CompTIA Updated PT0-003 Exam Questions and Answers by tony

When testing a power plant ' s network and needing to avoid disruption to the grid, configuring a port mirror and reviewing the network traffic is the most appropriate method to identify vulnerabilities without causing disruptions.

Port Mirroring:

Definition: Port mirroring (SPAN - Switched Port Analyzer) is a method of monitoring network traffic by duplicating packets from one or more switch ports to another port where a monitoring device is connected.

Purpose: Allows passive monitoring of network traffic without impacting network operations or device performance.

Avoiding Disruption:

Non-Intrusive: Port mirroring is non-intrusive and does not generate additional traffic or load on the network devices, making it suitable for sensitive environments like power plants where disruption is not acceptable.

Other Options:

Network Scanner Engine: Active scanning might disrupt network operations or devices, which is not suitable for critical infrastructure.

Testing Framework: Validating vulnerabilities on devices might involve active testing, which can be disruptive.

Network Mapper Tool: Running a network mapper tool (like Nmap) actively scans the network and might disrupt services.

Pentest References:

Passive Monitoring: Passive techniques such as port mirroring are essential in environments where maintaining operational integrity is critical.

Critical Infrastructure Security: Understanding the need for non-disruptive methods in critical infrastructure penetration testing to ensure continuous operations.

By configuring a port mirror and reviewing network traffic, the penetration tester can identify vulnerabilities in the power plant ' s network without risking disruption to the grid.

======

By default, Nmap scans the top 1,000 most commonly used TCP ports unless otherwise specified.

Option A (256) ❌: Incorrect. This refers to the number of hosts in a /24 subnet, not the number of ports scanned.

Option B (1,000) ✅: Correct. Nmap defaults to scanning the 1,000 most common TCP ports unless the -p flag is used to specify a different range.

Option C (1,024) ❌: Incorrect. The first 1,024 ports are well-known ports, but Nmap scans 1,000 by default, not 1,024.

Option D (65,535) ❌: Incorrect. Nmap only scans all ports if the -p- flag is used (e.g., nmap -p- < target > ).

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Network Scanning with Nmap

To avoid locking out accounts while attempting access, the penetration tester should use credential stuffing.

Credential Stuffing:

Definition: An attack method where attackers use a list of known username and password pairs, typically obtained from previous data breaches, to gain unauthorized access to accounts.

Advantages: Unlike brute-force attacks, credential stuffing uses already known credentials, which reduces the number of attempts per account and minimizes the risk of triggering account lockout mechanisms.

Tool: Tools like Sentry MBA, Snipr, and others are commonly used for credential stuffing attacks.

Other Techniques:

MFA Fatigue: A social engineering tactic to exhaust users into accepting multi-factor authentication requests, not applicable for avoiding lockouts in this context.

Dictionary Attack: Similar to brute-force but uses a list of likely passwords; still risks lockout due to multiple attempts.

Brute-force Attack: Systematically attempts all possible password combinations, likely to trigger account lockouts due to high number of failed attempts.

Pentest References:

Password Attacks: Understanding different types of password attacks and their implications on account security.

Account Lockout Policies: Awareness of how lockout mechanisms work and strategies to avoid triggering them during penetration tests.

By using credential stuffing, the penetration tester can attempt to gain access using known credentials without triggering account lockout policies, ensuring a stealthier approach to password attacks.

======

1: Null session enumeration

Weak SMB file permissions

Fragmentation attack

2: nmap

-sV

-p 1-1023

192.168.2.2

3: #!/usr/bin/python

export $PORTS = 21,22

for $PORT in $PORTS:

try:

s.connect((ip, port))

print(“%s:%s – OPEN” % (ip, port))

except socket.timeout

print(“%:%s – TIMEOUT” % (ip, port))

except socket.error as e:

print(“%:%s – CLOSED” % (ip, port))

finally

s.close()

port_scan(sys.argv[1], ports)