PT0-003 Exam Preparation Material | CompTIA PenTest+ Exam

Explanation:
The tester identified an HTTPS downgrade attack (e.g., SSL stripping). The best mitigation is to enforce HSTS (HTTP Strict Transport Security).
HSTS (Option A):
HSTS (Strict-Transport-Security) ensures that the browser always uses HTTPS, preventing downgrade attacks.
Example header:
Strict-Transport-Security: max-age=31536000; includeSubDomains
Reference: CompTIA PenTest+ PT0-003 Official Study Guide - "Web Security Headers and HTTPS Enforcements"
Incorrect options:
Option B (httponly flag): Protects cookies from JavaScript access but does not enforce HTTPS.
Option C (Firewall rule on port 80): Helps, but does not force browsers to use HTTPS.
Option D (Removing x-content-type-options): Unrelated; nosniff prevents MIME-type sniffing.

Explanation:
Penetration testers search for hardcoded credentials, API keys, and authentication tokens in source code repositories to identify secrets leakage.
Secrets scanning (Option B):
The find and egrep command scans all files recursively for sensitive keywords like "token," "key," and "login".
Attackers use tools like TruffleHog and GitLeaks to automate secret discovery.
Reference: CompTIA PenTest+ PT0-003 Official Study Guide - "Source Code Review and Secret Leakage"
Incorrect options:
Option A (Data tokenization): Tokenization replaces sensitive data with unique tokens, not scanning for credentials.
Option C (Password spraying): Tries common passwords across multiple accounts, unrelated to scanning source code.
Option D (Source code analysis): Broader than secrets scanning; this question focuses specifically on credential discovery.

Explanation:
Deauthentication is the correct answer because it is classically effective against WPA2 wireless networks, while WPA3 includes protections against unauthenticated deauthentication management-frame abuse when properly implemented with Protected Management Frames. Since AP3 is the only access point using WPA2, it is the only one that clearly remains the specific target for this attack in the scenario. A deauthentication attack forces connected clients off the network, often to capture handshakes or to push users toward reconnect behavior during wireless assessments. Brute force is not exclusive to AP3 in the way this question asks, signal jamming can affect any wireless network regardless of security standard, and evil twin attacks are not limited only to WPA2 networks. Therefore, the attack that applies only to AP3, based on its WPA2 configuration, is deauthentication.

Explanation:
Since SSID broadcast might be hidden, channel scanning allows the tester to identify active Wi-Fi networks.
Option A (Sidecar scanning) ❌ : Not a recognized Wi-Fi testing method.
Option B (Channel scanning) ✅ : Correct.
Identifies hidden SSIDs by monitoring probe requests and responses.
Option C (Stealth scanning) ❌ : Typically refers to evading detection, not Wi-Fi analysis.
Option D (Static analysis scanning) ❌ : Static analysis applies to code security, not Wi-Fi networks.
​Reference: CompTIA PenTest+ PT0-003 Official Guide C Wireless Reconnaissance Techniques

Explanation:
The logs indicate that the penetration testing team’s objective was to create persistence in the network.
Log Analysis:
schtasks /query: This command lists all the scheduled tasks on the system. It is often used to understand what tasks are currently scheduled and running.
schtasks /CREATE /SC DAILY: This command creates a new scheduled task that runs daily. Creating such a task can be used to ensure that a script or program runs regularly, maintaining a foothold in the system.
Persistence:
Definition: Persistence refers to techniques used to maintain access to a compromised system even after reboots or other interruptions.
Scheduled Tasks: One common method of achieving persistence on Windows systems is by creating scheduled tasks that execute malicious payloads or scripts at regular intervals.
Other Options:
Enumerate Current Users: The logs do not show commands related to user enumeration.
Determine Users' Permissions: Commands like whoami or net user would be more relevant for checking user permissions.
View Scheduled Processes: While schtasks /query can view scheduled tasks, the addition of the schtasks /CREATE command indicates the intent to create new scheduled tasks, which aligns with creating persistence.
Pentest
Reference: Post-Exploitation: Establishing persistence is a key objective after gaining initial access to ensure continued access.
Scheduled Tasks: Utilizing Windows Task Scheduler to run scripts or programs automatically at specified times as a method for maintaining access.
By creating scheduled tasks, the penetration testing team aims to establish persistence, ensuring they can retain access to the system over time.