Skip to content

PenTest+ (PT0-003) Practice Questions (Unofficial)

A bank of unofficial multiple-choice practice questions for the CompTIA PenTest+ (PT0-003) exam, grouped by the five domains. They are study aids for the concepts in this pentest-plus/ hub — not a simulation of the real exam.

Unofficial practice questions — NOT real CompTIA exam questions. These are pedagogical study aids written for this hub to rehearse documented PenTest+ concepts. They are not drawn from, affiliated with, or endorsed by CompTIA, and they do not reproduce any actual exam item. The real exam is max 90 questions (MCQ + PBQ) in 165 minutes; confirm the current scoring model on CompTIA: https://www.comptia.org/en-us/certifications/pentest/

Authorized-use note. Every technique referenced here is for understanding and defense. Penetration testing is legal only with written authorization, defined scope, and Rules of Engagement (RoE). These questions stay at the level of methodology, concepts, and tool purpose — no weaponized specifics.

How to use these

  1. Answer before peeking. Cover the answer line, commit to a choice, then check.
  2. Read every explanation, even when you were right — each links to the hub page that covers the topic in depth.
  3. Track misses by domain and re-read that domain page before retrying.
  4. Spread your study, do not cram — and rehearse the hands-on, output-reading skills the PBQ tips describe.

Correct-answer letters are deliberately mixed so the pattern itself teaches nothing.

Domain 1 — Engagement Management (~13%)

Q1. Before any testing activity begins, the single most important document that makes the engagement legal is the: - A. Network diagram - B. Written authorization (with scope and Rules of Engagement) - C. Vulnerability scan report - D. Final findings report

Answer: B. Penetration testing is lawful only with explicit written authorization, a defined scope, and agreed RoE. Without it, the activity is unauthorized access. See study-plan.md.

Q2. The Rules of Engagement (RoE) primarily define: - A. The price of the engagement - B. Which marketing materials the client may publish - C. What is in scope, what is off-limits, timing, and escalation/communication paths - D. The tester's salary

Answer: C. RoE bound the engagement — in-scope targets, prohibited actions, testing windows, and how to communicate and escalate. See study-plan.md.

Q3. Which item belongs in a penetration-test report to make a finding actionable? - A. A risk rating and concrete remediation guidance - B. Only the raw tool output - C. The tester's personal opinion of the client - D. A list of unrelated industry news

Answer: A. A useful finding pairs evidence with a risk rating and clear remediation so the client can fix it. Raw output alone is not actionable.

Q4. A tester discovers a host that is clearly part of the client's environment but is not listed in the agreed scope. The correct action is to: - A. Test it anyway since it belongs to the client - B. Ignore the engagement boundaries - C. Exploit it quietly and mention it later - D. Stop, document it, and seek authorization before touching it

Answer: D. Out-of-scope systems are off-limits until authorization is explicitly extended. Staying in scope is part of professional and legal conduct. See Domain 5 on scope discipline.

Q5. Communicating a critical, actively exploitable finding to the client should happen: - A. Only in the final report weeks later - B. Promptly, through the agreed escalation path, without waiting for the report - C. On social media - D. Never — it would alarm the client

Answer: B. Critical findings warrant immediate escalation via the channel defined in the RoE, separate from the eventual report.

Domain 2 — Reconnaissance & Enumeration (~21%)

Q6. The key difference between passive and active reconnaissance is that passive recon: - A. Is always illegal - B. Uses more bandwidth - C. Does not directly interact with the target's systems - D. Requires physical access

Answer: C. Passive recon gathers information without touching the target (e.g., public records, OSINT); active recon interacts with the target (e.g., scanning) and is more detectable. See study-plan.md.

Q7. Open-Source Intelligence (OSINT) is best described as: - A. Collecting information from publicly available sources - B. Exploiting open-source software bugs - C. A type of malware - D. A wireless attack

Answer: A. OSINT is intelligence assembled from public sources — websites, social media, public records, DNS — to profile a target before any active testing.

Q8. A tester runs a port scan and finds TCP 445 open on several hosts. This most directly indicates: - A. A web server - B. An SSH service - C. A DNS server - D. Server Message Block (SMB) / Windows file sharing is reachable

Answer: D. TCP 445 is SMB. Recognizing what an open port implies for the next enumeration step is core to this domain. See CEH Scanning Networks.

Q9. Enumeration differs from scanning in that enumeration: - A. Only pings hosts - B. Actively extracts detailed resources such as users, shares, and services from a discovered host - C. Is purely passive - D. Cannot be detected

Answer: B. Scanning finds live hosts and open ports; enumeration goes deeper to extract named resources (users, groups, shares, services). See CEH Enumeration.

Q10. Which tool's purpose is network host/port discovery and service identification? - A. Burp Suite - B. Hashcat - C. Nmap - D. sqlmap

Answer: C. Nmap is the standard host-discovery, port-scanning, and service/version identification tool. Burp is a web proxy, Hashcat audits hashes, sqlmap demonstrates SQL injection.

Q11. Why is active reconnaissance more likely to alert a defender than passive recon? - A. It sends traffic the target's systems and monitoring can observe - B. It is performed at night - C. It uses encryption - D. It never touches the network

Answer: A. Active recon generates packets to the target that intrusion detection, firewalls, and logs can record. This trade-off — depth vs detectability — is a recurring theme.

Q12. During AD enumeration, a standard user account can often read group memberships and share permissions because: - A. Active Directory has no security - B. The tester is a domain admin - C. The network is offline - D. Much directory information is readable by any authenticated user by default

Answer: D. AD exposes a lot of object information to authenticated users by default, which is why least privilege and monitoring of broad directory queries matter. See Domain 5.

Domain 3 — Vulnerability Discovery & Analysis (~17%)

Q13. A vulnerability scanner reports a critical flaw, but manual checking shows the affected feature is disabled and unreachable. This is a: - A. False negative - B. False positive - C. Zero-day - D. Confirmed exploit

Answer: B. A false positive is a reported issue that is not actually exploitable. Validating scanner output is central to this domain. See study-plan.md.

Q14. The more dangerous error for a defender is a false negative because: - A. It wastes the tester's time - B. It always crashes the scanner - C. A real, exploitable weakness was missed and left unaddressed - D. It only affects reporting

Answer: C. A false negative means a genuine vulnerability went undetected and unremediated — an unseen hole. False positives waste effort; false negatives leave real risk.

Q15. When prioritizing findings, a tester should rank highest a vulnerability that is: - A. Easily exploitable, on an exposed, business-critical system - B. Theoretical, with no known exploit, on an isolated host - C. Low severity on a decommissioned server - D. Already patched

Answer: A. Prioritization weighs exploitability and impact in context, not raw severity alone — an exposed, critical, easily exploited issue tops the list.

Q16. A CVSS base score alone is an incomplete basis for prioritization because it does not fully capture: - A. The vulnerability's name - B. The color of the dashboard - C. The scanner vendor - D. The environmental context — exposure, asset value, and compensating controls

Answer: D. CVSS base scores describe inherent severity; real prioritization adds environmental context (is it reachable, how valuable is the asset, what controls exist). See study-plan.md.

Q17. Authenticated (credentialed) scanning typically produces results that are: - A. Less accurate than unauthenticated scans - B. More accurate, because the scanner can see installed patches and configuration - C. Identical to unauthenticated scans - D. Only useful for web apps

Answer: B. Credentialed scans log in to inspect actual patch levels and configuration, yielding fewer false positives than purely external probing.

Q18. Why must a tester validate automated scanner findings before reporting them? - A. Scanners are always wrong - B. To slow down the engagement - C. To filter out false positives and confirm real, exploitable issues - D. Validation is never required

Answer: C. Manual validation separates real, exploitable findings from noise so the report is credible and actionable. See CEH Vulnerability Analysis.

Domain 4 — Attacks and Exploits (~35%)

Q19. Password spraying is designed to evade account lockout by: - A. Trying one or a few common passwords against many accounts - B. Trying thousands of passwords against one account - C. Stealing password hashes - D. Cracking hashes offline

Answer: A. Spraying keeps per-account attempts low (one common password across many users) to stay under lockout thresholds — distinct from brute force against a single account. See Domain 4.

Q20. The most effective single control against stolen or cracked passwords is: - A. Longer password expiry - B. A faster CPU - C. Disabling logging - D. Multi-Factor Authentication (MFA)

Answer: D. MFA means a password alone is insufficient to authenticate — the highest-value control against credential attacks. See Domain 4.

Q21. SQL injection succeeds because: - A. The database has no password - B. Untrusted input is interpreted as part of a database query - C. The network is unencrypted - D. The user is an administrator

Answer: B. Injection occurs when input is treated as code/query rather than data; the durable fix is parameterized queries. See CEH SQL Injection.

Q22. The definitive fix for SQL injection is: - A. A faster database - B. Hiding error messages only - C. Parameterized queries / prepared statements - D. Renaming tables

Answer: C. Parameterized queries separate code from data so input can never become part of the command. A WAF helps but does not remove the flaw. See Domain 4.

Q23. In the OWASP Top 10 (2021), the number-one risk category is: - A. Broken Access Control - B. Cryptographic Failures - C. Server-Side Request Forgery - D. Injection

Answer: A. Broken Access Control is A01 in the 2021 list; the durable defense is enforcing authorization server-side on every request. See CEH Hacking Web Applications.

Q24. Cross-Site Scripting (XSS) is primarily mitigated by: - A. Parameterized queries - B. Disabling cookies entirely - C. Faster TLS - D. Output encoding plus a Content Security Policy

Answer: D. XSS runs attacker script in another user's browser; context-aware output encoding plus CSP (and HttpOnly cookies) is the fix. Parameterized queries fix injection, not XSS rendering.

Q25. An evil-twin wireless attack works because clients: - A. Verify the access point's certificate - B. Trust an SSID name rather than the AP's identity - C. Always use WPA3 - D. Cannot connect to Wi-Fi

Answer: B. Clients associate by SSID, so a rogue AP broadcasting a known SSID can lure them; mutual authentication (802.1X) and wireless IPS defend against it. See CEH Hacking Wireless Networks.

Q26. The majority of cloud security incidents stem from: - A. Flaws in the cloud provider's hypervisor - B. Physical theft of servers - C. Customer misconfiguration and identity/access issues - D. Wireless attacks

Answer: C. Under the shared-responsibility model, most incidents are customer-side misconfiguration (public storage, over-permissive IAM, leaked keys). See CEH Cloud Computing.

Q27. MFA fatigue / prompt-bombing succeeds by: - A. Sending repeated push prompts until a tired user approves one - B. Cracking the MFA secret - C. Disabling MFA on the server - D. Stealing the user's phone

Answer: A. Repeated push prompts pressure a user into approving; number-matching MFA and push-rate limits counter it. See Domain 4.

Q28. When testing OT/ICS environments, a key difference from IT testing is that: - A. Confidentiality is the only concern - B. Active scanning is always safe - C. Patching is trivial - D. Availability and safety often outweigh confidentiality, so passive methods are preferred

Answer: D. OT/ICS prioritizes availability and safety; an intrusive scan can disrupt a safety-critical process, so passive monitoring and segmentation are preferred. See CEH IoT and OT Hacking.

Q29. A defender best detects LLMNR/NBT-NS poisoning by: - A. Watching for sudden authentication to an unexpected host - B. Counting open ports - C. Reading web logs only - D. Checking CPU temperature

Answer: A. Name-resolution poisoning redirects authentication to an attacker-controlled host; the tell is anomalous auth to an unexpected system. The fix is disabling legacy name resolution. See Domain 4.

Q30. The primary purpose of the Metasploit Framework is: - A. A web application firewall - B. A password manager - C. An exploitation/payload framework used in authorized testing - D. A wireless access point

Answer: C. Metasploit is a general exploitation platform. Naming it by purpose (not procedure) is the level PenTest+ expects.

Q31. Burp Suite and OWASP ZAP share the core purpose of: - A. Cracking password hashes - B. Intercepting and analyzing web application requests/responses - C. Scanning wireless networks - D. Managing privileged accounts

Answer: B. Both are intercepting proxies/scanners for web-app testing. Recognizing tool-to-purpose mapping is heavily tested in PBQs. See study-plan.md.

Q32. A Web Application Firewall (WAF) should be understood as: - A. A replacement for secure coding - B. A scanner - C. A password vault - D. A defense-in-depth layer that filters common attacks but does not remove the underlying flaw

Answer: D. A WAF buys time and provides virtual patching, but the durable fix lives in the code. See CEH Hacking Web Applications.

Q33. Server-Side Request Forgery (SSRF) is dangerous in cloud environments because it can be used to: - A. Reach internal services or the instance metadata endpoint - B. Crack Wi-Fi passwords - C. Format the disk - D. Disable MFA

Answer: A. SSRF coerces the app into requesting attacker-chosen URLs, including internal metadata services that may return credentials; allow-listing outbound and blocking metadata access defend against it. See Domain 4.

Q34. Tailgating (piggybacking) is countered primarily by: - A. A web application firewall - B. Stronger TLS ciphers - C. Mantraps, escorts, and badge-in/out with anti-pass-back - D. Password complexity rules

Answer: C. Tailgating is a physical attack on facility access; physical controls and anti-pass-back counter it. See Domain 4.

Q35. The defensive purpose of Hydra, Hashcat, and John the Ripper that a defender should internalize is: - A. They prove weak/unsalted credentials will not survive a breach, so enforce MFA and strong salted hashing - B. They are malware to be removed - C. They only work on Linux - D. They are wireless tools

Answer: A. These auditing tools demonstrate how fast weak credentials fall; the defense is long, unique, salted/slow-hashed secrets plus MFA. See CEH System Hacking.

Q36. Credential stuffing is effective primarily because of: - A. Weak TLS - B. Open ports - C. Misconfigured DNS - D. Password reuse across multiple sites

Answer: D. Stuffing replays breached username/password pairs, which works wherever users reuse passwords; MFA and unique passwords defeat it. See Domain 4.

Domain 5 — Post-exploitation & Lateral Movement (~14%)

Q37. Pivoting in post-exploitation refers to: - A. Rotating passwords - B. Routing traffic through a compromised host to reach otherwise-unreachable network segments - C. Switching to a new exploit - D. Changing the report format

Answer: B. A pivot uses a foothold host as a relay into segments the tester cannot reach directly; network segmentation raises the cost of pivoting. See Domain 5.

Q38. Pass-the-Hash (PtH) abuses the fact that: - A. Passwords are stored in plaintext - B. A captured password hash can be used to authenticate without the plaintext password - C. The network is unencrypted - D. The user has MFA

Answer: B. PtH reuses the hash itself as the authenticator. Tiered admin, PAM, and credential protection defend against it. See Kerberos and Domain 5.

Q39. Kerberoasting is best mitigated by: - A. Strong, long service-account passwords and managed/group-managed service accounts - B. Disabling Kerberos entirely - C. Opening more ports - D. Removing MFA

Answer: A. Kerberoasting cracks weak service-account passwords offline from requested service tickets; strong/managed service-account credentials remove the payoff. See Kerberos.

Q40. The control that most directly limits lateral movement across a flat network is: - A. A faster CPU - B. A louder alarm - C. Network segmentation combined with PAM-brokered, monitored privileged access - D. More disk space

Answer: C. Segmentation plus a PAM bastion forces movement through controlled, recorded boundaries and removes standing reusable credentials. This is the PAM core of the domain. See Domain 5 and the attack-to-defense matrix.

Q41. Why does Privileged Access Management (PAM) with credential vaulting and rotation specifically blunt Pass-the-Hash and Pass-the-Ticket? - A. It encrypts the network - B. It removes standing, reusable privileged secrets from endpoints and funnels access through a monitored choke point - C. It deletes all logs - D. It disables Active Directory

Answer: B. PtH/PtT depend on reusable credential material; vaulting/rotation eliminates standing secrets and the bastion records every privileged session. See PAM threat landscape and Session Management.

Q42. From a defender's standpoint, cleared or missing logs on a host should be treated as: - A. Normal housekeeping - B. A positive indicator of compromise, not an absence of evidence - C. Irrelevant - D. A sign the system is healthy

Answer: B. "Logs an attacker can edit are logs you cannot trust" — a log gap is itself an alert. Off-host, tamper-evident logging preserves the record. See Domain 5.

Q43. The best defense against the persistence phase (new services, scheduled tasks, autoruns) is: - A. Application allow-listing plus file-integrity monitoring against a known baseline - B. Faster networking - C. Longer passwords only - D. Disabling MFA

Answer: A. Allow-listing and integrity monitoring against a baseline catch unauthorized persistence mechanisms. See Domain 5.

Q44. Vertical privilege escalation means: - A. Reaching another account at the same privilege level - B. Gaining higher privileges than the current account holds (e.g., user to admin/root) - C. Moving to another host - D. Exfiltrating data

Answer: B. Vertical escalation goes up (user → admin/root); horizontal escalation reaches another same-level account. See CEH System Hacking.

Q45. During an authorized engagement, after creating a test persistence mechanism, the professional tester must: - A. Leave it in place permanently - B. Hide it from the client - C. Document it and remove it, restoring the environment as found - D. Sell access to it

Answer: C. A professional tester stays in scope, avoids unnecessary disruption, and cleans up artifacts created during testing. See Domain 5.

Q46. Data exfiltration is best detected by a defender through: - A. Counting open ports - B. Checking the screen saver - C. Reading the BIOS - D. Monitoring for large or anomalous outbound transfers and connections to unfamiliar destinations

Answer: D. Egress filtering plus DLP and monitoring for unusual outbound volume/destinations catch exfiltration and the staging that precedes it. See Domain 5.

Q47. Tiered administration (separating workstation, server, and domain-controller admin tiers) limits lateral movement because: - A. A workstation compromise cannot reach domain-admin credentials - B. It encrypts disks - C. It removes the need for passwords - D. It speeds up logons

Answer: A. Tiering prevents high-value credentials from being exposed on lower-tier systems, so a foothold on a workstation does not yield domain admin. See Domain 5.

Where to go next

Sources

  • CompTIA — PenTest+ (PT0-003) official certification page (exam format; verify scoring model and weightings): https://www.comptia.org/en-us/certifications/pentest/
  • CompTIA — PenTest+ (PT0-003) exam objectives (the authoritative concept checklist these questions rehearse): https://www.comptia.org/en-us/certifications/pentest/
  • OWASP — OWASP Top 10:2021: https://owasp.org/Top10/
  • NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment: https://csrc.nist.gov/pubs/sp/800/115/final
  • These are original, unofficial study questions written for this hub; they reproduce no real CompTIA exam content.