CompTIA PenTest+ (PT0-003) Practice Test
Frequently asked questions
How many CompTIA PenTest+ (PT0-003) practice questions are here?+
A full bank of original CompTIA PenTest+ (PT0-003) practice questions across the official content areas, weighted like the real exam, with explanations. Free, no signup.
What is the CompTIA PenTest+ (PT0-003) exam like?+
A multiple-choice exam, 165 minutes, and you need 750/900% to pass. Practice by topic here, then take the full timed mock exam to gauge readiness.
Are these the real exam questions?+
No. Every question is 100% original, written from public primary sources with explanations. We never copy real exam questions or paid prep material.
Can I study in Chinese or Spanish?+
PrepPass practice is in English, 中文 and Español. The official exam is in English — switch the question language to English any time to rehearse the exact terminology you'll see on test day.
Sample practice questions
A few real questions from this free bank, with full explanations. Use the practice tool above for the whole set.
- 1. Engagement Management
Which document formally defines the boundaries of a penetration test, including which systems, networks, and techniques are authorized?
- a.The final vulnerability report
- b.The rules of engagement / scope agreement
- c.The invoice for services
- d.The tester's personal notes
Answer: b
Explanation: The rules of engagement, together with the defined scope, formally authorize what may be tested and how, protecting both the tester and the client. Testing outside this agreement can be illegal, so scope must be established and signed before work begins.
- 2. Engagement Management
Why is written authorization from a properly empowered party essential before any testing activity begins?
- a.Without authorization, the same actions could constitute illegal unauthorized access
- b.It guarantees no vulnerabilities will be found
- c.It removes the need to define any scope
- d.It automatically encrypts all findings
Answer: a
Explanation: Penetration testing techniques mirror those of real attackers, so without proper written authorization the same actions could be prosecuted as unauthorized access. Authorization from an empowered party is the legal foundation that makes an engagement legitimate.
- 3. Reconnaissance and Enumeration
A tester wants to identify which TCP ports are open on a host and infer the services running behind them. Which tool is most commonly used for this?
- a.Nmap
- b.A word processor
- c.A spreadsheet macro
- d.A DNS registrar's billing portal
Answer: a
Explanation: Nmap is a widely used network scanner for discovering open ports, identifying services, and fingerprinting operating systems. The other options are not scanning tools and cannot enumerate network services.
- 4. Reconnaissance and Enumeration
A tester uses a search engine that indexes internet-connected devices to find exposed services and their banners for a target's IP ranges. Which resource fits this description?
- a.A word-processing template gallery
- b.Shodan
- c.A video streaming service
- d.A spreadsheet pivot table
Answer: b
Explanation: Shodan indexes internet-connected devices and their service banners, letting testers identify exposed systems and versions during reconnaissance. The other options are unrelated productivity or entertainment tools with no device-discovery capability.
- 5. Vulnerability Discovery and Analysis
A vulnerability scanner reports a critical flaw, but manual verification shows the affected feature is not actually present on the host. What is this scanner result called?
- a.A false positive
- b.A true positive
- c.A zero-day
- d.A privilege escalation
Answer: a
Explanation: A false positive is a reported vulnerability that does not actually exist on the target, which is why testers validate scanner output manually before acting. A true positive is a real finding, and the other options describe different concepts entirely.
- 6. Vulnerability Discovery and Analysis
Which of the following is a well-known open-source vulnerability scanner?
- a.Microsoft Word
- b.VLC Media Player
- c.OpenVAS
- d.A PDF reader
Answer: c
Explanation: OpenVAS is a widely used open-source vulnerability scanner that checks hosts against a database of known issues. The other options are general productivity or media applications with no vulnerability-scanning function.
- 7. Attacks and Exploits
A web application reflects unsanitized user input back into a page so that attacker-supplied script runs in other users' browsers. Which vulnerability is this?
- a.SQL injection
- b.Cross-site scripting (XSS)
- c.ARP spoofing
- d.Password spraying
Answer: b
Explanation: Cross-site scripting (XSS) occurs when an application includes unsanitized input in a page, causing attacker-controlled script to execute in victims' browsers. Proper output encoding and input validation mitigate it. SQL injection targets the database rather than the browser.
- 8. Attacks and Exploits
During a test, a captured password is stored only as a hash. Which approach would a tester conceptually use to recover the plaintext for weak passwords?
- a.Sending the hash back to the login form unchanged
- b.Emailing the hash to the user for confirmation
- c.Running an offline cracking tool that hashes guesses and compares them
- d.Rebooting the domain controller repeatedly
Answer: c
Explanation: Password cracking works offline by hashing candidate guesses and comparing them to the captured hash, so weak or common passwords are recovered quickly, which is why strong, unique passwords and slow hashing algorithms matter. The other options do not recover the plaintext.
- 9. Attacks and Exploits
Which tool is a widely used exploitation framework that helps testers develop and execute modules against known vulnerabilities in an authorized engagement?
- a.Nessus
- b.Metasploit
- c.Wireshark alone
- d.A spreadsheet application
Answer: b
Explanation: Metasploit is a popular framework for developing and running exploit modules against known vulnerabilities during authorized testing. Nessus is a vulnerability scanner, Wireshark is a packet analyzer, and a spreadsheet has no exploitation capability.
- 10. Post-exploitation and Lateral Movement
After compromising one internal host, a tester uses it as a foothold to reach and attack other systems on the internal network. What is this technique called?
- a.Scoping
- b.Passive reconnaissance
- c.Vulnerability scanning of the internet
- d.Lateral movement (pivoting)
Answer: d
Explanation: Lateral movement, or pivoting, uses a compromised host as a foothold to reach other systems that were not directly accessible, expanding access across the network. It is a post-exploitation activity, distinct from scoping or initial reconnaissance.