CompTIA Updated PT0-003 Exam Questions and Answers by layla-rose

To avoid triggering IDS/IPS alerts, the attacker should use offline cracking on compromised hashes rather than direct brute-force attempts.

Crack user accounts using compromised hashes (Option A):

Hashes can be cracked offline using tools like Hashcat or John the Ripper.

No direct login attempts, avoiding detection by security systems.

Configuring and Registering a Service:

Registering a malicious service ensures that it starts automatically with the system, providing persistence even after reboots.

This method is stealthier than others and is commonly used in advanced persistent threat (APT) scenarios.

Why Not Other Options?

B (Remote desktop software): Installing such software is noisy and can easily be detected by monitoring tools.

C (User logon script): While it provides persistence, it is less reliable and more detectable than a system service.

D (Kerberoasting): This is a credential-stealing technique and does not establish persistence.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)

Domain 4.0 (Penetration Testing Tools)

STRIDE is a threat classification model created by Microsoft that breaks down threats into six categories:

Spoofing

Tampering

Repudiation

Information disclosure

Denial of Service

Elevation of privilege

It is specifically designed for threat modeling.

PTES is a general pentesting methodology.

OSSTMM is a framework for operational security testing.

OCTAVE is a risk assessment methodology, not focused on threat classification.

To find the state of both TCP and UDP ports using Nmap, the appropriate command should combine both TCP and UDP scan options:

Understanding the Options:

-sU: Performs a UDP scan.

-sT: Performs a TCP connect scan.

Command Explanation:

Command: nmap -sU -sT -p 1-65535 example.com

This command will scan both TCP and UDP ports from 1 to 65535 on the target example.com. Combining -sU and -sT ensures that both types of services are scanned.

Comparison with Other Options:

-sW: Initiates a TCP Window scan, not relevant for identifying the state of TCP and UDP services.

-sY: Initiates a SCTP INIT scan, not relevant for this context.

-sN: Initiates a TCP Null scan, which is not used for discovering UDP services.

=================