CompTIA PT0-003 Actual Questions

Eavesdropping:

Eavesdropping involves intercepting communications between parties without their consent. If the details were obtained from a meeting, it likely involved intercepting audio or network communications, such as unsecured VoIP calls, radio signals, or in-room microphones.

Why Not Other Options?

B (Bluesnarfing): Targets Bluetooth-enabled devices, which is unlikely to apply to general meeting communications.

C (Credential harvesting): Focuses on collecting user credentials and does not explain the discovery of product details from a meeting.

D (SQL injection): Exploits databases and is unrelated to capturing meeting communication.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)

Techniques for Intercepting Communication

The rules of engagement define the scope, limitations, and conditions under which a penetration test is conducted. Here’s why option A is correct:

Testing Window: This specifies the time frame during which the penetration testing activities are authorized to occur. It is a crucial part of the rules of engagement to ensure the testing does not disrupt business operations and is conducted within agreed-upon hours.

Terms of Service: This generally refers to the legal agreement between a service provider and user, not specific to penetration testing engagements.

Authorization Letter: This provides formal permission for the penetration tester to perform the assessment but is not a component of the rules of engagement.

Shared Responsibilities: This refers to the division of security responsibilities between parties, often seen in cloud service agreements, but not specifically a function of the rules of engagement.

References from Pentest:

Luke HTB: Highlights the importance of clearly defining the testing window in the rules of engagement to ensure all parties are aligned​​.

Forge HTB: Demonstrates the significance of having a well-defined testing window to avoid disruptions and ensure compliance during the assessment​​.

=================

When needing to scan a large network for open ports quickly, the choice of tool is critical. Here’s why option B is correct:

masscan: This tool is designed for high-speed port scanning and can scan entire networks much faster than traditional tools like Nmap. It can handle large ranges of IP addresses and ports with high efficiency.

Nmap: While powerful and versatile, Nmap is generally slower than masscan for scanning very large networks, especially when speed is crucial.

Burp Suite: This tool is primarily for web application security testing and not optimized for network-wide port scanning.

hping: This is a network tool used for packet crafting and network testing, but it is not designed for high-speed network port scanning.

References from Pentest:

Luke HTB: Highlights the use of efficient tools for large-scale network scanning to identify open ports quickly​​.

Anubis HTB: Demonstrates scenarios where high-speed scanning tools like masscan are essential for large network assessments​​.

=================

The tool and command provided by option B are used to perform passive DNS enumeration, which can uncover subdomains associated with a domain. Here’s why option B is correct:

amass enum -passive -d comptia.org: This command uses the Amass tool to perform passive DNS enumeration, effectively identifying subdomains of the target domain. The output provided (subdomains) matches what this tool and command would produce.

nslookup -type=SOA comptia.org: This command retrieves the Start of Authority (SOA) record, which does not list subdomains.

nmap -Pn -sV -vv -A comptia.org: This Nmap command performs service detection and aggressive scanning but does not enumerate subdomains.

shodan host comptia.org: Shodan is an internet search engine for connected devices, but it does not perform DNS enumeration to list subdomains.

References from Pentest:

Writeup HTB: Demonstrates the use of DNS enumeration tools like Amass to uncover subdomains during external assessments​​.

Horizontall HTB: Highlights the effectiveness of passive DNS enumeration in identifying subdomains and associated information​​.

=================