CompTIA Updated PT0-003 Exam Questions and Answers by aron

The correct answer is A. Accidental loss of internal data

Unauthorized use of public LLMs creates a risk that employees may paste sensitive company information into external AI services. This can include internal documents, source code, customer data, security details, architecture diagrams, incident information, or confidential business content.

Because the LLM services are not approved by IT, the organization may not have controls for data handling, retention, monitoring, contractual protection, or data loss prevention. The broadest and best description of the risk is accidental loss of internal data.

B is incorrect because public disclosure of intellectual property is possible, but it is a narrower example of internal data loss.

C is incorrect because employee credentials could be exposed, but the question does not indicate credential theft or active exfiltration.

D is incorrect because prompt injection is an attack against LLM behavior. The scenario describes unauthorized use of public LLM services, not manipulation of an LLM through malicious prompts.

In PenTest+ terms, this falls under Information Gathering and Vulnerability Scanning, specifically identifying unauthorized services, shadow IT, data exposure risks, and AI/LLM-related security concerns.

Option A correctly performs the standard Bash text-processing sequence PenTest+ expects testers to use when transforming scan output into tool-ready input. First, grep -v " IP " removes the header line by excluding the row containing “IP” (the CSV header includes “Host, IP, Username, Password”). Next, cut -d " , " -f 3,4 splits each remaining line on commas and selects fields 3 and 4, which correspond to Username and Password in the exported format. Finally, sed -e ' s/,/ / ' replaces the remaining comma between those two fields with a space, producing the intended two-column output suitable for piping into password auditing, spraying, or validation tooling.

The other choices do not correctly parse CSV columns: find searches filenames, not CSV content; the grep expression in C does not extract fields and would only match lines; and D attempts to filter text by excluding hostnames/IPs rather than selecting the required columns. This makes A the only option that reliably yields “username password” per line from the CSV.

Since the client is worried about the availability of their consumer-facing application, the perimeter network web server (Server 3) is the most critical because:

It is internet-facing, making it a prime target for attackers.

A compromise could lead to data breaches, downtime, or service disruptions.

Even though it has fewer vulnerabilities (14 vs. 92 on QA server), its exposure is higher.

Option A (Development sandbox server) ❌: Internal and not publicly accessible.

Option B (Back-office file transfer server) ❌: Important, but not consumer-facing.

Option C (Perimeter web server) ✅: Correct. Publicly accessible and critical to operations.

Option D (Developer QA server) ❌: May have more vulnerabilities, but it’s less critical.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Prioritizing Vulnerability Testing

The correct answer is B. It ensures results can be independently verified.

Including attack steps in a penetration test report is important because it gives the client a clear, repeatable path showing how the vulnerability was discovered, exploited, and validated. This allows technical teams, auditors, or another tester to independently confirm the finding and understand the evidence behind it.

A is incorrect because recommended mitigations are usually included in a separate remediation or recommendations section. Attack steps may support mitigation planning, but that is not their primary purpose.

C is incorrect because the report is not intended to prove the tester’s competency. It is intended to communicate findings, evidence, impact, and remediation guidance.

D is incorrect because attack steps may help show complexity, but their main value is reproducibility and verification of results.

In PenTest+ terms, this falls under Reporting and Communication, specifically documentation quality, reproducibility, evidence support, and validation of penetration testing findings.