CompTIA PenTest+ (PT0-003) — Questions and Answers

Question 1: How does the PenTest+ body of knowledge relate to daily professional practice?

It is relevant only for academic research
It provides the foundational framework that guides decision-making and standard practices (Correct answer)
It is theoretical and has limited practical application
It only applies during certification exams

Correct answer: It provides the foundational framework that guides decision-making and standard practices

The body of knowledge provides the foundational framework of principles, standards, and best practices that professionals use to guide their daily decision-making, ensure consistent quality, and maintain alignment with industry standards.

Question 2: What should a penetration test report include?

The time spent on each test.
Only the list of vulnerabilities.
A detailed analysis of vulnerabilities and suggested remediation (Correct answer)
The cost of conducting the test.

Correct answer: A detailed analysis of vulnerabilities and suggested remediation

A penetration test report must be comprehensive and actionable to be truly valuable. It should go beyond a simple list of vulnerabilities, providing a detailed analysis that includes the severity, potential impact, and evidence of each discovered flaw. Crucially, the report must also offer clear, practical, and prioritized recommendations for remediation, guiding the organization on how to fix the identified security weaknesses effectively.

Question 3: Which tool is used during physical penetration testing to read and clone RFID/NFC access badges?

Proxmark or Flipper Zero (Correct answer)
HackRF One SDR
USB Rubber Ducky
LAN Turtle

Correct answer: Proxmark or Flipper Zero

Proxmark and Flipper Zero are dedicated RFID/NFC research tools capable of reading, storing, and emulating proximity access card data for physical security testing.

Question 4: Which Metasploit auxiliary module creates a SOCKS proxy through an active Meterpreter session?

auxiliary/server/socks_proxy (Correct answer)
post/windows/gather/credentials
auxiliary/server/capture/http
auxiliary/scanner/http/dir_scanner

Correct answer: auxiliary/server/socks_proxy

The socks_proxy auxiliary module creates a local SOCKS listener that routes all traffic through the Meterpreter session for seamless pivoting.

Question 5: A penetration tester must deliver findings verbally to a client's CISO before the written report is complete. What is the MOST important communication principle to follow?

Refuse to discuss findings until the written report is finalized
Clearly distinguish between confirmed findings and preliminary observations, and avoid overstating certainty (Correct answer)
Only discuss findings that have been fully documented
Share all raw technical details and exploit code

Correct answer: Clearly distinguish between confirmed findings and preliminary observations, and avoid overstating certainty

Verbal briefings before the final report must clearly distinguish confirmed findings from preliminary observations to avoid misleading decision-makers acting on incomplete information.

Question 6: Which stakeholder engagement strategy is MOST effective for PenTest+ professionals leading initiatives?

Engage stakeholders only when their approval is needed
Inform stakeholders only after decisions are made
Limit engagement to senior leadership only
Identify stakeholders early, understand their interests, and maintain regular communication (Correct answer)

Correct answer: Identify stakeholders early, understand their interests, and maintain regular communication

Early stakeholder identification, understanding their interests and concerns, and maintaining regular communication builds support, prevents surprises, and ensures diverse perspectives inform decision-making throughout the initiative.

Question 7: A penetration tester receives a statement of work that prohibits testing production systems during business hours. What type of constraint is this?

Technical constraint
Environmental constraint (Correct answer)
Legal constraint
Regulatory constraint

Correct answer: Environmental constraint

Environmental constraints define operational boundaries such as time windows, system availability, and business impact limitations.

Question 8: A client requests that a pentest report omit certain high-severity findings before sharing it with their board. How should the tester respond?

Explain that omitting findings undermines the report's integrity and offer alternative presentation formats (Correct answer)
Submit two versions of the report
Refuse to modify the report under any circumstances
Comply fully with the client's request

Correct answer: Explain that omitting findings undermines the report's integrity and offer alternative presentation formats

Testers should maintain report integrity while offering alternatives like a separate board summary that contextualizes risk without suppressing critical findings.

Question 9: Which Burp Suite feature is most useful for intercepting and modifying HTTP requests between a browser and a web server during a pentest?

Scanner
Proxy (Correct answer)
Repeater
Intruder

Correct answer: Proxy

Burp Suite's Proxy intercepts HTTP/HTTPS traffic between the browser and server, allowing a tester to view and modify requests and responses in real time.

Question 10: What is a zero-day attack?

An attack that occurs after a patch is released.
An attack targeting an unpatched, unknown vulnerability (Correct answer)
An attack that uses social engineering.
An attack that tests physical security.

Correct answer: An attack targeting an unpatched, unknown vulnerability

A zero-day attack refers to an exploit that targets a software vulnerability that is unknown to the vendor or for which no patch has yet been publicly released. The term "zero-day" signifies that the developers have had zero days to fix the vulnerability since it became known to the attackers. These attacks are particularly dangerous because there are no existing defenses or patches available to protect against them, making them highly effective until a fix is developed and deployed.

Question 11: Which of the following best describes the concept of 'threat modeling' during the planning phase of a penetration test?

Building a physical model of the target network
Creating automated scripts to simulate threats
Identifying likely adversaries, their motivations, and the attack vectors most relevant to the target organization (Correct answer)
Modeling the financial cost of potential breaches

Correct answer: Identifying likely adversaries, their motivations, and the attack vectors most relevant to the target organization

Threat modeling during planning identifies who might attack the organization, their capabilities, and which attack paths are most realistic, helping focus the penetration test on relevant scenarios.

Question 12: Which set of DNS records is critical for organizations to configure to defend against email spoofing used in phishing?

A, AAAA, and CNAME records
SOA, TXT, and CAA records
SPF, DKIM, and DMARC records (Correct answer)
MX, PTR, and NS records

Correct answer: SPF, DKIM, and DMARC records

SPF validates sending IP addresses, DKIM adds cryptographic signatures to emails, and DMARC enforces policy — together they significantly reduce domain spoofing in phishing.

Question 13: What is the BEST strategy for resource allocation in CompTIA PenTest+ Certification project management?

Allocate all resources equally regardless of need
Keep significant reserves without deployment
Match resources to priorities based on assessment of needs, risks, and strategic goals (Correct answer)
Focus resources only on the largest tasks

Correct answer: Match resources to priorities based on assessment of needs, risks, and strategic goals

Effective resource allocation requires matching available resources to priorities determined by assessment of needs, risk factors, and strategic goals. This ensures that critical areas receive appropriate support while maintaining overall efficiency.

Question 14: What is the main goal of exploiting a vulnerability?

To cause system malfunction.
To improve system performance.
To reduce the number of vulnerabilities.
To evaluate and exploit security weaknesses (Correct answer)

Correct answer: To evaluate and exploit security weaknesses

The main goal of exploiting a vulnerability in penetration testing is not to cause harm, but to demonstrate the real-world impact of a discovered security weakness. By successfully exploiting a vulnerability, testers can prove that a flaw is not just theoretical but can be leveraged by an attacker. This process helps organizations understand the severity of their vulnerabilities and the potential consequences, thereby motivating them to implement effective remediation measures.

Question 15: A tester gains code execution via a deserialization flaw in a Java application. Which tool is most commonly used to generate Java deserialization payloads?

Metasploit
SQLmap
ysoserial (Correct answer)
Burp Suite

Correct answer: ysoserial

ysoserial is the standard tool for generating Java deserialization exploit payloads targeting various Java libraries.

Question 16: Which metric best measures the success of a phishing simulation campaign during a pentest engagement?

Speed at which phishing emails were delivered
Click-through rate and credential submission rate (Correct answer)
Total number of phishing emails sent
Average size in kilobytes of the phishing emails

Correct answer: Click-through rate and credential submission rate

Click-through and credential submission rates directly measure how many targets were deceived, providing actionable data on organizational susceptibility to phishing.

Question 17: Which section of a penetration test report provides the highest-level summary intended for executives and decision-makers?

Executive summary (Correct answer)
Methodology section
Technical findings section
Appendices

Correct answer: Executive summary

The executive summary translates technical findings into business risk language for non-technical stakeholders who make strategic decisions.

Question 18: Which section of a pentest report would include details about testing methodology frameworks such as PTES or OWASP Testing Guide?

Risk matrix
Appendices
Executive summary
Methodology section (Correct answer)

Correct answer: Methodology section

The methodology section describes the testing frameworks, standards, and approaches used during the engagement to provide context and credibility to the findings.

Question 19: What is 'Kerberoasting' used for in Active Directory environments?

Flooding the Domain Controller with Kerberos requests to cause a DoS
Forging a Kerberos TGT to impersonate the domain admin
Requesting service tickets for SPNs and extracting their hashes for offline cracking (Correct answer)
Bypassing multi-factor authentication on Kerberos logins

Correct answer: Requesting service tickets for SPNs and extracting their hashes for offline cracking

Kerberoasting requests Kerberos service tickets for accounts with Service Principal Names (SPNs) and extracts the encrypted ticket portion for offline password cracking.

Question 20: What tool is commonly used for information gathering during a penetration test?

Nmap and Netcat (Correct answer)
Metasploit
Wireshark
Aircrack-ng

Correct answer: Nmap and Netcat

Nmap (Network Mapper) is a powerful and widely used tool for network discovery and security auditing, allowing testers to identify hosts, services, and open ports. Netcat is a versatile networking utility that can read and write data across network connections, often used for banner grabbing, port listening, and transferring files. Both are fundamental for initial information gathering and reconnaissance in penetration testing.

Question 21: What is the MOST important leadership quality for a PenTest+ certified professional managing a team?

Avoiding all forms of conflict within the team
Maintaining strict control over all decisions
Achieving the highest personal performance metrics
Demonstrating integrity, clear communication, and ability to develop team members (Correct answer)

Correct answer: Demonstrating integrity, clear communication, and ability to develop team members

Effective leadership in professional settings requires integrity to build trust, clear communication to align the team, and the ability to develop team members' skills and capabilities. These qualities create a productive and engaged team.

Question 22: Why is DNS tunneling commonly used for data exfiltration during penetration tests?

DNS queries are rarely blocked by firewalls and can carry encoded data on port 53 (Correct answer)
DNS tunneling is undetectable by all IDS systems
DNS responses are too small to inspect
DNS traffic is encrypted by default

Correct answer: DNS queries are rarely blocked by firewalls and can carry encoded data on port 53

DNS tunneling encodes data within DNS queries and responses, exploiting the fact that port 53 UDP/TCP is almost universally allowed through firewalls.

Question 23: A tester discovers that a web application renders user input inside a Jinja2 template. Submitting `{{7*7}}` returns `49`. What vulnerability is present?

Cross-Site Scripting (XSS)
Server-Side Template Injection (SSTI) (Correct answer)
XML Injection
Remote Code Execution via SQL

Correct answer: Server-Side Template Injection (SSTI)

When template expressions like `{{7*7}}` are evaluated server-side and the result is returned, it confirms Server-Side Template Injection (SSTI), which can often lead to remote code execution.

Question 24: What is the MOST effective way for new PenTest+ professionals to build competency in their field?

Focusing solely on the most advanced topics
Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Studying certification materials exclusively
Learning entirely through trial and error

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building professional competency requires a multi-faceted approach: formal education provides foundational knowledge, mentored practice develops applied skills under guidance, and ongoing professional development ensures continuous growth and currency in the field.

Question 25: What is the first step in the planning phase of a penetration test?

Implementing security measures.
Identifying vulnerabilities.
Defining the test scope and objectives (Correct answer)
Conducting network reconnaissance.

Correct answer: Defining the test scope and objectives

The planning phase of a penetration test begins with clearly defining what will be tested (scope) and what the test aims to achieve (objectives). This crucial first step ensures all stakeholders agree on the boundaries, targets, and desired outcomes of the assessment. Without a well-defined scope and objectives, the test can become unfocused, inefficient, or even lead to unintended consequences.

Question 26: Which statement BEST describes the relationship between CompTIA PenTest+ Certification certification requirements and industry evolution?

Certification requirements never change once established
Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards (Correct answer)
Changes only occur when government mandates new requirements
Requirements become less stringent over time

Correct answer: Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards

Certification requirements evolve to keep pace with advances in professional knowledge, technological developments, and changes in practice standards. This ensures that certified professionals remain current and competent in a changing professional landscape.

Question 27: Which foundational principle is MOST important for success in the CompTIA PenTest+ Certification profession?

Maximizing financial returns on every engagement
Maintaining the minimum requirements for certification
Specializing in only one narrow area of practice
Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Success in any professional field requires a commitment to continuous learning to stay current, ethical practice to maintain trust and integrity, and a focus on quality outcomes that serve stakeholders and the public interest.

Question 28: A penetration test report recommends implementing network segmentation as a remediation for multiple findings. What type of recommendation is this?

A tactical quick-fix recommendation
A strategic or architectural remediation recommendation addressing root cause across multiple findings (Correct answer)
A compensating control recommendation
A compliance-only recommendation

Correct answer: A strategic or architectural remediation recommendation addressing root cause across multiple findings

Network segmentation addresses root causes affecting multiple findings simultaneously and represents a strategic architectural improvement rather than a tactical per-vulnerability fix.

Question 29: What should be done after identifying vulnerabilities in a penetration test?

Patch the systems without informing the client.
Report and assess risk for further testing (Correct answer)
Immediately exploit the vulnerabilities.
Ignore the vulnerabilities.

Correct answer: Report and assess risk for further testing

After identifying vulnerabilities, the next crucial step is to document them thoroughly, report them to the client, and assess their potential risk and impact. This assessment helps prioritize which vulnerabilities should be further investigated or exploited during the penetration test, based on their severity and likelihood. It ensures a structured approach to testing and provides actionable intelligence for remediation.

Question 30: A tester intercepts a JWT token and modifies the algorithm field from RS256 to none, then submits it without a signature. What vulnerability is being exploited?

JWT none algorithm vulnerability (Correct answer)
Algorithm confusion attack
Token replay attack
Signature forgery

Correct answer: JWT none algorithm vulnerability

The JWT 'none' algorithm vulnerability allows an attacker to remove the signature when the server accepts unsigned tokens with alg=none.

Question 31: What is the significance of specifying IP address ranges versus domain names in a penetration test scope document?

Domain names expand the scope automatically to include all subdomains
IP ranges are more precise but domain names may resolve to shared hosting affecting third parties (Correct answer)
There is no practical difference between specifying IPs or domain names
Domain names are always preferred because IPs can change

Correct answer: IP ranges are more precise but domain names may resolve to shared hosting affecting third parties

Domain names may resolve to shared infrastructure used by multiple organizations, so testing based on IP ranges prevents inadvertent testing of third-party systems sharing the same host.

Question 32: What is the MOST important factor to consider when selecting assessment tools for PenTest+ certification work?

How quickly the tool can be administered
Personal familiarity with the tool
The cost of the assessment tool
Validity, reliability, and appropriateness for the specific context (Correct answer)

Correct answer: Validity, reliability, and appropriateness for the specific context

Assessment tools must be valid (measuring what they claim to measure), reliable (producing consistent results), and appropriate for the specific context and population. These psychometric properties ensure the quality of assessment outcomes.

Question 33: When performing passive DNS reconnaissance, which resource provides historical DNS records including past IP addresses associated with a domain?

WHOIS database
Passive DNS databases (e.g., RiskIQ, SecurityTrails) (Correct answer)
Certificate transparency logs
ARIN IP allocation records

Correct answer: Passive DNS databases (e.g., RiskIQ, SecurityTrails)

Passive DNS databases aggregate historical DNS resolution data, allowing testers to find past IP addresses and infrastructure changes for a domain.

Question 34: A penetration tester discovers a critical zero-day vulnerability during an engagement. What should they do first according to rules of engagement best practices?

Exploit the vulnerability to prove its impact
Notify the client through the agreed-upon communication channel (Correct answer)
Publish the finding immediately
Report it to a vulnerability database

Correct answer: Notify the client through the agreed-upon communication channel

The rules of engagement typically define escalation procedures for critical findings; notifying the client through agreed channels ensures proper handling.

Question 35: A tester finds a web application that accepts user input in a URL parameter and reflects it back in the response. What vulnerability should be investigated FIRST?

Server-side request forgery (SSRF)
Cross-site scripting (XSS) (Correct answer)
Command injection
XML external entity (XXE) injection

Correct answer: Cross-site scripting (XSS)

When user input is reflected in the browser response without sanitization, cross-site scripting (XSS) is the primary vulnerability to investigate.

Question 36: Which document formally authorizes a penetration tester to perform security assessments and protects them from legal liability?

Master service agreement
Rules of engagement (Correct answer)
Non-disclosure agreement
Statement of work

Correct answer: Rules of engagement

The rules of engagement (ROE) document formally authorizes testing activities and defines boundaries, providing legal protection for the tester.

Question 37: What is 'spear phishing' and how does it differ from standard phishing?

Phishing that targets the fishing and maritime industry specifically
Phishing using spear-shaped graphic elements in emails
A mass phishing campaign sent to millions of recipients at once
Targeted phishing customized with personal details about a specific individual or organization (Correct answer)

Correct answer: Targeted phishing customized with personal details about a specific individual or organization

Spear phishing uses personalized information about the victim (name, role, colleagues) to craft highly convincing, targeted deceptive messages unlike mass phishing blasts.

Question 38: When assessment results for a CompTIA PenTest+ Certification evaluation are inconclusive, the BEST practice is to:

Delay reporting until results are favorable
Conduct additional assessment using alternative methods (Correct answer)
Report the results as definitive anyway
Discard the results and start over completely

Correct answer: Conduct additional assessment using alternative methods

Inconclusive results require additional assessment using alternative methods to gather more data. This triangulation approach helps clarify findings without compromising the integrity of the assessment process.

Question 39: What is the purpose of defining 'success criteria' during the planning phase of a penetration test?

To limit the number of hours billed
To define which tools the tester is required to use
To guarantee the tester will find vulnerabilities
To establish measurable objectives that determine when the engagement goals are met (Correct answer)

Correct answer: To establish measurable objectives that determine when the engagement goals are met

Success criteria provide clear, agreed-upon objectives (e.g., 'obtain domain admin credentials' or 'access PII database') so both parties know what constitutes a completed engagement.

Question 40: Which foundational principle is MOST important for success in the CompTIA PenTest+ Certification profession?

Specializing in only one narrow area of practice
Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)
Maximizing financial returns on every engagement
Maintaining the minimum requirements for certification

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Question 41: Which Windows registry location is commonly abused to establish persistence after a system compromise?

HKCU\Software\Classes\ms-settings
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
HKCU\Software\Microsoft\Windows\CurrentVersion\Run (Correct answer)
HKLM\SYSTEM\CurrentControlSet\Services

Correct answer: HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Registry Run keys cause programs to execute automatically at user login, making them one of the most common persistence mechanisms abused by attackers.

Question 42: Which of the following is a key reason to include third-party service providers in the scoping discussion of a penetration test?

Testing systems owned by third parties may require separate authorization (Correct answer)
Third-party systems are always out of scope
Providers must perform their own portion of the test
Third-party providers always have more vulnerabilities

Correct answer: Testing systems owned by third parties may require separate authorization

Third-party owned infrastructure (SaaS, cloud providers, MSPs) requires separate authorization from those providers before testing, even if the client uses the service.

Question 43: Which command finds SUID binaries on Linux that can be abused for privilege escalation?

ps aux --forest
find / -perm -4000 2>/dev/null (Correct answer)
netstat -tulpn
ls -la /bin

Correct answer: find / -perm -4000 2>/dev/null

The find command with -perm -4000 locates SUID binaries that run with elevated privileges and are commonly abused to escalate to root.

Question 44: When assessment results for a CompTIA PenTest+ Certification evaluation are inconclusive, the BEST practice is to:

Delay reporting until results are favorable
Discard the results and start over completely
Conduct additional assessment using alternative methods (Correct answer)
Report the results as definitive anyway

Correct answer: Conduct additional assessment using alternative methods

Question 45: Which type of penetration test provides the tester with full knowledge of the internal network architecture, source code, and credentials?

Black-box
White-box (Correct answer)
Red team
Gray-box

Correct answer: White-box

White-box testing provides complete transparency including network diagrams, credentials, and source code, simulating an insider threat or detailed audit.

Question 46: What should be included in the 'remediation recommendations' section of a pentest report for a critical finding?

Only a description of the vulnerability
Specific, actionable steps to fix the vulnerability with prioritization guidance (Correct answer)
A list of similar vulnerabilities found elsewhere
The exact exploit code used

Correct answer: Specific, actionable steps to fix the vulnerability with prioritization guidance

Remediation recommendations must be specific and actionable so the client's technical team can address the vulnerability effectively, with priority guidance based on severity.

Question 47: An attacker exploits a race condition between a privilege check and file operation in a SUID program. What classic vulnerability type does this represent?

Use-after-free
Time-of-check to time-of-use (TOCTOU) (Correct answer)
Double free
Integer overflow

Correct answer: Time-of-check to time-of-use (TOCTOU)

TOCTOU (Time-of-Check to Time-of-Use) exploits the window between a security check and the subsequent use of the checked resource.

Question 48: An attacker on a switched network sends gratuitous ARP replies mapping the default gateway's IP to their own MAC address. What is the goal?

MAC flooding
DNS spoofing
ARP cache poisoning for MitM (Correct answer)
VLAN hopping

Correct answer: ARP cache poisoning for MitM

ARP cache poisoning redirects network traffic through the attacker's machine by associating the gateway's IP with the attacker's MAC address.

Question 49: A tester finds a stored XSS vulnerability in an admin panel's user comment field. An attacker submits a payload that creates a new admin account when an admin views the comment. This is an example of:

XSS-driven CSRF attack (Correct answer)
Clickjacking
DOM-based XSS
Reflected XSS exploitation

Correct answer: XSS-driven CSRF attack

Combining stored XSS with CSRF allows the attacker's script to perform authenticated actions on behalf of the admin victim viewing the malicious comment.

Question 50: During a pentest, a tester discovers a web server running an outdated version of Apache with a known CVE. What CVSS metric primarily describes whether the vulnerability can be exploited over the network without physical access?

User Interaction
Attack Vector (Correct answer)
Attack Complexity
Privileges Required

Correct answer: Attack Vector

The Attack Vector metric in CVSS describes the context in which exploitation is possible, including Network, Adjacent, Local, and Physical.

Question 51: What is the purpose of a denial-of-service (DoS) attack?

To gather sensitive information.
To increase system speed.
To cause service interruption (Correct answer)
To decrease network bandwidth.

Correct answer: To cause service interruption

The primary purpose of a Denial-of-Service (DoS) attack is to make a machine or network resource unavailable to its intended users. This is typically achieved by overwhelming the target system with a flood of traffic or requests, or by exploiting a vulnerability that causes the system to crash or become unresponsive. The goal is to disrupt normal operations and prevent legitimate users from accessing services.

Question 52: A tester uses Masscan to perform rapid port scanning across a large IP range. What is the PRIMARY risk of using Masscan at high packet rates during a pentest?

The scan results will be inaccurate due to TCP handshake limitations
The tool may expose the tester's identity through unique packet signatures
High packet rates may trigger IDS/IPS alerts or disrupt network devices (Correct answer)
Masscan cannot scan UDP ports, limiting vulnerability discovery

Correct answer: High packet rates may trigger IDS/IPS alerts or disrupt network devices

Masscan's extremely high packet rates can overwhelm network devices, trigger intrusion detection systems, and potentially disrupt services on the target network.

Question 53: A tester submits the payload `' OR '1'='1` into a login form and gains unauthorized access. What vulnerability has been exploited?

XPATH Injection
LDAP Injection
Broken Authentication
SQL Injection (Correct answer)

Correct answer: SQL Injection

The payload manipulates the SQL query logic to always evaluate as true, which is a classic SQL Injection technique used to bypass authentication.

Question 54: What is the primary purpose of testing for Cross-Site Request Forgery (CSRF) vulnerabilities in a web application?

To force authenticated users to unknowingly submit requests (Correct answer)
To extract sensitive data from server databases
To inject malicious scripts into web pages viewed by other users
To bypass server-side input validation

Correct answer: To force authenticated users to unknowingly submit requests

CSRF vulnerabilities trick authenticated users into submitting unintended requests (such as changing passwords or transferring funds) by exploiting the trust a site has in the user's browser.

Question 55: What is 'scope creep' in the context of a penetration testing engagement, and why is it problematic?

When the tester discovers more vulnerabilities than expected
When the engagement takes longer than planned
Unauthorized expansion of testing beyond the agreed boundaries (Correct answer)
When the client adds more testers to the project

Correct answer: Unauthorized expansion of testing beyond the agreed boundaries

Scope creep occurs when testing expands beyond documented boundaries without authorization, creating legal exposure and potentially impacting systems the client did not intend to include.

Question 56: A red team operator uses a signed binary (living off the land) to download and execute a payload, evading application whitelisting. Which category of technique does this represent?

LOLBin (Living Off the Land Binary) abuse (Correct answer)
Reflective DLL injection
Process injection
DLL sideloading

Correct answer: LOLBin (Living Off the Land Binary) abuse

LOLBin abuse leverages trusted, pre-installed system binaries like certutil, mshta, or regsvr32 to execute malicious code while evading whitelisting controls.

Question 57: What does token impersonation allow an attacker to do in a Windows post-exploitation scenario?

Assume the identity and privileges of another logged-in user (Correct answer)
Crash the target system
Modify Windows Firewall rules
Encrypt files for ransom

Correct answer: Assume the identity and privileges of another logged-in user

Token impersonation steals authentication tokens from other logged-in users to assume their privileges without needing their plaintext password.

Question 58: A web application accepts a URL parameter to redirect users after login. An attacker crafts a link that redirects victims to a malicious site. What vulnerability is this?

Open Redirect (Correct answer)
Server-Side Request Forgery (SSRF)
Cross-Site Request Forgery (CSRF)
Clickjacking

Correct answer: Open Redirect

An Open Redirect vulnerability occurs when an application accepts user-controlled input to redirect users, allowing attackers to redirect victims to malicious external sites.

Question 59: What is the purpose of a 'lessons learned' or 'post-engagement review' meeting after a penetration test?

To plan the next year's budget
To assign blame for discovered vulnerabilities
To renegotiate the contract price
To discuss what worked, what didn't, and how to improve future security posture and testing engagements (Correct answer)

Correct answer: To discuss what worked, what didn't, and how to improve future security posture and testing engagements

Post-engagement reviews help both the client and the testing team improve processes, understand findings more deeply, and plan remediation priorities collaboratively.

Question 60: What distinguishes a CompTIA PenTest+ Certification certified professional from a non-certified practitioner?

Certification validates competency through standardized assessment against established benchmarks (Correct answer)
There is no meaningful difference in competency
Certified professionals exclusively work in larger organizations
Certified professionals always have more years of experience

Correct answer: Certification validates competency through standardized assessment against established benchmarks

Certification provides objective validation of competency through standardized assessment. While non-certified practitioners may be skilled, certification offers verified evidence that a professional meets established benchmarks for knowledge and performance.

Question 61: An attacker sends crafted ICMP packets with a source IP of the victim's address to a large number of hosts that reply to the victim. What DoS technique is this?

SYN flood
Teardrop attack
Smurf attack (Correct answer)
Ping of death

Correct answer: Smurf attack

A Smurf attack sends ICMP echo requests with a spoofed source IP to broadcast addresses, causing all hosts to reply to the victim and overwhelming it.

Question 62: Which document formally authorizes a penetration tester to perform testing activities and provides legal protection?

Get-out-of-jail-free letter (Correct answer)
Non-disclosure agreement (NDA)
Statement of work (SOW)
Rules of engagement (ROE)

Correct answer: Get-out-of-jail-free letter

A get-out-of-jail-free letter (authorization letter) from the client explicitly grants permission to test and provides legal protection if the tester is questioned by law enforcement.

Question 63: What is the MOST important factor to consider when selecting assessment tools for PenTest+ certification work?

The cost of the assessment tool
How quickly the tool can be administered
Personal familiarity with the tool
Validity, reliability, and appropriateness for the specific context (Correct answer)

Correct answer: Validity, reliability, and appropriateness for the specific context

Question 64: A client asks the penetration testing team to keep findings confidential from certain internal IT staff during the engagement. What is the primary reason a client might make this request?

To prevent the IT team from patching vulnerabilities before they are documented
To test whether internal staff would detect the intrusion without being tipped off (double-blind testing) (Correct answer)
To comply with HIPAA requirements
To reduce the cost of the engagement

Correct answer: To test whether internal staff would detect the intrusion without being tipped off (double-blind testing)

Double-blind testing keeps internal IT staff unaware of the engagement to realistically assess detection and response capabilities without bias from foreknowledge.

Question 65: When communicating findings to a technical audience in a pentest report, which approach is MOST appropriate?

Include full technical details such as CVE numbers, proof-of-concept code, and reproduction steps (Correct answer)
Avoid including screenshots to keep the report concise
Limit findings to a single paragraph per vulnerability
Use only business impact language without technical details

Correct answer: Include full technical details such as CVE numbers, proof-of-concept code, and reproduction steps

Technical audiences (sysadmins, developers) require detailed technical information including CVEs, reproduction steps, and proof-of-concept to understand and remediate findings.

Question 66: What is the PRIMARY purpose of obtaining PenTest+ certification in CompTIA PenTest+ Certification?

To satisfy a personal achievement goal
To guarantee employment in the field
To bypass educational requirements
To demonstrate verified competency and adherence to professional standards (Correct answer)

Correct answer: To demonstrate verified competency and adherence to professional standards

Professional certification demonstrates that an individual has met established competency standards through verified assessment. It provides assurance to employers, clients, and the public that the certified professional possesses the knowledge and skills required for competent practice.

Question 67: A client requests a 'purple team' exercise rather than a traditional penetration test. How does this affect the planning and scoping phase?

Scope must include collaboration protocols defining how red and blue teams will share information in real time (Correct answer)
Purple team exercises require no planning since they are informal
The blue team is excluded from the planning phase entirely
Purple team exercises are out of scope for PenTest+ certification

Correct answer: Scope must include collaboration protocols defining how red and blue teams will share information in real time

Purple team exercises require scoping to define information-sharing protocols, collaboration checkpoints, and how the red team's techniques will be communicated to the blue team for training purposes.

Question 68: How is social engineering used in information gathering?

By exploiting human behavior to gain information (Correct answer)
By scanning networks.
By using brute-force tools.
By exploiting physical security systems.

Correct answer: By exploiting human behavior to gain information

Social engineering is a manipulation technique that exploits human psychology, rather than technical vulnerabilities, to trick individuals into divulging confidential information or performing actions. In information gathering, this involves using psychological tactics like phishing, pretexting, or impersonation to persuade targets to unknowingly provide access or data. This method bypasses technical defenses by targeting human trust and susceptibility.

Question 69: Which HTTP security header specifically prevents a web page from being embedded in an iframe to mitigate clickjacking attacks?

X-Content-Type-Options
Strict-Transport-Security
Content-Security-Policy
X-Frame-Options (Correct answer)

Correct answer: X-Frame-Options

The `X-Frame-Options` header (or the `frame-ancestors` CSP directive) controls whether a browser should allow a page to be rendered inside a frame, directly preventing clickjacking.

Question 70: What is the purpose of obtaining written permission before starting a penetration test?

To gain access to the testing tools.
To ensure the test is successful.
To prevent legal and ethical violations (Correct answer)
To limit the scope of the test.

Correct answer: To prevent legal and ethical violations

Obtaining written permission, often in the form of a formal Statement of Work, is absolutely critical before conducting any penetration test. Without explicit authorization, performing such activities could be considered illegal hacking or unauthorized access. This permission protects the penetration testers from legal repercussions and ensures ethical conduct.

Question 71: Which assessment method provides the MOST reliable data for PenTest+ professionals making critical decisions?

Standardized tools combined with professional observation (Correct answer)
Social media reviews and testimonials
Single-source data from one stakeholder
Informal verbal feedback alone

Correct answer: Standardized tools combined with professional observation

Combining standardized assessment tools with professional observation provides the most reliable and comprehensive data. Standardized tools ensure consistency and validity, while professional observation captures nuances that tools might miss.

Question 72: An attacker sends an email appearing to come from an executive asking an employee to wire funds immediately. Which social engineering technique is this?

Business Email Compromise (BEC) (Correct answer)
Spear phishing
Whaling
Vishing

Correct answer: Business Email Compromise (BEC)

Business Email Compromise (BEC) involves impersonating executives or vendors to trick employees into transferring money or sensitive data.

Question 73: What is the MOST important leadership quality for a PenTest+ certified professional managing a team?

Maintaining strict control over all decisions
Avoiding all forms of conflict within the team
Achieving the highest personal performance metrics
Demonstrating integrity, clear communication, and ability to develop team members (Correct answer)

Correct answer: Demonstrating integrity, clear communication, and ability to develop team members

Question 74: What is the primary purpose of including a 'scope of work' section in a penetration testing report?

To outline remediation timelines
To summarize vulnerabilities by severity
To define what systems and activities were authorized during the engagement (Correct answer)
To list all tools used during testing

Correct answer: To define what systems and activities were authorized during the engagement

The scope of work documents exactly which systems, networks, and test types were authorized, providing legal protection and contextualizing the findings.

Question 75: What should be done if an unexpected vulnerability is discovered during a penetration test?

Limit the test to exclude that area.
Ignore the vulnerability to avoid disruption.
Document, report, and reassess within the scope (Correct answer)
Address the vulnerability without reporting it.

Correct answer: Document, report, and reassess within the scope

If an unexpected vulnerability is discovered during a penetration test, it should be immediately documented and reported to the client or relevant stakeholders. The testing team should then reassess whether exploiting this vulnerability falls within the agreed-upon scope of the test. This ensures transparency, allows for informed decisions, and maintains the integrity of the testing process.

Question 76: A penetration tester uses Recon-ng to automate OSINT collection. Which of the following best describes Recon-ng's primary function?

A modular web reconnaissance framework for gathering open-source intelligence (Correct answer)
An exploitation framework similar to Metasploit
A network packet analyzer for capturing live traffic
A password cracking utility for offline hash attacks

Correct answer: A modular web reconnaissance framework for gathering open-source intelligence

Recon-ng is a full-featured web reconnaissance framework with a modular design for automating OSINT gathering from multiple sources.

Question 77: Which technique allows an attacker to move laterally using a compromised account's NTLM hash without cracking it to plaintext?

Overpass-the-hash
Silver ticket attack
Pass-the-hash (Correct answer)
Kerberoasting

Correct answer: Pass-the-hash

Pass-the-hash uses a captured NTLM hash directly for authentication against SMB, WMI, or other NTLM-supporting services without needing the plaintext password.

Question 78: What is the BEST strategy for resource allocation in CompTIA PenTest+ Certification project management?

Keep significant reserves without deployment
Focus resources only on the largest tasks
Match resources to priorities based on assessment of needs, risks, and strategic goals (Correct answer)
Allocate all resources equally regardless of need

Correct answer: Match resources to priorities based on assessment of needs, risks, and strategic goals

Question 79: Which tool is commonly used for maintaining persistent access and post-exploitation activities after initial compromise?

Metasploit Meterpreter (Correct answer)
Wireshark
Nikto
Nmap

Correct answer: Metasploit Meterpreter

Metasploit Meterpreter provides a powerful in-memory post-exploitation shell with built-in features for persistence, pivoting, and lateral movement.

Question 80: Which DNS record type would a penetration tester query to identify the mail servers associated with a target domain?

CNAME record
PTR record
A record
MX record (Correct answer)

Correct answer: MX record

MX (Mail Exchanger) records specify the mail servers responsible for accepting email for a domain.

Question 81: What is the purpose of footprinting in penetration testing?

To conduct physical attacks.
To limit the test’s duration.
To gather information for identifying vulnerabilities (Correct answer)
To assess security postures.

Correct answer: To gather information for identifying vulnerabilities

Footprinting is the initial phase of reconnaissance in penetration testing, where an attacker or tester passively gathers as much information as possible about a target system or network. The primary purpose is to build a comprehensive profile of the target, including its infrastructure, services, and potential points of entry. This detailed intelligence is then used to identify specific vulnerabilities that can be exploited in later stages of the penetration test.

Question 82: What is the first step in information gathering during a penetration test?

Scanning the network for open ports.
Identifying vulnerabilities.
Conducting brute-force attacks.
Gathering OSINT information about the target (Correct answer)

Correct answer: Gathering OSINT information about the target

The first step in information gathering is often Open-Source Intelligence (OSINT), which involves collecting publicly available information about the target. This can include details from websites, social media, public records, and news articles. OSINT helps build a comprehensive profile of the target, identifying potential entry points and attack vectors before any active scanning begins.

Question 83: During a web application pentest, you discover that user input is reflected in an HTML page without sanitization. Which attack type should you attempt first?

Command Injection
SQL Injection
Cross-Site Scripting (XSS) (Correct answer)
XML External Entity (XXE)

Correct answer: Cross-Site Scripting (XSS)

When user input is reflected unsanitized in an HTML page, Cross-Site Scripting (XSS) is the most direct attack to attempt, as the browser will execute injected scripts.

Question 84: An application server sends the header `Access-Control-Allow-Origin: *` with `Access-Control-Allow-Credentials: true`. Why is this a security risk?

It prevents the browser from enforcing the same-origin policy entirely
It allows any origin to make credentialed cross-origin requests, exposing authenticated data (Correct answer)
It disables TLS for cross-origin connections
It enables SQL injection from cross-origin requests

Correct answer: It allows any origin to make credentialed cross-origin requests, exposing authenticated data

A wildcard origin combined with `Allow-Credentials: true` is an invalid but dangerously misconfigured CORS policy; browsers block this combination, but some frameworks mishandle it by reflecting the request origin, granting any attacker site access to credentialed responses.

Question 85: A tester discovers that a web application constructs an OS command using unsanitized user input and executes it via shell_exec(). The tester appends '; cat /etc/passwd' to the input. What is this attack?

OS command injection (Correct answer)
Argument injection
Code injection
Shell escape

Correct answer: OS command injection

OS command injection occurs when unsanitized user input is passed to a shell command, allowing attackers to append additional commands using shell metacharacters.

Question 86: What is a 'USB drop attack' (baiting) and why is it effective as a physical social engineering technique?

Physically dropping a USB drive to destroy it before data recovery
Connecting a USB device to a locked workstation to bypass authentication
Inserting a USB keylogger between a keyboard and a workstation
Planting a malicious USB device in a public area to auto-execute malware when inserted (Correct answer)

Correct answer: Planting a malicious USB device in a public area to auto-execute malware when inserted

USB drop attacks exploit human curiosity — targets find planted USB drives and plug them in, triggering malicious payloads that auto-execute on insertion.

Question 87: A tester is enumerating a target network and discovers an SNMP service running with default community strings. What information can typically be extracted via SNMP v1/v2c?

Only device uptime statistics
Encrypted user credentials only
Network topology, routing tables, and running processes (Correct answer)
Hardware serial numbers exclusively

Correct answer: Network topology, routing tables, and running processes

SNMP with default community strings like 'public' can expose network topology, interface information, routing tables, ARP tables, and running processes.

Question 88: When planning a project in CompTIA PenTest+ Certification, which element should be established FIRST?

The project timeline
The team member assignments
Clear objectives, scope, and success criteria (Correct answer)
The budget allocation

Correct answer: Clear objectives, scope, and success criteria

Clear objectives, scope, and success criteria must be established first because they form the foundation for all other planning decisions. Without knowing what success looks like, it is impossible to properly allocate budget, assign personnel, or set timelines.

Question 89: What is a 'Golden Ticket' attack in Active Directory and what makes it so powerful?

Brute-forcing the domain administrator password offline
A phishing campaign targeting privileged admin accounts
Exploiting a zero-day vulnerability in the Domain Controller
Forging a Kerberos TGT using the KRBTGT account hash, granting persistent domain-wide access (Correct answer)

Correct answer: Forging a Kerberos TGT using the KRBTGT account hash, granting persistent domain-wide access

A Golden Ticket forges a Kerberos TGT signed with the KRBTGT account's hash, providing nearly unrestricted, long-lasting access to any resource in the domain.

Question 90: A tester accesses `/api/users/1001` and then changes the ID to `/api/users/1002` to view another user's data without authorization. What vulnerability is this?

Privilege Escalation
Insecure Direct Object Reference (IDOR) (Correct answer)
Broken Function Level Authorization
Mass Assignment

Correct answer: Insecure Direct Object Reference (IDOR)

Insecure Direct Object Reference (IDOR) occurs when an application exposes internal implementation objects (like user IDs) without proper authorization checks, allowing access to other users' data.

CompTIA PenTest+ (PT0-003)

The CompTIA PenTest+ certification validates intermediate-level penetration testing skills, covering planning, reconnaissance, vulnerability analysis, attacks and exploits, and post-exploitation techniques used by ethical hackers and security professionals.

Questions

165 min

Time Limit

83%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds