Free CompTIA PT0-003 Practice Questions & Answers 2026 Part3

Question #1

[Attacks and Exploits]A penetration tester writes the following script to enumerate a 1724 network:1 #!/bin/bash2 for i in {1..254}; do3 ping -c1 192.168.1.$i4 doneThe tester executes the script, but it fails with the following error:-bash: syntax error near unexpected token `ping'Which of the following should the tester do to fix the error?

A. Add do after line 2

B. Replace {1

C. Replace bash with tsh

D. Replace $i with ${i}

View answer

Correct Answer: B

Question #2

A penetration tester runs a vulnerability scan that identifies several issues across numerous customer hosts.The executive report outlines the following:The client is concerned about the availability of its consumer-facing production application. Which of the following hosts should the penetration tester select for additional manual testing?

A. erver 2

B. erver 3

C. erver 1

D. erver 4

View answer

Correct Answer: B

Question #3

A penetration tester is conducting reconnaissance for an upcoming assessment of a large corporate client. The client authorized spear phishing in the rules of engagement. Which of the following should the tester do first when developing the phishing campaign?

A. Shoulder surfing

B. Recon-ng

C. Social media

D. Password dumps

View answer

Correct Answer: C

Question #4

During a wireless network vulnerability assessment, you need to measure the power levels of access points to determine their coverage and signal range. Which scanning method is most appropriate?

A. Service set identifier (SSID) scanning

B. Channel scanning

C. Signal strength scanning

D. Stealth scans

View answer

Correct Answer: C

Question #5

[Tools and Code Analysis]During an assessment, a penetration tester obtains an NTLM hash from a legacy Windows machine.Which of the following tools should the penetration tester use to continue the attack?

A. esponder

B. ydra

C. loodHound

D. rackMapExec

View answer

Correct Answer: D

Question #6

[Attacks and Exploits]During a penetration test, the tester identifies several unused services that are listening on all targeted internal laptops.Which of the following technical controls should the tester recommend to reduce the risk of compromise?

A. Multifactor authentication

B. Patch management

C. System hardening

D. Network segmentation

View answer

Correct Answer: C

Question #7

A penetration tester needs to confirm the version number of a client's web application server. Which of the following techniques should the penetration tester use?

A. SSL certificate inspection

B. URL spidering

C. Banner grabbing

D. Directory brute forcing

E. Reveal Answer

View answer

Correct Answer: C

Question #8

[Reporting and Communication]Given the following statements:Implement a web application firewall.Upgrade end-of-life operating systems.Implement a secure software development life cycle.In which of the following sections of a penetration test report would the above statements be found?

A. Executive summary

B. Attack narrative

C. Detailed findings

D. Recommendations

View answer

Correct Answer: D

Question #9

[Attacks and Exploits]A penetration tester gains initial access to an endpoint and needs to execute a payload to obtain additional access.Which of the following commands should the penetration tester use?

A. powershell

B. certutil

C. powershell

D. rundll32

View answer

Correct Answer: B

Question #10

[Attacks and Exploits]A penetration tester gains access to a host but does not have access to any type of shell.Which of the following is the best way for the tester to further enumerate the host and the environment in which it resides?

A. ProxyChains

B. Netcat

C. PowerShell ISE

D. Process IDs

View answer

Correct Answer: B

Question #11

A penetration tester wants to check the security awareness of specific workers in the company with targeted attacks.

A. Phishing

B. Tailgating

C. Whaling

D. Spear phishing

View answer

Correct Answer: D

Question #12

A penetration tester is working on an engagement in which a main objective is to collect confidential information that could be used to exfiltrate data and perform a ransomware attack. During the engagement, the tester is able to obtain an internal foothold on the target network.Which of the following is the next task the tester should complete to accomplish the objective?

A. Initiate a social engineering campaign

B. Perform credential dumping

C. Compromise an endpoint

D. Share enumeration

View answer

Correct Answer: D

Question #13

During an internal penetration test, the tester uses the following command:

A. Bypassing normal authentication

B. Enumerating shares

C. Obtaining current user credentials

D. Using password spraying

View answer

Correct Answer: A

Question #14

[Attacks and Exploits]A penetration tester downloads a JAR file that is used in an organization's production environment. The tester evaluates the contents of the JAR file to identify potentially vulnerable components that can be targeted for exploit.Which of the following describes the tester's activities?

A. SAST

B. SBOM

C. ICS

D. SCA

View answer

Correct Answer: D

Question #15

[Attacks and Exploits]A penetration tester is working on a security assessment of a mobile application that was developed in-house for local use by a hospital. The hospital and its customers are very concerned about disclosure of information.Which of the following tasks should the penetration tester do first?

A. Set up Drozer in order to manipulate and scan the application

B. Run the application through the mobile application security framework

C. Connect Frida to analyze the application at runtime to look for data leaks

D. Load the application on client-owned devices for testing

View answer

Correct Answer: B

Question #16

[Attacks and Exploits]A penetration tester writes the following script to enumerate a 1724 network:1 #!/bin/bash2 for i in {1..254}; do3 ping -c1 192.168.1.$i4 doneThe tester executes the script, but it fails with the following error:-bash: syntax error near unexpected token `ping'Which of the following should the tester do to fix the error?

A. Add do after line 2

B. Replace {1

C. Replace bash with tsh

D. Replace $i with ${i}

View answer

Correct Answer: B

Question #17

A penetration tester is performing a security review of a web application. Which of the following should the tester leverage to identify the presence of vulnerable open-source libraries?

A. VM

B. IAST

C. DAST

D. SCA

View answer

Correct Answer: D

Question #18

[Attacks and Exploits]A penetration tester gains initial access to an endpoint and needs to execute a payload to obtain additional access.Which of the following commands should the penetration tester use?

A. powershell

B. certutil

C. powershell

D. rundll32

View answer

Correct Answer: B

Question #19

[Attacks and Exploits]A penetration tester writes the following script to enumerate a 1724 network:1 #!/bin/bash2 for i in {1..254}; do3 ping -c1 192.168.1.$i4 doneThe tester executes the script, but it fails with the following error:-bash: syntax error near unexpected token `ping'Which of the following should the tester do to fix the error?

A. Add do after line 2

B. Replace {1

C. Replace bash with tsh

D. Replace $i with ${i}

View answer

Correct Answer: B

Question #20

A penetration tester is working on an engagement in which a main objective is to collect confidential information that could be used to exfiltrate data and perform a ransomware attack. During the engagement, the tester is able to obtain an internal foothold on the target network.Which of the following is the next task the tester should complete to accomplish the objective?

A. Initiate a social engineering campaign

B. Perform credential dumping

C. Compromise an endpoint

D. Share enumeration

View answer

Correct Answer: D

Question #21

[Attacks and Exploits]During a penetration test, the tester identifies several unused services that are listening on all targeted internal laptops.Which of the following technical controls should the tester recommend to reduce the risk of compromise?

A. Multifactor authentication

B. Patch management

C. System hardening

D. Network segmentation

View answer

Correct Answer: C

Question #22

A penetration tester presents the following findings to stakeholders:Control | Number of findings | Risk | NotesEncryption | 1 | Low | Weak algorithm notedPatching | 8 | Medium | Unsupported systemsSystem hardening | 2 | Low | Baseline drift observedSecure SDLC | 10 | High | Libraries have vulnerabilities Password policy | 0 | Low | No exceptions notedBased on the findings, which of the following recommendations should the tester make? (Select two).

A. Develop a secure encryption algorithm

B. Deploy an asset management system

C. Write an SDLC policy

D. Implement an SCA tool

E. Obtain the latest library version

F. Patch the libraries

View answer

Correct Answer: DE

Question #23

A penetration tester needs to test a very large number of URLs for public access. Given the following code snippet:Which of the following changes is required?

A. he condition on line 6

B. he method on line 5

C. he import on line 1

D. he delimiter in line 3

View answer

Correct Answer: A

Question #24

A penetration tester is working on an engagement in which a main objective is to collect confidential information that could be used to exfiltrate data and perform a ransomware attack. During the engagement, the tester is able to obtain an internal foothold on the target network.Which of the following is the next task the tester should complete to accomplish the objective?

A. Initiate a social engineering campaign

B. Perform credential dumping

C. Compromise an endpoint

D. Share enumeration

View answer

Correct Answer: D

Question #25

A penetration tester assesses an application allow list and has limited command - line access on the Windows system. Which of the following would give the penetration tester information that could aid in continuing the test?

A. mmc

B. icacls

C. nltest

D. rundll

View answer

Correct Answer: C

Question #26

[Attacks and Exploits]A penetration tester gains initial access to an endpoint and needs to execute a payload to obtain additional access.Which of the following commands should the penetration tester use?

A. powershell

B. certutil

C. powershell

D. rundll32

View answer

Correct Answer: B

Question #27

During a penetration test, the tester uses a vulnerability scanner to collect information about any possible vulnerabilities that could be used to compromise the network. The tester receives the results and then executes the following command:snmpwalk -v 2c -c public 192.168.1.23Which of the following is the tester trying to do based on the command they used?

A. Bypass defensive systems to collect more information

B. Use an automation tool to perform the attacks

C. Script exploits to gain access to the systems and host

D. Validate the results and remove false positives

View answer

Correct Answer: D

Question #28

[Tools and Code Analysis]A penetration tester wants to use multiple TTPs to assess the reactions (alerted, blocked, and others) by the client's current security tools. The threat-modeling team indicates the TTPs in the list might affect their internal systems and servers.Which of the following actions would the tester most likely take?

A. Use a BAS tool to test multiple TTPs based on the input from the threat-modeling team

B. Perform an internal vulnerability assessment with credentials to review the internal attack surface

C. Use a generic vulnerability scanner to test the TTPs and review the results with the threat- modeling team

D. Perform a full internal penetration test to review all the possible exploits that could affect the systems

View answer

Correct Answer: A

Question #29

[Reporting and Communication]Given the following statements:Implement a web application firewall.Upgrade end-of-life operating systems.Implement a secure software development life cycle.In which of the following sections of a penetration test report would the above statements be found?

A. xecutive summary

B. ttack narrative

C. etailed findings

D. ecommendations

View answer

Correct Answer: D

Question #30

A penetration tester is working on an engagement in which a main objective is to collect confidential information that could be used to exfiltrate data and perform a ransomware attack. During the engagement, the tester is able to obtain an internal foothold on the target network.Which of the following is the next task the tester should complete to accomplish the objective?

A. Initiate a social engineering campaign

B. Perform credential dumping

C. Compromise an endpoint

D. Share enumeration

View answer

Correct Answer: D

Question #31

A penetration tester downloads a JAR file that is used in an organization ' s production environment. The tester evaluates the contents of the JAR file to identify potentially vulnerable components that can be targeted for exploit. Which of the following describes the tester ' s activities?

A. CS

B. CA

C. AST

D. BOM

View answer

Correct Answer: B

Question #32

[Attacks and Exploits]A penetration tester identifies an exposed corporate directory containing first and last names and phone numbers for employees.Which of the following attack techniques would be the most effective to pursue if the penetration tester wants to compromise user accounts?

A. Smishing

B. Impersonation

C. Tailgating

D. Whaling

View answer

Correct Answer: A

Question #33

[Attacks and Exploits]During a web application assessment, a penetration tester identifies an input field that allows JavaScript injection. The tester inserts a line of JavaScript that results in a prompt, presenting a text box when browsing to the page going forward.Which of the following types of attacks is this an example of?

A. SQL injection

B. SSRF

C. XSS

D. Server-side template injection

View answer

Correct Answer: C

Question #34

[Attacks and Exploits]During a web application assessment, a penetration tester identifies an input field that allows JavaScript injection. The tester inserts a line of JavaScript that results in a prompt, presenting a text box when browsing to the page going forward.Which of the following types of attacks is this an example of?

A. SQL injection

B. SSRF

C. XSS

D. Server-side template injection

View answer

Correct Answer: C

Question #35

[Attacks and Exploits]A penetration tester needs to collect information over the network for further steps in an internal assessment.Which of the following would most likely accomplish this goal?

A. ntlmrelayx

B. nc -tulpn 1234 192

C. responder

D. crackmapexec smb 192

View answer

Correct Answer: C

Question #36

[Attacks and Exploits]During a web application assessment, a penetration tester identifies an input field that allows JavaScript injection. The tester inserts a line of JavaScript that results in a prompt, presenting a text box when browsing to the page going forward.Which of the following types of attacks is this an example of?

A. SQL injection

B. SSRF

C. XSS

D. Server-side template injection

View answer

Correct Answer: C

Question #37

A tester completed a report for a new client. Prior to sharing the report with the client, which of the following should the tester request to complete a review?

A. A generative AI assistant

B. The customer's designated contact

C. A cybersecurity industry peer

D. A team member

E. Reveal Answer

View answer

Correct Answer: D

Question #38

Given the following statements:

A. Executive summary

B. Attack narrative

C. Detailed findings

D. Recommendations

View answer

Correct Answer: D

Question #39

[Attacks and Exploits]A penetration tester writes the following script to enumerate a 1724 network:1 #!/bin/bash2 for i in {1..254}; do3 ping -c1 192.168.1.$i4 doneThe tester executes the script, but it fails with the following error:-bash: syntax error near unexpected token `ping'Which of the following should the tester do to fix the error?

A. Add do after line 2

B. Replace {1

C. Replace bash with tsh

D. Replace $i with ${i}

View answer

Correct Answer: B

Question #40

A penetration tester compromises a Windows OS endpoint that is joined to an Active Directory local environment. Which of the following tools should the tester use to manipulate authentication mechanisms to move laterally in the network?

A. mpacket

B. TLMRelayX

C. inPEAS

D. ubeus

View answer

Correct Answer: D

Question #41

[Attacks and Exploits]A penetration tester wants to use the following Bash script to identify active servers on a network:1 network_addr="192.168.1"2 for h in {1..254}; do3 ping -c 1 -W 1 $network_addr.$h > /dev/null4 if [ $? -eq 0 ]; then5 echo "Host $h is up"6 else7 echo "Host $h is down"8 fi9 doneWhich of the following should the tester do to modify the script?

A. hange the condition on line 4

B. dd 2>&1 at the end of line 3

C. se seq on the loop on line 2

D. eplace $h with ${h} on line 3

View answer

Correct Answer: C

Question #42

[Attacks and Exploits]A tester plans to perform an attack technique over a compromised host. The tester prepares a payload using the following command:msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.12.12.1 LPORT=10112 -f csharpThe tester then takes the shellcode from the msfvenom command and creates a file called evil.xml.Which of the following commands would most likely be used by the tester to continue with the attack on the host?

A. regsvr32 /s /n /u C:\evil

B. MSBuild

C. mshta

D. AppInstaller

View answer

Correct Answer: B

Question #43

[Attacks and Exploits]A penetration tester writes the following script to enumerate a 1724 network:1 #!/bin/bash2 for i in {1..254}; do3 ping -c1 192.168.1.$i4 doneThe tester executes the script, but it fails with the following error:-bash: syntax error near unexpected token `ping'Which of the following should the tester do to fix the error?

A. Add do after line 2

B. Replace {1

C. Replace bash with tsh

D. Replace $i with ${i}

View answer

Correct Answer: B

Question #44

During a penetration test, a tester captures information about an SPN account. Which of the following attacks requires this information as a prerequisite to proceed?

A. Golden Ticket

B. Kerberoasting

C. DCShadow

D. LSASS dumping

View answer

Correct Answer: B

Question #45

A penetration tester identifies the URL for an internal administration application while following DevOps team members on their commutes.

A. Shoulder surfing

B. Dumpster diving

C. Spear phishing

D. Tailgating

View answer

Correct Answer: A

Question #46

[Attacks and Exploits]During a penetration test, the tester identifies several unused services that are listening on all targeted internal laptops.Which of the following technical controls should the tester recommend to reduce the risk of compromise?

A. Multifactor authentication

B. Patch management

C. System hardening

D. Network segmentation

View answer

Correct Answer: C

Question #47

[Information Gathering and Vulnerability Scanning]A penetration tester cannot find information on the target company's systems using common OSINT methods. The tester's attempts to do reconnaissance against internet-facing resources have been blocked by the company's WAF. Which of the following is the best way to avoid the WAF and gather information about the target company's systems?

A. HTML scraping

B. Code repository scanning

C. Directory enumeration

D. Port scanning

View answer

Correct Answer: B

Question #48

A penetration tester exports the following CSV data from a scanner. The tester wants to parse the data using Bash and input it into another tool.

A. cat data

B. cat data

C. cat data

D. cat data

View answer

Correct Answer: A

Question #49

A penetration tester reviews a SAST vulnerability scan report. The following vulnerability has been reported as high severity:Source file: components.tsIssue 2 of 12: Command injectionSeverity: HighCall: .innerHTML = responseThe tester inspects the source file and finds the variable response is defined as a constant and is not referred to or used in other sections of the code. Which of the following describes how the tester should classify this reported vulnerability?

A. False negative

B. False positive

C. True positive

D. Low severity

View answer

Correct Answer: B

Question #50

[Attacks and Exploits]During a penetration test, the tester identifies several unused services that are listening on all targeted internal laptops.Which of the following technical controls should the tester recommend to reduce the risk of compromise?

A. Multifactor authentication

B. Patch management

C. System hardening

D. Network segmentation

View answer

Correct Answer: C

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Free CompTIA PT0-003 Practice Questions & Answers 2026 Part3 | CompTIA PenTest+

View The Updated CompTIA Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Free CompTIA PT0-003 Practice Questions & Answers 2026 Part3 | CompTIA PenTest+

View The Updated CompTIA Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now