CompTIA PenTest+ (PT0-003) Practice Exam

What the CompTIA PenTest+ (PT0-003) exam covers

• Engagement Management131 questions
• Reconnaissance and Enumeration206 questions
• Vulnerability Discovery and Analysis166 questions
• Attacks and Exploits343 questions
• Post-exploitation and Lateral Movement139 questions

Free PT0-003 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 985.

1. Question 1Reconnaissance and Enumeration

   A tester runs a WHOIS lookup on target.com but the registrant name, email, and phone are shown as 'REDACTED FOR PRIVACY.' What most likely explains this?

   • AThe domain has expired and its records were purged from the registry
   • BPrivacy regulations such as GDPR cause registrars to mask personal contact dataCorrect
   • CThe WHOIS server rate-limited the query and returned only partial output
   • DThe domain uses DNSSEC, which encrypts all registration record fields
   ✓ Correct answer: B

   Since GDPR took effect, ICANN-accredited registrars and privacy-protection services routinely redact personal registrant data (name, email, phone) from public WHOIS output, replacing it with generic or proxy values. Testers can still learn the registrar, creation and expiry dates, and name servers, but personal contact details usually require a data-access request or alternate OSINT. This is a deliberate privacy control, not an error or an expired record.

   Why the other options are wrong

   • AExpired domains still return records during the redemption or grace period; expiry does not blank the registrant fields.
   • CRate limiting typically returns an error or throttling message, not fields literally labeled 'REDACTED FOR PRIVACY.'
   • DDNSSEC signs DNS zone data for integrity; it does not encrypt or hide WHOIS registration fields.
2. Question 2Reconnaissance and Enumeration

   Which enum4linux-ng invocation runs all enumeration checks (users, shares, groups, policy) against a target?

   • Aenum4linux-ng -A targetCorrect
   • Benum4linux-ng --quick target
   • Cenum4linux-ng -d target
   • Denum4linux-ng -p target
   ✓ Correct answer: A

   The -A flag in enum4linux-ng runs all available enumeration modules against the target, comprehensively gathering SMB/NetBIOS information including OS details, domain/workgroup membership, user accounts (via RID cycling and SAMR enumeration), group memberships, shared resources, printer information, password policy settings, and local groups. Running -A provides the broadest initial enumeration coverage against Windows or Samba targets in a single command, making it the standard choice for comprehensive SMB enumeration during penetration testing assessments.

   Why the other options are wrong

   • Benum4linux-ng --quick target is incorrect because --quick is not a documented enum4linux-ng flag; if it were interpreted as a quick/fast mode, it would imply reduced enumeration coverage rather than running all available checks comprehensively.
   • Cenum4linux-ng -d target is incorrect because -d is not an all-checks flag in enum4linux-ng; specific flag letters in enum4linux-ng correspond to individual enumeration categories (such as -U for users, -S for shares), and -d does not map to a comprehensive full enumeration mode.
   • Denum4linux-ng -p target is incorrect because -p in enum4linux-ng is not the flag for running all checks; it may correspond to password policy enumeration specifically, making it a targeted rather than comprehensive enumeration option that would miss most of the enumeration categories covered by -A.
3. Question 3Vulnerability Discovery and Analysis

   A tester maps each confirmed finding to specific adversary techniques so the client can align detection coverage. Which framework is designed for this technique-to-behavior mapping?

   • ACVSS, a numeric scoring system for rating and ranking vulnerability severity
   • BSTRIDE, a categorization scheme for design-phase threat elicitation
   • CMITRE ATT&CK, a knowledge base of adversary tactics and techniquesCorrect
   • DOWASP ASVS, a checklist of application security verification levels
   ✓ Correct answer: C

   MITRE ATT&CK is a curated knowledge base of adversary tactics and techniques based on real-world observations. Mapping findings and planned actions to ATT&CK technique IDs lets a client compare their detection and logging coverage against how attackers actually behave. It is widely used to translate offensive results into defensive gap analysis.

   Why the other options are wrong

   • ACVSS scores severity but does not describe adversary behaviors or techniques.
   • BSTRIDE elicits design threats by category; it is not a catalog of observed techniques.
   • DOWASP ASVS defines verification requirements, not a mapping of adversary techniques.
4. Question 4Engagement Management

   When reporting an identity-related finding, why should the tester recommend least privilege as remediation for an over-permissioned account?

   • AIt limits the blast radius if the account is later compromisedCorrect
   • BIt prevents the account's credentials from ever being stolen in the first place
   • CIt compensates for the account lacking multi-factor authentication
   • DIt automatically detects and alerts on misuse of the account
   ✓ Correct answer: A

   The principle of least privilege dictates that every account should have only the minimum permissions necessary to perform its intended function. When an over-permissioned account is compromised through phishing, credential theft, or session hijacking, the attacker inherits all of that account's permissions, so excessive privileges directly translate to greater potential damage. By implementing least privilege, the organization ensures that even if the account is compromised, the attacker's ability to move laterally, access sensitive data, or escalate privileges is constrained to the account's limited scope. This principle is foundational to defense-in-depth strategies and is recommended by every major security framework including NIST, CIS, and OWASP.

   Why the other options are wrong

   • BLeast privilege reduces impact after compromise; it does not stop credentials from being phished or stolen.
   • CLeast privilege and MFA are complementary controls; trimming permissions does not substitute for enforcing MFA.
   • DRestricting permissions constrains what an attacker can do but performs no detection or alerting on misuse.
5. Question 5Engagement Management

   During a social engineering assessment, the tester successfully phished 60% of employees. How should this be framed in the executive summary?

   • AAs a blunt statistical failure with the exact line '60% of your employees clicked a phishing link', with no surrounding business context or remediation guidance
   • BAs a business risk narrative: the high click rate indicates significant exposure to credential theft and malware delivery, with a recommendation to improve awareness trainingCorrect
   • CBy naming each individual employee who clicked the link so that their managers can pursue targeted disciplinary action against those specific staff members in this incident report
   • DBy omitting the click percentage entirely and treating the individual click results as protected health information that cannot be disclosed to leadership
   ✓ Correct answer: B

   Executive summaries should translate technical results into business impact language. A 60% click rate is meaningful data, but its value to leadership is in understanding what it means - significant exposure to phishing-driven credential theft and malware installation - and what to do about it, typically enhanced security awareness training, simulated phishing programs, and improved email filtering. Framing statistics as business risk drives action rather than confusion.

   Why the other options are wrong

   • AA bare statistic without risk context fails the executive summary's purpose of conveying business impact.
   • CNaming individuals is punitive, breaches assessment ethics, and does not belong in an executive summary.
   • DPhishing click data is not PHI, and omitting the metric hides the key risk finding from leadership.
6. Question 6Vulnerability Discovery and Analysis

   A vulnerability scanner reports a host as missing a Windows hotfix, but the host is fully patched via a cumulative update that supersedes that hotfix. What is the MOST likely cause?

   • AThe scanner checks for the specific KB article and does not account for supersedence by a later cumulative updateCorrect
   • BThe target host's system clock is out of sync with the vulnerability scanner's clock, causing timestamp mismatches
   • CThe scan was run without credentials, so the scanner could not read the patch registry
   • DThe CVSS score for the hotfix was calculated incorrectly by the scanning engine
   ✓ Correct answer: A

   Windows servicing supersedes older standalone hotfixes inside cumulative updates, so the original KB is intentionally absent on a patched host. A plugin that only checks for the specific KB number, rather than the effective patch state, will report it as missing. Tuning the scanner's supersedence logic resolves these false positives.

   Why the other options are wrong

   • BClock skew and timestamp mismatches do not cause a patch-supersedence false positive in software inventory checks.
   • CAn uncredentialed scan issue would affect many checks; here the credentialed check simply misses supersedence.
   • DA CVSS miscalculation affects severity scoring, not whether a superseded KB is flagged as missing.
7. Question 7Attacks and Exploits

   A tester captures traffic and observes a client performing NTLM authentication. They want to relay it to a target over SMB but the target enforces SMB signing. What is the result?

   • AThe relay fails because the relayed session cannot produce valid signatures without the user's session keyCorrect
   • BThe relay still succeeds but the attacker is limited to read-only access on the target's SMB shares
   • CThe captured NTLM hash is automatically cracked to plaintext and reused as the account password
   • DSMB signing forces a protocol downgrade to Kerberos, which enables Kerberoasting of the account instead
   ✓ Correct answer: A

   SMB signing cryptographically signs each message using a key derived from the user's credentials. A relay attacker forwards authentication but never learns the session key, so it cannot sign subsequent packets and the connection is rejected. This is why enforcing SMB signing is the standard defense against SMB relay.

   Why the other options are wrong

   • BWith signing enforced the relay is rejected outright; it does not degrade to read-only access.
   • CNTLM relay forwards the authentication live and never cracks the hash to a password.
   • DSMB signing does not downgrade to Kerberos or enable Kerberoasting; it simply blocks the relay.
8. Question 8Post-exploitation and Lateral MovementSelect all that apply

   A tester is establishing persistence on a Linux host and wants mechanisms that re-execute payloads automatically. Which TWO are valid Linux persistence techniques? (Choose TWO)

   • AAdding a malicious systemd service unit set to start at bootCorrect
   • BInserting a payload into a user's crontabCorrect
   • CCreating a Windows scheduled task with schtasks
   • DSetting the SetGID bit on /bin/ls
   ✓ Correct answer: A, B

   A systemd unit enabled with systemctl enable starts the payload at boot, surviving reboots. A crontab entry runs the payload on a schedule or at reboot (@reboot). Both are common, reliable persistence methods on Linux.

   Why the other options are wrong

   • Cschtasks creates Windows scheduled tasks and does not exist on Linux.
   • DSetting SetGID on /bin/ls does not establish persistence; it only changes the group context of listing files and grants no re-execution.
9. Question 9Vulnerability Discovery and Analysis

   A tester wants Burp Suite's active scanner to test only the in-scope application and avoid sending intrusive payloads to third-party domains the app links to. What is the correct configuration?

   • ADefine the target scope and restrict the scanner to in-scope items onlyCorrect
   • BDisable the proxy listener so no traffic is intercepted at all
   • CSet the active scanner's thread count down to a single thread
   • DTurn off response interception within the intercepting proxy
   ✓ Correct answer: A

   Burp's scope rules let the tester include only the authorized host or path patterns; restricting tools to in-scope items ensures active scanning and intrusive checks never fire against linked external domains, keeping the engagement within authorization.

   Why the other options are wrong

   • BDisabling the proxy listener stops all interception and defeats scanning, rather than limiting scope.
   • CReducing threads only slows scanning; it does not stop payloads reaching third-party domains.
   • DTurning off response interception does not constrain which hosts the active scanner targets.
10. Question 10Engagement Management

    The final report contains plaintext credentials harvested during the test, internal network diagrams, and proof-of-concept exploits. Which control is the most appropriate for distributing this document to the client?

    • AEncrypt the report and transfer it over a secure channel to a defined list of authorized recipientsCorrect
    • BEmail the report as a standard unencrypted attachment to the entire general IT distribution list
    • CUpload the report to a public file-sharing link for easy access
    • DPrint copies and leave them at the front desk for pickup
    ✓ Correct answer: A

    Penetration test reports are highly sensitive: they effectively document how to compromise the environment. Secure handling requires encryption at rest and in transit, transfer over a protected channel, and restriction to a least-privilege list of authorized recipients. Anything less risks the report itself becoming the breach.

    Why the other options are wrong

    • BA broad, unencrypted distribution list exposes the most sensitive document in the organization to unnecessary parties.
    • CA public sharing link could let anyone retrieve a step-by-step guide to breaching the network.
    • DUnattended printed copies provide no access control and can be taken by anyone passing by.

Who this CompTIA PenTest+ (PT0-003) practice exam is for

This practice set is for anyone preparing for the CompTIA PenTest+ (PT0-003) exam - from first-time candidates building a foundation to experienced professionals doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this CompTIA PenTest+ (PT0-003) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real CompTIA PenTest+ (PT0-003) exam.

Related Security resources

• CompTIA PenTest+ (PT0-003) study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Best Security+ Practice Exams (2026)Comparison
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• CompTIA Security+ SY0-701 practice examRelated
• CompTIA SecurityX (CAS-005, formerly CASP+) practice examRelated
• EC-Council CEH (Certified Ethical Hacker) practice examRelated

CompTIA PenTest+ (PT0-003) practice exam FAQ