Best Way To Study For CompTIA PT0-003 Exam Brilliant PT0-003 Exam Questions PDF [Q94-Q109]

Posted On August 19, 2026

Best Way To Study For CompTIA PT0-003 Exam Brilliant PT0-003 Exam Questions PDF

Updated Verified Pass PT0-003 Exam – Real Questions and Answers

QUESTION 94
During a security assessment, a penetration tester gains access to an internal server and manipulates some data to hide its presence. Which of the following is the best way for the penetration tester to hide the activities performed?

Clear the Windows event logs.

Modify the system time.

Alter the log permissions.

Reduce the log retention settings.

During a penetration test, one of the critical steps for maintaining access and covering tracks is to clear evidence of the attack. Manipulating data to hide activities on an internal server involves ensuring that logs and traces of the attack are removed. Here’s a detailed explanation of why clearing the Windows event logs is the best method for this scenario:
Understanding Windows Event Logs: Windows event logs are a key forensic artifact that records system, security, and application events. These logs can provide detailed information about user activities, system changes, and potential security incidents.
Why Clear Windows Event Logs:
Comprehensive Coverage: Clearing the event logs removes all recorded events, including login attempts, application errors, and security alerts. This makes it difficult for an investigator to trace back the actions performed by the attacker.
Avoiding Detection: Penetration testers clear event logs to ensure that their presence and activities are not detected by system administrators or security monitoring tools.
Method to Clear Event Logs:
Use the built-in Windows command line utility wevtutil to clear logs. For example:
shell
Copy code
wevtutil cl System
wevtutil cl Security
wevtutil cl Application
These commands clear the System, Security, and Application logs, respectively.
Alternative Options and Their Drawbacks:
Modify the System Time: Changing the system time can create confusion but is easily detectable and can be reverted. It does not erase existing log entries.
Alter Log Permissions: Changing permissions might prevent new entries but does not remove existing ones and can alert administrators to suspicious activity.
Reduce Log Retention Settings: This can limit future logs but does not affect already recorded logs and can be easily noticed by administrators.
Case Reference:
HTB Writeups: Many Hack The Box (HTB) writeups demonstrate the importance of clearing logs post-exploitation to maintain stealth. For example, in the “Gobox” and “Writeup” machines, maintaining a low profile involved managing log data to avoid detection.
Real-World Scenarios: In real-world penetration tests, attackers often clear logs to avoid detection by forensic investigators and incident response teams. This step is crucial during red team engagements and advanced persistent threat (APT) simulations.
In conclusion, clearing Windows event logs is a well-established practice for hiding activities during a penetration test. It is the most effective way to remove evidence of the attack from the system, thereby maintaining stealth and ensuring that the tester’s actions remain undetected.

QUESTION 95
A client recently hired a penetration testing firm to conduct an assessment of their consumer-facing web application. Several days into the assessment, the client’s networking team observes a substantial increase in DNS traffic. Which of the following would most likely explain the increase in DNS traffic?

Covert data exfiltration

URL spidering

HTML scrapping

DoS attack

QUESTION 96
During a penetration test, a tester attempts to pivot from one Windows 10 system to another Windows system.
The penetration tester thinks a local firewall is blocking connections. Which of the following command-line utilities built into Windows is most likely to disable the firewall?

certutil.exe

bitsadmin.exe

msconfig.exe

netsh.exe

QUESTION 97
During an assessment, a penetration tester runs the following command:
dnscmd.exe /config /serverlevelplugindll C:usersnecad-TADocumentsadduser.dll Which of the following is the penetration tester trying to achieve?

DNS enumeration

Privilege escalation

Command injection

A list of available users

QUESTION 98
A penetration tester obtains network-level access to a hardened subnet that has no Windows-based hosts and needs to find credentials. The client mentioned that the SOC is only monitoring user endpoints and not servers. Which of the following commands should the tester use?

pwinspector -i <file_of_targets> -o <found_credentials> -m 8 -M 16 -1 -u -n -p

responder -I eth0

nmap -sV -n -T3 -p 22 <targets> –reason

hydra -L root -P /path/to/wordlist -t 3 -M <file of targets>

QUESTION 99
Given the following statements:
– Implement a web application firewall.
– Upgrade end-of-life operating systems.
– Implement a secure software development life cycle.
In which of the following sections of a penetration test report would the above statements be found?

Executive summary

Attack narrative

Detailed findings

Recommendations

QUESTION 100
A penetration tester obtains network-level access to a hardened subnet that has no Windows- based hosts and needs to find credentials. The client mentioned that the SOC is only monitoring user endpoints and not servers. Which of the following commands should the tester use?

pwinspector -i <file_of_targets> -o <found_credentials> -m 8 -M 16 -1 -u

-n -p
responder -I eth0

nmap -sV -n -T3 -p 22 <targets> –reason

hydra -L root -P /path/to/wordlist -t 3 -M <file_of_targets>

QUESTION 101
Which of the following explains the reason a tester would opt to use DREAD over PTES during the planning phase of a penetration test?

The tester is conducting a web application test.

The tester is assessing a mobile application.

The tester is evaluating a thick client application.

The tester is creating a threat model.

QUESTION 102
Which of the following is the most likely LOLBin to be used to perform an exfiltration on a Microsoft Windows environment?

procdump.exe

msbuild.exe

bitsadmin.exe

cscript.exe

QUESTION 103
A penetration tester is preparing a password-spraying attack against a known list of users for the company “example.” The tester is using the following list of commands:
1. pw-inspector -i $allwords | tee $pass
2. spray365.py spray -ep $plan
3. users=”~/user.txt”; allwords=”~/words.txt”; pass=”~/passwords.txt”;
plan=”~/spray.plan”
4. spray365.py generate –password_file $pass –user file $user –domain
“example.com” –execution_plan $plan
5. cewl -m 5 “http://www.example.com” -w $allwords
Which of the following is the correct order for the list of the commands?

3, 4, 1, 2, 5

3, 1, 2, 5, 4

2, 3, 1, 4, 5

3, 5, 1, 4, 2

QUESTION 104
Which of the following OT protocols sends information in cleartext?

TTEthernet

DNP3

Modbus

PROFINET

QUESTION 105
A company that uses an insecure corporate wireless network is concerned about security. Which of the following is the most likely tool a penetration tester could use to obtain initial access?

Responder

Metasploit

Netcat

Nmap

QUESTION 106
Due to a few recent unsolved break-ins, an organization hires a physical penetration tester to check internal and external areas for weaknesses. The organization’s security officers receive some door and badge reader alerts during the testing window but cannot identify the cause. The tester’s findings include the following:

Which of the following should the tester recommend? (Choose two.)

Installing an access control vestibule in the lobby and at the delivery door

Introducing scheduled security officer patrols and documentation requirements

Improving the visitor and delivery check-in process by requiring separate badges

Incorporating physical security content and procedures into employee security awareness training

Implementing a video management system and additional camera coverage

Updating the access control system to require a badge and personal identification number

QUESTION 107
After obtaining a reverse shell, a penetration tester identifies a locally cloned Git repository that contains thousands of files and directories on a Windows machine. The tester suspects there could be sensitive information related to “ProjectX.” Which of the following commands should the tester use in a script to identify potential files to produce the best results?

gc * | select “ProjectX”

dir /R | findstr “ProjectX”

Get-ChildItem * | Select-String “ProjectX”

gci -Path . -Recurse | Select-String -Pattern “ProjectX”

QUESTION 108
Which of the following is the BEST resource for obtaining payloads against specific network infrastructure products?

Exploit-DB

Metasploit

Shodan

Retina

QUESTION 109
During the reconnaissance phase, a penetration tester collected the following information from the DNS records:
A—–> www
A—–> host
TXT –> vpn.comptia.org
SPF—> ip =2.2.2.2
Which of the following DNS records should be in place to avoid phishing attacks using spoofing domain techniques?

SOA

DMARC

CNAME