CompTIA Updated PT0-003 Exam Questions and Answers by kobi

The SeImpersonatePrivilege allows a process to impersonate another user’s security context, which is commonly used in token manipulation attacks for privilege escalation.

Option A (SeImpersonatePrivilege) ✅: Correct.

Used in Juicy Potato or Rogue Potato attacks to escalate privileges.

Option B (SeCreateGlobalPrivilege) ❌: Allows creating global objects, but not privilege escalation.

Option C (SeChangeNotifyPrivilege) ❌: Enables traverse directory access, not privilege escalation.

Option D (SeManageVolumePrivilege) ❌: Used for disk management, not privilege escalation.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Windows Privilege Escalation via Token Impersonation

Encoding to Evade DLP:

Encoding (e.g., Base64) transforms data into a format that may bypass data loss prevention (DLP) tools.

DLP solutions often look for specific patterns (e.g., sensitive keywords, file headers) and may not recognize encoded data.

Why Not Other Options?

B (Compression): Compression reduces file size but does not typically bypass DLP detection mechanisms.

C (Encryption): Encrypted data is detectable by DLP tools, though its contents may not be readable.

D (Obfuscation): While obfuscation hides intent, encoding is more effective for bypassing automated detection.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)