Practice questions · Cybersecurity
CompTIA PenTest+ (PT0-003): Practice Questions
Original, syllabus-based practice questions for CompTIA PenTest+ (PT0-003). Each answer is explained, including why the other options are wrong. Filter by domain or difficulty. These are original concept checks to test understanding - not questions taken from any live exam, and they describe techniques at a conceptual level only.
Answered 0 · Correct 0
-
Which document defines what may be tested, when, from where, and what is off-limits?
Correct answer: C. The rules of engagement record the agreed targets, timing, source and exclusions. A scan report only lists findings after testing, the executive summary communicates risk to leadership, and a network diagram documents topology rather than permission. -
During a test you discover a live host that is clearly outside the agreed target list. What is the correct response?
Correct answer: A. Anything outside scope needs fresh written authorisation, and being inside a test window does not extend scope. Continuing or quietly testing is scope creep, and removing a host is destructive and never the tester's decision. -
A client's web application is hosted on a third-party cloud platform. Before testing it, what is usually also required?
Correct answer: B. When assets are managed by another provider, the client's permission alone may not be enough and the provider's testing policy applies. Physical access is irrelevant, publishing test dates harms security, and the client's signature alone can be insufficient. -
What is the main purpose of the executive summary in a penetration test report?
Correct answer: C. The executive summary translates findings into business risk for leaders. Reproduction detail and configuration belong in the technical findings section, and a good report describes technique categories rather than a raw command log. -
A client asks for a short signed document confirming a test happened, its scope and dates, to send to their auditor. What is this?
Correct answer: A. An attestation of findings is the short signed statement of scope and dates for auditors. A master service agreement sets the standing legal relationship, a non-disclosure agreement protects confidential information, and a statement of work defines deliverables before work starts. -
What does de-confliction refer to during an engagement?
Correct answer: D. De-confliction lets the defensive team distinguish test traffic from a genuine incident. It is not about billing, deduplicating the report, or assigning targets among testers. -
Which testing model gives the tester full information about the environment in advance?
Correct answer: D. Known-environment testing, formerly white box, shares full information and maximises coverage. Unknown-environment shares little, partially known shares some, and blind reconnaissance is not a defined testing model. -
Which of the following activities counts as passive reconnaissance?
Correct answer: B. Passive reconnaissance uses third-party and public sources without touching the target, such as certificate logs. Sending requests, scanning ports and probing a login all send traffic to the target and are therefore active. -
What best describes the difference between passive and active reconnaissance?
Correct answer: A. The defining split is whether traffic reaches the target: active does and is detectable, passive does not. Legality depends on scope, passive normally comes first, and neither type is defined by whether credentials are used. -
What is the main value of enumeration after a host has been discovered?
Correct answer: D. Enumeration builds the detail that makes later phases precise: services, versions, users, shares and domains. It is not destructive, has nothing to do with billing, and is not about protecting the tester's notes. -
Why is open-source intelligence usually gathered before active scanning?
Correct answer: A. Open-source intelligence draws on public sources without touching the target, so it is low-risk and comes first. Active methods are also legal in scope, it does not always yield more, and authorisation is still required for the engagement. -
A tester compiles exposed services, endpoints and interfaces into a single picture of everything an attacker could interact with. What is this called?
Correct answer: B. The attack surface is the total set of exposed, interactable points that guides the next phase. Chain of custody is about evidence handling, rules of engagement is the testing agreement, and recovery point objective is a recovery metric. -
What level of scripting knowledge does the reconnaissance domain expect for PT0-003?
Correct answer: A. The exam expects conceptual understanding of what automation does and what its output means. It does not ask you to write frameworks, recall exact syntax, or build firmware. -
Which enumeration result most directly suggests where credential attacks might be relevant?
Correct answer: A. Discovering user and group accounts points to where authentication weaknesses could matter. Building location, an accounting firm and website styling do not inform credential-related decisions. -
Which of these is information typically obtained through open-source intelligence?
Correct answer: B. Job adverts publicly reveal roles and technology stacks, a classic open-source source. Private keys, live memory and stored passwords are not public and would require active compromise, not open-source collection. -
A tester wants to map an organisation's externally reachable hostnames without sending traffic to them. Which source fits?
Correct answer: D. Certificate transparency logs are public records of issued certificates that reveal hostnames passively. An authenticated scan, a brute-force sweep and traffic capture all interact with the target and are active. -
What advantage does a credentialed scan have over a non-credentialed scan?
Correct answer: C. A credentialed scan logs in and sees real patch and configuration state, which reduces false positives. It is not necessarily faster, still needs authorisation, and can still be detected. -
A scanner reports a critical vulnerability, but the tester confirms the affected feature is disabled. This finding is a:
Correct answer: A. A reported issue that is not actually exploitable is a false positive. A false negative is a missed real issue, a zero-day is an unpatched flaw under active exploitation, and privilege escalation is an attack outcome. -
Why should findings be prioritised using more than the CVSS score alone?
Correct answer: D. CVSS scores severity in the abstract, but real priority also depends on exposure, asset value and whether the flaw is exploitable there. CVSS is not random, a higher score does not mean lower risk, and it is not limited to cloud systems. -
A real, exploitable weakness exists but the scan did not report it. This is a:
Correct answer: A. A missed real weakness is a false negative, the dangerous case that leaves a hole in the report. A false positive is a wrong alert, a compensating control offsets risk, and a true positive is a correctly reported issue. -
What does validation add to a raw scanner finding?
Correct answer: B. Validation manually confirms a finding is real, which protects credibility. It does not change the CVSS score, guarantee remediation, or delete the finding. -
Which scan type sees only what an unauthenticated outsider would see?
Correct answer: C. A non-credentialed scan runs without login and sees the outsider's view. A credentialed scan authenticates, an agent-based scan runs locally with access, and a configuration review inspects settings directly. -
A tester compares a system's settings against a hardening baseline instead of running a scanner. This is best described as:
Correct answer: D. Checking settings against a baseline is configuration review, a form of analysis without a scanner. Passive reconnaissance gathers public data, lateral movement reaches other systems, and social engineering targets people. -
What does a CVE identifier represent?
Correct answer: A. A CVE is the catalogue identifier for a specific known vulnerability, while CVSS is the severity score. It is not proof of exploitation, nor is it a mitigating control. -
A described attack intercepts communication between two parties to read or alter it. Which category is this?
Correct answer: C. Sitting between two parties to intercept traffic is an on-path attack, formerly man-in-the-middle. Privilege escalation raises access, broken access control is a web authorisation flaw, and social engineering manipulates people. -
An API returns records belonging to other users when an object identifier is changed. Which weakness category is this?
Correct answer: A. Reaching other users' objects by changing an identifier is broken object level authorisation, a core API flaw. Cross-site scripting runs script in a browser, server-side request forgery abuses server requests, and deserialisation flaws process malicious serialized data. -
Which category best fits a rogue wireless access point that imitates a legitimate one?
Correct answer: D. A fake access point imitating a real one is an evil twin, a wireless attack concept. SQL injection targets databases, privilege escalation raises access, and an insider threat is a trusted actor. -
A web flaw lets an attacker make the server send requests to internal systems it should not reach. Which category is this?
Correct answer: C. Inducing the server to make requests to unreachable internal systems is server-side request forgery. Cross-site scripting runs script in a user's browser, broken access control exposes restricted actions, and an on-path attack intercepts traffic. -
Which category describes untrusted input being processed by an application as a command?
Correct answer: B. Input that an application processes as a command is injection, a web application attack class. Tailgating is a physical attack, an evil twin is wireless, and pivoting is a post-exploitation movement concept. -
A tester follows an employee through a badge-controlled door without authenticating. Which concept is this?
Correct answer: C. Following someone through a secure door is tailgating, a physical attack concept. Phishing uses fake messages, injection is a web flaw, and lateral movement is reaching other systems after a foothold. -
In an authorised test, what must be true before any social-engineering activity begins?
Correct answer: C. Social engineering is legitimate only when explicitly authorised in writing and in scope. Warning targets defeats the test, it need not be run by client staff, and email is a common permitted channel. -
Which category best fits an attack that abuses over-permissive identity policies in a cloud tenant?
Correct answer: C. Abusing over-permissive cloud identity policies is a cloud attack-surface concept. Deauthentication is a wireless concept, tailgating is physical, and plaintext interception is a network concept. -
A web flaw lets an attacker run script in another user's browser session. Which category is this?
Correct answer: A. Running script in another user's browser is cross-site scripting. Server-side request forgery abuses server requests, broken object level authorisation is an API flaw, and credential stuffing reuses credentials exposed in earlier breaches. -
Two techniques would both prove a finding, but one risks an outage. What guides the choice in a professional test?
Correct answer: B. Professional testing proves the finding with the least necessary impact and defensible evidence. Choosing purely for speed, maximum spread, or deliberate noise all raise risk without benefit. -
A described IoT device ships with the same fixed login on every unit. Which weakness category is this?
Correct answer: B. A fixed login shared across all units is a default or hardcoded credential weakness common to IoT. Server-side request forgery, insecure deserialisation and on-path positioning describe unrelated categories. -
Which category fits an attack that captures and re-sends valid authentication material to gain access?
Correct answer: C. Reusing captured authentication material is a replay attack, a network concept. Cross-site scripting is a web flaw, configuration review is analysis, and data exfiltration is moving data out during post-exploitation. -
During the attacks phase, why is knowing how a technique is detected part of the objective?
Correct answer: A. PT0-003 expects testers to explain how a category is detected and prevented, because that is what helps the client. Detection is not solely the defender's concern, a detected test can still be valuable, and it belongs in the report. -
A described attack uses fake messages to trick staff into revealing credentials. Which category is this?
Correct answer: A. Fake messages aimed at extracting credentials are phishing, a social-engineering technique. An evil twin is wireless, server-side request forgery is a web flaw, and privilege escalation raises access after entry. -
What is the difference between vertical and horizontal privilege escalation?
Correct answer: D. Vertical escalation raises the privilege level, while horizontal moves sideways to another account at the same level. Legality depends on scope, neither is cloud-only, and horizontal does not require physical access. -
A tester routes through a compromised host to reach a network segment they could not touch directly. What is this called?
Correct answer: C. Routing through a foothold to reach an otherwise unreachable segment is pivoting. Scoping defines the engagement, validation confirms findings, and phishing is a social-engineering technique. -
Why must any persistence mechanism used in a test be documented and removed?
Correct answer: B. Persistence must be agreed, recorded and removed because leftovers endanger the client and reflect on the tester. It is not always illegal, does not improve security, and removal is never optional. -
What does lateral movement describe?
Correct answer: B. Lateral movement reaches additional systems after a foothold, often by reusing trust relationships. Raising privileges is escalation, the executive summary is reporting, and port scanning is reconnaissance. -
During post-exploitation, how should data handling be approached in an authorised test?
Correct answer: D. Authorised tests minimise extraction, protect what is taken, and destroy it at engagement close. Mass copying, leaving data behind and publishing samples all increase risk and breach good practice. -
Why does a professional test include a cleanup phase at the end?
Correct answer: C. Cleanup removes artefacts and restores the original state. It never deletes client backups, does not hide findings, and leaving tools behind is a security risk. -
Why is understanding detection avoidance useful to the client, not just the tester?
Correct answer: D. Detection-avoidance work reveals whether the client's monitoring caught the activity, useful feedback. It guarantees nothing, does not replace the report, and cannot prove a client is unbreachable.
Practice questions FAQ
- Are these real PT0-003 exam questions?
- No. These are original study questions written to test understanding. They are not real exam questions, exam dumps, or copied from any provider.
- How should I use these practice questions?
- Answer each one, read the explanation (including why the wrong options are wrong), and use the per-domain score below to focus your revision on weak areas. Revisit before exam day.
- How many questions should I do before the exam?
- Enough to score consistently across every domain, alongside full-length practice from official or reputable providers. Understanding why each answer is right matters more than raw volume.
- What score means I am ready?
- A good signal is consistently scoring around 80% or higher across all domains on questions you have not seen before, and being able to explain why the wrong options are wrong.
- Should I use exam dumps?
- No. Dumps (real or leaked questions) breach provider policy, can void your certification, and do not build the understanding the exam actually tests.