts and services.

Comparison with Other Actions:

Rechecking the Scanner Configuration (A): Useful but not as comprehensive as ensuring all hosts are discovered.

Using a Different Scan Engine (C): Not necessary if the issue is with host discovery rather than the scanner’s capability.

Configuring All TCP Ports on the Scan (D): Helps in detailed scanning but does not address missing hosts.

Performing a discovery scan ensures that all in-scope devices are identified and included in the vulnerability assessment, making it the best course of action.

======

The correct answer is A. Port mirroring

Port mirroring, also known as SPAN, allows network traffic from one or more switch ports to be copied to a monitoring port. This lets the tester passively observe network communications without directly interacting with production systems.

This is especially appropriate in sensitive environments such as ICS, SCADA, OT, and power plant control networks, where active scanning or probing may disrupt operations. Since the tester needs to identify vulnerabilities observable in the network stack while following rules that prohibit interaction with production systems, passive traffic capture through port mirroring is the safest and most appropriate technique.

B is incorrect because storyboarding is a planning or communication technique and does not observe network-stack behavior.

C is incorrect because a write blocker is used in forensic investigations to prevent modification of storage media. It does not help assess network-stack vulnerabilities.

D is incorrect because a SAST tool analyzes source code for vulnerabilities. It does not passively inspect live network traffic or network-stack behavior.

In PenTest+ terms, this falls under Information Gathering and Vulnerability Scanning, specifically passive reconnaissance, network traffic analysis, and safe testing practices in ICS/OT environments.