PT0-003 Dumps with Practice Exam Questions Answers

Breach and Attack Simulation (BAS) tools emulate real-world attacks to test security controls.

Atomic Red Team (Option C):

Atomic Red Team is an open-source BAS framework that provides simple commands to simulate MITRE ATT & CK® techniques.

It allows controlled adversary simulations without real exploitation.

RFID cloning involves copying data from an existing access card to create a duplicate badge. Attackers use tools like Proxmark3 or Flipper Zero to capture and replicate RFID signals.

Option A (Smurfing) ❌: A DDoS attack technique, unrelated to physical security.

Option B (Credential stuffing) ❌: Uses compromised usernames/passwords, not RFID badges.

Option C (RFID cloning) ✅: Correct. Creates a duplicate access badge using RFID technology.

Option D (Card skimming) ❌: Steals credit card data, but does not duplicate RFID badges.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Physical Security Testing & RFID Cloning

The presence of SMB (port 445) and MSRPC (port 135) indicates potential Windows network services that could be vulnerable to misconfigurations or exploits.

Enumerate shares and search for vulnerabilities on SMB (Option B):

SMB (Server Message Block) allows file and printer sharing. Misconfigured or open shares could contain sensitive data.

Tools like enum4linux or smbclient can be used to list available shares and check for anonymous access.

SMB vulnerabilities (e.g., EternalBlue - CVE-2017-0144) can be exploited for remote code execution.

The correct answer is A. Evilginx

Evilginx is a phishing framework commonly associated with adversary-in-the-middle phishing attacks. It can proxy authentication traffic between a victim and a legitimate service, allowing the attacker to capture credentials and session tokens. Because session tokens may be captured after successful authentication, Evilginx is known for being able to defeat or bypass some MFA workflows during authorized social engineering assessments.

B is incorrect because the listed commands resemble a phishing module configuration, but they are not the best-known or most appropriate option for capturing MFA/session tokens.

C is incorrect because wget portal.office.com only retrieves web content, and setting an environment variable named MFA does not create an MFA capture capability.

D is incorrect because Recon-ng is an OSINT and reconnaissance framework. It is used for information gathering, not for capturing MFA tokens or conducting adversary-in-the-middle phishing.

In PenTest+ terms, this falls under Attacks and Exploits, specifically social engineering, phishing, credential harvesting, and MFA/session-token capture techniques used during authorized engagements.

Gophish and Evilginx are the most applicable choices because the scenario specifically describes acquiring valid credentials through a social engineering campaign. Gophish is a phishing framework used to create campaigns, send phishing emails, manage landing pages, track user interaction, and measure susceptibility to credential-harvesting simulations. Evilginx is a reverse-proxy phishing framework that can relay legitimate authentication flows through an attacker-controlled proxy during an authorized assessment, allowing the tester to evaluate exposure to credential theft and session-token capture techniques, including attacks against some multi-factor authentication workflows. TruffleHog is primarily used to find secrets in repositories or file systems, not to run a social engineering campaign. Shodan identifies Internet-exposed systems but does not perform credential acquisition through phishing. Maltego and theHarvester are useful for OSINT, target mapping, and discovering emails or relationships, but they are preparatory reconnaissance tools rather than primary credential-acquisition mechanisms. Because the question asks for tools and techniques most applicable to obtaining valid credentials through social engineering, Gophish and Evilginx directly satisfy the objective. This maps to study-guide topics covering social engineering, phishing campaigns, credential attacks, adversary emulation, and authorized exploitation workflows.