CompTIA Updated PT0-003 Exam Questions and Answers by aura

In operational technology environments, safety, availability, and process stability are the highest priorities. Because the requirement says the tester must not disrupt OT services and must minimize device interaction, passive network capture is the best approach. Passive capture allows the tester to observe traffic flows, protocols, device communications, and asset relationships without directly probing or interrogating the systems. This greatly reduces the risk of causing faults, crashes, or unintended behavior in fragile industrial devices. Low-impact scanning may still generate traffic that certain PLCs, RTUs, or legacy controllers cannot safely handle. Physical assessment can help with inventory, but it is not the best method for network-based system discovery. Deploying agents is intrusive and operationally risky. Therefore, passive capture is the most appropriate and safest discovery method in a segmented OT environment.

==============

Responder es una herramienta especializada para capturar tráfico LLMNR, NBNS y MDNS, y realizar ataques de spoofing y captura de hashes. Es ampliamente utilizada en entornos Windows para capturar credenciales cuando se resuelven nombres que no existen en el DNS.

Netcat y Burp Suite no están diseñados para este propósito. Nmap sirve para escaneo de redes, pero no para captura ni explotación de LLMNR.

Referencia: PT0-003 Objective 4.2 – Explain lateral movement techniques and privilege escalation tools (Responder is explicitly listed).

To reenter the system remotely after the patch for the recently exploited RCE vulnerability has been deployed, the penetration tester can use schtasks.exe and sc.exe.

schtasks.exe:

Purpose: Used to create, delete, and manage scheduled tasks on Windows systems.

Persistence: By creating a scheduled task, the tester can ensure a script or program runs at a specified time, providing a persistent backdoor.

Example:

schtasks /create /tn " Backdoor " /tr " C:\path\to\backdoor.exe " /sc daily /ru SYSTEM

sc.exe:

Purpose: Service Control Manager command-line tool used to manage Windows services.

Persistence: By creating or modifying a service to run a malicious executable, the tester can maintain persistent access.

Example:

sc create backdoor binPath= " C:\path\to\backdoor.exe " start= auto

Other Utilities:

rundll.exe: Used to run DLLs as applications, not typically used for persistence.

cmd.exe: General command prompt, not specifically used for creating persistence mechanisms.

chgusr.exe: Used to change install mode for Remote Desktop Session Host, not relevant for persistence.

netsh.exe: Used for network configuration, not typically used for persistence.

Pentest References:

Post-Exploitation: Establishing persistence is crucial to maintaining access after initial exploitation.

Windows Tools: Understanding how to leverage built-in Windows tools like schtasks.exe and sc.exe to create backdoors that persist through reboots and patches.

By using schtasks.exe and sc.exe, the penetration tester can set up persistent mechanisms that will allow reentry into the system even after the patch is applied.

======

The correct answer is C. intext:

The intext: search operator is used to search for specific text within the body content of indexed web pages. Since email addresses typically appear as visible text on web pages, documents, staff directories, contact pages, PDFs, and archived pages, intext: is the best operator for locating exposed email addresses during OSINT.

For example, a tester could search for:

intext: " @example.com "

This would return pages where email addresses or domain-based email strings appear in the page content.

A is incorrect because site: limits results to a specific domain or website. It is useful when narrowing OSINT searches, but by itself it does not specifically search for email addresses.

B is incorrect because intitle: searches only page titles. Email addresses are rarely found in page titles.

D is incorrect because inurl: searches for terms in URLs. Email addresses are typically not located in URLs.

In PenTest+ terms, this falls under Information Gathering and Vulnerability Scanning, specifically OSINT and search engine reconnaissance for phishing preparation.