CompTIA PenTest+ (PT0-003) — All Questions

Which document formally defines the boundaries of a penetration test, including which systems, networks, and techniques are authorized?

• a.The final vulnerability report
• b.The rules of engagement / scope agreement✓
• c.The invoice for services
• d.The tester's personal notes

The rules of engagement, together with the defined scope, formally authorize what may be tested and how, protecting both the tester and the client. Testing outside this agreement can be illegal, so scope must be established and signed before work begins.

During an engagement, a tester discovers evidence of an active, ongoing compromise by an unknown third party. According to good engagement practice, what should the tester do?

• a.Continue silently and mention it only in the final report weeks later
• b.Attempt to remove the intruder without telling anyone
• c.Ignore it because it is outside the test scope
• d.Immediately notify the client contact per the agreed communication plan✓

Discovering a live breach is a defined communication trigger, so the tester must promptly notify the designated client contact rather than delaying or acting unilaterally. The rules of engagement typically specify these escalation paths in advance for exactly this situation.

Why is written authorization from a properly empowered party essential before any testing activity begins?

• a.Without authorization, the same actions could constitute illegal unauthorized access✓
• b.It guarantees no vulnerabilities will be found
• c.It removes the need to define any scope
• d.It automatically encrypts all findings

Penetration testing techniques mirror those of real attackers, so without proper written authorization the same actions could be prosecuted as unauthorized access. Authorization from an empowered party is the legal foundation that makes an engagement legitimate.

A tester gathers information about a target organization from public sources such as social media, job postings, and DNS records without sending any packets to the target's systems. Which activity is this?

• a.Active scanning
• b.Exploitation
• c.Passive reconnaissance (OSINT)✓
• d.Privilege escalation

Passive reconnaissance, including open-source intelligence (OSINT), collects information from publicly available sources without directly interacting with the target's systems, making it stealthy. Active scanning sends traffic to the target and is therefore detectable, unlike passive collection.

A tester wants to identify which TCP ports are open on a host and infer the services running behind them. Which tool is most commonly used for this?

• a.Nmap✓
• b.A word processor
• c.A spreadsheet macro
• d.A DNS registrar's billing portal

Nmap is a widely used network scanner for discovering open ports, identifying services, and fingerprinting operating systems. The other options are not scanning tools and cannot enumerate network services.

Which technique attempts to discover valid subdomains and host records for a target domain during reconnaissance?

• a.Password spraying
• b.SQL injection
• c.Buffer overflow
• d.DNS enumeration✓

DNS enumeration queries name-server records to discover subdomains, mail servers, and other hosts, expanding the tester's map of the target's attack surface. The other options are attack techniques against credentials or applications, not reconnaissance of DNS.

A tester uses a search engine that indexes internet-connected devices to find exposed services and their banners for a target's IP ranges. Which resource fits this description?

• a.A word-processing template gallery
• b.Shodan✓
• c.A video streaming service
• d.A spreadsheet pivot table

Shodan indexes internet-connected devices and their service banners, letting testers identify exposed systems and versions during reconnaissance. The other options are unrelated productivity or entertainment tools with no device-discovery capability.

What is the primary purpose of service and operating-system fingerprinting during enumeration?

• a.To permanently delete the target's logs
• b.To encrypt the tester's own hard drive
• c.To identify software versions so known vulnerabilities can be researched✓
• d.To generate an invoice for the client

Fingerprinting identifies the specific services, versions, and operating systems on a target so the tester can research vulnerabilities that apply to those exact versions. It does not delete logs, encrypt disks, or handle billing.

A vulnerability scanner reports a critical flaw, but manual verification shows the affected feature is not actually present on the host. What is this scanner result called?

• a.A false positive✓
• b.A true positive
• c.A zero-day
• d.A privilege escalation

A false positive is a reported vulnerability that does not actually exist on the target, which is why testers validate scanner output manually before acting. A true positive is a real finding, and the other options describe different concepts entirely.

Which framework provides a standardized numeric score, typically from 0 to 10, to represent the severity of a vulnerability?

• a.OSINT
• b.CVSS (Common Vulnerability Scoring System)✓
• c.DHCP
• d.RAID

The Common Vulnerability Scoring System (CVSS) produces a standardized severity score from 0 to 10 based on characteristics such as attack vector and impact, helping teams prioritize remediation. OSINT is an intelligence method, while DHCP and RAID are unrelated networking and storage technologies.

A tester has a long list of confirmed vulnerabilities and limited time. Which factor should most influence which vulnerabilities to address first?

• a.Alphabetical order of the affected hostnames
• b.The color assigned to each finding in the tool
• c.How recently each host was rebooted
• d.The risk each poses, combining severity and likelihood of exploitation✓

Prioritization is driven by risk, which combines the severity of a vulnerability with the likelihood and impact of its exploitation in the target's context. Cosmetic factors like alphabetical order or tool colors do not reflect real risk.

Which of the following is a well-known open-source vulnerability scanner?

• a.Microsoft Word
• b.VLC Media Player
• c.OpenVAS✓
• d.A PDF reader

OpenVAS is a widely used open-source vulnerability scanner that checks hosts against a database of known issues. The other options are general productivity or media applications with no vulnerability-scanning function.

An application concatenates untrusted user input directly into a database query, allowing an attacker to alter the query's logic. Which vulnerability class is this?

• a.SQL injection✓
• b.Cross-site scripting
• c.Denial of service
• d.Physical tailgating

SQL injection occurs when untrusted input is placed into a database query without proper parameterization, letting an attacker change the query's logic. The defense is to use parameterized queries and input validation. Cross-site scripting targets the browser, not the database.

A web application reflects unsanitized user input back into a page so that attacker-supplied script runs in other users' browsers. Which vulnerability is this?

• a.SQL injection
• b.Cross-site scripting (XSS)✓
• c.ARP spoofing
• d.Password spraying

Cross-site scripting (XSS) occurs when an application includes unsanitized input in a page, causing attacker-controlled script to execute in victims' browsers. Proper output encoding and input validation mitigate it. SQL injection targets the database rather than the browser.

An attacker sends a crafted email impersonating the IT help desk to trick an employee into revealing their password. Which category does this attack fall under?

• a.Buffer overflow
• b.SQL injection
• c.Port scanning
• d.Social engineering (phishing)✓

Phishing is a social-engineering technique that manipulates people into disclosing information or taking unsafe actions, rather than exploiting a technical flaw. Security-awareness training and email controls are key defenses. The other options are purely technical attacks.

During a test, a captured password is stored only as a hash. Which approach would a tester conceptually use to recover the plaintext for weak passwords?

• a.Sending the hash back to the login form unchanged
• b.Emailing the hash to the user for confirmation
• c.Running an offline cracking tool that hashes guesses and compares them✓
• d.Rebooting the domain controller repeatedly

Password cracking works offline by hashing candidate guesses and comparing them to the captured hash, so weak or common passwords are recovered quickly, which is why strong, unique passwords and slow hashing algorithms matter. The other options do not recover the plaintext.

A tester positions themselves between a client and server to intercept and potentially alter traffic that is not properly encrypted. Which attack concept is this?

• a.On-path (man-in-the-middle) attack✓
• b.Cross-site request forgery
• c.SQL injection
• d.Directory brute forcing

An on-path, or man-in-the-middle, attack places the attacker between two communicating parties to intercept or modify traffic, which strong encryption and certificate validation defend against. The other options target applications rather than the communication path itself.

Which tool is a widely used exploitation framework that helps testers develop and execute modules against known vulnerabilities in an authorized engagement?

• a.Nessus
• b.Metasploit✓
• c.Wireshark alone
• d.A spreadsheet application

Metasploit is a popular framework for developing and running exploit modules against known vulnerabilities during authorized testing. Nessus is a vulnerability scanner, Wireshark is a packet analyzer, and a spreadsheet has no exploitation capability.

A tester exploits a low-privileged account and then abuses a misconfigured service to gain administrative rights on the same host. What is this step called?

• a.Reconnaissance
• b.Scoping
• c.Privilege escalation✓
• d.Reporting

Privilege escalation is the act of gaining higher permissions than initially obtained, such as moving from a standard user to administrator, often by abusing misconfigurations. It follows initial access and precedes deeper post-exploitation activity.

After compromising one internal host, a tester uses it as a foothold to reach and attack other systems on the internal network. What is this technique called?

• a.Scoping
• b.Passive reconnaissance
• c.Vulnerability scanning of the internet
• d.Lateral movement (pivoting)✓

Lateral movement, or pivoting, uses a compromised host as a foothold to reach other systems that were not directly accessible, expanding access across the network. It is a post-exploitation activity, distinct from scoping or initial reconnaissance.

In a post-exploitation context, what does establishing persistence refer to?

• a.Maintaining continued access to a compromised system across reboots or credential changes✓
• b.Permanently improving the client's password policy
• c.Encrypting the tester's report for delivery
• d.Scoping the next engagement with the client

Persistence is the ability to retain access to a compromised system over time, for example surviving reboots, which demonstrates the potential impact of a breach. Testers document any persistence mechanisms used so they can be fully removed during cleanup.

Why is cleanup and restoration an important part of the post-exploitation phase of an authorized penetration test?

• a.It increases the CVSS score of every finding
• b.It removes tester-created artifacts and accounts so the environment is returned to its original state✓
• c.It replaces the need for a final report
• d.It automatically patches all discovered vulnerabilities

Cleanup removes tools, accounts, and other artifacts the tester introduced, returning the environment to its pre-test state and avoiding leaving new weaknesses behind. It does not alter scores, replace the report, or remediate the client's underlying vulnerabilities, which the client must fix.