CertCrack

CompTIA PenTest+ · PT0-003

PT0-003 Practice Exam: 750 Questions with Explanations

Preparing for the CompTIA PenTest+ (PT0-003) certification? CertCrack gives you 750 original practice questions mapped to the official PT0-003 exam objectives — Engagement Management (13%), Reconnaissance and Enumeration (21%), Vulnerability Discovery and Analysis (17%), Attacks and Exploits (35%), and Post-exploitation and Lateral Movement (14%) — plus 10 performance-based questions (PBQs) in the full PDF. Every question includes a detailed explanation so you learn the why, not just the answer.

What's inside

Free PenTest+ study guide

The free PenTest+ study guide teaches every procedure as a step-by-step illustrated walkthrough — original diagrams drawn for this book that show what each stage of the task involves and the decisions a tester makes at each step, so you understand the real workflow before you open the tool itself.

Read the free PenTest+ (PT0-003) study guide →

Try 30 sample questions

These are real samples from the PT0-003 bank — the full version has 750 like these.

1. CertCrack.com hires a penetration testing team to assess its production web application. During scoping, the client states that the payment processing subsystem is out of scope, but the testers later discover that the payment API is reachable from the in-scope application. What should the testers do first?

  1. Silently test the payment API, since it is reachable from an in-scope system and quietly confirming the exposure would help the client sooner
  2. Exclude the payment API from the report entirely
  3. Test the payment API and disclose it only if a critical flaw is found
  4. Notify the client point of contact and obtain a written scope amendment before testing the payment API
Correct answer: D. testing outside the agreed scope violates the authorization, so the team must notify the client contact and get a written amendment before touching the payment API. Why others are wrong: silently testing it is unauthorized regardless of reachability; excluding it entirely hides a risk the client should know about through proper channels; testing first and disclosing conditionally is still unauthorized testing.

2. Choose two. Which two items must be defined in a scoping document before testing begins?

  1. The authorized IP ranges and hostnames
  2. The agreed testing windows
  3. The testers' personal salaries
  4. The exploit code the team plans to use
Correct answers: A and B. authorized targets and agreed testing windows are core scoping elements that bound what may be tested and when. Why others are wrong: tester salaries are a commercial matter, not scope; specific exploit code is a tactical detail decided during testing, not a scoping requirement.

3. During a three-week engagement, how should the testing team keep the client informed?

  1. Provide status updates at the frequency and through the channels agreed in the rules of engagement
  2. Send raw tool output daily, so the client can follow every test step and finding as it happens without waiting for summaries
  3. Report only at the end of the engagement
  4. Update only when critical findings appear
Correct answer: A. update frequency and channels are engagement terms, so the team follows what the rules of engagement agreed. Why others are wrong: daily raw output is unsafe and noisy; end-only reporting leaves the client blind for weeks; critical-only updates omit progress and lower findings the client expects to track.

4. Which findings should be remediated first?

  1. Those easiest to fix
  2. Those found last
  3. Those affecting the most systems regardless of severity
  4. Critical, exploitable findings on exposed systems
Correct answer: D. remediation order follows risk: critical, exploitable flaws on exposed systems cause the most harm soonest. Why others are wrong: ease of fixing ignores risk; discovery order is arbitrary; affecting many systems does not make a finding the highest priority, since severity and exploitability on exposed systems decide.

5. While reviewing DNS records for CertCrack.com, a tester reads a TXT record containing v=spf1 and several include statements. What does this record most usefully reveal?

  1. The version of the company's web server software and its patch level and loaded modules
  2. A complete list of the company's subdomains
  3. The company's internal network address ranges
  4. Which third-party services are authorized to send mail for the domain
Correct answer: D. SPF data published in TXT records lists authorized mail senders, revealing email providers and related third parties. Why others are wrong: web server versions appear in HTTP banners, not DNS TXT records; TXT records do not enumerate subdomains; internal address ranges are not published in public TXT records.

6. Version detection on an authorized target shows SSH answering on TCP 8080. What should the tester conclude?

  1. Report port 8080 as a web server because 8080 is conventionally used for web traffic
  2. Ignore the version result and use the port number instead
  3. Skip the host, since non-standard ports are out of scope
  4. Report SSH on port 8080, since the service matters more than the port number
Correct answer: D. version detection reports the actual service, and services can bind any port, so the port number alone never identifies the service. Why others are wrong: assuming HTTP from the port number repeats the error; reporting 8080 as a web server would be factually wrong; skipping identification leaves the finding inaccurate.

7. A tester runs curl -I against an authorized target's website. What does this command return?

  1. Downloading the full page body and its linked resources
  2. Scanning ports on the web server
  3. Reading the server header without the page body
  4. Exploiting the web server
Correct answer: C. curl with -I requests headers only, so the tester reads the Server header without downloading the page body. Why others are wrong: a plain curl call downloads the full body; curl does not scan ports; and it does not exploit the server.

8. CertCrack.com's tester must scan a network segment that contains fragile legacy devices the client says cannot tolerate unexpected traffic. Which scan approach best balances assessment value against the risk of disruption?

  1. A full credentialed scan at maximum intensity against every device
  2. An aggressive scan of every port on every device in the segment
  3. A denial-of-service test to confirm the devices can survive heavy traffic without disruption
  4. An unauthenticated scan with safe checks only, plus passive observation of traffic
Correct answer: D. safe checks plus passive observation assess the segment without sending disruptive probes to fragile devices. Why others are wrong: maximum-intensity credentialed scans risk crashing fragile devices; denial-of-service testing is a disruption, not an assessment method, and is out of place here; aggressive full-port scanning is exactly the traffic the client warned against.

9. A Nessus report for a CertCrack.com host includes several informational results alongside the vulnerabilities. How should the tester treat the informational results?

  1. They are low-severity vulnerabilities, just below the reporting threshold for clients
  2. They are false positives that should be removed from the report
  3. They describe observed facts, such as the detected OS, and are not vulnerabilities
  4. They prove the host was exploited at some point in the past
Correct answer: C. informational results describe what the scanner observed, such as the operating system, and are not vulnerabilities. Why others are wrong: informational results are not low-severity flaws; they are not false positives, since they make no vulnerability claim; they are not proof of exploitation.

10. Two low-severity flaws at CertCrack.com chain together: one discloses a session token, the other uses it to reach an administrative function. How should the tester prioritize them for exploitation planning?

  1. Treat each flaw in isolation at its own low priority level
  2. Prioritize the chain as a unit, since it reaches administrative access
  3. Deprioritize the chain because each flaw is low severity alone
  4. Patch only the first flaw and ignore the second one entirely
Correct answer: B. two low-severity flaws that chain into administrative access present a higher risk together than either does alone, so the chain is prioritized as a unit. Why others are wrong: treating each flaw in isolation misses the chain; the chain's risk is higher, not lower, than its parts; patching only one link without noting the chain leaves the path partially open.

11. During an authorized test of CertCrack.com, you broadcast an open network named for the building's cafe and present a login page asking for the company's email credentials. Several visitors enter credentials, which you capture for the report. Which attack is this?

  1. Rogue wired access point
  2. Evil twin attack alone
  3. Captive portal phishing with a fake login page
  4. Karma attack
Correct answer: C. a fake captive portal that collects credentials from users who believe they are joining a legitimate guest network is captive portal phishing. Why others are wrong: An evil twin impersonates the SSID but does not necessarily present a credential-harvesting portal. A karma attack answers probes rather than presenting a portal. A rogue wired access point bridges to the LAN rather than harvesting web credentials.

12. During an authorized test of CertCrack.com, you log in to several network switches using the vendor's factory username and password, which nobody changed after installation. Which weakness did you exploit?

  1. Password spraying
  2. Brute force
  3. Unchanged default credentials
  4. Credential stuffing
Correct answer: C. default credentials on network devices are a configuration failure, and vendors publish them, so no cracking is needed at all. Why others are wrong: A brute force attack guesses many passwords rather than using one known default. Credential stuffing replays breached pairs rather than vendor defaults. Password spraying tries common passwords broadly rather than a device-specific default.

13. During an authorized test of CertCrack.com, which two of the following are SQL injection techniques? (Choose two.)

  1. Union-based injection
  2. Reflected cross-site scripting
  3. Boolean blind injection
  4. Directory traversal
Correct answers: A and C. union-based and boolean blind injections are both SQL injection techniques, while the other options belong to different attack classes. Why others are wrong: Reflected XSS is a scripting attack, not a database attack. A directory traversal reads files rather than querying a database.

14. During an authorized test of CertCrack.com, which two of the following are session management vulnerabilities? (Choose two.)

  1. SQL injection
  2. Session fixation
  3. Predictable session identifiers
  4. SSRF
Correct answers: B and C. session fixation plants an identifier before login, and predictable session identifiers can be guessed, so both are session management flaws, while the other options belong to different attack classes. Why others are wrong: SQL injection targets database queries rather than sessions. SSRF forces server requests rather than abusing sessions.

15. During an authorized test of CertCrack.com, you take a captured request and automatically iterate its user identifier through hundreds of values to test for IDOR. Which Burp component is this?

  1. Burp Intruder to automate identifier iteration
  2. Burp Proxy
  3. Burp Sequencer
  4. Burp Repeater
Correct answer: A. Intruder automates parameter variations, such as iterating identifiers or fuzzing inputs, across many requests from a template. Why others are wrong: Repeater handles one request at a time manually rather than automating. Proxy intercepts traffic rather than automating variations. Sequencer analyzes token entropy rather than sending varied requests.

16. During an authorized test of CertCrack.com, you access a restricted file that proves the impact of a vulnerability. Within scope, what is the appropriate next step?

  1. Disabling the host's firewall
  2. Capturing proof of access for the report
  3. Deleting the restricted file after reading it
  4. Changing the file's permissions
Correct answer: B. capturing proof of access, such as a screenshot of a restricted file or a captured hash, documents the finding for the report without altering the target beyond scope. Why others are wrong: Deleting the file would destroy evidence and exceed scope. Changing the file's permissions would alter the target unnecessarily. Disabling the host's firewall would expand exposure beyond the engagement's needs.

17. A tester enumerating a Windows host for privilege escalation finds several conditions. Which two allow escalation to SYSTEM? (Choose two.)

  1. A service running as SYSTEM whose binary path is unquoted and whose parent folder is writable
  2. A service running as SYSTEM that the tester is permitted to reconfigure
  3. A service running as SYSTEM with a quoted path, a protected binary, and locked-down permissions
  4. A standard user account with no special privileges or group memberships
Correct answers: A and B. an unquoted path with a writable parent folder lets the tester plant an executable Windows runs as SYSTEM, and a reconfigurable SYSTEM service lets the tester point its binary path at a payload. Why others are wrong: a quoted path with a protected binary and locked-down permissions offers no abuse path, and a plain standard user account carries no privilege to abuse.

18. A tester's rules of engagement authorize privilege escalation only on hosts explicitly listed in scope. During enumeration the tester finds an unpatched privilege-escalation flaw on a host that is not on the list. What should the tester do?

  1. Escalate on every host discovered, regardless of scope, to maximize test coverage
  2. Verify scope and report the finding, escalating only if authorized
  3. Skip escalation entirely without telling the client
  4. Escalate only on the tester's own workstation
Correct answer: B. scope is binding, so the tester must verify the host is authorized and report the finding, escalating only if authorization is confirmed. Why others are wrong: escalating outside scope violates the engagement; silently skipping hides a finding the client should know about; escalating on the tester's own workstation tests nothing.

19. A tester holds stolen credentials but no plaintext passwords. Which two techniques allow lateral movement without knowing any plaintext password? (Choose two.)

  1. Pass-the-hash, using a stolen NTLM hash
  2. Pass-the-ticket, using a stolen Kerberos ticket
  3. RDP logon with the user's password
  4. SSH logon with the user's password
Correct answers: A and B. pass-the-hash authenticates with a hash and pass-the-ticket authenticates with a ticket, neither requiring the plaintext password. Why others are wrong: RDP and SSH logons with a password both require the plaintext password the tester does not have.

20. A tester deletes a scheduled task the tester created, at the end of an authorized engagement, after confirming it is no longer needed. Is this covering tracks or cleanup?

  1. Covering tracks, because it removes evidence of the tester's activity from the host
  2. Persistence, because it maintains access
  3. Cleanup, because it restores the pre-test state at the engagement's end
  4. Lateral movement, because it affects another system
Correct answer: C. removing tester-created artifacts at the end of the engagement is cleanup, done openly and reported to the client. Why others are wrong: covering tracks hides activity during the engagement rather than restoring systems afterward; persistence maintains access rather than removing it; no new system is reached, so it is not lateral movement.

21. A penetration tester engaged by CertCrack.com has only the root domain to start from and needs the most complete inventory of subdomains possible before any scanning begins. Which tool should the tester run to enumerate subdomains by merging many OSINT sources with DNS enumeration techniques?

  1. theHarvester, to collect employee email addresses from search engines
  2. Amass, in enumeration mode against the root domain
  3. Shodan, queried for the domain's known IP ranges
  4. A single DNS zone transfer attempt against the primary name server
Correct answer: B. Amass is built for attack-surface mapping — it merges dozens of OSINT data sources with DNS techniques (brute forcing, permutations, certificate and web scraping) to produce the subdomain inventory other tools then scan. Why others are wrong: theHarvester gathers email addresses and some hostnames from search engines — an email-focused collection, not a systematic subdomain enumeration; Shodan indexes services on addresses it has already scanned; it cannot enumerate the subdomains of a domain; a zone transfer works only when a server is misconfigured to allow AXFR, and even then yields one server's records rather than a merged multi-source inventory.

22. CertCrack.com's CI pipeline must block builds that leak credentials. A developer once committed an AWS key and later 'removed' it in a follow-up commit. Which tool should scan the repository's full git history — including that earlier commit — for secrets, and can verify whether found keys are still live?

  1. TruffleHog, scanning git history for secrets
  2. Grype, matching vulnerabilities from an SBOM
  3. Docker Bench, auditing the build host's Docker configuration
  4. Nikto, scanning the running web server
Correct answer: A. TruffleHog digs through git history commit by commit, finds secrets with hundreds of detectors, and can validate many of them against the live service — so the key 'removed' in a later commit is still caught in history, where it remains exposed. Why others are wrong: Grype matches known package vulnerabilities in images and SBOMs; it does not hunt credentials in commit history; Docker Bench checks a Docker host's configuration against benchmark guidance, not repositories; Nikto scans a running web server for dangerous files and misconfigurations; it never reads git history.

23. A tester with a low-privilege domain account at CertCrack.com wants to Kerberoast: request service tickets for accounts that have SPNs, save the tickets, and crack the service account passwords offline. Which tool performs this attack from the tester's Windows attack machine?

  1. Mimikatz, extracting credentials from LSASS memory
  2. Certify, enumerating AD CS certificate templates
  3. Rubeus, requesting and harvesting Kerberos service tickets
  4. Seatbelt, sweeping the local host's security posture
Correct answer: C. Rubeus is the Kerberos toolkit — its kerberoast function requests TGS tickets for SPN accounts from the KDC, exports them in a crackable format, and hands them to an offline cracker, exactly the attack described. Why others are wrong: Mimikatz extracts credentials that already exist in a compromised host's memory; it does not request or harvest service tickets; Certify finds and abuses AD CS misconfigurations — a certificate attack path, not SPN ticket harvesting; Seatbelt enumerates a host's configuration and security settings; it performs no Kerberos attacks.

24. A CertCrack.com developer's AWS access keys are recovered from a public repository during the test. The tester now needs a purpose-built framework to work inside the account: enumerate what the keys can do, escalate privileges, and establish persistence. Which tool fits?

  1. Pacu, the AWS exploitation framework
  2. Prowler, checking the account against CIS benchmarks
  3. ScoutSuite, generating a cloud posture report
  4. Trivy, scanning the account's container images
Correct answer: A. Pacu is the AWS exploitation framework — modular tooling for exactly this phase: permission enumeration, privilege escalation, persistence, and data access, driven by the compromised keys. Why others are wrong: Prowler evaluates configuration against benchmarks and reports pass/fail; it deliberately does not exploit anything; ScoutSuite produces a read-only posture assessment across cloud services; it has no exploitation modules; Trivy scans container artifacts for vulnerabilities and never operates inside a cloud account.

25. During a wireless test at CertCrack.com, the tester captures the WPA2 four-way handshake from the corporate access point. The next step is offline cracking of the pre-shared key against a wordlist. Which tool performs the crack?

  1. Aircrack-ng, cracking the captured handshake
  2. Kismet, logging the networks it detects
  3. InSSIDer, surveying channel utilization
  4. BeEF, hooking browsers on the network
Correct answer: A. Aircrack-ng is the wireless suite whose cracking engine attacks the captured WPA/WPA2 handshake (or a PMKID) with dictionary or brute-force candidates until the pre-shared key is recovered. Why others are wrong: Kismet detects and logs wireless networks and clients; it has no key-cracking function; InSSIDer visualizes channels and signal strength for surveys; it cannot crack anything; BeEF exploits hooked web browsers — a different layer and a different engagement phase entirely.

26. For an authorized phishing exercise at CertCrack.com, the tester wants to clone the company's real SSO login page in minutes and harvest the credentials employees type into the clone. Which toolkit provides this site-cloner and credential-harvester workflow?

  1. Gophish, scheduling campaign waves and tracking clicks
  2. BeEF, exploiting browsers that were already hooked
  3. Evilginx, proxying the live login to steal sessions
  4. The Social-Engineer Toolkit (SET), cloning the page and harvesting input
Correct answer: D. SET's website attack vector clones a target page and stands up its credential harvester in one workflow — the fast, classic way to run the cloned-login exercise described. Why others are wrong: Gophish is the campaign platform — sending, tracking, and reporting across many targets — not the one-shot site-clone harvester; BeEF takes control of browsers after they are hooked; it does not clone login pages; Evilginx transparently proxies the genuine site to steal live sessions — a different mechanism from SET's static clone, and heavier to set up.

27. To test how CertCrack.com's firewall handles malformed traffic, a tester needs to build packets field by field in Python — fragmented probes, hand-set flags, and a custom protocol exchange — and read the replies programmatically. Which tool is the packet-crafting library for this?

  1. Nmap, running its standard scan types
  2. Wireshark, dissecting a capture the tester already has
  3. Netcat, piping a raw byte stream over TCP
  4. Scapy, constructing and sending custom packets
Correct answer: D. Scapy forges, sends, and sniffs packets layer by layer under script control — the standard tool when the test needs packets that no fixed scanner template produces. Why others are wrong: Nmap's scans are pre-built probes; fine-grained, field-by-field packet construction is not its job; Wireshark analyzes traffic that already exists in a capture; it creates nothing; Netcat moves raw byte streams between endpoints but cannot assemble layered protocol headers field by field.

28. CertCrack.com wants adversary emulation that runs like a real intrusion: a server deploys agents, chains ATT&CK abilities — discovery, then credential access, then movement — and adapts the operation to what the environment answers. Which platform does this?

  1. Atomic Red Team, executing isolated technique tests
  2. Infection Monkey, spreading to test segmentation
  3. Caldera, running chained adversary-emulation operations
  4. Metasploit, driven manually by the operator
Correct answer: C. Caldera, MITRE's adversary-emulation platform, runs operations in which its planner chains abilities across agents — exactly the autonomous, multi-step emulation the scenario describes — and maps results to ATT&CK. Why others are wrong: Atomic Red Team is a library of small, single-technique tests run one at a time; it does not chain an operation; the Monkey's purpose is propagation and segmentation testing, not a directed multi-step emulation with a planner; Metasploit is an operator-driven exploitation framework; the emulation automation and ability chaining are Caldera's.

29. CertCrack.com's new REST API ships with a request collection. The tester wants a workbench to send crafted requests, swap authorization headers and tokens, chain calls, and inspect responses interactively before automating anything. Which tool is this workbench?

  1. Postman, building and sending API requests interactively
  2. sqlmap, automating injection through one parameter
  3. Nikto, scanning the API host for server issues
  4. Wfuzz, blasting value lists at a single endpoint
Correct answer: A. Postman is the API testing workbench — collections of requests the tester can edit, authenticate, chain, and re-send, with full response inspection, which is how API engagements explore a surface before scripting attacks. Why others are wrong: sqlmap automates SQL injection detection and exploitation against parameters; it is not a general request-building workbench; Nikto scans a web server for known dangerous files and settings, an infrastructure check rather than API exploration; Wfuzz fuzzes values at scale; interactive request crafting, header management, and response study are Postman's role.

30. For the Windows-focused phase of a CertCrack.com engagement, the team wants a collaborative command-and-control platform: browser-based, multi-operator, built on .NET, with implants it calls Grunts that the whole team can task and watch in real time. Which framework is this?

  1. Covenant, the collaborative .NET C2 with Grunts
  2. Metasploit, driven from its single-operator console
  3. Netcat, opening raw listener connections
  4. sshuttle, tunneling traffic through an SSH server
Correct answer: A. Covenant is the collaborative, .NET-based C2 framework — its Grunt implants are tasked from a web interface where several operators share sessions, data, and tasking, which is the model the team describes. Why others are wrong: Metasploit's sessions are powerful, but its working model is an operator-driven exploitation console, not a shared web C2 built on .NET Grunts; Netcat is a raw connection utility with no implant management, tasking, or operator collaboration; sshuttle only forwards traffic through SSH; it issues no commands to implants at all.

Get full access

One payment unlocks the online question bank and the full PDF.

$10 · 3 months access

Get full access Download the free sample PDF (30 questions)

15-day money-back guarantee (before 25% of questions attempted). PDF downloads are non-refundable.

Exam facts: CompTIA PenTest+ (PT0-003)

Frequently asked questions

How long do I get access?

Three months (90 days) from purchase, covering both the interactive online bank and the full PDF download. Access can be extended.

Is there a free trial?

Yes — a free 30-question sample quiz and a free sample PDF are available with no account required, so you can judge the quality before paying. The complete PenTest+ study guidebook is also free to read online.

Are these questions like the real PT0-003 exam?

All 750 questions are mapped to the official PT0-003 exam objectives and written in the same style and difficulty as the real exam — scenario-first, built around real engagement work: scoping and rules of engagement, OSINT and scanning, triaging scanner output, exploiting networks, applications, cloud and wireless, and moving through a target after the foothold. Every tool named in the official objectives is covered, including Amass, Nmap, TruffleHog, Rubeus, Pacu, Prowler, WiFi-Pumpkin, Evilginx, Caldera, and Covenant.

Can I study offline?

Yes. Your purchase includes the complete question bank as a downloadable PDF for offline study.

What is the refund policy?

Full access is refundable within 15 days, or before 25% of the questions have been attempted — whichever comes first. Downloaded PDFs are non-refundable.

How much does the PenTest+ exam cost?

The CompTIA PenTest+ (PT0-003) exam costs $439 USD.

How many questions are on the PenTest+ (PT0-003) exam?

A maximum of 90 questions in 165 minutes — multiple-choice plus performance-based questions (PBQs), which test hands-on work such as reading Nmap and scanner output, ordering an attack path, and judging scope from an engagement log.

What is the passing score for PenTest+?

750 on CompTIA's scaled score range of 100 to 900.

Is PT0-003 the current PenTest+ exam?

Yes. PT0-003 launched on December 17, 2024 and is the current PenTest+ exam. The previous version, PT0-002, retired on June 17, 2025.

How long is the PenTest+ certification valid?

Three years from the date you pass. You can renew it through CompTIA's Continuing Education (CE) program.

Where can I practice for the PenTest+ exam for free?

Right here on CertCrack. Start with the free 30-question sample quiz and the free sample PDF on this page — no account needed — and read the free PenTest+ study guidebook. When you're ready for the full bank, this page gives you every practice question with detailed explanations for $10.

Get a free practice question every week

Join the list — one exam-style question with a full explanation, every week. No spam.