CompTIA Updated PT0-003 Exam Questions and Answers by reyan

Tailgating is the term used to describe a situation where a penetration tester bypasses physical access controls and gains access to a facility by entering at the same time as an employee.

Tailgating:

Definition: Tailgating occurs when an unauthorized person follows an authorized person into a restricted area without the latter’s consent or knowledge. The authorized person typically opens a door or checkpoint, and the unauthorized person slips in behind them.

Example: An attacker waits near the entrance of a building and enters right after an employee, bypassing security measures.

Physical Security:

Importance: Physical security is a crucial aspect of overall security posture. Tailgating exploits human factors and weaknesses in physical security controls.

Prevention: Security measures such as turnstiles, mantraps, and security personnel can help prevent tailgating.

Pentest References:

Physical Penetration Testing: Tailgating is a common technique used in physical penetration tests to assess the effectiveness of an organization’s physical security controls.

Social Engineering: Tailgating often involves social engineering, where the attacker relies on the politeness or unawareness of the employee to gain unauthorized access.

By understanding and using tailgating, penetration testers can evaluate the effectiveness of an organization’s physical security measures and identify potential vulnerabilities that could be exploited by malicious actors.

======

The correct answer is C. CVE-202X-YYYY: OpenSSL DROWN Attack

DROWN is an attack against SSL/TLS implementations that allows an attacker to decrypt encrypted communications when vulnerable SSLv2 support is present. Since SSL/TLS is a common protocol suite used to protect web and application traffic, a vulnerability that weakens or exposes encrypted communications aligns best with the scenario.

A is incorrect because IKEv2/IPSec relates to VPN/IPSec negotiation and encrypted tunnels, but the well-known attack associated with decrypting encrypted SSL/TLS communications is DROWN.

B is incorrect because Wireshark is a packet analysis tool, not the network protocol being exploited.

D is incorrect because EternalBlue targets Microsoft SMBv1 for remote code execution. It is not primarily an encrypted-communications interception or manipulation vulnerability.

In PenTest+ terms, this falls under Attacks and Exploits, specifically exploitation of cryptographic protocol weaknesses and attacks against SSL/TLS implementations.

When Nmap is unavailable on a compromised host, PenTest+ expects testers to adapt by using native scripting (for example, PowerShell) to perform reconnaissance and port checks with built-in .NET classes such as System.Net.Sockets.TcpClient. To scan multiple ports, the script must iterate over two dimensions: the host range and the port list. In PowerShell, supplying a comma-separated list to a variable (for example, $port = 80,443,445) creates an array-like collection. The correct way to use that collection is to add a nested Foreach loop inside the existing loop that iterates through IPs, so each reachable host is tested against every port in the list.

Duplicating the socket block (A) is inefficient, error-prone, and does not scale as the number of ports grows. Option C is not the correct syntax for combining two enumerations in a single Foreach header; PowerShell requires a separate loop (or pipeline) to iterate ports. Therefore, adding a second Foreach directly beneath the current one and enclosing the socket logic within it best achieves the intended multi-port scanning behavior.

A peer review process ensures that a penetration test report is accurate, unbiased, and free from errors.

Peer review (Option B):

Senior security professionals verify findings, risk levels, and remediation recommendations.

Reduces the risk of misinterpretation or incorrect data in reports.