CompTIA PT0-003 Exam Dumps

In operational technology environments, safety, availability, and process stability are the highest priorities. Because the requirement says the tester must not disrupt OT services and must minimize device interaction, passive network capture is the best approach. Passive capture allows the tester to observe traffic flows, protocols, device communications, and asset relationships without directly probing or interrogating the systems. This greatly reduces the risk of causing faults, crashes, or unintended behavior in fragile industrial devices. Low-impact scanning may still generate traffic that certain PLCs, RTUs, or legacy controllers cannot safely handle. Physical assessment can help with inventory, but it is not the best method for network-based system discovery. Deploying agents is intrusive and operationally risky. Therefore, passive capture is the most appropriate and safest discovery method in a segmented OT environment.

==============

The correct answer is A. Mimikatz

The KRBTGT account is a special Active Directory account used by the Key Distribution Center to encrypt and sign Kerberos tickets. If the KRBTGT account password has not been changed for a long time, and an attacker obtains the account hash, the attacker can use it to forge Kerberos Ticket Granting Tickets. This is known as a Golden Ticket attack.

Mimikatz is the tool commonly used to extract credentials, obtain Kerberos-related secrets, and create forged Kerberos tickets such as Golden Tickets. With a valid forged ticket, an attacker may maintain long-term domain persistence and impersonate privileged users.

B is incorrect because John the Ripper is primarily used for offline password cracking. It does not create or inject Kerberos Golden Tickets.

C is incorrect because Hashcat is also used for password/hash cracking. It may help crack hashes, but it is not the primary tool used to exploit a stale KRBTGT password through Golden Ticket creation.

D is incorrect because Hydra is an online password brute-force tool. It is not used for Kerberos ticket forgery.

In PenTest+ terms, this falls under Attacks and Exploits, specifically Active Directory attacks, Kerberos abuse, credential attacks, and Golden Ticket persistence.

To maintain access to a compromised system after rebooting, a penetration tester should create a scheduled task. Scheduled tasks are designed to run automatically at specified times or when certain conditions are met, ensuring persistence across reboots.

Persistence Mechanisms:

Scheduled Task: Creating a scheduled task ensures that a specific program or script runs automatically according to a set schedule or in response to certain events, including system startup. This makes it a reliable method for maintaining access after a system reboot.

Reverse Shell: While establishing a reverse shell provides immediate access, it typically does not survive a system reboot unless coupled with another persistence mechanism.

Process Injection: Injecting a malicious process into another running process can provide stealthy access but may not persist through reboots.

Credential Dumping: Dumping credentials allows for re-access by using stolen credentials, but it does not ensure automatic access upon reboot.

Creating a Scheduled Task:

On Windows, the schtasks command can be used to create scheduled tasks. For example:

schtasks /create /tn 'Persistence' /tr 'C:\path\to\malicious.exe' /sc onlogon /ru SYSTEM

On Linux, a cron job can be created by editing the crontab:

(crontab -l; echo '@reboot /path/to/malicious.sh') | crontab -

Pentest Reference:

Maintaining persistence is a key objective in post-exploitation. Scheduled tasks (Windows Task Scheduler) and cron jobs (Linux) are commonly used techniques.

Reference to real-world scenarios include creating scheduled tasks to execute malware, keyloggers, or reverse shells automatically on system startup.

By creating a scheduled task, the penetration tester ensures that their access method (e.g., reverse shell, malware) is executed automatically whenever the system reboots, providing reliable persistence.

======

DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that helps prevent email spoofing and phishing. It builds on SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to provide a mechanism for email senders and receivers to improve and monitor the protection of the domain from fraudulent email.

Understanding DMARC:

SPF: Defines which IP addresses are allowed to send emails on behalf of a domain.

DKIM: Provides a way to check that an email claiming to come from a specific domain was indeed authorized by the owner of that domain.

DMARC: Uses SPF and DKIM to determine the authenticity of an email and specifies what action to take if the email fails the authentication checks.

Implementing DMARC:

Create a DMARC policy in your DNS records. This policy can specify to reject, quarantine, or take no action on emails that fail SPF or DKIM checks.

Example DMARC record: v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com;

Benefits of DMARC:

Helps to prevent email spoofing and phishing attacks.

Provides visibility into email sources through reports.

Enhances domain reputation by ensuring only legitimate emails are sent from the domain.

DMARC Record Components:

v: Version of DMARC.

p: Policy for handling emails that fail the DMARC check (none, quarantine, reject).

rua: Reporting URI of aggregate reports.

ruf: Reporting URI of forensic reports.

pct: Percentage of messages subjected to filtering.

Real-World Example:

A company sets up a DMARC policy with p=reject to ensure that any emails failing SPF or DKIM checks are rejected outright, significantly reducing the risk of phishing attacks using their domain.

Reference from Pentesting Literature:

In 'Penetration Testing - A Hands-on Introduction to Hacking,' DMARC is mentioned as part of email security protocols to prevent phishing.

HTB write-ups often highlight the importance of DMARC in securing email communications and preventing spoofing attacks.

Step-by-Step ExplanationReference:

Penetration Testing - A Hands-on Introduction to Hacking

HTB Official Writeups

======

A reverse shell that is left on a target to maintain access is a form of persistence/backdoor. The action described --- removing the reverse shell at the end of the engagement --- is specifically the removal of a persistence mechanism. Post-engagement cleanup requires removal of any artifacts that provide continued access (web shells, scheduled tasks, reverse shells, cron jobs, created accounts, etc.) so the environment is returned to its pre-test state and to prevent later compromise.

Why not the others:

B (Uninstalling tools): Removing tools is also a cleanup activity, but the question explicitly references removing the reverse shell (persistence).

C (Preserving artifacts): Preserving artifacts is the opposite (saving logs/evidence) for incident response --- not removing access.

D (Reverting configuration changes): Important, but the best single match for removing a reverse shell is ''removing persistence mechanisms.''

PT0-003 mapping: Domain 5 --- post-engagement cleanup and returning environment to baseline.