CompTIA PenTest+ (PT0-003) — Questions and Answers

Question 1: Which Metasploit post-exploitation module is used to add routes through a Meterpreter session for pivoting?

auxiliary/gather/enum_dns
auxiliary/scanner/portscan/tcp
post/multi/manage/autoroute (Correct answer)
exploit/multi/handler

Correct answer: post/multi/manage/autoroute

The autoroute post module adds network routes through an active Meterpreter session, enabling traffic to be proxied through the compromised host.

Question 2: A tester performs a Shodan search and discovers an exposed industrial control system (ICS) device belonging to the target. What is the MOST appropriate next step?

Immediately attempt to exploit the device to prove impact
Attempt to log in with default credentials to confirm vulnerability
Document the finding and report it to the client before any further action (Correct answer)
Ignore it since ICS is out of scope for most pentests

Correct answer: Document the finding and report it to the client before any further action

Exposed ICS/SCADA systems carry significant risk; the tester should document the finding and consult the client before taking any action that could cause disruption.

Question 3: What is the significance of specifying IP address ranges versus domain names in a penetration test scope document?

There is no practical difference between specifying IPs or domain names
Domain names are always preferred because IPs can change
Domain names expand the scope automatically to include all subdomains
IP ranges are more precise but domain names may resolve to shared hosting affecting third parties (Correct answer)

Correct answer: IP ranges are more precise but domain names may resolve to shared hosting affecting third parties

Domain names may resolve to shared infrastructure used by multiple organizations, so testing based on IP ranges prevents inadvertent testing of third-party systems sharing the same host.

Question 4: Which Sysinternals tool is commonly used for lateral movement by executing commands on remote Windows systems via SMB?

Process Monitor
TCPView
Autoruns
PsExec (Correct answer)

Correct answer: PsExec

PsExec uses SMB and valid credentials to execute commands or launch interactive shells on remote Windows systems, making it a go-to tool for lateral movement.

Question 5: An attacker on a switched network sends gratuitous ARP replies mapping the default gateway's IP to their own MAC address. What is the goal?

DNS spoofing
ARP cache poisoning for MitM (Correct answer)
VLAN hopping
MAC flooding

Correct answer: ARP cache poisoning for MitM

ARP cache poisoning redirects network traffic through the attacker's machine by associating the gateway's IP with the attacker's MAC address.

Question 6: A tester exploits a web application by injecting template syntax like {{7*7}} into a user-supplied input field and receives '49' in the response. What vulnerability was discovered?

Server-Side Template Injection (SSTI) (Correct answer)
XSS
Code injection
LDAP injection

Correct answer: Server-Side Template Injection (SSTI)

Server-Side Template Injection (SSTI) occurs when user input is embedded in a server-side template, allowing code execution within the template engine's context.

Question 7: What is the purpose of obtaining written permission before starting a penetration test?

To limit the scope of the test.
To ensure the test is successful.
To gain access to the testing tools.
To prevent legal and ethical violations (Correct answer)

Correct answer: To prevent legal and ethical violations

Obtaining written permission, often in the form of a formal Statement of Work, is absolutely critical before conducting any penetration test. Without explicit authorization, performing such activities could be considered illegal hacking or unauthorized access. This permission protects the penetration testers from legal repercussions and ensures ethical conduct.

Question 8: A web application uses OAuth 2.0 and does not validate the `state` parameter during the authorization callback. What attack is possible?

JWT Algorithm Confusion
Authorization Code Interception
Token Replay Attack
Cross-Site Request Forgery on OAuth Flow (Correct answer)

Correct answer: Cross-Site Request Forgery on OAuth Flow

The OAuth `state` parameter functions as a CSRF token; without validating it, an attacker can forge a callback request and link their malicious account to a victim's session.

Question 9: Which tool is widely used to extract plaintext passwords and NTLM hashes from Windows LSASS memory?

Responder
Hashcat
John the Ripper
Mimikatz (Correct answer)

Correct answer: Mimikatz

Mimikatz is the standard tool for dumping plaintext credentials, NTLM hashes, and Kerberos tickets directly from Windows LSASS process memory.

Question 10: In a penetration test report, what does 'attack narrative' or 'attack path' documentation provide?

The testing team's schedule
A step-by-step walkthrough showing how an attacker could chain vulnerabilities to achieve an objective (Correct answer)
A list of all IP addresses scanned
A comparison against industry benchmarks

Correct answer: A step-by-step walkthrough showing how an attacker could chain vulnerabilities to achieve an objective

An attack narrative demonstrates how individual vulnerabilities can be chained together to show realistic attack paths and the true business impact of vulnerabilities.

Question 11: A penetration tester uses Recon-ng to automate OSINT collection. Which of the following best describes Recon-ng's primary function?

A modular web reconnaissance framework for gathering open-source intelligence (Correct answer)
An exploitation framework similar to Metasploit
A password cracking utility for offline hash attacks
A network packet analyzer for capturing live traffic

Correct answer: A modular web reconnaissance framework for gathering open-source intelligence

Recon-ng is a full-featured web reconnaissance framework with a modular design for automating OSINT gathering from multiple sources.

Question 12: During a pentest, a tester accidentally accesses data that appears to be personally identifiable information (PII) outside the agreed scope. What is the correct action?

Document it in the final report only
Immediately stop accessing the data and notify the client and legal counsel (Correct answer)
Copy the data as evidence and continue
Delete the data to protect privacy

Correct answer: Immediately stop accessing the data and notify the client and legal counsel

Unintended access to out-of-scope PII requires immediate cessation of access and notification to the client and potentially legal counsel due to regulatory implications.

Question 13: When testing REST APIs during a pentest, which technique helps identify endpoints that are not documented but may be accessible?

Fuzzing with wordlists of common API paths (Correct answer)
Running Nikto against the API server
Performing a SQL injection on each parameter
Capturing traffic with Wireshark

Correct answer: Fuzzing with wordlists of common API paths

Fuzzing API endpoints with wordlists (using tools like ffuf or Gobuster) discovers undocumented or hidden endpoints that may lack proper access controls.

Question 14: How should a penetration tester handle proprietary client data collected during testing after the engagement concludes?

Securely delete all client data per the data retention policy agreed in the contract (Correct answer)
Archive it permanently as part of the engagement record
Retain it for use in future engagements with similar clients
Transfer it to the tester's personal backup systems

Correct answer: Securely delete all client data per the data retention policy agreed in the contract

Client data must be securely deleted after the engagement per the data handling policy specified in the contract to protect client confidentiality and meet legal obligations.

Question 15: What is privilege escalation?

Gaining higher-level access privileges (Correct answer)
Preventing unauthorized access.
Limiting user permissions.
Removing system vulnerabilities.

Correct answer: Gaining higher-level access privileges

Privilege escalation is a post-exploitation technique where an attacker, having gained initial access to a system, seeks to obtain elevated permissions or access rights. This means moving from a low-privilege user account to a higher-privilege account, such as an administrator or root user. Gaining these higher-level privileges allows the attacker to perform more critical actions, access sensitive data, or further compromise the system.

Question 16: During a red team engagement, an operator uses Cobalt Strike's sleep command combined with jitter. What is the primary purpose of this technique?

Increase beacon speed
Bypass endpoint AV scanning
Evade network-based anomaly detection (Correct answer)
Encrypt C2 traffic

Correct answer: Evade network-based anomaly detection

Sleep with jitter adds randomized delays to beacon check-ins, making traffic patterns irregular and harder to detect via network behavioral analysis.

Question 17: What is the BEST strategy for resource allocation in CompTIA PenTest+ Certification project management?

Allocate all resources equally regardless of need
Match resources to priorities based on assessment of needs, risks, and strategic goals (Correct answer)
Keep significant reserves without deployment
Focus resources only on the largest tasks

Correct answer: Match resources to priorities based on assessment of needs, risks, and strategic goals

Effective resource allocation requires matching available resources to priorities determined by assessment of needs, risk factors, and strategic goals. This ensures that critical areas receive appropriate support while maintaining overall efficiency.

Question 18: A client asks the penetration testing team to keep findings confidential from certain internal IT staff during the engagement. What is the primary reason a client might make this request?

To test whether internal staff would detect the intrusion without being tipped off (double-blind testing) (Correct answer)
To prevent the IT team from patching vulnerabilities before they are documented
To reduce the cost of the engagement
To comply with HIPAA requirements

Correct answer: To test whether internal staff would detect the intrusion without being tipped off (double-blind testing)

Double-blind testing keeps internal IT staff unaware of the engagement to realistically assess detection and response capabilities without bias from foreknowledge.

Question 19: When documenting assessment findings in PenTest+ practice, which approach is MOST appropriate?

Include only positive findings to maintain optimism
Record objective findings, measurements, and professional observations factually (Correct answer)
Use technical jargon that only experts can understand
Summarize findings verbally without written documentation

Correct answer: Record objective findings, measurements, and professional observations factually

Assessment documentation must be objective, factual, and comprehensive. Recording measurements, observations, and findings without bias ensures that the documentation is useful for decision-making and withstands scrutiny.

Question 20: A penetration tester is asked to perform a physical security assessment as part of a broader engagement. Which additional authorization consideration applies?

Only the IT department needs to authorize physical testing
Physical testing is always illegal and should be refused
Written permission specific to physical access attempts must be obtained (Correct answer)
Physical testing requires no additional authorization if logical systems are in scope

Correct answer: Written permission specific to physical access attempts must be obtained

Physical penetration testing involves entering facilities or bypassing physical controls, which requires explicit written authorization separate from network testing permission.

Question 21: Which foundational principle is MOST important for success in the CompTIA PenTest+ Certification profession?

Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)
Specializing in only one narrow area of practice
Maximizing financial returns on every engagement
Maintaining the minimum requirements for certification

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Success in any professional field requires a commitment to continuous learning to stay current, ethical practice to maintain trust and integrity, and a focus on quality outcomes that serve stakeholders and the public interest.

Question 22: Which stakeholder engagement strategy is MOST effective for PenTest+ professionals leading initiatives?

Limit engagement to senior leadership only
Engage stakeholders only when their approval is needed
Identify stakeholders early, understand their interests, and maintain regular communication (Correct answer)
Inform stakeholders only after decisions are made

Correct answer: Identify stakeholders early, understand their interests, and maintain regular communication

Early stakeholder identification, understanding their interests and concerns, and maintaining regular communication builds support, prevents surprises, and ensures diverse perspectives inform decision-making throughout the initiative.

Question 23: A tester discovers evidence of an active breach by a third party during a scheduled pentest. What is the MOST appropriate immediate action?

Include the finding only in the final report
Attempt to identify and remove the threat actor
Document the breach evidence and immediately notify the client (Correct answer)
Continue testing to avoid disrupting the engagement timeline

Correct answer: Document the breach evidence and immediately notify the client

Discovery of an active breach requires immediate notification to the client so they can engage incident response resources, as this takes priority over the pentest scope.

Question 24: When assessing scope for a web application penetration test, why is it important to identify the application's technology stack in advance?

Different technologies have unique vulnerabilities and require specific testing methodologies (Correct answer)
Knowing the stack allows the tester to skip reconnaissance
The stack determines which regulatory framework applies
The technology stack determines the price of the engagement

Correct answer: Different technologies have unique vulnerabilities and require specific testing methodologies

Understanding the technology stack (e.g., PHP, Java, .NET, frameworks) helps identify relevant vulnerability classes and ensures appropriate testing tools and techniques are included in scope.

Question 25: A penetration tester uses theHarvester to collect email addresses and subdomains for a target organization. What category of reconnaissance does this represent?

Internal reconnaissance
Passive reconnaissance (Correct answer)
Active reconnaissance
Physical reconnaissance

Correct answer: Passive reconnaissance

theHarvester gathers data from public sources (search engines, DNS records) without directly interacting with the target, making it passive reconnaissance.

Question 26: Which stakeholder engagement strategy is MOST effective for PenTest+ professionals leading initiatives?

Limit engagement to senior leadership only
Inform stakeholders only after decisions are made
Identify stakeholders early, understand their interests, and maintain regular communication (Correct answer)
Engage stakeholders only when their approval is needed

Correct answer: Identify stakeholders early, understand their interests, and maintain regular communication

Question 27: During an assessment, a tester finds a Linux SUID binary that calls system() with a relative path. Which privilege escalation technique applies?

DLL hijacking
PATH variable hijacking (Correct answer)
Kernel exploit
LD_PRELOAD injection

Correct answer: PATH variable hijacking

PATH variable hijacking exploits SUID binaries that call system commands using relative paths by placing a malicious binary earlier in the PATH.

Question 28: A tester uploads a file named 'shell.php%00.jpg' to bypass a file extension whitelist. What technique is being used?

Double extension bypass
MIME type spoofing
Null byte injection (Correct answer)
Content-Type manipulation

Correct answer: Null byte injection

Null byte injection (%00) terminates string processing in older PHP versions or C-based functions, causing the server to treat the filename as 'shell.php' and ignore '.jpg'.

Question 29: Which HTTP security header specifically prevents a web page from being embedded in an iframe to mitigate clickjacking attacks?

Strict-Transport-Security
X-Content-Type-Options
X-Frame-Options (Correct answer)
Content-Security-Policy

Correct answer: X-Frame-Options

The `X-Frame-Options` header (or the `frame-ancestors` CSP directive) controls whether a browser should allow a page to be rendered inside a frame, directly preventing clickjacking.

Question 30: A tester uses Masscan to perform rapid port scanning across a large IP range. What is the PRIMARY risk of using Masscan at high packet rates during a pentest?

Masscan cannot scan UDP ports, limiting vulnerability discovery
High packet rates may trigger IDS/IPS alerts or disrupt network devices (Correct answer)
The tool may expose the tester's identity through unique packet signatures
The scan results will be inaccurate due to TCP handshake limitations

Correct answer: High packet rates may trigger IDS/IPS alerts or disrupt network devices

Masscan's extremely high packet rates can overwhelm network devices, trigger intrusion detection systems, and potentially disrupt services on the target network.

Question 31: What is the PRIMARY purpose of obtaining PenTest+ certification in CompTIA PenTest+ Certification?

To satisfy a personal achievement goal
To demonstrate verified competency and adherence to professional standards (Correct answer)
To guarantee employment in the field
To bypass educational requirements

Correct answer: To demonstrate verified competency and adherence to professional standards

Professional certification demonstrates that an individual has met established competency standards through verified assessment. It provides assurance to employers, clients, and the public that the certified professional possesses the knowledge and skills required for competent practice.

CompTIA PenTest+ (PT0-003)

The CompTIA PenTest+ certification validates intermediate-level penetration testing skills, covering planning, reconnaissance, vulnerability analysis, attacks and exploits, and post-exploitation techniques used by ethical hackers and security professionals.

Questions

35 min

Time Limit

83%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

comptia.org — Eligibility, fees, exam format, passing score, time limit, test delivery, score validity, retake policy · verified Oct 2026