CompTIA PenTest+ PT0-003 Practice Test 6
Question 50
A blue team wants to map observed adversary techniques to detection gaps discovered during the exercise. The reviewer asks for the underlying reason, not a list of tools. What principle explains the recommended assessment decision?
- Secure distribution protects potentially sensitive findings during stakeholder communication
- ATT&CK describes adversary behavior and coverage, not contractual approval boundaries
- STRIDE is a threat classification model built around six security-failure categories
- PTES organizes phases and communication rather than prescribing a single attack payload
Explanation
Correct Answer
B:ATT&CK describes adversary behavior and coverage, not contractual approval boundaries. It directly supports Classify observations using MITRE ATT&CK tactics and techniques under the scenario constraints.
Incorrect Answers
A:Secure distribution protects potentially sensitive findings during stakeholder communication. That applies when evidence files contain account identifiers and are about to be sent to a broad project mailing list. It does not establish the particular requirement here.
C:STRIDE is a threat classification model built around six security-failure categories. That applies when during threat modeling, the team enumerates spoofing, tampering, repudiation, information disclosure, denial of service and privilege escalation. It does not establish the particular requirement here.
D:PTES organizes phases and communication rather than prescribing a single attack payload. That applies when a client wants a consistent end-to-end penetration-test process from scoping to reporting. It does not establish the particular requirement here.
Question 51
A blue team wants to map observed adversary techniques to detection gaps discovered during the exercise. A reviewer instead suggests: "Treat ATT&CK as the statement of work." What precise limitation makes that alternative unsuitable here?
- A catalog of weaknesses does not define engagement execution and governance
- A threat knowledge base cannot replace client authorization and scope
- A previously approved target does not override a time-limited authorization
- Port discovery alone cannot assess mobile application data handling
Explanation
Correct Answer
B:A threat knowledge base cannot replace client authorization and scope. The named proposal is Treat ATT&CK as the statement of work, which leaves the original requirement unresolved; use Classify observations using MITRE ATT&CK tactics and techniques instead.
Incorrect Answers
A:A catalog of weaknesses does not define engagement execution and governance. That reasoning concerns the different shortcut Use a vulnerability identifier list as the entire methodology in the case A client wants a consistent end-to-end penetration-test process from scoping to reporting.
C:A previously approved target does not override a time-limited authorization. That reasoning concerns the different shortcut Continue until the queue is empty in the case A production network test is approved only during a Saturday maintenance window, and a scanner is still running afterward.
D:Port discovery alone cannot assess mobile application data handling. That reasoning concerns the different shortcut Replace mobile review with desktop port enumeration in the case A mobile banking client wants security verification coverage of application storage, authentication and platform interaction.
Question 52
A blue team wants to map observed adversary techniques to detection gaps discovered during the exercise. The approved step is complete and the client requests proof. What outcome would most directly verify the finding or mitigation?
- Mobile test cases map to verified requirements and platform-specific evidence
- The model lists threats and mitigations by STRIDE category
- The assessment shows technique mappings and validated detection gaps
- All referenced identifiers resolve and conclusions match retained test evidence
Explanation
Correct Answer
C:The assessment shows technique mappings and validated detection gaps. That validates Classify observations using MITRE ATT&CK tactics and techniques without relying on an unsupported or out-of-scope conclusion.
Incorrect Answers
A:Mobile test cases map to verified requirements and platform-specific evidence. This validates Map test requirements to OWASP MASVS and relevant mobile testing guidance in the separate situation A mobile banking client wants security verification coverage of application storage, authentication and platform interaction. It does not verify this case.
B:The model lists threats and mitigations by STRIDE category. This validates Use STRIDE categories to structure the analysis in the separate situation During threat modeling, the team enumerates spoofing, tampering, repudiation, information disclosure, denial of service and privilege escalation. It does not verify this case.
D:All referenced identifiers resolve and conclusions match retained test evidence. This validates Verify every citation and technical statement before delivery and note review controls in the separate situation A report draft was partially generated using an AI writing assistant and includes an invented CVE reference. It does not verify this case.
Question 53
During threat modeling, the team enumerates spoofing, tampering, repudiation, information disclosure, denial of service and privilege escalation. What should the assessor recommend?
- Use STRIDE categories to structure the analysis
- Use the Purdue model to describe operational technology zones and conduits
- Use the Penetration Testing Execution Standard as an engagement framework
- Use CVSS as the threat-model taxonomy
Explanation
Correct Answer
A:Use STRIDE categories to structure the analysis. STRIDE is a threat classification model built around six security-failure categories. The relevant evidence is that the model lists threats and mitigations by STRIDE category.
Incorrect Answers
B:Use the Purdue model to describe operational technology zones and conduits. This would address a different authorized case: An industrial plant asks testers to distinguish enterprise IT assets from controllers and safety-critical field devices. Industrial architecture zones help constrain tests that could affect physical processes.
C:Use the Penetration Testing Execution Standard as an engagement framework. This would address a different authorized case: A client wants a consistent end-to-end penetration-test process from scoping to reporting. PTES organizes phases and communication rather than prescribing a single attack payload.
D:Vulnerability severity scoring is not the six-category STRIDE classification. The proposed shortcut does not satisfy the exact condition in this case.
Question 54
During threat modeling, the team enumerates spoofing, tampering, repudiation, information disclosure, denial of service and privilege escalation. The reviewer asks for the underlying reason, not a list of tools. Which security property most directly supports the recommendation?
- STRIDE is a threat classification model built around six security-failure categories
- Peer validation distinguishes a true security boundary failure from a misleading UI state
- ATT&CK describes adversary behavior and coverage, not contractual approval boundaries
- PTES organizes phases and communication rather than prescribing a single attack payload
Explanation
Correct Answer
A:STRIDE is a threat classification model built around six security-failure categories. It directly supports Use STRIDE categories to structure the analysis under the scenario constraints.
Incorrect Answers
B:Peer validation distinguishes a true security boundary failure from a misleading UI state. That applies when a junior tester reports administrative access based only on a screenshot with no request context. It does not establish the particular requirement here.
C:ATT&CK describes adversary behavior and coverage, not contractual approval boundaries. That applies when a blue team wants to map observed adversary techniques to detection gaps discovered during the exercise. It does not establish the particular requirement here.
D:PTES organizes phases and communication rather than prescribing a single attack payload. That applies when a client wants a consistent end-to-end penetration-test process from scoping to reporting. It does not establish the particular requirement here.
Question 55
During threat modeling, the team enumerates spoofing, tampering, repudiation, information disclosure, denial of service and privilege escalation. A reviewer instead suggests: "Use CVSS as the threat-model taxonomy." Which risk would that shortcut leave unresolved?
- A threat knowledge base cannot replace client authorization and scope
- An industrial controller has safety and availability risks unlike a typical web endpoint
- Vulnerability severity scoring is not the six-category STRIDE classification
- Possessing addresses does not establish legal permission to attack them
Explanation
Correct Answer
C:Vulnerability severity scoring is not the six-category STRIDE classification. The named proposal is Use CVSS as the threat-model taxonomy, which leaves the original requirement unresolved; use Use STRIDE categories to structure the analysis instead.
Incorrect Answers
A:A threat knowledge base cannot replace client authorization and scope. That reasoning concerns the different shortcut Treat ATT&CK as the statement of work in the case A blue team wants to map observed adversary techniques to detection gaps discovered during the exercise.
B:An industrial controller has safety and availability risks unlike a typical web endpoint. That reasoning concerns the different shortcut Treat controllers as ordinary internet web servers in the case An industrial plant asks testers to distinguish enterprise IT assets from controllers and safety-critical field devices.
D:Possessing addresses does not establish legal permission to attack them. That reasoning concerns the different shortcut Treat the address list as implicit consent in the case An external consultant receives a list of private IP addresses but no signed permission to perform penetration testing.
Question 56
During threat modeling, the team enumerates spoofing, tampering, repudiation, information disclosure, denial of service and privilege escalation. The approved step is complete and the client requests proof. What evidence should the client request at review?
- The model lists threats and mitigations by STRIDE category
- An unauthorized test workstation cannot reach the database service
- The assessment shows technique mappings and validated detection gaps
- The plan maps authorization, intelligence, testing, analysis and reporting milestones
Explanation
Correct Answer
A:The model lists threats and mitigations by STRIDE category. That validates Use STRIDE categories to structure the analysis without relying on an unsupported or out-of-scope conclusion.
Incorrect Answers
B:An unauthorized test workstation cannot reach the database service. This validates Recommend scoped network segmentation and explicit workload access controls in the separate situation An internal test shows workstations can reach a sensitive production database over unrestricted east-west network paths. It does not verify this case.
C:The assessment shows technique mappings and validated detection gaps. This validates Classify observations using MITRE ATT&CK tactics and techniques in the separate situation A blue team wants to map observed adversary techniques to detection gaps discovered during the exercise. It does not verify this case.
D:The plan maps authorization, intelligence, testing, analysis and reporting milestones. This validates Use the Penetration Testing Execution Standard as an engagement framework in the separate situation A client wants a consistent end-to-end penetration-test process from scoping to reporting. It does not verify this case.
Question 57
A mobile banking client wants security verification coverage of application storage, authentication and platform interaction. What should the assessor recommend?
- Classify observations using MITRE ATT&CK tactics and techniques
- Use the Penetration Testing Execution Standard as an engagement framework
- Replace mobile review with desktop port enumeration
- Map test requirements to OWASP MASVS and relevant mobile testing guidance
Explanation
Correct Answer
D:Map test requirements to OWASP MASVS and relevant mobile testing guidance. MASVS describes mobile-app security verification areas rather than network-port scan settings. The relevant evidence is that mobile test cases map to verified requirements and platform-specific evidence.
Incorrect Answers
A:Classify observations using MITRE ATT&CK tactics and techniques. This would address a different authorized case: A blue team wants to map observed adversary techniques to detection gaps discovered during the exercise. ATT&CK describes adversary behavior and coverage, not contractual approval boundaries.
B:Use the Penetration Testing Execution Standard as an engagement framework. This would address a different authorized case: A client wants a consistent end-to-end penetration-test process from scoping to reporting. PTES organizes phases and communication rather than prescribing a single attack payload.
C:Port discovery alone cannot assess mobile application data handling. The proposed shortcut does not satisfy the exact condition in this case.
Question 58
A mobile banking client wants security verification coverage of application storage, authentication and platform interaction. The reviewer asks for the underlying reason, not a list of tools. Which security property most directly supports the recommendation?
- Additional origin-bound factors reduce takeover from stolen passwords
- PTES organizes phases and communication rather than prescribing a single attack payload
- MASVS describes mobile-app security verification areas rather than network-port scan settings
- STRIDE is a threat classification model built around six security-failure categories
Explanation
Correct Answer
C:MASVS describes mobile-app security verification areas rather than network-port scan settings. It directly supports Map test requirements to OWASP MASVS and relevant mobile testing guidance under the scenario constraints.
Incorrect Answers
A:Additional origin-bound factors reduce takeover from stolen passwords. That applies when a portal accepts valid passwords but privileged sessions never require a second factor. It does not establish the particular requirement here.
B:PTES organizes phases and communication rather than prescribing a single attack payload. That applies when a client wants a consistent end-to-end penetration-test process from scoping to reporting. It does not establish the particular requirement here.
D:STRIDE is a threat classification model built around six security-failure categories. That applies when during threat modeling, the team enumerates spoofing, tampering, repudiation, information disclosure, denial of service and privilege escalation. It does not establish the particular requirement here.
Question 59
A mobile banking client wants security verification coverage of application storage, authentication and platform interaction. A reviewer instead suggests: "Replace mobile review with desktop port enumeration." Which risk would that shortcut leave unresolved?
- Port discovery alone cannot assess mobile application data handling
- Previously copied credentials remain valid unless revoked
- A threat knowledge base cannot replace client authorization and scope
- A catalog of weaknesses does not define engagement execution and governance
Explanation
Correct Answer
A:Port discovery alone cannot assess mobile application data handling. The named proposal is Replace mobile review with desktop port enumeration, which leaves the original requirement unresolved; use Map test requirements to OWASP MASVS and relevant mobile testing guidance instead.
Incorrect Answers
B:Previously copied credentials remain valid unless revoked. That reasoning concerns the different shortcut Delete only the visible source line in the case An application deployment reveals a credential embedded in its source repository.
C:A threat knowledge base cannot replace client authorization and scope. That reasoning concerns the different shortcut Treat ATT&CK as the statement of work in the case A blue team wants to map observed adversary techniques to detection gaps discovered during the exercise.
D:A catalog of weaknesses does not define engagement execution and governance. That reasoning concerns the different shortcut Use a vulnerability identifier list as the entire methodology in the case A client wants a consistent end-to-end penetration-test process from scoping to reporting.
Question 60
A mobile banking client wants security verification coverage of application storage, authentication and platform interaction. The approved step is complete and the client requests proof. Which safe follow-up result demonstrates the outcome?
- The model lists threats and mitigations by STRIDE category
- An unauthorized test workstation cannot reach the database service
- The scope maps industrial tiers, owners and prohibited active probes
- Mobile test cases map to verified requirements and platform-specific evidence
Explanation
Correct Answer
D:Mobile test cases map to verified requirements and platform-specific evidence. That validates Map test requirements to OWASP MASVS and relevant mobile testing guidance without relying on an unsupported or out-of-scope conclusion.
Incorrect Answers
A:The model lists threats and mitigations by STRIDE category. This validates Use STRIDE categories to structure the analysis in the separate situation During threat modeling, the team enumerates spoofing, tampering, repudiation, information disclosure, denial of service and privilege escalation. It does not verify this case.
B:An unauthorized test workstation cannot reach the database service. This validates Recommend scoped network segmentation and explicit workload access controls in the separate situation An internal test shows workstations can reach a sensitive production database over unrestricted east-west network paths. It does not verify this case.
C:The scope maps industrial tiers, owners and prohibited active probes. This validates Use the Purdue model to describe operational technology zones and conduits in the separate situation An industrial plant asks testers to distinguish enterprise IT assets from controllers and safety-critical field devices. It does not verify this case.
