CompTIA PenTest+ (PT0-003) Practice Exam

What the CompTIA PenTest+ (PT0-003) exam covers

• Engagement Management125 questions
• Reconnaissance and Enumeration201 questions
• Vulnerability Discovery and Analysis163 questions
• Attacks and Exploits335 questions
• Post-exploitation and Lateral Movement134 questions

Free CompTIA PenTest+ (PT0-003) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 958.

1. Question 1Reconnaissance and Enumeration

   A tester runs a WHOIS lookup on target.com but the registrant name, email, and phone are shown as 'REDACTED FOR PRIVACY.' What most likely explains this?

   • AThe domain has expired and its records were purged from the registry
   • BPrivacy regulations such as GDPR cause registrars to mask personal contact dataCorrect
   • CThe WHOIS server rate-limited the query and returned only partial output
   • DThe domain uses DNSSEC, which encrypts all registration record fields
   ✓ Correct answer: B

   Since GDPR took effect, ICANN-accredited registrars and privacy-protection services routinely redact personal registrant data (name, email, phone) from public WHOIS output, replacing it with generic or proxy values. Testers can still learn the registrar, creation and expiry dates, and name servers, but personal contact details usually require a data-access request or alternate OSINT. This is a deliberate privacy control, not an error or an expired record.

   Why the other options are wrong

   • AExpired domains still return records during the redemption or grace period; expiry does not blank the registrant fields.
   • CRate limiting typically returns an error or throttling message, not fields literally labeled 'REDACTED FOR PRIVACY.'
   • DDNSSEC signs DNS zone data for integrity; it does not encrypt or hide WHOIS registration fields.
2. Question 2Reconnaissance and Enumeration

   Which Gobuster command performs directory/file brute forcing against a web server using a wordlist?

   • AGobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txtCorrect
   • BGobuster scan -u http://target
   • CGobuster brute -p 80 target
   • DGobuster dns -u http://target -w wordlist.txt
   ✓ Correct answer: A

   Gobuster brute-forces hidden directories and files by requesting each wordlist entry against a web server. The dir subcommand selects directory/file enumeration mode, -u specifies the target URL, and -w specifies the wordlist. Each entry is appended to the base URL as a path and the HTTP status code (200, 301, 302) reveals existing resources versus 404 for not found, uncovering admin panels, backups, and config files.

   Why the other options are wrong

   • Bgobuster scan -u http://target uses scan, which is not a valid Gobuster subcommand; the real modes are dir, dns, vhost, fuzz, and s3.
   • Cgobuster brute -p 80 target uses the invalid subcommand brute and wrong -p port syntax, so the command would not run.
   • Dgobuster dns -u http://target -w wordlist.txt uses dns (subdomain enumeration), which expects -d for the domain rather than -u for a URL, and does not perform web directory brute-forcing.
3. Question 3Reconnaissance and Enumeration

   Why is accurate time synchronization (e.g., NTP) across hosts important for log analysis and detection?

   • AIt allows events from different systems to be correlated on a consistent timelineCorrect
   • BIt guarantees the integrity of log entries so they cannot be tampered with after the fact
   • CIt compresses log volume by deduplicating identical events across hosts
   • DIt ensures every host forwards its logs to the central collector in real time
   ✓ Correct answer: A

   When multiple systems across an enterprise generate log events, accurate cross-system correlation depends on all timestamps being synchronized to a common reference time. If different systems have drifted clocks, events that are causally related-for example, a lateral movement attempt from host A to host B-may appear in the logs with timestamps that do not align, making it impossible to construct an accurate attack timeline. Network Time Protocol (NTP) synchronization ensures all systems share a consistent timestamp base, enabling SIEM correlation rules that join events across sources by time window to function accurately. For penetration test engagements, a tester-provided timeline is only useful for detection analysis if the client's systems are also time-synchronized.

   Why the other options are wrong

   • BNTP aligns clocks but does nothing to sign or protect log entries from later modification; that requires hashing or write-once storage.
   • CTime synchronization does not deduplicate or compress events; it only makes their timestamps consistent.
   • DNTP sets the clock; it does not configure or guarantee log forwarding, which is handled by the logging pipeline itself.
4. Question 4Attacks and Exploits

   Which OAuth/OpenID Connect attack tricks an application into accepting an authorization response intended for a different client by manipulating the redirect URI?

   • AA SYN flood aimed at overwhelming the OAuth authorization server's listening port
   • BA DNS record time-to-live modification on the OpenID Connect identity provider domain
   • COpen redirect / redirect URI manipulation to steal authorization codes or tokensCorrect
   • DDisk defragmentation performed on the OpenID Connect identity provider's server
   ✓ Correct answer: C

   OAuth and OpenID Connect flows rely on redirect URIs to deliver authorization codes or tokens back to the client application after user authentication. If the authorization server does not strictly validate the redirect URI against a pre-registered allowlist, an attacker can modify the URI to point to a server they control. When the victim completes authentication, the authorization code or token is sent to the attacker's endpoint instead of the legitimate application, allowing the attacker to exchange it for access tokens and hijack the victim's session. Proper mitigation requires exact-match validation of redirect URIs, avoiding wildcard or partial matching, and implementing PKCE (Proof Key for Code Exchange) to bind authorization codes to the original requesting client.

   Why the other options are wrong

   • AA SYN flood is denial-of-service, not manipulation of an OAuth redirect URI.
   • BChanging DNS TTLs does not divert an authorization response to another client.
   • DDefragmentation is a disk operation unrelated to OAuth redirect abuse.
5. Question 5Engagement Management

   After a red team engagement the client's blue team asks for a detailed timeline of every action the red team took. What is this document called?

   • AAttack narrative
   • BPurple team report
   • COperator log / chronological activity logCorrect
   • DThreat intelligence report
   ✓ Correct answer: C

   During red team engagements, operators maintain a chronological activity log (often called an operator log or OPLOG) that records timestamps, commands executed, systems touched, and techniques used. Delivering this to the blue team enables a detailed compare-and-contrast exercise - the blue team can check which actions they detected, which they missed, and exactly when each event occurred, driving concrete improvements to detection and response capabilities.

   Why the other options are wrong

   • AAn attack narrative is a prose description of the engagement storyline written for the report; it is typically a summary rather than a granular timestamped record.
   • BA purple team report documents collaborative exercises where red and blue teams work together in real time; it is not the same as a post-engagement log review.
   • DA threat intelligence report covers external adversary TTPs, indicators of compromise, and threat actor profiles - not the internal record of what the engagement team did.
6. Question 6Vulnerability Discovery and Analysis

   Why must a scanner's plugin/feed be updated before an engagement?

   • ASo the scan finishes faster on large networks
   • BSo newly disclosed vulnerabilities are detectedCorrect
   • CSo the scanner can bypass the target firewall
   • DSo the scanner supports newer target systems
   ✓ Correct answer: B

   Detection content, whether Nessus plugins, OpenVAS NVTs, or Nuclei templates, is only as good as its last update; a stale feed simply will not test for CVEs published after that date. Updating before the engagement ensures the scanner covers current threats. Feed updates do not change scan speed, evade firewalls, or eliminate the need for manual validation.

   Why the other options are wrong

   • AFeed freshness does not make scans run faster.
   • CPlugin content has nothing to do with bypassing firewall rules.
   • DPlugin/feed updates add detection for newly disclosed vulnerabilities, not operating-system support for targets.
7. Question 7Attacks and Exploits

   A tester exploits an XML parser that resolves external entities. Reading /etc/passwd succeeds, but outbound network access is blocked, preventing classic out-of-band exfiltration. Which XXE variant can still retrieve data?

   • BError-based / in-band XXE that returns file contents in parser error messagesCorrect
   • AReflected XSS delivered through the XML response rendered in the victim's browser
   • CDNS rebinding that repoints the XML parser host to an internal service address
   • DCSRF forcing an authenticated user to submit the malicious XML to the endpoint
   ✓ Correct answer: B

   If the application echoes parser errors, an attacker can craft entities that force the file contents into a malformed reference, causing the parser to disclose the data inside an error message. This in-band technique works without any outbound connectivity required by blind/OOB XXE.

   Why the other options are wrong

   • AXSS executes script in a browser and does not exfiltrate server-side files when outbound access is blocked.
   • CDNS rebinding targets browser same-origin controls and does not retrieve local file contents via the parser.
   • DCSRF causes a victim to send a request but does not read back file data through a blocked out-of-band channel.
8. Question 8Post-exploitation and Lateral Movement

   A tester needs to move laterally to a Windows host where they only possess the user's NTLM hash, and they want to spawn a remote semi-interactive shell over SMB. Which command demonstrates pass-the-hash with Impacket's psexec?

   • Apsexec.py -hashes :<NTLMHASH> CORP/jsmith@10.10.5.10Correct
   • Bhashcat -m 1000 hash.txt rockyou.txt
   • Ccrackmapexec ssh 10.10.5.10 -u jsmith -p Password1
   • Dnmap --script smb-enum-shares 10.10.5.10
   ✓ Correct answer: A

   The '-hashes :<NTLMHASH>' syntax supplies the NT hash (empty LM portion) so no plaintext password is needed. psexec.py then creates a service to run commands, giving a SYSTEM-level shell when the account has admin rights. This is a classic pass-the-hash lateral-movement technique.

   Why the other options are wrong

   • Bhashcat cracks the hash offline; it does not authenticate or move laterally.
   • CThis uses SSH with a plaintext password, not pass-the-hash over SMB.
   • Dnmap enumerates shares but does not provide a shell or perform PtH.
9. Question 9Reconnaissance and Enumeration

   A tester wants to use Google dorking to find login portals belonging to target.com that are indexed and contain the word admin in the page title. Which search query is correct?

   • Asite:target.com intitle:admin inurl:loginCorrect
   • Bdomain:target.com title=admin path=login
   • Chost:target.com banner:admin port:login
   • Dcountry:US product:admin org:target.com
   ✓ Correct answer: A

   site:target.com limits results to that domain, intitle:admin requires admin in the HTML title, and inurl:login looks for login in the URL, together surfacing administrative login pages indexed by Google.

   Why the other options are wrong

   • Bdomain:, title=, and path= are not Google search operators.
   • Chost:, banner:, and port: are Shodan filters, not Google operators.
   • Dcountry:, product:, and org: are Shodan filters and do not apply to a Google query.
10. Question 10Attacks and Exploits

    A tester finds that a web app reflects input into a JavaScript context: document.write(location.hash). No server-side reflection occurs; the payload after the # is processed entirely by client-side script. Which XSS variant and which characteristic apply?

    • ADOM-based XSS, because the payload flows from a client-side source (location.hash) into a dangerous sink without server involvementCorrect
    • BStored XSS, because location.hash persists the payload in the server-side database on load
    • CReflected XSS, because the server includes the fragment in its HTTP response body
    • DMutation XSS, because the browser rewrites the sanitized markup back into an executable form
    ✓ Correct answer: A

    DOM-based XSS occurs entirely in the browser: a source under attacker control such as location.hash is passed to a dangerous sink like document.write, innerHTML, or eval without the server ever seeing or reflecting it. The fragment after # is never sent to the server, so this cannot be reflected or stored XSS; the vulnerability lives in the page's own JavaScript.

    Why the other options are wrong

    • BNothing is persisted server-side; the fragment is processed only in the browser, so it is not stored XSS.
    • CThe URL fragment after # is never sent to the server, so the server cannot reflect it in a response.
    • DMutation XSS involves sanitizer-parser mismatches, not a straightforward client-side source-to-sink data flow.

Related Security resources

• CompTIA PenTest+ (PT0-003) study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• (ISC)² CISSP practice examRelated
• (ISC)² Certified in Cybersecurity (CC) practice examRelated
• CompTIA Security+ SY0-701 practice examRelated

CompTIA PenTest+ (PT0-003) practice exam FAQ