CompTIA PenTest+ (PT0-003) — Questions and Answers

Question 1: An attacker on a switched network sends gratuitous ARP replies mapping the default gateway's IP to their own MAC address. What is the goal?

ARP cache poisoning for MitM (Correct answer)
DNS spoofing
VLAN hopping
MAC flooding

Correct answer: ARP cache poisoning for MitM

ARP cache poisoning redirects network traffic through the attacker's machine by associating the gateway's IP with the attacker's MAC address.

Question 2: Which of the following is a key reason to include third-party service providers in the scoping discussion of a penetration test?

Third-party providers always have more vulnerabilities
Third-party systems are always out of scope
Providers must perform their own portion of the test
Testing systems owned by third parties may require separate authorization (Correct answer)

Correct answer: Testing systems owned by third parties may require separate authorization

Third-party owned infrastructure (SaaS, cloud providers, MSPs) requires separate authorization from those providers before testing, even if the client uses the service.

Question 3: How is social engineering used in information gathering?

By using brute-force tools.
By exploiting physical security systems.
By scanning networks.
By exploiting human behavior to gain information (Correct answer)

Correct answer: By exploiting human behavior to gain information

Social engineering is a manipulation technique that exploits human psychology, rather than technical vulnerabilities, to trick individuals into divulging confidential information or performing actions. In information gathering, this involves using psychological tactics like phishing, pretexting, or impersonation to persuade targets to unknowingly provide access or data. This method bypasses technical defenses by targeting human trust and susceptibility.

Question 4: What is 'tailgating' (piggybacking) in physical security penetration testing?

Following an authorized person through a secured door without presenting credentials (Correct answer)
Attaching a hardware implant to a target's workstation
Monitoring network traffic at a physical location
Following a target vehicle to surveil their movements

Correct answer: Following an authorized person through a secured door without presenting credentials

Tailgating exploits social politeness by closely following an authorized person through a secured entry, gaining physical access without valid credentials.

Question 5: When communicating findings to a technical audience in a pentest report, which approach is MOST appropriate?

Include full technical details such as CVE numbers, proof-of-concept code, and reproduction steps (Correct answer)
Limit findings to a single paragraph per vulnerability
Use only business impact language without technical details
Avoid including screenshots to keep the report concise

Correct answer: Include full technical details such as CVE numbers, proof-of-concept code, and reproduction steps

Technical audiences (sysadmins, developers) require detailed technical information including CVEs, reproduction steps, and proof-of-concept to understand and remediate findings.

Question 6: What is the role of reconnaissance in penetration testing?

Mitigating identified vulnerabilities.
Ensuring the target system is secure.
Gathering information to identify attack vectors (Correct answer)
Identifying vulnerabilities in code.

Correct answer: Gathering information to identify attack vectors

Reconnaissance is the initial phase of a penetration test where testers gather as much information as possible about the target system or organization. This intelligence gathering helps identify potential weaknesses, exposed assets, and various attack vectors that could be exploited. Effective reconnaissance is crucial for planning targeted and successful attacks.

Question 7: During passive reconnaissance, a tester reviews the target's robots.txt file and finds entries for '/admin/', '/backup/', and '/config/'. What should the tester do with this information?

Ignore it since robots.txt is only relevant to web crawlers
Immediately attempt to access the /backup/ directory
Report it as a critical finding without further investigation
Use the discovered paths as targets for further active enumeration (Correct answer)

Correct answer: Use the discovered paths as targets for further active enumeration

robots.txt disallowed entries often reveal sensitive directories; these paths should be noted and investigated during active testing within scope.

Question 8: During a red team engagement, the blue team detects the testers' activity and begins incident response. According to proper communication protocols, what should happen?

Red team should escalate their activities to test incident response further
Red team should immediately go dark and cease all activity
Red team should identify themselves to the blue team immediately
Red team continues unless a pre-established abort signal is received from the engagement coordinator (Correct answer)

Correct answer: Red team continues unless a pre-established abort signal is received from the engagement coordinator

Red team operations continue unless a pre-defined abort signal from the engagement coordinator is received, as detection by the blue team is a normal and expected test scenario.

Question 9: Which tool is commonly used for maintaining persistent access and post-exploitation activities after initial compromise?

Wireshark
Metasploit Meterpreter (Correct answer)
Nikto
Nmap

Correct answer: Metasploit Meterpreter

Metasploit Meterpreter provides a powerful in-memory post-exploitation shell with built-in features for persistence, pivoting, and lateral movement.

Question 10: A tester accesses `/api/users/1001` and then changes the ID to `/api/users/1002` to view another user's data without authorization. What vulnerability is this?

Insecure Direct Object Reference (IDOR) (Correct answer)
Mass Assignment
Privilege Escalation
Broken Function Level Authorization

Correct answer: Insecure Direct Object Reference (IDOR)

Insecure Direct Object Reference (IDOR) occurs when an application exposes internal implementation objects (like user IDs) without proper authorization checks, allowing access to other users' data.

Question 11: A penetration tester is hired by a subsidiary company. The parent company's systems are reachable from the subsidiary's network. Can the tester legally test the parent company's systems?

No, unless the parent company has also provided written authorization (Correct answer)
Yes, because they are accessible from the authorized network
Yes, if the parent company is mentioned in the subsidiary's contract
No, unless the tester uses a VPN to access them

Correct answer: No, unless the parent company has also provided written authorization

Authorization to test must come from the entity that owns or is responsible for the systems; reachability from an authorized network does not constitute permission.

Question 12: A tester discovers that a web application constructs an OS command using unsanitized user input and executes it via shell_exec(). The tester appends '; cat /etc/passwd' to the input. What is this attack?

Argument injection
Code injection
OS command injection (Correct answer)
Shell escape

Correct answer: OS command injection

OS command injection occurs when unsanitized user input is passed to a shell command, allowing attackers to append additional commands using shell metacharacters.

Question 13: Which type of penetration test provides the tester with full knowledge of the internal network architecture, source code, and credentials?

Black-box
Gray-box
Red team
White-box (Correct answer)

Correct answer: White-box

White-box testing provides complete transparency including network diagrams, credentials, and source code, simulating an insider threat or detailed audit.

Question 14: What is the BEST strategy for resource allocation in CompTIA PenTest+ Certification project management?

Keep significant reserves without deployment
Match resources to priorities based on assessment of needs, risks, and strategic goals (Correct answer)
Allocate all resources equally regardless of need
Focus resources only on the largest tasks

Correct answer: Match resources to priorities based on assessment of needs, risks, and strategic goals

Effective resource allocation requires matching available resources to priorities determined by assessment of needs, risk factors, and strategic goals. This ensures that critical areas receive appropriate support while maintaining overall efficiency.

Question 15: What is 'whaling' in the context of phishing attacks?

Phishing emails using whale-themed imagery as lures
Mass phishing campaigns targeting large enterprises
Phishing attacks targeting maritime and fishing companies
Highly targeted phishing aimed at senior executives and high-value individuals (Correct answer)

Correct answer: Highly targeted phishing aimed at senior executives and high-value individuals

Whaling targets high-value individuals such as CEOs, CFOs, and board members with carefully crafted attacks to gain access to sensitive organizational data or funds.

Question 16: What is the PRIMARY purpose of obtaining PenTest+ certification in CompTIA PenTest+ Certification?

To satisfy a personal achievement goal
To demonstrate verified competency and adherence to professional standards (Correct answer)
To guarantee employment in the field
To bypass educational requirements

Correct answer: To demonstrate verified competency and adherence to professional standards

Professional certification demonstrates that an individual has met established competency standards through verified assessment. It provides assurance to employers, clients, and the public that the certified professional possesses the knowledge and skills required for competent practice.

Question 17: Which foundational principle is MOST important for success in the CompTIA PenTest+ Certification profession?

Specializing in only one narrow area of practice
Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)
Maximizing financial returns on every engagement
Maintaining the minimum requirements for certification

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Success in any professional field requires a commitment to continuous learning to stay current, ethical practice to maintain trust and integrity, and a focus on quality outcomes that serve stakeholders and the public interest.

Question 18: A tester submits XML input containing a DOCTYPE declaration that references an external entity pointing to /etc/passwd. Which vulnerability is being tested?

XXE injection (Correct answer)
SSTI
XPath injection
SSRF

Correct answer: XXE injection

XXE (XML External Entity) injection exploits XML parsers that process external entity references, potentially exposing local files or internal services.

Question 19: Which document formally authorizes a penetration tester to perform testing activities and provides legal protection?

Rules of engagement (ROE)
Get-out-of-jail-free letter (Correct answer)
Non-disclosure agreement (NDA)
Statement of work (SOW)

Correct answer: Get-out-of-jail-free letter

A get-out-of-jail-free letter (authorization letter) from the client explicitly grants permission to test and provides legal protection if the tester is questioned by law enforcement.

Question 20: Which tool is commonly used to exploit network vulnerabilities?

Nmap
Wireshark
John the Ripper
Metasploit (Correct answer)

Correct answer: Metasploit

Metasploit is a widely recognized and powerful open-source penetration testing framework. It provides a vast collection of exploits, payloads, and tools designed to discover, exploit, and validate vulnerabilities in various systems and applications. While other tools like Wireshark, Nmap, and John the Ripper serve different purposes, Metasploit is specifically engineered for the exploitation phase of a penetration test.

Question 21: An attacker sends crafted ICMP packets with a source IP of the victim's address to a large number of hosts that reply to the victim. What DoS technique is this?

Teardrop attack
Smurf attack (Correct answer)
Ping of death
SYN flood

Correct answer: Smurf attack

A Smurf attack sends ICMP echo requests with a spoofed source IP to broadcast addresses, causing all hosts to reply to the victim and overwhelming it.

Question 22: How frequently should ongoing assessments be conducted in CompTIA PenTest+ Certification practice?

At regular intervals based on established protocols and as conditions change (Correct answer)
Once annually regardless of circumstances
Only when problems are reported
Only when required by external auditors

Correct answer: At regular intervals based on established protocols and as conditions change

Ongoing assessments should follow established protocols for regular intervals and also be conducted when conditions change. This balanced approach ensures continuous monitoring while remaining responsive to new developments.

Question 23: Which foundational principle is MOST important for success in the CompTIA PenTest+ Certification profession?

Maximizing financial returns on every engagement
Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)
Maintaining the minimum requirements for certification
Specializing in only one narrow area of practice

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Question 24: Which section of a pentest report would include details about testing methodology frameworks such as PTES or OWASP Testing Guide?

Appendices
Methodology section (Correct answer)
Risk matrix
Executive summary

Correct answer: Methodology section

The methodology section describes the testing frameworks, standards, and approaches used during the engagement to provide context and credibility to the findings.

Question 25: An attacker exploits a race condition between a privilege check and file operation in a SUID program. What classic vulnerability type does this represent?

Double free
Time-of-check to time-of-use (TOCTOU) (Correct answer)
Use-after-free
Integer overflow

Correct answer: Time-of-check to time-of-use (TOCTOU)

TOCTOU (Time-of-Check to Time-of-Use) exploits the window between a security check and the subsequent use of the checked resource.

Question 26: A tester discovers evidence of an active breach by a third party during a scheduled pentest. What is the MOST appropriate immediate action?

Attempt to identify and remove the threat actor
Continue testing to avoid disrupting the engagement timeline
Include the finding only in the final report
Document the breach evidence and immediately notify the client (Correct answer)

Correct answer: Document the breach evidence and immediately notify the client

Discovery of an active breach requires immediate notification to the client so they can engage incident response resources, as this takes priority over the pentest scope.

Question 27: What does a 'get-out-of-jail-free letter' represent in the context of a penetration testing engagement?

A waiver releasing the client from paying for the engagement
A legal agreement preventing the client from suing the tester
A document granting immunity from reporting vulnerabilities
Written authorization proving the tester has permission to conduct the assessment (Correct answer)

Correct answer: Written authorization proving the tester has permission to conduct the assessment

A get-out-of-jail-free letter is written authorization from the client that a tester can present to law enforcement if questioned during the engagement.

Question 28: What is the MOST effective way for new PenTest+ professionals to build competency in their field?

Studying certification materials exclusively
Focusing solely on the most advanced topics
Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Learning entirely through trial and error

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building professional competency requires a multi-faceted approach: formal education provides foundational knowledge, mentored practice develops applied skills under guidance, and ongoing professional development ensures continuous growth and currency in the field.

Question 29: A company hires a penetration testing firm to assess compliance with PCI DSS. How does this regulatory requirement affect the scope of the engagement?

It allows the tester to skip the rules of engagement
It has no effect on the technical scope
It requires testing all company assets regardless of card data involvement
It mandates specific targets, methodologies, and reporting formats (Correct answer)

Correct answer: It mandates specific targets, methodologies, and reporting formats

Compliance-driven engagements like PCI DSS specify which systems must be tested, what methodologies to follow, and how findings must be documented and reported.

Question 30: Which stakeholder engagement strategy is MOST effective for PenTest+ professionals leading initiatives?

Inform stakeholders only after decisions are made
Engage stakeholders only when their approval is needed
Limit engagement to senior leadership only
Identify stakeholders early, understand their interests, and maintain regular communication (Correct answer)

Correct answer: Identify stakeholders early, understand their interests, and maintain regular communication

Early stakeholder identification, understanding their interests and concerns, and maintaining regular communication builds support, prevents surprises, and ensures diverse perspectives inform decision-making throughout the initiative.

Question 31: What does the term 'attack surface' refer to in the context of vulnerability identification during a penetration test?

The physical area of the target facility being tested
The total number of CVEs identified during scanning
All the different points where an attacker could attempt to enter or extract data (Correct answer)
The list of exploits available in Metasploit for the target OS

Correct answer: All the different points where an attacker could attempt to enter or extract data

The attack surface encompasses all potential entry points, interfaces, protocols, and data paths through which an attacker could attempt to compromise the target.

Question 32: What is 'Pass-the-Hash' (PtH) and how does it enable lateral movement?

Cracking NTLM hashes offline using a wordlist
Using captured NTLM hashes directly for authentication without knowing the plaintext password (Correct answer)
Passing hashed network packets through a firewall rule
Encrypting lateral movement traffic with a derived hash

Correct answer: Using captured NTLM hashes directly for authentication without knowing the plaintext password

Pass-the-Hash exploits the NTLM authentication protocol by using a captured password hash directly to authenticate, enabling lateral movement without cracking the hash.

Question 33: A JWT token uses `alg: none` and is accepted by the server without signature verification. What is this vulnerability called?

Algorithm Confusion (None Algorithm) (Correct answer)
Insecure Deserialization
Token Replay
Weak Secret Attack

Correct answer: Algorithm Confusion (None Algorithm)

The 'none' algorithm attack exploits servers that accept JWTs with no signature when `alg` is set to `none`, allowing attackers to forge arbitrary token claims without a valid signature.

Question 34: When using Nmap's -sV flag, what additional information does the tester receive compared to a standard port scan?

The operating system kernel version
The geographic location of the target server
Service and version information for open ports (Correct answer)
Vulnerability CVE identifiers for each service

Correct answer: Service and version information for open ports

The -sV flag enables version detection, causing Nmap to probe open ports and report the service name and version running on each.

Question 35: What is the MOST important factor to consider when selecting assessment tools for PenTest+ certification work?

How quickly the tool can be administered
Personal familiarity with the tool
Validity, reliability, and appropriateness for the specific context (Correct answer)
The cost of the assessment tool

Correct answer: Validity, reliability, and appropriateness for the specific context

Assessment tools must be valid (measuring what they claim to measure), reliable (producing consistent results), and appropriate for the specific context and population. These psychometric properties ensure the quality of assessment outcomes.

Question 36: A penetration tester uses theHarvester to collect email addresses and subdomains for a target organization. What category of reconnaissance does this represent?

Internal reconnaissance
Physical reconnaissance
Active reconnaissance
Passive reconnaissance (Correct answer)

Correct answer: Passive reconnaissance

theHarvester gathers data from public sources (search engines, DNS records) without directly interacting with the target, making it passive reconnaissance.

Question 37: A tester uses Masscan to perform rapid port scanning across a large IP range. What is the PRIMARY risk of using Masscan at high packet rates during a pentest?

The tool may expose the tester's identity through unique packet signatures
The scan results will be inaccurate due to TCP handshake limitations
Masscan cannot scan UDP ports, limiting vulnerability discovery
High packet rates may trigger IDS/IPS alerts or disrupt network devices (Correct answer)

Correct answer: High packet rates may trigger IDS/IPS alerts or disrupt network devices

Masscan's extremely high packet rates can overwhelm network devices, trigger intrusion detection systems, and potentially disrupt services on the target network.

Question 38: Which OWASP Top 10 category describes a flaw where an application uses components with known security weaknesses such as outdated libraries?

Security Misconfiguration
Vulnerable and Outdated Components (Correct answer)
Broken Access Control
Injection

Correct answer: Vulnerable and Outdated Components

OWASP A06:2021 - Vulnerable and Outdated Components specifically addresses the risk of using libraries, frameworks, or other software with known vulnerabilities.

Question 39: A tester identifies a PostgreSQL database and injects a COPY TO/FROM PROGRAM statement. What capability does this provide?

Database schema extraction
Privilege escalation within the database
Blind SQL data exfiltration
OS command execution via the database (Correct answer)

Correct answer: OS command execution via the database

PostgreSQL's COPY TO/FROM PROGRAM allows superusers to execute OS commands by passing shell commands to the PROGRAM keyword.

Question 40: A tester uploads a file named 'shell.php%00.jpg' to bypass a file extension whitelist. What technique is being used?

MIME type spoofing
Double extension bypass
Content-Type manipulation
Null byte injection (Correct answer)

Correct answer: Null byte injection

Null byte injection (%00) terminates string processing in older PHP versions or C-based functions, causing the server to treat the filename as 'shell.php' and ignore '.jpg'.

Question 41: What should be done if an unexpected vulnerability is discovered during a penetration test?

Ignore the vulnerability to avoid disruption.
Limit the test to exclude that area.
Document, report, and reassess within the scope (Correct answer)
Address the vulnerability without reporting it.

Correct answer: Document, report, and reassess within the scope

If an unexpected vulnerability is discovered during a penetration test, it should be immediately documented and reported to the client or relevant stakeholders. The testing team should then reassess whether exploiting this vulnerability falls within the agreed-upon scope of the test. This ensures transparency, allows for informed decisions, and maintains the integrity of the testing process.

Question 42: What is the PRIMARY benefit of using data-driven decision making in CompTIA PenTest+ Certification management?

It eliminates the need for professional judgment
It provides objective evidence to support decisions, reduce bias, and track outcomes (Correct answer)
It guarantees positive results for every decision
It simplifies the decision-making process to one approach

Correct answer: It provides objective evidence to support decisions, reduce bias, and track outcomes

Data-driven decision making provides objective evidence that supports more informed decisions, helps reduce personal bias, and enables tracking of outcomes to evaluate effectiveness. It complements, rather than replaces, professional judgment.

Question 43: What distinguishes a CompTIA PenTest+ Certification certified professional from a non-certified practitioner?

There is no meaningful difference in competency
Certification validates competency through standardized assessment against established benchmarks (Correct answer)
Certified professionals exclusively work in larger organizations
Certified professionals always have more years of experience

Correct answer: Certification validates competency through standardized assessment against established benchmarks

Certification provides objective validation of competency through standardized assessment. While non-certified practitioners may be skilled, certification offers verified evidence that a professional meets established benchmarks for knowledge and performance.

Question 44: A web application uses OAuth 2.0 and does not validate the `state` parameter during the authorization callback. What attack is possible?

JWT Algorithm Confusion
Token Replay Attack
Cross-Site Request Forgery on OAuth Flow (Correct answer)
Authorization Code Interception

Correct answer: Cross-Site Request Forgery on OAuth Flow

The OAuth `state` parameter functions as a CSRF token; without validating it, an attacker can forge a callback request and link their malicious account to a victim's session.

Question 45: A penetration tester uses a script to send thousands of login attempts against a web application using a list of common username/password pairs. Which attack technique is being performed?

Brute force
Rainbow table attack
Password spraying
Credential stuffing (Correct answer)

Correct answer: Credential stuffing

Credential stuffing uses previously breached username/password pairs to attempt logins across multiple services.

Question 46: A web form accepts filenames and passes them directly to a shell command. Which attack allows an attacker to run arbitrary OS commands?

Server-Side Template Injection
Local File Inclusion
SQL Injection
OS Command Injection (Correct answer)

Correct answer: OS Command Injection

OS Command Injection occurs when user-supplied input is incorporated into shell commands without proper sanitization, allowing attackers to execute arbitrary operating system commands.

Question 47: What is the first step in information gathering during a penetration test?

Scanning the network for open ports.
Conducting brute-force attacks.
Gathering OSINT information about the target (Correct answer)
Identifying vulnerabilities.

Correct answer: Gathering OSINT information about the target

The first step in information gathering is often Open-Source Intelligence (OSINT), which involves collecting publicly available information about the target. This can include details from websites, social media, public records, and news articles. OSINT helps build a comprehensive profile of the target, identifying potential entry points and attack vectors before any active scanning begins.

Question 48: What is the primary goal of post-exploitation activities during a penetration test?

Performing password spraying attacks
Running automated vulnerability scans
Scanning for additional open ports
Maintaining access, escalating privileges, and gathering further intelligence (Correct answer)

Correct answer: Maintaining access, escalating privileges, and gathering further intelligence

Post-exploitation focuses on maintaining persistent access, escalating privileges, and gathering additional intelligence to demonstrate the full impact of a breach.

Question 49: A tester performs a credentialed vulnerability scan versus an uncredentialed scan. What is the PRIMARY advantage of a credentialed scan?

It identifies vulnerabilities that are only visible from an authenticated perspective, such as patch levels (Correct answer)
It requires no access to the target network
It bypasses firewall rules more effectively
It is faster because it skips authentication checks

Correct answer: It identifies vulnerabilities that are only visible from an authenticated perspective, such as patch levels

Credentialed scans authenticate to target systems and can inspect installed software versions, registry settings, and local configurations not visible externally.

Question 50: Which tool is specifically designed for conducting social engineering campaigns and phishing simulations during pentests?

Social-Engineer Toolkit (SET) (Correct answer)
Metasploit Framework
Burp Suite
Aircrack-ng

Correct answer: Social-Engineer Toolkit (SET)

The Social-Engineer Toolkit (SET) is an open-source framework built specifically for social engineering attacks including phishing, credential harvesting, and payload delivery.

Question 51: Which Sysinternals tool is commonly used for lateral movement by executing commands on remote Windows systems via SMB?

Process Monitor
PsExec (Correct answer)
TCPView
Autoruns

Correct answer: PsExec

PsExec uses SMB and valid credentials to execute commands or launch interactive shells on remote Windows systems, making it a go-to tool for lateral movement.

Question 52: What distinguishes a CompTIA PenTest+ Certification certified professional from a non-certified practitioner?

Certified professionals always have more years of experience
Certification validates competency through standardized assessment against established benchmarks (Correct answer)
There is no meaningful difference in competency
Certified professionals exclusively work in larger organizations

Correct answer: Certification validates competency through standardized assessment against established benchmarks

Question 53: When documenting assessment findings in PenTest+ practice, which approach is MOST appropriate?

Use technical jargon that only experts can understand
Include only positive findings to maintain optimism
Summarize findings verbally without written documentation
Record objective findings, measurements, and professional observations factually (Correct answer)

Correct answer: Record objective findings, measurements, and professional observations factually

Assessment documentation must be objective, factual, and comprehensive. Recording measurements, observations, and findings without bias ensures that the documentation is useful for decision-making and withstands scrutiny.

Question 54: Why is reporting important in penetration testing?

To increase the number of vulnerabilities discovered.
To provide actionable recommendations for improving security (Correct answer)
To limit the test's duration.
To avoid the legal process.

Correct answer: To provide actionable recommendations for improving security

Reporting is a crucial final phase in penetration testing, as it translates technical findings into understandable and actionable intelligence for the client. A comprehensive report doesn't just list vulnerabilities; it explains their impact, severity, and, most importantly, provides clear, prioritized recommendations for remediation. This enables organizations to effectively address identified weaknesses and significantly enhance their overall security posture.

Question 55: Which Metasploit post-exploitation module is used to add routes through a Meterpreter session for pivoting?

post/multi/manage/autoroute (Correct answer)
auxiliary/gather/enum_dns
exploit/multi/handler
auxiliary/scanner/portscan/tcp

Correct answer: post/multi/manage/autoroute

The autoroute post module adds network routes through an active Meterpreter session, enabling traffic to be proxied through the compromised host.

Question 56: Which technique involves sending specially crafted packets to a target and analyzing the responses to determine the operating system version?

Service enumeration
OS fingerprinting (Correct answer)
Banner grabbing
Port sweeping

Correct answer: OS fingerprinting

OS fingerprinting analyzes TCP/IP stack responses and timing characteristics to identify the target operating system and version.

Question 57: Which command finds SUID binaries on Linux that can be abused for privilege escalation?

ps aux --forest
ls -la /bin
netstat -tulpn
find / -perm -4000 2>/dev/null (Correct answer)

Correct answer: find / -perm -4000 2>/dev/null

The find command with -perm -4000 locates SUID binaries that run with elevated privileges and are commonly abused to escalate to root.

Question 58: A penetration tester is asked to perform a physical security assessment as part of a broader engagement. Which additional authorization consideration applies?

Physical testing requires no additional authorization if logical systems are in scope
Physical testing is always illegal and should be refused
Written permission specific to physical access attempts must be obtained (Correct answer)
Only the IT department needs to authorize physical testing

Correct answer: Written permission specific to physical access attempts must be obtained

Physical penetration testing involves entering facilities or bypassing physical controls, which requires explicit written authorization separate from network testing permission.

Question 59: A tester discovers a web server running PHP with the allow_url_include directive enabled. An attacker supplies a remote URL as a file parameter. What attack is possible?

Local File Inclusion (LFI)
Remote File Inclusion (RFI) (Correct answer)
Server-Side Request Forgery (SSRF)
XML External Entity (XXE)

Correct answer: Remote File Inclusion (RFI)

Remote File Inclusion (RFI) allows attackers to include and execute remote files when the server fetches and processes URLs passed as parameters.

Question 60: A tester identifies a service responding on port 8443. What is the MOST likely service running on this port?

FTP over TLS
LDAP over SSL
Standard HTTP web server
HTTPS alternate port (often used for admin panels or alternative SSL services) (Correct answer)

Correct answer: HTTPS alternate port (often used for admin panels or alternative SSL services)

Port 8443 is a common alternate port for HTTPS, frequently used for administrative interfaces, development servers, or secondary SSL/TLS services.

Question 61: Which Metasploit auxiliary module creates a SOCKS proxy through an active Meterpreter session?

auxiliary/scanner/http/dir_scanner
auxiliary/server/socks_proxy (Correct answer)
post/windows/gather/credentials
auxiliary/server/capture/http

Correct answer: auxiliary/server/socks_proxy

The socks_proxy auxiliary module creates a local SOCKS listener that routes all traffic through the Meterpreter session for seamless pivoting.

Question 62: How is SSH port forwarding used for pivoting during a penetration test?

To brute-force SSH credentials on internal hosts
To bypass SSL certificate validation on internal servers
To forward traffic through an SSH connection and reach internal hosts not directly accessible (Correct answer)
To encrypt all captured network traffic

Correct answer: To forward traffic through an SSH connection and reach internal hosts not directly accessible

SSH local (-L) and remote (-R) port forwarding tunnels traffic through an SSH connection, allowing access to internal services behind firewalls.

Question 63: A penetration tester uses Responder to capture NTLMv2 hashes on a network. What type of attack does Responder perform to collect these hashes?

LLMNR/NBT-NS poisoning (Correct answer)
Kerberoasting
Pass-the-hash
AS-REP roasting

Correct answer: LLMNR/NBT-NS poisoning

Responder performs LLMNR and NBT-NS poisoning to intercept name resolution requests and capture NTLMv2 authentication hashes.

Question 64: When assessing scope for a web application penetration test, why is it important to identify the application's technology stack in advance?

Different technologies have unique vulnerabilities and require specific testing methodologies (Correct answer)
The stack determines which regulatory framework applies
Knowing the stack allows the tester to skip reconnaissance
The technology stack determines the price of the engagement

Correct answer: Different technologies have unique vulnerabilities and require specific testing methodologies

Understanding the technology stack (e.g., PHP, Java, .NET, frameworks) helps identify relevant vulnerability classes and ensures appropriate testing tools and techniques are included in scope.

Question 65: During directory traversal testing, which payload would most likely help access /etc/passwd on a Linux web server?

SELECT * FROM passwd
..\..\windows\system32
../../../etc/passwd (Correct answer)
%00../etc/passwd

Correct answer: ../../../etc/passwd

The `../../../etc/passwd` payload uses dot-dot-slash sequences to traverse up the directory tree and access the sensitive /etc/passwd file on Linux systems.

Question 66: Which Windows registry location is commonly abused to establish persistence after a system compromise?

HKLM\SYSTEM\CurrentControlSet\Services
HKCU\Software\Microsoft\Windows\CurrentVersion\Run (Correct answer)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
HKCU\Software\Classes\ms-settings

Correct answer: HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Registry Run keys cause programs to execute automatically at user login, making them one of the most common persistence mechanisms abused by attackers.

Question 67: A PHP application includes files based on a `page` parameter: `include($_GET['page'] . '.php')`. How could a tester exploit Local File Inclusion (LFI)?

Using path traversal sequences like `../../../etc/passwd%00` (Correct answer)
Sending an oversized value to trigger a buffer overflow
Passing a SQL query in the page parameter
Injecting JavaScript into the page parameter

Correct answer: Using path traversal sequences like `../../../etc/passwd%00`

By using path traversal sequences and a null byte to truncate the .php extension, a tester can include arbitrary files from the server's filesystem via the LFI vulnerability.

Question 68: What is the BEST strategy for resource allocation in CompTIA PenTest+ Certification project management?

Allocate all resources equally regardless of need
Focus resources only on the largest tasks
Keep significant reserves without deployment
Match resources to priorities based on assessment of needs, risks, and strategic goals (Correct answer)

Correct answer: Match resources to priorities based on assessment of needs, risks, and strategic goals

Question 69: Which foundational principle is MOST important for success in the CompTIA PenTest+ Certification profession?

Specializing in only one narrow area of practice
Maximizing financial returns on every engagement
Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)
Maintaining the minimum requirements for certification

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Question 70: During a pentest, a tester discovers that a web application reflects user-supplied input in error messages without sanitization. Which vulnerability class does this represent?

Path traversal
Reflected XSS (Correct answer)
CSRF
SQL injection

Correct answer: Reflected XSS

Reflected XSS occurs when user-supplied input is immediately returned by the server in a response without proper sanitization.

Question 71: During a red team engagement, an operator uses Cobalt Strike's sleep command combined with jitter. What is the primary purpose of this technique?

Bypass endpoint AV scanning
Increase beacon speed
Encrypt C2 traffic
Evade network-based anomaly detection (Correct answer)

Correct answer: Evade network-based anomaly detection

Sleep with jitter adds randomized delays to beacon check-ins, making traffic patterns irregular and harder to detect via network behavioral analysis.

Question 72: Which of the following best describes the concept of 'threat modeling' during the planning phase of a penetration test?

Creating automated scripts to simulate threats
Building a physical model of the target network
Modeling the financial cost of potential breaches
Identifying likely adversaries, their motivations, and the attack vectors most relevant to the target organization (Correct answer)

Correct answer: Identifying likely adversaries, their motivations, and the attack vectors most relevant to the target organization

Threat modeling during planning identifies who might attack the organization, their capabilities, and which attack paths are most realistic, helping focus the penetration test on relevant scenarios.

Question 73: When assessment results for a CompTIA PenTest+ Certification evaluation are inconclusive, the BEST practice is to:

Conduct additional assessment using alternative methods (Correct answer)
Report the results as definitive anyway
Delay reporting until results are favorable
Discard the results and start over completely

Correct answer: Conduct additional assessment using alternative methods

Inconclusive results require additional assessment using alternative methods to gather more data. This triangulation approach helps clarify findings without compromising the integrity of the assessment process.

Question 74: What is the MOST important leadership quality for a PenTest+ certified professional managing a team?

Demonstrating integrity, clear communication, and ability to develop team members (Correct answer)
Achieving the highest personal performance metrics
Maintaining strict control over all decisions
Avoiding all forms of conflict within the team

Correct answer: Demonstrating integrity, clear communication, and ability to develop team members

Effective leadership in professional settings requires integrity to build trust, clear communication to align the team, and the ability to develop team members' skills and capabilities. These qualities create a productive and engaged team.

Question 75: What is the significance of a vulnerability assessment report?

To keep the vulnerabilities undisclosed.
To minimize the importance of vulnerabilities.
To document vulnerabilities and suggest mitigation steps (Correct answer)
To limit the number of systems tested.

Correct answer: To document vulnerabilities and suggest mitigation steps

A vulnerability assessment report is a critical deliverable that summarizes the findings of a security assessment. Its significance lies in clearly documenting all identified security weaknesses, categorizing them by severity, and providing detailed information about their potential impact. Crucially, the report also includes actionable recommendations and mitigation strategies, enabling organizations to understand their risks and implement necessary improvements to enhance their security posture.

Question 76: What does 'living off the land' (LotL) mean in a post-exploitation context?

Using zero-day exploits exclusively
Exfiltrating data via DNS queries
Deploying custom malware payloads
Using built-in OS tools like PowerShell and WMI to avoid detection (Correct answer)

Correct answer: Using built-in OS tools like PowerShell and WMI to avoid detection

Living off the land uses legitimate, built-in OS utilities (PowerShell, WMI, certutil) for malicious purposes to blend in and evade security tools.

Question 77: Which tool is commonly used to perform automated web application vulnerability scanning during a CompTIA PenTest+ engagement?

Nikto (Correct answer)
Hashcat
Metasploit Framework
Responder

Correct answer: Nikto

Nikto is an open-source web server scanner that checks for dangerous files, outdated server software, and common web vulnerabilities, making it a standard tool for web application assessments.

Question 78: Which risk rating system is most commonly used in penetration testing reports to score vulnerability severity?

CVSS (Common Vulnerability Scoring System) (Correct answer)
DREAD
PASTA
STRIDE

Correct answer: CVSS (Common Vulnerability Scoring System)

CVSS provides a standardized numerical score (0-10) widely used in the industry to rate vulnerability severity in pentest reports.

Question 79: Which vulnerability is exploited when an attacker injects an external entity into an XML document to read local files from the server?

XPath Injection
XXE Injection (Correct answer)
SSTI
SSRF

Correct answer: XXE Injection

XML External Entity (XXE) Injection exploits weakly configured XML parsers to process external entity declarations, which can allow file disclosure, SSRF, or denial of service.

Question 80: Which concept describes the process of correlating data from multiple OSINT sources to build a comprehensive profile of a target?

Data normalization
Attack surface mapping
Intelligence fusion (Correct answer)
Threat modeling

Correct answer: Intelligence fusion

Intelligence fusion involves combining and correlating data from multiple disparate OSINT sources to create a unified, comprehensive picture of the target.

Question 81: What must always be obtained before conducting physical penetration testing at a facility?

A detailed floor plan of every building on the premises
A complete list of all employees and their schedules
Written authorization from the facility owner or an authorized representative (Correct answer)
Network credentials for the facility's guest Wi-Fi

Correct answer: Written authorization from the facility owner or an authorized representative

Written authorization ('get out of jail free' letter) is mandatory before physical testing to provide legal protection for the tester and clearly define permitted activities and scope.

Question 82: What is the primary purpose of including a 'scope of work' section in a penetration testing report?

To summarize vulnerabilities by severity
To define what systems and activities were authorized during the engagement (Correct answer)
To list all tools used during testing
To outline remediation timelines

Correct answer: To define what systems and activities were authorized during the engagement

The scope of work documents exactly which systems, networks, and test types were authorized, providing legal protection and contextualizing the findings.

Question 83: Which assessment method provides the MOST reliable data for PenTest+ professionals making critical decisions?

Informal verbal feedback alone
Single-source data from one stakeholder
Social media reviews and testimonials
Standardized tools combined with professional observation (Correct answer)

Correct answer: Standardized tools combined with professional observation

Combining standardized assessment tools with professional observation provides the most reliable and comprehensive data. Standardized tools ensure consistency and validity, while professional observation captures nuances that tools might miss.

Question 84: What is 'scope creep' in the context of a penetration testing engagement, and why is it problematic?

Unauthorized expansion of testing beyond the agreed boundaries (Correct answer)
When the engagement takes longer than planned
When the tester discovers more vulnerabilities than expected
When the client adds more testers to the project

Correct answer: Unauthorized expansion of testing beyond the agreed boundaries

Scope creep occurs when testing expands beyond documented boundaries without authorization, creating legal exposure and potentially impacting systems the client did not intend to include.

Question 85: A tester submits the payload `' OR '1'='1` into a login form and gains unauthorized access. What vulnerability has been exploited?

LDAP Injection
SQL Injection (Correct answer)
Broken Authentication
XPATH Injection

Correct answer: SQL Injection

The payload manipulates the SQL query logic to always evaluate as true, which is a classic SQL Injection technique used to bypass authentication.

Question 86: During OSINT gathering, a tester finds the target company's employees frequently post on LinkedIn with job titles referencing specific internal tools. How should this information be classified?

Confidential data requiring legal review before use
Technical intelligence that may reveal internal technology stack (Correct answer)
Personal data only useful for phishing
Irrelevant data to be discarded

Correct answer: Technical intelligence that may reveal internal technology stack

Job postings and LinkedIn profiles can reveal internal technologies, frameworks, and tools, providing valuable technical intelligence for attack planning.

Question 87: What is the importance of conducting a risk assessment in the planning phase of a penetration test?

To reduce the scope of the test.
To evaluate the test's success rate.
To identify potential risks and prioritize tests (Correct answer)
To determine the cost of the test.

Correct answer: To identify potential risks and prioritize tests

Conducting a risk assessment during the planning phase allows the penetration testing team to identify and evaluate potential risks associated with the target systems and the testing process itself. This helps in prioritizing which areas to focus on, understanding the potential impact of identified vulnerabilities, and allocating resources effectively. It ensures the test addresses the most critical security concerns first.

Question 88: Which foundational principle is MOST important for success in the CompTIA PenTest+ Certification profession?

Specializing in only one narrow area of practice
Maximizing financial returns on every engagement
Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)
Maintaining the minimum requirements for certification

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Question 89: What is the MOST effective way for new PenTest+ professionals to build competency in their field?

Learning entirely through trial and error
Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Studying certification materials exclusively
Focusing solely on the most advanced topics

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Question 90: Which social engineering technique involves creating a fabricated scenario to manipulate a target into divulging sensitive information?

Tailgating
Phishing
Pretexting (Correct answer)
Dumpster diving

Correct answer: Pretexting

Pretexting involves inventing a believable fictional scenario (pretext) to manipulate targets into providing sensitive information or taking desired actions.

CompTIA PenTest+ (PT0-003)

The CompTIA PenTest+ certification validates intermediate-level penetration testing skills, covering planning, reconnaissance, vulnerability analysis, attacks and exploits, and post-exploitation techniques used by ethical hackers and security professionals.

Questions

165 min

Time Limit

83%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

comptia.org — Eligibility, fees, exam format, passing score, time limit, test delivery, score validity, retake policy · verified Oct 2026