CompTIA Updated PT0-003 Exam Questions and Answers by gigi

During an active PenTest+ engagement, goal changes are most commonly driven by new, material risk that affects the client’s threat landscape or business exposure. A publicly disclosed zero-day vulnerability can immediately change what the organization considers most critical because it may be actively exploited in the wild, may impact internet-facing systems, and may require urgent validation of compensating controls, patch readiness, or exposure level. In PenTest+ planning and scoping practices, the tester and client may revisit priorities mid-engagement when emerging threats create a higher likelihood of compromise or when leadership requires rapid answers (for example, “Are we vulnerable?” and “Can you prove impact?”).

Decommissioning an end-of-life server (A) typically reduces scope rather than reprioritizing goals, and it is a routine operational change. Not capturing artifacts (C) is a tester process/quality issue addressed through engagement management, not a client-driven reprioritization trigger. Assigning a new lead tester (D) is a staffing change and should not alter the client’s goals unless scope and requirements change. The zero-day disclosure is the clearest driver for reprioritization.

The command snmpwalk -v 2c -c public 192.168.1.23 is used to query SNMP (Simple Network Management Protocol) data from a device. Here’s the purpose in the context provided:

SNMP Enumeration:

Function: snmpwalk is used to retrieve a large amount of information from the target device using SNMP.

Version: -v 2c specifies the SNMP version.

Community String: -c public specifies the community string, which is essentially a password for SNMP queries.

Purpose of the Command:

Validate Results: The tester uses SNMP to gather detailed information about the network devices to confirm the findings of the vulnerability scanner and remove any false positives.

Detailed Information: SNMP can provide detailed information about device configurations, network interfaces, and other settings that can validate the scanner’s results.

Comparison with Other Options:

Bypassing Defensive Systems (A): Not directly related to SNMP enumeration.

Using Automation Tools (B): While SNMPwalk is automated, the primary purpose here is validation.

Script Exploits (C): SNMPwalk is not used for scripting exploits but for information gathering.

By using snmpwalk, the tester is validating the results from the vulnerability scanner and removing any false positives, ensuring accurate reporting.

======

CrackMapExec (CME) is the best choice because it supports authenticated enumeration against Active Directory and can retrieve domain configuration information—including password policy details—using valid domain credentials. In the PenTest+ methodology, once a tester has a standard domain account, a common next step is to enumerate domain settings that influence attack feasibility and safety, such as minimum password length, complexity requirements, lockout threshold, lockout duration, and password history. These values directly inform how to build a “policy-aware” custom wordlist and how to tune dictionary or spraying attempts to remain within rules of engagement and avoid triggering lockouts.

Responder is primarily used for LLMNR/NBT-NS poisoning and capturing or relaying authentication on local networks; it does not query AD policy as its main function. Hydra is a login brute-force tool that performs attacks, not policy retrieval. msfvenom is a payload generator used for exploitation and post-exploitation delivery, unrelated to enumerating AD password policy. Therefore, CME is the most appropriate tool to retrieve the password policy for informed dictionary construction.

The correct answer is A. Target 1: EPSS Score = 0.6 and CVSS Score = 4

EPSS, the Exploit Prediction Scoring System, estimates the likelihood that a vulnerability will be exploited in the wild. CVSS, the Common Vulnerability Scoring System, measures the severity or technical impact of a vulnerability.

The question asks which target is most likely to get attacked, so the EPSS score is the most important factor. The highest EPSS score shown is 0.6, which appears in both Target 1 and Target 3.

Between those two, Target 1 has the higher CVSS score:

Target 1: EPSS 0.6, CVSS 4

Target 3: EPSS 0.6, CVSS 1

Since both have the same exploitation likelihood, the vulnerability with the higher impact/severity is the better choice. Therefore, Target 1 is the most likely and more meaningful attack target.

B is incorrect because its EPSS score is lower at 0.3.

C is incorrect because although its EPSS score is tied for highest, its CVSS score is much lower than Target 1.

D is incorrect because it has the highest CVSS score, but its EPSS score is lower than Target 1 and Target 3. A higher CVSS score means greater severity, not necessarily a higher likelihood of exploitation.

In PenTest+ terms, this falls under Information Gathering and Vulnerability Scanning, specifically vulnerability prioritization using exploit likelihood and severity metrics.