CompTIA PenTest+ (PT0-003) — Questions and Answers

Question 1: During an assessment, a tester finds a Linux SUID binary that calls system() with a relative path. Which privilege escalation technique applies?

DLL hijacking
LD_PRELOAD injection
PATH variable hijacking (Correct answer)
Kernel exploit

Correct answer: PATH variable hijacking

PATH variable hijacking exploits SUID binaries that call system commands using relative paths by placing a malicious binary earlier in the PATH.

Question 2: Which element of the master service agreement (MSA) is most directly relevant to managing liability during a penetration test?

Payment schedule
Reporting timelines
Limitation of liability clauses (Correct answer)
Tester's certification requirements

Correct answer: Limitation of liability clauses

Limitation of liability clauses cap the financial exposure of both parties in the event that testing causes unintended damage or service disruption.

Question 3: What should be done if an unexpected vulnerability is discovered during a penetration test?

Document, report, and reassess within the scope (Correct answer)
Ignore the vulnerability to avoid disruption.
Address the vulnerability without reporting it.
Limit the test to exclude that area.

Correct answer: Document, report, and reassess within the scope

If an unexpected vulnerability is discovered during a penetration test, it should be immediately documented and reported to the client or relevant stakeholders. The testing team should then reassess whether exploiting this vulnerability falls within the agreed-upon scope of the test. This ensures transparency, allows for informed decisions, and maintains the integrity of the testing process.

Question 4: A penetration tester discovers that a web application uses predictable session token values (e.g., sequential integers). Which vulnerability category does this represent?

Clickjacking vulnerability
Insecure direct object reference (IDOR)
Broken authentication due to weak session management (Correct answer)
Cross-site request forgery (CSRF)

Correct answer: Broken authentication due to weak session management

Predictable session tokens fall under broken authentication — weak session management allows attackers to guess or forge valid session identifiers.

Question 5: How does the PenTest+ body of knowledge relate to daily professional practice?

It is theoretical and has limited practical application
It only applies during certification exams
It is relevant only for academic research
It provides the foundational framework that guides decision-making and standard practices (Correct answer)

Correct answer: It provides the foundational framework that guides decision-making and standard practices

The body of knowledge provides the foundational framework of principles, standards, and best practices that professionals use to guide their daily decision-making, ensure consistent quality, and maintain alignment with industry standards.

Question 6: What is 'double pivoting' in penetration testing?

Exploiting two different vulnerabilities on one host simultaneously
Running two reverse shells in parallel for redundancy
Using two Metasploit sessions on the same target
Chaining two compromised hosts to reach a third, deeper network segment (Correct answer)

Correct answer: Chaining two compromised hosts to reach a third, deeper network segment

Double pivoting chains two compromised hosts sequentially, routing traffic through the first pivot to reach the second, which then provides access to an even deeper network.

Question 7: Which statement BEST describes the relationship between CompTIA PenTest+ Certification certification requirements and industry evolution?

Requirements become less stringent over time
Changes only occur when government mandates new requirements
Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards (Correct answer)
Certification requirements never change once established

Correct answer: Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards

Certification requirements evolve to keep pace with advances in professional knowledge, technological developments, and changes in practice standards. This ensures that certified professionals remain current and competent in a changing professional landscape.

Question 8: A penetration tester abuses GenericWrite permissions on an Active Directory user account to set a Service Principal Name (SPN) and then request a TGS ticket. What attack is this?

Silver ticket attack
Golden ticket attack
AS-REP roasting
Kerberoasting via targeted SPN setting (Correct answer)

Correct answer: Kerberoasting via targeted SPN setting

Targeted Kerberoasting involves using GenericWrite or similar permissions to set an SPN on a target account, then requesting and cracking the resulting TGS ticket.

Question 9: In the context of pentest reporting, what does 'false positive' refer to?

A finding confirmed by manual testing
A reported vulnerability that does not actually exist or cannot be exploited in the target environment (Correct answer)
A vulnerability found outside the agreed scope
A vulnerability that is more severe than initially assessed

Correct answer: A reported vulnerability that does not actually exist or cannot be exploited in the target environment

A false positive is a vulnerability flagged by tools or initial analysis that further investigation reveals is not actually exploitable or present in the environment.

Question 10: Why is it important to document the scope of a penetration test?

To ensure alignment between stakeholders (Correct answer)
To increase the test's duration.
To limit the number of systems tested.
To make the test more complex.

Correct answer: To ensure alignment between stakeholders

Documenting the scope of a penetration test is critical for ensuring that all parties involved, including the client, management, and the testing team, have a shared understanding of what will and will not be tested. This clarity prevents misunderstandings, manages expectations, and ensures the test focuses on the agreed-upon objectives. It acts as a formal agreement, preventing scope creep or disputes later on.

Question 11: During a pentest, a tester discovers a web server running an outdated version of Apache with a known CVE. What CVSS metric primarily describes whether the vulnerability can be exploited over the network without physical access?

Attack Vector (Correct answer)
User Interaction
Attack Complexity
Privileges Required

Correct answer: Attack Vector

The Attack Vector metric in CVSS describes the context in which exploitation is possible, including Network, Adjacent, Local, and Physical.

Question 12: A tester uploads a file named 'shell.php%00.jpg' to bypass a file extension whitelist. What technique is being used?

Content-Type manipulation
Double extension bypass
MIME type spoofing
Null byte injection (Correct answer)

Correct answer: Null byte injection

Null byte injection (%00) terminates string processing in older PHP versions or C-based functions, causing the server to treat the filename as 'shell.php' and ignore '.jpg'.

Question 13: What is the BEST strategy for resource allocation in CompTIA PenTest+ Certification project management?

Allocate all resources equally regardless of need
Match resources to priorities based on assessment of needs, risks, and strategic goals (Correct answer)
Keep significant reserves without deployment
Focus resources only on the largest tasks

Correct answer: Match resources to priorities based on assessment of needs, risks, and strategic goals

Effective resource allocation requires matching available resources to priorities determined by assessment of needs, risk factors, and strategic goals. This ensures that critical areas receive appropriate support while maintaining overall efficiency.

Question 14: A tester reviews SSL/TLS certificate information for a target and discovers Subject Alternative Names (SANs) listing additional domains. Why is this significant for reconnaissance?

SANs indicate the certificate is self-signed and therefore vulnerable
SANs contain the server's internal IP address
SANs can expose additional subdomains and related domains in scope (Correct answer)
SANs reveal the certificate authority's private key

Correct answer: SANs can expose additional subdomains and related domains in scope

SAN entries in SSL certificates often list multiple hostnames and subdomains, providing valuable reconnaissance data about the organization's infrastructure.

Question 15: Which document formally authorizes a penetration tester to perform testing activities and provides legal protection?

Non-disclosure agreement (NDA)
Get-out-of-jail-free letter (Correct answer)
Rules of engagement (ROE)
Statement of work (SOW)

Correct answer: Get-out-of-jail-free letter

A get-out-of-jail-free letter (authorization letter) from the client explicitly grants permission to test and provides legal protection if the tester is questioned by law enforcement.

Question 16: A tester discovers that a web application renders user input inside a Jinja2 template. Submitting `{{7*7}}` returns `49`. What vulnerability is present?

Remote Code Execution via SQL
Server-Side Template Injection (SSTI) (Correct answer)
Cross-Site Scripting (XSS)
XML Injection

Correct answer: Server-Side Template Injection (SSTI)

When template expressions like `{{7*7}}` are evaluated server-side and the result is returned, it confirms Server-Side Template Injection (SSTI), which can often lead to remote code execution.

Question 17: What is the significance of 'proof of exploitation' screenshots or logs included in a pentest report?

They are only relevant for compliance audits
They are required by ISO 27001 standards
They help the tester remember what was found
They provide irrefutable evidence that a vulnerability was successfully exploited, validating the finding's severity (Correct answer)

Correct answer: They provide irrefutable evidence that a vulnerability was successfully exploited, validating the finding's severity

Proof of exploitation evidence validates findings and demonstrates real-world impact, preventing clients from dismissing findings as theoretical or false positives.

Question 18: What is the purpose of a denial-of-service (DoS) attack?

To cause service interruption (Correct answer)
To decrease network bandwidth.
To increase system speed.
To gather sensitive information.

Correct answer: To cause service interruption

The primary purpose of a Denial-of-Service (DoS) attack is to make a machine or network resource unavailable to its intended users. This is typically achieved by overwhelming the target system with a flood of traffic or requests, or by exploiting a vulnerability that causes the system to crash or become unresponsive. The goal is to disrupt normal operations and prevent legitimate users from accessing services.

Question 19: How does the PenTest+ body of knowledge relate to daily professional practice?

It only applies during certification exams
It is theoretical and has limited practical application
It is relevant only for academic research
It provides the foundational framework that guides decision-making and standard practices (Correct answer)

Correct answer: It provides the foundational framework that guides decision-making and standard practices

Question 20: A tester intercepts a JWT token and modifies the algorithm field from RS256 to none, then submits it without a signature. What vulnerability is being exploited?

Algorithm confusion attack
Token replay attack
Signature forgery
JWT none algorithm vulnerability (Correct answer)

Correct answer: JWT none algorithm vulnerability

The JWT 'none' algorithm vulnerability allows an attacker to remove the signature when the server accepts unsigned tokens with alg=none.

Question 21: Which document formally authorizes a penetration tester to perform security assessments and protects them from legal liability?

Master service agreement
Statement of work
Non-disclosure agreement
Rules of engagement (Correct answer)

Correct answer: Rules of engagement

The rules of engagement (ROE) document formally authorizes testing activities and defines boundaries, providing legal protection for the tester.

Question 22: What is the MOST important leadership quality for a PenTest+ certified professional managing a team?

Demonstrating integrity, clear communication, and ability to develop team members (Correct answer)
Avoiding all forms of conflict within the team
Achieving the highest personal performance metrics
Maintaining strict control over all decisions

Correct answer: Demonstrating integrity, clear communication, and ability to develop team members

Effective leadership in professional settings requires integrity to build trust, clear communication to align the team, and the ability to develop team members' skills and capabilities. These qualities create a productive and engaged team.

Question 23: How frequently should ongoing assessments be conducted in CompTIA PenTest+ Certification practice?

Only when problems are reported
Once annually regardless of circumstances
Only when required by external auditors
At regular intervals based on established protocols and as conditions change (Correct answer)

Correct answer: At regular intervals based on established protocols and as conditions change

Ongoing assessments should follow established protocols for regular intervals and also be conducted when conditions change. This balanced approach ensures continuous monitoring while remaining responsive to new developments.

Question 24: Which of the following best describes the concept of 'threat modeling' during the planning phase of a penetration test?

Modeling the financial cost of potential breaches
Building a physical model of the target network
Identifying likely adversaries, their motivations, and the attack vectors most relevant to the target organization (Correct answer)
Creating automated scripts to simulate threats

Correct answer: Identifying likely adversaries, their motivations, and the attack vectors most relevant to the target organization

Threat modeling during planning identifies who might attack the organization, their capabilities, and which attack paths are most realistic, helping focus the penetration test on relevant scenarios.

Question 25: What is the PRIMARY benefit of using data-driven decision making in CompTIA PenTest+ Certification management?

It provides objective evidence to support decisions, reduce bias, and track outcomes (Correct answer)
It guarantees positive results for every decision
It simplifies the decision-making process to one approach
It eliminates the need for professional judgment

Correct answer: It provides objective evidence to support decisions, reduce bias, and track outcomes

Data-driven decision making provides objective evidence that supports more informed decisions, helps reduce personal bias, and enables tracking of outcomes to evaluate effectiveness. It complements, rather than replaces, professional judgment.

Question 26: What distinguishes 'risk' from 'vulnerability' in penetration test report terminology?

Risk refers only to financial losses; vulnerability refers to technical flaws
Vulnerability is the technical weakness; risk combines the vulnerability with likelihood of exploitation and potential business impact (Correct answer)
Vulnerability is more severe than risk
They are interchangeable terms in pentest reports

Correct answer: Vulnerability is the technical weakness; risk combines the vulnerability with likelihood of exploitation and potential business impact

A vulnerability is the technical flaw itself, while risk is the combination of that vulnerability's exploitability with the potential business impact if exploited.

Question 27: Which section of a pentest report would include details about testing methodology frameworks such as PTES or OWASP Testing Guide?

Executive summary
Methodology section (Correct answer)
Risk matrix
Appendices

Correct answer: Methodology section

The methodology section describes the testing frameworks, standards, and approaches used during the engagement to provide context and credibility to the findings.

Question 28: When planning a project in CompTIA PenTest+ Certification, which element should be established FIRST?

The project timeline
The budget allocation
The team member assignments
Clear objectives, scope, and success criteria (Correct answer)

Correct answer: Clear objectives, scope, and success criteria

Clear objectives, scope, and success criteria must be established first because they form the foundation for all other planning decisions. Without knowing what success looks like, it is impossible to properly allocate budget, assign personnel, or set timelines.

Question 29: Which social engineering influence principle exploits a target's sense of obligation after receiving something of value?

Social proof
Reciprocity (Correct answer)
Scarcity
Authority

Correct answer: Reciprocity

Reciprocity exploits the human tendency to feel obligated to return a favor, where attackers offer something (fake IT help, gifts) to elicit sensitive information in return.

Question 30: Which Windows registry location is commonly abused to establish persistence after a system compromise?

HKLM\SYSTEM\CurrentControlSet\Services
HKCU\Software\Microsoft\Windows\CurrentVersion\Run (Correct answer)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
HKCU\Software\Classes\ms-settings

Correct answer: HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Registry Run keys cause programs to execute automatically at user login, making them one of the most common persistence mechanisms abused by attackers.

Question 31: A PHP application includes files based on a `page` parameter: `include($_GET['page'] . '.php')`. How could a tester exploit Local File Inclusion (LFI)?

Sending an oversized value to trigger a buffer overflow
Passing a SQL query in the page parameter
Injecting JavaScript into the page parameter
Using path traversal sequences like `../../../etc/passwd%00` (Correct answer)

Correct answer: Using path traversal sequences like `../../../etc/passwd%00`

By using path traversal sequences and a null byte to truncate the .php extension, a tester can include arbitrary files from the server's filesystem via the LFI vulnerability.

CompTIA PenTest+ (PT0-003)

The CompTIA PenTest+ certification validates intermediate-level penetration testing skills, covering planning, reconnaissance, vulnerability analysis, attacks and exploits, and post-exploitation techniques used by ethical hackers and security professionals.

Questions

35 min

Time Limit

83%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds