Community Q&A
PT0-003 — frequently asked questions
Community-vetted answers to 14 common questions about this exam, each traced back to a specific practice question.
Questions from real practice questions
Each Q&A comes from a specific question — follow the link for the full analysisRemediating Insecure Exception Handling in SAST Reports
Why is printStackTrace() considered insecure?
It outputs detailed internal stack traces to standard error, which can reveal sensitive system architecture, file paths, and class names to unauthorized users.
What is the difference between fixing the code vs. training developers?
Fixing the code addresses the immediate vulnerability in the current build, while training is a long-term preventive measure that does not remediate existing flaws.
Enumerating TLS Versions with Nmap
What does the ssl-enum-ciphers script return?
It returns a list of supported SSL/TLS versions, cipher suites, and a security grade (A-F) based on the strength of the configurations.
Why is curl --tls-max not useful for discovery?
It limits the maximum TLS version the client will use for a connection attempt, but it does not probe or report which versions the server actually supports.
Most Efficient Sensitive-File Exfiltration Method
Why is HTTPS exfiltration more efficient than DNS tunneling with dnscat?
HTTPS carries large payloads over a full TCP connection with guaranteed delivery, while dnscat sends tiny DNS queries and responses, forcing the file into fragments that must be reassembled slowly.
Does encrypting the file before sending it over HTTPS matter?
Yes. TLS already protects data in transit, but encrypting the file itself adds at-rest protection if a copy is later captured, and it costs negligible time compared with the transfer.
When would steganography or TFTP be a better choice than HTTPS?
They would not be more efficient. Steganography trades bandwidth for concealment when stealth is the priority, and TFTP suits trusted local LAN transfers of unattended files, not sensitive data over the internet.
Physical Security Social Engineering: Crutch Impersonation
What is the difference between tailgating and piggybacking?
Tailgating is gaining unauthorized access by following someone without their knowledge or consent, often exploiting distraction. Piggybacking is when the authorized person knowingly allows the follower in, often due to a request for help or social pressure.
Is using crutches always considered impersonation?
In the context of penetration testing exams, yes. It is a deliberate use of a prop to create a false narrative (pretext) about the attacker's status, which constitutes impersonating an injured person to elicit sympathy and bypass security.
User Enumeration When Legacy Services Fail
Why isn't smbclient used for Linux user enumeration?
smbclient requires the Linux system to be running Samba. Many Linux servers do not run Samba, making it an unreliable universal tool compared to OSINT methods.
What does theHarvester actually collect?
It collects emails, usernames, hostnames, subdomains, and IP addresses from public sources like search engines, PGP directories, and social media profiles.
Identifying the Penetration Testing Framework with 14 Components
Why isn't MITRE ATT&CK the correct answer if it has 14 items?
MITRE ATT&CK contains 14 tactics which describe adversary behavior steps. The question asks for a framework that breaks the testing life cycle into components. OSSTMM is the methodology that structures the test itself into 14 channels.
What are the 14 components in OSSTMM?
OSSTMM divides testing into 14 channels: Information, Data, Systems, Human, Wireless, Physical, Databases, Applications, Remote Access, Networks, Voice, Video, Telephony, and Management. These guide the scope of the penetration test.
Is CREST a testing framework?
No, CREST is a professional certification and accreditation body for cybersecurity professionals. It does not provide a technical methodology or framework for conducting penetration tests like OSSTMM or PTES.