During a penetration test, a tester identifies a Windows service running with SYSTEM privileges. The service's binary path is 'C:\Program Files\Vendor\Service.exe'. The tester has write access to the 'C:\Program Files\Vendor' directory. Which action would most likely lead to privilege escalation?

Modify the service's registry entry to point to a different executable

Create a new service with the same name

Stop the service and then start it again

Replace Service.exe with a malicious binary and restart the service

A penetration tester is trying to escalate privileges on a Windows host that has Credential Guard enabled. The tester wants to extract credentials from LSASS. Which approach is most likely to succeed?

Disable Credential Guard via registry modification

Use Mimikatz to dump LSASS memory directly

Use a kernel-level exploit to bypass Credential Guard

Extract credentials from the Local Security Authority (LSA) cache

What is the primary purpose of process injection in the context of a penetration test?

To hide malicious activity by running code within a legitimate process

To increase the speed of code execution

A penetration tester is performing a DLL injection attack on a Windows process. The tester wants to execute a payload that runs in the context of the target process without creating a new thread. Which technique would achieve this?

Use WriteProcessMemory to overwrite the entry point

Use QueueUserAPC to execute LoadLibrary in the target process

Use SetWindowsHookEx to load the DLL

Use CreateRemoteThread to call LoadLibrary

A penetration tester gains initial access to a Windows workstation as a standard user. The tester discovers a scheduled task that runs with SYSTEM privileges and is configured to execute a script from a user-writable directory. The tester wants to escalate privileges by replacing the script with a reverse shell payload. Which technique is the tester most likely using?

Unquoted service path exploitation

CompTIAPenTest+

Domain 4Objective 3

Host-Based Attacks PT0-003 Practice Questions (Page 4)

Part of the Attacks and exploits domain, which accounts for 35% of the PT0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~23–39 in this domain), expect 4–7 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

8concepts

35%of the exam

Questions 16–20

16application · medium
During a penetration test, a tester identifies a Windows service running with SYSTEM privileges. The service's binary path is 'C:\Program Files\Vendor\Service.exe'. The tester has write access to the 'C:\Program Files\Vendor' directory. Which action would most likely lead to privilege escalation?
Select an answer first
17application · medium
A penetration tester is trying to escalate privileges on a Windows host that has Credential Guard enabled. The tester wants to extract credentials from LSASS. Which approach is most likely to succeed?
Select an answer first
18foundation · easy
What is the primary purpose of process injection in the context of a penetration test?
Select an answer first
19application · medium
A penetration tester is performing a DLL injection attack on a Windows process. The tester wants to execute a payload that runs in the context of the target process without creating a new thread. Which technique would achieve this?
Select an answer first
20application · medium
A penetration tester gains initial access to a Windows workstation as a standard user. The tester discovers a scheduled task that runs with SYSTEM privileges and is configured to execute a script from a user-writable directory. The tester wants to escalate privileges by replacing the script with a reverse shell payload. Which technique is the tester most likely using?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PT0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “PT0-003” is a trademark of its owner, used for identification only.