Free CompTIA PenTest+ PT0-003 Certification Exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the CompTIA PenTest+ PT0-003 Certification Exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A client approves testing its corporate subnet but excludes the payroll database. What should the assessment plan record to make that exclusion operationally clear?

   1. A. The database vendor and its published release cycle
   2. B. The system name and IP address on the exclusion list
   3. C. The database owner's department in the contact list
   4. D. The payroll application's risk score in the findings

   Answer: B

   Explanation: NIST states, "the system name and IP address should be included in the assessment plan’s exclusion list." Identifying the excluded target makes the boundary enforceable; vendor details, contacts, and finding scores do not define which system must be excluded.

   Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment — Section 6.5, p. 6-10

2. 2An internal assessment must identify communicating hosts without transmitting discovery probes. Which technique satisfies that constraint?

   1. A. Perform a TCP SYN sweep of the approved address range
   2. B. Analyze a packet capture from an approved monitoring point
   3. C. Run an ICMP echo sweep of the approved address range
   4. D. Apply active operating-system fingerprinting to the approved hosts

   Answer: B

   Explanation: The source states, "without sending out a single probing packet.". Monitoring existing communications is passive discovery. SYN and ICMP sweeps and active fingerprinting generate discovery traffic rather than observing existing traffic.

   Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment — Section 4.1, p. 4-1

3. 3An assessment must inspect installed host software using authorized administrative access rather than relying only on exposed network services. Which scanning approach provides that access?

   1. A. Unauthenticated perimeter scanning from the internet
   2. B. Passive collection of traffic from the external gateway
   3. C. Port-number identification without logging in to the host
   4. D. Credentialed scanning using the approved administrative account

   Answer: D

   Explanation: NIST explains that some scanners "have administrator-level credentials on individual hosts and can extract vulnerability information from hosts using those credentials." Credentialed scanning provides the required host access. Network-only observation and port identification do not provide the requested authenticated inspection.

   Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment — Section 4.3, p. 4-5

4. 4Two equally critical in-scope assets have vulnerabilities with comparable impact and test effort. The engagement prioritizes evidence of likely near-term exploitation in the wild. Which measure most directly supports that priority?

   1. A. The CVSS base severity score assigned to each vulnerability
   2. B. The EPSS exploitation probability estimated for each vulnerability
   3. C. The CWE weakness category associated with each vulnerability
   4. D. The CVE identifier assigned to distinguish each vulnerability

   Answer: B

   Explanation: The source states, "estimates the probability that a published CVE will be exploited in the wild in the next 30 days.". EPSS estimates near-term exploitation probability. CVSS base severity, CWE weakness classification, and CVE identity describe different properties and do not directly supply this probability.

   Reference: FIRST Exploit Prediction Scoring System — EPSS overview

5. 5A tester has approval and permission to configure recurring execution under a Linux test account. Which mechanism schedules the validation program to run repeatedly at specified times?

   1. A. Schedule an at job for the next approved test time
   2. B. Launch the validation program with nohup from the shell
   3. C. Install a recurring cron entry in the test account's crontab
   4. D. Launch the validation program as a background shell job

   Answer: C

   Explanation: The source states, "The crontab file contains the schedule of cron entries to be run and the specified times for execution.". A recurring cron entry schedules repeated launches at specified times. An at job schedules a particular launch, while nohup and shell backgrounding change process handling rather than creating a recurring time schedule.

   Reference: MITRE ATT&CK: Cron — Description

6. 6Some in-scope servers are housed on a network owned by a separate hosting company. According to NIST SP 800-115, what additional pre-engagement action is usually needed?

   1. A. Obtain written consent from the other network's owner
   2. B. Accept the client's server inventory as host consent
   3. C. Treat the hosting contract as blanket test permission
   4. D. Replace written consent with source-IP attribution

   Answer: A

   Explanation: NIST states, "the owner of the other network usually must also consent in writing to the assessment plan." Client ownership of servers does not itself establish permission to test another party’s network. Inventory, hosting arrangements, and attribution do not substitute for that consent.

   Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment — Section 6.5, p. 6-10

7. 7A tester has an IP address and wants to retrieve its associated name through reverse DNS. Which dig command performs that lookup?

   1. A. dig 192.0.2.25 A
   2. B. dig 192.0.2.25 MX
   3. C. dig 192.0.2.25 NS
   4. D. dig -x 192.0.2.25

   Answer: D

   Explanation: The BIND manual says -x "sets simplified reverse lookups, for mapping addresses to names." The -x command performs the requested reverse lookup. A, MX, and NS queries against the numeric text do not request the corresponding reverse-address name.

   Reference: BIND 9 Manual Pages: dig — dig, Options, -x addr

8. 8A tester must trace unsafe data flows in an application's own source code without executing the application. Which testing category matches that task?

   1. A. Dynamic application security testing
   2. B. Static application security testing
   3. C. Interactive application security testing
   4. D. Software composition analysis

   Answer: B

   Explanation: The source states, "can help analyze source code or compiled versions of code to help find security flaws.". SAST analyzes the application's code without requiring its execution. DAST exercises running interfaces, IAST observes execution with instrumentation, and composition analysis focuses on included components rather than tracing the application's own source flows.

   Reference: OWASP Source Code Analysis Tools — Opening description

9. 9A candidate exploit's CVSS v3.1 vector includes PR:H. What prerequisite should the tester account for when deciding whether the exploit is usable from the current foothold?

   1. A. A separate user must approve the attack by clicking a link
   2. B. The target must be reachable only through a local physical console
   3. C. The attacker must already have significant privileges on the component
   4. D. The exploit must change the security scope of another component

   Answer: C

   Explanation: For PR:H, FIRST states, "The attacker requires privileges that provide significant (e.g., administrative) control over the vulnerable component". PR describes privileges required before exploitation; it does not describe user interaction, physical reachability, or scope change.

   Reference: FIRST CVSS v3.1 Specification Document — Section 2.1.3, Table 3, High (H)

10. 10An approved persistence test adds a program reference to a Windows user's Registry Run key. When and in what security context should that program execute?

    1. A. At the user's logon, with that user's associated permissions
    2. B. At the user's logon, with the Local System account's permissions
    3. C. At system boot before logon, with that user's associated permissions
    4. D. At system boot before logon, with the Local System account's permissions

    Answer: A

    Explanation: MITRE says execution occurs "when a user logs in" and programs run "under the context of the user". A user Run key therefore supplies a logon trigger in that user’s security context, not a pre-logon boot trigger or automatic Local System execution.

    Reference: MITRE ATT&CK: Registry Run Keys / Startup Folder — Description