Free CompTIA PT0-003 Practice Questions & Answers 2026 Part2

Question #1

A penetration tester is working on an engagement in which a main objective is to collect confidential information that could be used to exfiltrate data and perform a ransomware attack. During the engagement, the tester is able to obtain an internal foothold on the target network.Which of the following is the next task the tester should complete to accomplish the objective?

A. Initiate a social engineering campaign

B. Perform credential dumping

C. Compromise an endpoint

D. Share enumeration

View answer

Correct Answer: D

Question #2

During a penetration test, a tester captures information about an SPN account. Which of the following attacks requires this information as a prerequisite to proceed?

A. olden Ticket

B. erberoasting

C. CShadow

D. SASS dumping

View answer

Correct Answer: B

Question #3

[Attacks and Exploits]During a penetration test, the tester identifies several unused services that are listening on all targeted internal laptops.Which of the following technical controls should the tester recommend to reduce the risk of compromise?

A. Multifactor authentication

B. Patch management

C. System hardening

D. Network segmentation

View answer

Correct Answer: C

Question #4

A penetration tester successfully gains access to a Linux system and then uses the following command:find / -type f -ls > /tmp/recon.txtWhich of the following best describes the tester's goal?

A. ecrets enumeration

B. ervice enumeration

C. ser enumeration

D. ermission enumeration

View answer

Correct Answer: D

Question #5

[Attacks and Exploits]A penetration tester gains initial access to an endpoint and needs to execute a payload to obtain additional access.Which of the following commands should the penetration tester use?

A. powershell

B. certutil

C. powershell

D. rundll32

View answer

Correct Answer: B

Question #6

A. map marked the port as open|filtered because no response was received

B. he SNMP daemon delayed its response beyond Nmap's UDP scan timeout

C. he scanned host applied rate limiting to its responses to prevent UDP fingerprinting

D. he Nmap scan lacked root privileges, which reduced packet inspection accuracy

View answer

Correct Answer: A

Question #7

After a recent penetration test was conducted by the company's penetration testing team, a systems administrator notices the following in the logs:2/10/2023 05:50AM C:\users\mgranite\schtasks /query2/10/2023 05:53AM C:\users\mgranite\schtasks /CREATE /SC DAILY Which of the following best explains the team's objective?

A. To enumerate current users

B. To determine the users' permissions

C. To view scheduled processes

D. To create persistence in the network

E. Reveal Answer

View answer

Correct Answer: D

Question #8

A penetration tester conducts a web application assessment and receives the following Set-Cookie upon logging in:Set-Cookie auth=UGVudGVzdFVzZXI6OTE1MzYKUpon analysis, the penetration tester determines this is a Base64-encoded string, which when decoded reads:Pentestuser:91536The penetration tester logs out, logs back in, and sees the decoded string now reads:Pentestuser:91944Which of the following attacks will the penetration tester most likely conduct based on this information?

A. WT manipulation

B. ollision attack

C. ession hijacking

D. nsecure direct object reference

View answer

Correct Answer: C

Question #9

After a recent penetration test was conducted by the company's penetration testing team, a systems administrator notices the following in the logs:2/10/2023 05:50AM C:\users\mgranite\schtasks /query2/10/2023 05:53AM C:\users\mgranite\schtasks /CREATE /SC DAILYWhich of the following best explains the team's objective?

A. To enumerate current users

B. To determine the users' permissions

C. To view scheduled processes

D. To create persistence in the network

View answer

Correct Answer: D

Question #10

[Information Gathering and Vulnerability Scanning]A penetration tester needs to launch an Nmap scan to find the state of the port for both TCP and UDPservices. Which of the following commands should the tester use?

A. map -sU -sW -p 1-65535 example

B. map -sU -sY -p 1-65535 example

C. map -sU -sT -p 1-65535 example

D. map -sU -sN -p 1-65535 example

View answer

Correct Answer: C

Question #11

A penetration tester is working on an engagement in which a main objective is to collect confidential information that could be used to exfiltrate data and perform a ransomware attack. During the engagement, the tester is able to obtain an internal foothold on the target network. Which of the following is the next task the tester should complete to accomplish the objective?

A. ompromise an endpoint

B. hare enumeration

C. erform credential dumping

D. nitiate a social engineering campaign

View answer

Correct Answer: B

Question #12

During a penetration testing engagement, a tester targets the internet-facing services used by the client.Which of the following describes the type of assessment that should be considered in this scope of work?

A. Segmentation

B. Mobile

C. External

D. Web

View answer

Correct Answer: C

Question #13

A penetration tester obtains password dumps associated with the target and identifies strict lockout policies.The tester does not want to lock out accounts when attempting access. Which of the following techniques should the tester use?

A. ictionary attack

B. FA fatigue

C. rute-force attack

D. redential stuffing

View answer

Correct Answer: D

Question #14

You identify a server hosting sensitive financial data. Which factor makes this server a high-priority target?

A. End-of-life software/systems

B. High-value asset identification

C. Exploit Prediction Scoring System (EPSS)

D. Default configurations

View answer

Correct Answer: B

Question #15

A penetration tester is conducting reconnaissance for an upcoming assessment of a large corporate client. The client authorized spear phishing in the rules of engagement. Which of the following should the tester do first when developing the phishing campaign?

A. houlder surfing

B. econ-ng

C. ocial media

D. assword dumps

View answer

Correct Answer: C

Question #16

[Attacks and Exploits]During a web application assessment, a penetration tester identifies an input field that allows JavaScript injection. The tester inserts a line of JavaScript that results in a prompt, presenting a text box when browsing to the page going forward.Which of the following types of attacks is this an example of?

A. SQL injection

B. SSRF

C. XSS

D. Server-side template injection

View answer

Correct Answer: C

Question #17

[Information Gathering and Vulnerability Scanning]During a penetration test, the tester uses a vulnerability scanner to collect information about any possible vulnerabilities that could be used to compromise the network. The tester receives the results and then executes the following command:snmpwalk -v 2c -c public 192.168.1.23Which of the following is the tester trying to do based on the command they used?

A. Bypass defensive systems to collect more information

B. Use an automation tool to perform the attacks

C. Script exploits to gain access to the systems and host

D. Validate the results and remove false positives

View answer

Correct Answer: D

Question #18

[Attacks and Exploits]Which of the following elements in a lock should be aligned to a specific level to allow the key cylinder to turn?

A. Latches

B. Pins

C. Shackle

D. Plug

View answer

Correct Answer: B

Question #19

Which of the following explains the reason a tester would opt to use DREAD over PTES during the planning phase of a penetration test?

A. The tester is conducting a web application test

B. The tester is assessing a mobile application

C. The tester is evaluating a thick client application

D. The tester is creating a threat model

View answer

Correct Answer: D

Question #20

After concluding a penetration test, you securely wipe all sensitive test data and logs to prevent recovery. What activity are you performing?

A. Secure data destruction

B. Remove tools

C. Remove tester-created credentials

D. Revert configuration changes

View answer

Correct Answer: A

Question #21

[Attacks and Exploits]During a penetration test, the tester identifies several unused services that are listening on all targeted internal laptops.Which of the following technical controls should the tester recommend to reduce the risk of compromise?

A. Multifactor authentication

B. Patch management

C. System hardening

D. Network segmentation

View answer

Correct Answer: C

Question #22

A penetration tester wants to use multiple TTPs to assess the reactions (alerted, blocked, and others) by the client’s current security tools. The threat - modeling team indicates the TTPs in the list might affect their internal systems and servers. Which of the following actions would the tester most likely take?

A. Use a BAS tool to test multiple TTPs based on the input from the threat - modeling team

B. Perform an internal vulnerability assessment with credentials to review the internal attack surface

C. Use a generic vulnerability scanner to test the TTPs and review the results with the threat - modeling team

D. Perform a full internal penetration test to review all the possible exploits that could affect the systems

View answer

Correct Answer: A

Question #23

[Attacks and Exploits]A penetration tester gains initial access to an endpoint and needs to execute a payload to obtain additional access.Which of the following commands should the penetration tester use?

A. powershell

B. certutil

C. powershell

D. rundll32

View answer

Correct Answer: B

Question #24

During an assessment, a penetration tester exploits an SQLi vulnerability. Which of the following commands would allow the penetration tester to enumerate password hashes?

A. sqlmap -u www

B. sqlmap -u www

C. sqlmap -u www

D. sqlmap -u www

E. Reveal Answer

View answer

Correct Answer: B

Question #25

A penetration tester finds that an application responds with the contents of the /etc/passwd file when the following payload is sent:Which of the following should the tester recommend in the report to best prevent this type of vulnerability?

A. Drop all excessive file permissions with chmod o-rwx

B. Ensure the requests application access logs are reviewed frequently

C. Disable the use of external entities

D. Implement a WAF to filter all incoming requests

View answer

Correct Answer: C

Question #26

[Attacks and Exploits]A penetration tester gains initial access to an endpoint and needs to execute a payload to obtain additional access.Which of the following commands should the penetration tester use?

A. powershell

B. certutil

C. powershell

D. rundll32

View answer

Correct Answer: B

Question #27

A penetration tester modifies a web application's URL by inserting malformed data into input parameters.The web application returns the error message below:Internal Server ErrorNumberFormatException: For input string ...Source file: /home/www/htmldoc/app001/140612/mainWhich of the following actions will the tester most likely take?

A. amper with the application's log files

B. orce a remote memory overflow

C. xploit SQL injection vulnerabilities

D. erform application dynamic testing

View answer

Correct Answer: D

Question #28

[Tools and Code Analysis]A penetration tester performs an assessment on the target company's Kubernetes cluster using kube- hunter.Which of the following types of vulnerabilities could be detected with the tool?

A. Network configuration errors in Kubernetes services

B. Weaknesses and misconfigurations in the Kubernetes cluster

C. Application deployment issues in Kubernetes

D. Security vulnerabilities specific to Docker containers

View answer

Correct Answer: B

Question #29

[Attacks and Exploits]A penetration tester gains initial access to an endpoint and needs to execute a payload to obtain additional access.Which of the following commands should the penetration tester use?

A. powershell

B. certutil

C. powershell

D. rundll32

View answer

Correct Answer: B

Question #30

A penetration tester discovers evidence of an advanced persistent threat on the network that is being tested. Which of the following should the tester do next?

A. Report the finding

B. Analyze the finding

C. Remove the threat

D. Document the finding and continue testing

E. Reveal Answer

View answer

Correct Answer: A

Question #31

A penetration tester is conducting an assessment of a web application's login page. The tester needs to determine whether there are any hidden form fields of interest. Which of the following is the most effective technique? Hidden form fields in web applications can store user roles, session tokens, and security parameters that attackers may exploit. HTML scraping (Option D): Involves analyzing HTML source code to find hidden fields like: Attackers use tools like Burp Suite, ZAP, or browser developer tools (Ctrl+U or Inspect Element) to locate hidden fields. Incorrect options: Option A (XSS): Exploits JavaScript injection, not for finding hidden fields. Option B (On-path attack): Involves MITM interception, not directly analyzing form fields. Option C (SQL injection): Targets databases, not HTML forms

A. XSS

B. On-path attack

C. SQL injection

D. HTML scraping

View answer

Correct Answer: D

Question #32

During a penetration test, a tester attempts to pivot from one Windows 10 system to another Windows system. The penetration tester thinks a local firewall is blocking connections. Which of the following command-line utilities built into Windows is most likely to disable the firewall?

A. certutil

B. bitsadmin

C. msconfig

D. netsh

View answer

Correct Answer: D

Question #33

Which prioritization metric evaluates the technical characteristics and impact of a vulnerability?

A. Common Vulnerabilities and Exposures (CVE)

B. Exploit Prediction Scoring System (EPSS)

C. Common Weakness Enumeration (CWE)

D. Common Vulnerability Scoring System (CVSS) base score

View answer

Correct Answer: D

Question #34

[Tools and Code Analysis]During an assessment, a penetration tester obtains an NTLM hash from a legacy Windows machine.Which of the following tools should the penetration tester use to continue the attack?

A. Responder

B. Hydra

C. BloodHound

D. CrackMapExec

View answer

Correct Answer: D

Question #35

[Attacks and Exploits]During a web application assessment, a penetration tester identifies an input field that allows JavaScript injection. The tester inserts a line of JavaScript that results in a prompt, presenting a text box when browsing to the page going forward.Which of the following types of attacks is this an example of?

A. SQL injection

B. SSRF

C. XSS

D. Server-side template injection

View answer

Correct Answer: C

Question #36

As part of an engagement, a penetration tester wants to maintain access to a compromised system after rebooting. Which of the following techniques would be best for the tester to use?

A. Establishing a reverse shell

B. Executing a process injection attack

C. Creating a scheduled task

D. Performing a credential-dumping attack

E. Reveal Answer

View answer

Correct Answer: C

Question #37

A penetration tester finds that an application responds with the contents of the /etc/passwd file when the following payload is sent:Which of the following should the tester recommend in the report to best prevent this type of vulnerability?

A. rop all excessive file permissions with chmod o-rwx

B. nsure the requests application access logs are reviewed frequently

C. isable the use of external entities

D. mplement a WAF to filter all incoming requests

View answer

Correct Answer: C

Question #38

A penetration tester discovers a system with weak default configurations. Which of the following best describes why this is a significant target?

A. Such systems are often easier to exploit due to predictable settings

B. These systems are automatically high-value assets

C. They always use outdated software

D. They are typically immune to privilege escalation attacks

View answer

Correct Answer: A

Question #39

[Attacks and Exploits]During a penetration test, the tester identifies several unused services that are listening on all targeted internal laptops.Which of the following technical controls should the tester recommend to reduce the risk of compromise?

A. Multifactor authentication

B. Patch management

C. System hardening

D. Network segmentation

View answer

Correct Answer: C

Question #40

[Attacks and Exploits]A penetration tester writes the following script to enumerate a 1724 network:1 #!/bin/bash2 for i in {1..254}; do3 ping -c1 192.168.1.$i4 doneThe tester executes the script, but it fails with the following error:-bash: syntax error near unexpected token `ping'Which of the following should the tester do to fix the error?

A. Add do after line 2

B. Replace {1

C. Replace bash with tsh

D. Replace $i with ${i}

View answer

Correct Answer: B

Question #41

During an assessment, a penetration tester sends the following request:POST /services/v1/users/create HTTP/1.1Host: target-application.comContent-Type: application/jsonContent-Length: [dynamic]Authorization: Bearer (FUZZ)Which of the following attacks is the penetration tester performing?

A. irectory traversal

B. rivilege escalation

C. PI abuse

D. erver-side request forgery

View answer

Correct Answer: C

Question #42

A penetration tester wants to send a specific network packet with custom flags and sequence numbers to a vulnerable target. Which of the following should the tester use?

A. cprelay

B. luecrack

C. capy

D. cpdump

View answer

Correct Answer: C

Question #43

[Information Gathering and Vulnerability Scanning]A tester performs a vulnerability scan and identifies several outdated libraries used within thecustomer SaaS product offering. Which of the following types of scans did the tester use to identifythe libraries?

A. AST

B. BOM

C. AST

D. AST

View answer

Correct Answer: D

Question #44

A penetration tester is performing a security review of a web application. Which of the following should the tester leverage to identify the presence of vulnerable open-source libraries?

A. M

B. AST

C. AST

D. CA

View answer

Correct Answer: D

Question #45

[Tools and Code Analysis]A penetration tester performs an assessment on the target company's Kubernetes cluster using kube-hunter. Which of the following types of vulnerabilities could be detected with the tool?

A. etwork configuration errors in Kubernetes services

B. eaknesses and misconfigurations in the Kubernetes cluster

C. pplication deployment issues in Kubernetes

D. ecurity vulnerabilities specific to Docker containers

View answer

Correct Answer: B

Question #46

In a cloud environment, a security team discovers that an attacker accessed confidential information that was used to configure virtual machines during their initialization. Through which of the following features could this information have been accessed?

A. IAM

B. Block storage

C. Virtual private cloud

D. Metadata services

E. Reveal Answer

View answer

Correct Answer: D

Question #47

A penetration tester is working on an engagement in which a main objective is to collect confidential information that could be used to exfiltrate data and perform a ransomware attack. During the engagement, the tester is able to obtain an internal foothold on the target network.Which of the following is the next task the tester should complete to accomplish the objective?

A. Initiate a social engineering campaign

B. Perform credential dumping

C. Compromise an endpoint

D. Share enumeration

View answer

Correct Answer: D

Question #48

[Attacks and Exploits]A penetration tester gains initial access to an endpoint and needs to execute a payload to obtain additional access.Which of the following commands should the penetration tester use?

A. powershell

B. certutil

C. powershell

D. rundll32

View answer

Correct Answer: B

Question #49

[Tools and Code Analysis]During a penetration test, a junior tester uses Hunter.io for an assessment and plans to review the information that will be collected.Which of the following describes the information the junior tester will receive from the Hunter.io tool?

A. A collection of email addresses for the target domain that is available on multiple sources on the internet

B. DNS records for the target domain and subdomains that could be used to increase the external attack surface

C. Data breach information about the organization that could be used for additional enumeration

D. Information from the target's main web page that collects usernames, metadata, and possible data exposures

View answer

Correct Answer: A

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Free CompTIA PT0-003 Practice Questions & Answers 2026 Part2 | CompTIA PenTest+

View The Updated CompTIA Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Free CompTIA PT0-003 Practice Questions & Answers 2026 Part2 | CompTIA PenTest+

View The Updated CompTIA Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now