A penetration tester has compromised a Windows server and wants to cover their tracks by manipulating logs. The tester wants to remove evidence of a specific logon event without deleting the entire log, which might raise suspicion. Which action is the most appropriate for this scenario?

Use a tool like Mimikatz to clear the specific logon event from the Security log.

Disable the Security log and restart the system.

Use a log editing tool to remove the specific event ID from the Security log.

Delete the entire Security log to remove all evidence.

Why might a penetration tester manipulate system logs after completing post-exploitation activities?

To remove evidence of unauthorized access

To increase the accuracy of the penetration test report

To comply with data protection regulations

In a pass-the-hash attack, what is used to authenticate to a remote system instead of a plaintext password?

The NTLM hash of the user's password

CompTIAPenTest+

Domain 5Objective 1

Post-Exploitation Activities PT0-003 Practice Questions (Page 5)

Part of the Post-exploitation and lateral movement domain, which accounts for 14% of the PT0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~9–15 in this domain), expect 5–8 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

12concepts

14%of the exam

Questions 21–25

21foundation · easy
A penetration tester wants to ensure a malicious payload runs every time a specific user logs into a Windows system. Which scheduled task trigger should be configured?
Select an answer first
22application · medium
A penetration tester has compromised a Windows server and wants to cover their tracks by manipulating logs. The tester wants to remove evidence of a specific logon event without deleting the entire log, which might raise suspicion. Which action is the most appropriate for this scenario?
Select an answer first
23foundation · easy
Why might a penetration tester manipulate system logs after completing post-exploitation activities?
Select an answer first
24foundation · easy
Which command-line tool is used to modify registry entries on Windows systems?
Select an answer first
25foundation · easy
In a pass-the-hash attack, what is used to authenticate to a remote system instead of a plaintext password?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PT0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “PT0-003” is a trademark of its owner, used for identification only.

Post-Exploitation Activities PT0-003 Practice Questions (Page 5)

Questions 21–25

A penetration tester wants to ensure a malicious payload runs every time a specific user logs into a Windows system. Which scheduled task trigger should be configured?

A penetration tester has compromised a Windows server and wants to cover their tracks by manipulating logs. The tester wants to remove evidence of a specific logon event without deleting the entire log, which might raise suspicion. Which action is the most appropriate for this scenario?

Why might a penetration tester manipulate system logs after completing post-exploitation activities?

Which command-line tool is used to modify registry entries on Windows systems?

In a pass-the-hash attack, what is used to authenticate to a remote system instead of a plaintext password?

Keep studying — Post-exploitation and lateral movement