PT0-003 Dumps with Practice Exam Questions Answers

Explanation of the Correct Option:

A (responder and ntlmrelayx.py):

Responder is a tool for intercepting and relaying NTLM authentication requests.

Since SMB signing is disabled, ntlmrelayx.py can relay authentication requests and escalate privileges to move laterally without directly brute-forcing credentials, which is stealthier.

Why Not Other Options?

B: Exploiting MS17-010 (psexec) is noisy and likely to trigger alerts.

C: Brute-forcing credentials with Hydra is highly detectable due to the volume of failed login attempts.

D: Nmap scripts like smb-brute.nse are useful for enumeration but involve brute-force methods that increase detection risk.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)

Comprehensive and Detailed Explanation:

An external attack surface review focuses on identifying publicly accessible assets that an attacker could exploit. The first step in this process is information gathering, which involves enumerating domains, subdomains, public IPs, DNS records, and other internet-facing resources. This is done using passive reconnaissance tools such as Whois, Shodan, Google Dorking, and OSINT techniques.

Option A is correct because it aligns with the assessment goal—finding public-facing systems and their vulnerabilities before an attacker does.

Option B (phishing assessment) is incorrect because it involves social engineering, which is not part of an external attack surface review.

Option C (physical security review) is incorrect as it pertains to physical penetration testing, not an external attack analysis.

Option D (vulnerability assessment) is incorrect because a vulnerability assessment is a later step after reconnaissance. The first step is identifying assets through information gathering.

When a penetration tester identifies several unused services listening on targeted internal laptops, the most appropriate recommendation to reduce the risk of compromise is system hardening. Here's why:

System Hardening:

Purpose: System hardening involves securing systems by reducing their surface of vulnerability. This includes disabling unnecessary services, applying security patches, and configuring systems securely.

Impact: By disabling unused services, the attack surface is minimized, reducing the risk of these services being exploited by attackers.

Comparison with Other Controls:

Multifactor Authentication (A): While useful for securing authentication, it does not address the issue of unused services running on the system.

Patch Management (B): Important for addressing known vulnerabilities but not specifically related to disabling unused services.

Network Segmentation (D): Helps in containing breaches but does not directly address the issue of unnecessary services.

System hardening is the most direct control for reducing the risk posed by unused services, making it the best recommendation.

=================

Shoulder surfinges el método más efectivo en este contexto.Cuando los ejecutivos trabajan en lugares públicos como trenes, un atacante puede visualizar sus pantallas sin ser detectado para recopilar datos confidenciales.

Credential harvesting requiere phishing o explotación directa. Bluetooth spamming y MFA fatigue no aplican directamente en un entorno de observación física.

Referencia:PT0-003 Objective 2.1 – Social engineering and physical observation methods.

Since the system is running Windows 7 SP0, it is highly likely to be vulnerable to MS17-010 (EternalBlue), a critical SMB vulnerability used for remote code execution (RCE).

Option A (psexec) ❌: PsExec requires valid credentials, which we do not have yet.

Option B (ms08_067_netapi) ❌: MS08-067 targets Windows XP/Server 2003, but the system is Windows 7.

Option C (ms17_010_eternalblue) ✅: Correct.

EternalBlue allows remote exploitation of SMBv1 in Windows 7/Server 2008.

Option D (snmp_login scanner) ❌: Only checks default SNMP credentials, not an exploit.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – SMB Exploitation & EternalBlue