A penetration tester is analyzing a packet capture and needs to see the full contents of all HTTP POST requests to a specific web application. The tester wants to extract the data being submitted. Which Wireshark display filter should the tester use?

http.request.uri contains 'login'

A penetration tester is analyzing a packet capture and needs to identify all HTTP traffic that contains a specific string in the request body. The tester wants to find potential SQL injection attempts. Which Wireshark display filter should the tester use?

http.request.method == 'POST' && http contains 'select'

http.request.uri contains 'select'

A penetration tester is reviewing a Wireshark capture to find all DNS queries that contain the string 'admin' in the query name. Which display filter should the tester use?

dns.flags.response == 1 && dns.qry.name contains 'admin'

CompTIAPenTest+

Domain 2Objective 3

Reconnaissance Tools PT0-003 Practice Questions (Page 2)

Part of the Reconnaissance and enumeration domain, which accounts for 21% of the PT0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~14–23 in this domain), expect 4–6 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

6concepts

21%of the exam

Questions 6–10

6application · easy
A penetration tester is analyzing a packet capture and needs to see the full contents of all HTTP POST requests to a specific web application. The tester wants to extract the data being submitted. Which Wireshark display filter should the tester use?
Select an answer first
7foundation · easy
A penetration tester wants to isolate only HTTP traffic in a Wireshark capture. Which display filter should be applied?
Select an answer first
8expert · medium
A penetration tester is analyzing a packet capture and needs to identify all HTTP traffic that contains a specific string in the request body. The tester wants to find potential SQL injection attempts. Which Wireshark display filter should the tester use?
Select an answer first
9foundation · easy
Which Nmap option is used to perform a TCP SYN scan, a common technique that does not complete the TCP handshake?
Select an answer first
10application · medium
A penetration tester is reviewing a Wireshark capture to find all DNS queries that contain the string 'admin' in the query name. Which display filter should the tester use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PT0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “PT0-003” is a trademark of its owner, used for identification only.

Reconnaissance Tools PT0-003 Practice Questions (Page 2)

Questions 6–10

A penetration tester is analyzing a packet capture and needs to see the full contents of all HTTP POST requests to a specific web application. The tester wants to extract the data being submitted. Which Wireshark display filter should the tester use?

A penetration tester wants to isolate only HTTP traffic in a Wireshark capture. Which display filter should be applied?

A penetration tester is analyzing a packet capture and needs to identify all HTTP traffic that contains a specific string in the request body. The tester wants to find potential SQL injection attempts. Which Wireshark display filter should the tester use?

Which Nmap option is used to perform a TCP SYN scan, a common technique that does not complete the TCP handshake?

A penetration tester is reviewing a Wireshark capture to find all DNS queries that contain the string 'admin' in the query name. Which display filter should the tester use?

Keep studying — Reconnaissance and enumeration