CompTIA PenTest+ (PT0-003) — Questions and Answers

Question 1: During a Windows pentest, a tester extracts the NTDS.dit file from a domain controller. What is the purpose of obtaining this file?

To read cached Group Policy settings
To obtain Kerberos service tickets
To enumerate Active Directory OUs
To extract all domain password hashes (Correct answer)

Correct answer: To extract all domain password hashes

NTDS.dit is the Active Directory database that stores all domain user account password hashes, making it a primary credential harvesting target.

Question 2: What is the MOST effective way for new PenTest+ professionals to build competency in their field?

Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Focusing solely on the most advanced topics
Studying certification materials exclusively
Learning entirely through trial and error

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building professional competency requires a multi-faceted approach: formal education provides foundational knowledge, mentored practice develops applied skills under guidance, and ongoing professional development ensures continuous growth and currency in the field.

Question 3: When reporting on social engineering test results, which data must be handled with particular sensitivity?

The tools used to craft phishing emails
The timestamp of when phishing emails were sent
The identities of employees who failed the tests, to ensure their privacy and prevent retaliation (Correct answer)
The IP addresses of mail servers used

Correct answer: The identities of employees who failed the tests, to ensure their privacy and prevent retaliation

Employee-specific results from social engineering tests must be handled sensitively to protect individuals from retaliation and should typically be reported as aggregate statistics.

Question 4: Which DNS record type would a penetration tester query to identify the mail servers associated with a target domain?

A record
MX record (Correct answer)
PTR record
CNAME record

Correct answer: MX record

MX (Mail Exchanger) records specify the mail servers responsible for accepting email for a domain.

Question 5: An application server sends the header `Access-Control-Allow-Origin: *` with `Access-Control-Allow-Credentials: true`. Why is this a security risk?

It prevents the browser from enforcing the same-origin policy entirely
It allows any origin to make credentialed cross-origin requests, exposing authenticated data (Correct answer)
It enables SQL injection from cross-origin requests
It disables TLS for cross-origin connections

Correct answer: It allows any origin to make credentialed cross-origin requests, exposing authenticated data

A wildcard origin combined with `Allow-Credentials: true` is an invalid but dangerously misconfigured CORS policy; browsers block this combination, but some frameworks mishandle it by reflecting the request origin, granting any attacker site access to credentialed responses.

Question 6: How does the PenTest+ body of knowledge relate to daily professional practice?

It provides the foundational framework that guides decision-making and standard practices (Correct answer)
It only applies during certification exams
It is relevant only for academic research
It is theoretical and has limited practical application

Correct answer: It provides the foundational framework that guides decision-making and standard practices

The body of knowledge provides the foundational framework of principles, standards, and best practices that professionals use to guide their daily decision-making, ensure consistent quality, and maintain alignment with industry standards.

Question 7: A penetration tester discovers that a web application uses predictable session token values (e.g., sequential integers). Which vulnerability category does this represent?

Insecure direct object reference (IDOR)
Clickjacking vulnerability
Broken authentication due to weak session management (Correct answer)
Cross-site request forgery (CSRF)

Correct answer: Broken authentication due to weak session management

Predictable session tokens fall under broken authentication — weak session management allows attackers to guess or forge valid session identifiers.

Question 8: What does the term 'attack surface' refer to in the context of vulnerability identification during a penetration test?

All the different points where an attacker could attempt to enter or extract data (Correct answer)
The physical area of the target facility being tested
The list of exploits available in Metasploit for the target OS
The total number of CVEs identified during scanning

Correct answer: All the different points where an attacker could attempt to enter or extract data

The attack surface encompasses all potential entry points, interfaces, protocols, and data paths through which an attacker could attempt to compromise the target.

Question 9: How should a penetration tester handle proprietary client data collected during testing after the engagement concludes?

Archive it permanently as part of the engagement record
Retain it for use in future engagements with similar clients
Transfer it to the tester's personal backup systems
Securely delete all client data per the data retention policy agreed in the contract (Correct answer)

Correct answer: Securely delete all client data per the data retention policy agreed in the contract

Client data must be securely deleted after the engagement per the data handling policy specified in the contract to protect client confidentiality and meet legal obligations.

Question 10: What is a 'Golden Ticket' attack in Active Directory and what makes it so powerful?

Exploiting a zero-day vulnerability in the Domain Controller
A phishing campaign targeting privileged admin accounts
Brute-forcing the domain administrator password offline
Forging a Kerberos TGT using the KRBTGT account hash, granting persistent domain-wide access (Correct answer)

Correct answer: Forging a Kerberos TGT using the KRBTGT account hash, granting persistent domain-wide access

A Golden Ticket forges a Kerberos TGT signed with the KRBTGT account's hash, providing nearly unrestricted, long-lasting access to any resource in the domain.

Question 11: What is the PRIMARY purpose of obtaining PenTest+ certification in CompTIA PenTest+ Certification?

To satisfy a personal achievement goal
To bypass educational requirements
To demonstrate verified competency and adherence to professional standards (Correct answer)
To guarantee employment in the field

Correct answer: To demonstrate verified competency and adherence to professional standards

Professional certification demonstrates that an individual has met established competency standards through verified assessment. It provides assurance to employers, clients, and the public that the certified professional possesses the knowledge and skills required for competent practice.

Question 12: What is the primary purpose of including a 'scope of work' section in a penetration testing report?

To summarize vulnerabilities by severity
To define what systems and activities were authorized during the engagement (Correct answer)
To outline remediation timelines
To list all tools used during testing

Correct answer: To define what systems and activities were authorized during the engagement

The scope of work documents exactly which systems, networks, and test types were authorized, providing legal protection and contextualizing the findings.

Question 13: A penetration tester is asked to perform a physical security assessment as part of a broader engagement. Which additional authorization consideration applies?

Written permission specific to physical access attempts must be obtained (Correct answer)
Physical testing is always illegal and should be refused
Physical testing requires no additional authorization if logical systems are in scope
Only the IT department needs to authorize physical testing

Correct answer: Written permission specific to physical access attempts must be obtained

Physical penetration testing involves entering facilities or bypassing physical controls, which requires explicit written authorization separate from network testing permission.

Question 14: What is the MOST important leadership quality for a PenTest+ certified professional managing a team?

Avoiding all forms of conflict within the team
Maintaining strict control over all decisions
Demonstrating integrity, clear communication, and ability to develop team members (Correct answer)
Achieving the highest personal performance metrics

Correct answer: Demonstrating integrity, clear communication, and ability to develop team members

Effective leadership in professional settings requires integrity to build trust, clear communication to align the team, and the ability to develop team members' skills and capabilities. These qualities create a productive and engaged team.

Question 15: A penetration testing team uses an encrypted communication channel to relay daily status updates to the client during a long-term engagement. What is the MAIN reason for encrypting these communications?

To reduce bandwidth usage
To meet PCI-DSS audit requirements
To comply with GDPR requirements
To prevent threat actors from learning which systems have already been tested (Correct answer)

Correct answer: To prevent threat actors from learning which systems have already been tested

Encrypting status communications prevents adversaries from learning which systems have been tested and which vulnerabilities remain, which could be exploited before remediation.

Question 16: What is the primary purpose of testing for Cross-Site Request Forgery (CSRF) vulnerabilities in a web application?

To bypass server-side input validation
To inject malicious scripts into web pages viewed by other users
To force authenticated users to unknowingly submit requests (Correct answer)
To extract sensitive data from server databases

Correct answer: To force authenticated users to unknowingly submit requests

CSRF vulnerabilities trick authenticated users into submitting unintended requests (such as changing passwords or transferring funds) by exploiting the trust a site has in the user's browser.

Question 17: What is the importance of having a penetration testing policy?

To ensure compliance with legal and ethical standards (Correct answer)
To limit the scope of the test.
To make sure no security measures are implemented.
To ensure that all tests are successful.

Correct answer: To ensure compliance with legal and ethical standards

A penetration testing policy is essential for establishing clear guidelines and boundaries for the testing process. It ensures that all activities are conducted legally, ethically, and in accordance with organizational standards and regulatory requirements. This policy helps prevent unauthorized actions, defines responsibilities, and protects both the organization and the testers.

Question 18: During a network scan, a tester finds ports 135, 139, and 445 open on multiple hosts. What does this combination MOST likely indicate?

Network printers with management interfaces
Windows systems with SMB and RPC services (Correct answer)
Database servers with remote access enabled
Linux servers running Samba

Correct answer: Windows systems with SMB and RPC services

Ports 135 (RPC), 139 (NetBIOS), and 445 (SMB) are characteristic Windows networking ports used for file sharing and remote procedure calls.

Question 19: In CompTIA PenTest+ Certification, what is the PRIMARY purpose of conducting an initial assessment?

To establish a baseline and identify needs for appropriate action (Correct answer)
To generate documentation for billing purposes
To fulfill administrative paperwork requirements
To demonstrate the assessor's expertise

Correct answer: To establish a baseline and identify needs for appropriate action

The initial assessment establishes a baseline of current conditions and identifies specific needs. This foundational information guides all subsequent decisions, planning, and interventions.

Question 20: A client wants a penetration test but is concerned about sensitive data exposure during the test. Which scoping consideration addresses this?

Setting test time windows
Defining target IP ranges
Establishing data handling procedures (Correct answer)
Identifying third-party dependencies

Correct answer: Establishing data handling procedures

Data handling procedures ensure that sensitive information encountered during testing is protected, stored securely, and not improperly disclosed.

Question 21: What is the purpose of a 'severity rating' assigned to each finding in a pentest report?

To help the client prioritize remediation efforts based on risk to the organization (Correct answer)
To determine the tester's billing rate for that finding
To comply with federal reporting requirements
To rank findings alphabetically

Correct answer: To help the client prioritize remediation efforts based on risk to the organization

Severity ratings allow clients to prioritize which vulnerabilities to remediate first based on the potential impact and likelihood of exploitation.

Question 22: Which scoping activity helps identify systems that should be excluded from testing to prevent business disruption?

Asset discovery
Target profiling
Fragility assessment (Correct answer)
Threat modeling

Correct answer: Fragility assessment

Fragility assessment identifies systems like legacy equipment, medical devices, or ICS components that could be damaged by testing, warranting exclusion.

Question 23: What is 'shoulder surfing' as a physical security attack?

Mounting a covert camera inside a shoulder bag
Observing someone's screen or keyboard to capture PINs, passwords, or sensitive data (Correct answer)
Climbing over physical barriers to gain unauthorized facility access
Surfing the internet using a target's corporate Wi-Fi network

Correct answer: Observing someone's screen or keyboard to capture PINs, passwords, or sensitive data

Shoulder surfing involves physically positioning close enough to observe a target's screen, keyboard input, or documents to capture sensitive information without any technical tools.

Question 24: Which OWASP Top 10 category describes a flaw where an application uses components with known security weaknesses such as outdated libraries?

Vulnerable and Outdated Components (Correct answer)
Injection
Security Misconfiguration
Broken Access Control

Correct answer: Vulnerable and Outdated Components

OWASP A06:2021 - Vulnerable and Outdated Components specifically addresses the risk of using libraries, frameworks, or other software with known vulnerabilities.

Question 25: Which document formally authorizes a penetration tester to perform security assessments and protects them from legal liability?

Rules of engagement (Correct answer)
Statement of work
Non-disclosure agreement
Master service agreement

Correct answer: Rules of engagement

The rules of engagement (ROE) document formally authorizes testing activities and defines boundaries, providing legal protection for the tester.

Question 26: How does the PenTest+ body of knowledge relate to daily professional practice?

It only applies during certification exams
It is theoretical and has limited practical application
It is relevant only for academic research
It provides the foundational framework that guides decision-making and standard practices (Correct answer)

Correct answer: It provides the foundational framework that guides decision-making and standard practices

Question 27: A tester submits the payload `' OR '1'='1` into a login form and gains unauthorized access. What vulnerability has been exploited?

XPATH Injection
SQL Injection (Correct answer)
LDAP Injection
Broken Authentication

Correct answer: SQL Injection

The payload manipulates the SQL query logic to always evaluate as true, which is a classic SQL Injection technique used to bypass authentication.

Question 28: A tester accesses `/api/users/1001` and then changes the ID to `/api/users/1002` to view another user's data without authorization. What vulnerability is this?

Broken Function Level Authorization
Mass Assignment
Privilege Escalation
Insecure Direct Object Reference (IDOR) (Correct answer)

Correct answer: Insecure Direct Object Reference (IDOR)

Insecure Direct Object Reference (IDOR) occurs when an application exposes internal implementation objects (like user IDs) without proper authorization checks, allowing access to other users' data.

Question 29: What is the BEST strategy for resource allocation in CompTIA PenTest+ Certification project management?

Allocate all resources equally regardless of need
Match resources to priorities based on assessment of needs, risks, and strategic goals (Correct answer)
Keep significant reserves without deployment
Focus resources only on the largest tasks

Correct answer: Match resources to priorities based on assessment of needs, risks, and strategic goals

Effective resource allocation requires matching available resources to priorities determined by assessment of needs, risk factors, and strategic goals. This ensures that critical areas receive appropriate support while maintaining overall efficiency.

Question 30: A tester gains code execution via a deserialization flaw in a Java application. Which tool is most commonly used to generate Java deserialization payloads?

SQLmap
Metasploit
ysoserial (Correct answer)
Burp Suite

Correct answer: ysoserial

ysoserial is the standard tool for generating Java deserialization exploit payloads targeting various Java libraries.

Question 31: A penetration tester uses Responder to capture NTLMv2 hashes on a network. What type of attack does Responder perform to collect these hashes?

LLMNR/NBT-NS poisoning (Correct answer)
Pass-the-hash
AS-REP roasting
Kerberoasting

Correct answer: LLMNR/NBT-NS poisoning

Responder performs LLMNR and NBT-NS poisoning to intercept name resolution requests and capture NTLMv2 authentication hashes.

Question 32: How should a PenTest+ professional manager address underperformance within their team?

Ignore it until formal review periods
Immediately reassign the individual to a different role
Publicly address the issue in team meetings
Provide timely, specific feedback with support and a clear improvement plan (Correct answer)

Correct answer: Provide timely, specific feedback with support and a clear improvement plan

Addressing underperformance requires timely intervention with specific, objective feedback about the performance gap. Providing support resources and a clear improvement plan with defined expectations and timelines gives the individual a fair opportunity to improve.

Question 33: What is 'pivoting' in the context of penetration testing?

Switching the attack tool mid-engagement
Using a compromised host as a relay to reach other network segments (Correct answer)
Alternating between different user accounts
Rotating encryption keys on captured data

Correct answer: Using a compromised host as a relay to reach other network segments

Pivoting uses a compromised host as a relay to route traffic through it and reach otherwise inaccessible internal network segments.

Question 34: A company hires a penetration testing firm to assess compliance with PCI DSS. How does this regulatory requirement affect the scope of the engagement?

It allows the tester to skip the rules of engagement
It mandates specific targets, methodologies, and reporting formats (Correct answer)
It has no effect on the technical scope
It requires testing all company assets regardless of card data involvement

Correct answer: It mandates specific targets, methodologies, and reporting formats

Compliance-driven engagements like PCI DSS specify which systems must be tested, what methodologies to follow, and how findings must be documented and reported.

Question 35: During a web application pentest, you discover that user input is reflected in an HTML page without sanitization. Which attack type should you attempt first?

Cross-Site Scripting (XSS) (Correct answer)
Command Injection
XML External Entity (XXE)
SQL Injection

Correct answer: Cross-Site Scripting (XSS)

When user input is reflected unsanitized in an HTML page, Cross-Site Scripting (XSS) is the most direct attack to attempt, as the browser will execute injected scripts.

Question 36: When assessing scope for a web application penetration test, why is it important to identify the application's technology stack in advance?

Different technologies have unique vulnerabilities and require specific testing methodologies (Correct answer)
The stack determines which regulatory framework applies
Knowing the stack allows the tester to skip reconnaissance
The technology stack determines the price of the engagement

Correct answer: Different technologies have unique vulnerabilities and require specific testing methodologies

Understanding the technology stack (e.g., PHP, Java, .NET, frameworks) helps identify relevant vulnerability classes and ensures appropriate testing tools and techniques are included in scope.

Question 37: What is the PRIMARY purpose of obtaining PenTest+ certification in CompTIA PenTest+ Certification?

To guarantee employment in the field
To demonstrate verified competency and adherence to professional standards (Correct answer)
To satisfy a personal achievement goal
To bypass educational requirements

Correct answer: To demonstrate verified competency and adherence to professional standards

Question 38: During wireless testing, a tester captures a 4-way WPA2 handshake and runs it through hashcat with a wordlist. What is being attacked?

The PMKID without client association
The WPA2 TKIP encryption key
The PMK directly
The Pre-Shared Key (PSK) via offline dictionary attack (Correct answer)

Correct answer: The Pre-Shared Key (PSK) via offline dictionary attack

Capturing a WPA2 4-way handshake enables an offline dictionary attack against the PSK, since the handshake contains data derived from the password.

Question 39: Which type of penetration test provides the tester with full knowledge of the internal network architecture, source code, and credentials?

Black-box
Gray-box
Red team
White-box (Correct answer)

Correct answer: White-box

White-box testing provides complete transparency including network diagrams, credentials, and source code, simulating an insider threat or detailed audit.

Question 40: A client requests a 'purple team' exercise rather than a traditional penetration test. How does this affect the planning and scoping phase?

Purple team exercises are out of scope for PenTest+ certification
The blue team is excluded from the planning phase entirely
Purple team exercises require no planning since they are informal
Scope must include collaboration protocols defining how red and blue teams will share information in real time (Correct answer)

Correct answer: Scope must include collaboration protocols defining how red and blue teams will share information in real time

Purple team exercises require scoping to define information-sharing protocols, collaboration checkpoints, and how the red team's techniques will be communicated to the blue team for training purposes.

Question 41: Which technique involves an attacker injecting shellcode into a running process's memory by exploiting a buffer that resides on the heap rather than the stack?

Heap spray (Correct answer)
Stack-based buffer overflow
Return-oriented programming
Format string attack

Correct answer: Heap spray

Heap spray fills large portions of heap memory with NOP sleds and shellcode to increase the probability of hitting injected code during exploitation.

Question 42: In the context of pentest reporting, what does 'false positive' refer to?

A vulnerability found outside the agreed scope
A finding confirmed by manual testing
A reported vulnerability that does not actually exist or cannot be exploited in the target environment (Correct answer)
A vulnerability that is more severe than initially assessed

Correct answer: A reported vulnerability that does not actually exist or cannot be exploited in the target environment

A false positive is a vulnerability flagged by tools or initial analysis that further investigation reveals is not actually exploitable or present in the environment.

Question 43: What is the first step in information gathering during a penetration test?

Scanning the network for open ports.
Conducting brute-force attacks.
Gathering OSINT information about the target (Correct answer)
Identifying vulnerabilities.

Correct answer: Gathering OSINT information about the target

The first step in information gathering is often Open-Source Intelligence (OSINT), which involves collecting publicly available information about the target. This can include details from websites, social media, public records, and news articles. OSINT helps build a comprehensive profile of the target, identifying potential entry points and attack vectors before any active scanning begins.

Question 44: When assessment results for a CompTIA PenTest+ Certification evaluation are inconclusive, the BEST practice is to:

Report the results as definitive anyway
Delay reporting until results are favorable
Discard the results and start over completely
Conduct additional assessment using alternative methods (Correct answer)

Correct answer: Conduct additional assessment using alternative methods

Inconclusive results require additional assessment using alternative methods to gather more data. This triangulation approach helps clarify findings without compromising the integrity of the assessment process.

Question 45: Why might a penetration tester recommend a phased approach when the client wants to test a very large environment?

To focus resources on highest-risk areas first and maintain manageable scope within each phase (Correct answer)
Because regulations require phased testing for all large environments
To increase billing opportunities for the tester
To avoid the need for written authorization in later phases

Correct answer: To focus resources on highest-risk areas first and maintain manageable scope within each phase

Phased testing allows methodical coverage of large environments by prioritizing critical assets, keeping each phase's scope manageable, and allowing findings to inform subsequent phases.

Question 46: Which tool is commonly used for maintaining persistent access and post-exploitation activities after initial compromise?

Metasploit Meterpreter (Correct answer)
Wireshark
Nmap
Nikto

Correct answer: Metasploit Meterpreter

Metasploit Meterpreter provides a powerful in-memory post-exploitation shell with built-in features for persistence, pivoting, and lateral movement.

Question 47: A tester discovers evidence of an active breach by a third party during a scheduled pentest. What is the MOST appropriate immediate action?

Document the breach evidence and immediately notify the client (Correct answer)
Include the finding only in the final report
Attempt to identify and remove the threat actor
Continue testing to avoid disrupting the engagement timeline

Correct answer: Document the breach evidence and immediately notify the client

Discovery of an active breach requires immediate notification to the client so they can engage incident response resources, as this takes priority over the pentest scope.

Question 48: Which statement BEST describes the relationship between CompTIA PenTest+ Certification certification requirements and industry evolution?

Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards (Correct answer)
Requirements become less stringent over time
Changes only occur when government mandates new requirements
Certification requirements never change once established

Correct answer: Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards

Certification requirements evolve to keep pace with advances in professional knowledge, technological developments, and changes in practice standards. This ensures that certified professionals remain current and competent in a changing professional landscape.

Question 49: What is vulnerability identification in the context of penetration testing?

Finding software bugs.
Reducing network traffic.
Scanning and identifying potential vulnerabilities in the systems (Correct answer)
Performing brute-force attacks.

Correct answer: Scanning and identifying potential vulnerabilities in the systems

Vulnerability identification in penetration testing involves systematically scanning and analyzing target systems, applications, and networks to discover known weaknesses or misconfigurations. This process aims to pinpoint specific flaws that an attacker could exploit. It's a critical step before attempting exploitation, providing a roadmap of potential attack surfaces.

Question 50: A penetration tester uses theHarvester to collect email addresses and subdomains for a target organization. What category of reconnaissance does this represent?

Physical reconnaissance
Active reconnaissance
Internal reconnaissance
Passive reconnaissance (Correct answer)

Correct answer: Passive reconnaissance

theHarvester gathers data from public sources (search engines, DNS records) without directly interacting with the target, making it passive reconnaissance.

Question 51: What tool is commonly used for information gathering during a penetration test?

Metasploit
Wireshark
Nmap and Netcat (Correct answer)
Aircrack-ng

Correct answer: Nmap and Netcat

Nmap (Network Mapper) is a powerful and widely used tool for network discovery and security auditing, allowing testers to identify hosts, services, and open ports. Netcat is a versatile networking utility that can read and write data across network connections, often used for banner grabbing, port listening, and transferring files. Both are fundamental for initial information gathering and reconnaissance in penetration testing.

Question 52: A penetration tester discovers a critical SQL injection vulnerability during an engagement. The client's system is actively processing customer financial transactions. What should the tester do FIRST?

Document the finding and continue testing
Immediately notify the client's designated point of contact per the communication plan (Correct answer)
Halt all testing and leave the premises
Exploit the vulnerability fully to demonstrate impact

Correct answer: Immediately notify the client's designated point of contact per the communication plan

Critical findings that pose immediate risk must be communicated to the client's designated contact immediately per the pre-agreed communication plan before further exploitation.

Question 53: A web application uses OAuth 2.0 and does not validate the `state` parameter during the authorization callback. What attack is possible?

JWT Algorithm Confusion
Authorization Code Interception
Token Replay Attack
Cross-Site Request Forgery on OAuth Flow (Correct answer)

Correct answer: Cross-Site Request Forgery on OAuth Flow

The OAuth `state` parameter functions as a CSRF token; without validating it, an attacker can forge a callback request and link their malicious account to a victim's session.

Question 54: Which command finds SUID binaries on Linux that can be abused for privilege escalation?

ps aux --forest
netstat -tulpn
ls -la /bin
find / -perm -4000 2>/dev/null (Correct answer)

Correct answer: find / -perm -4000 2>/dev/null

The find command with -perm -4000 locates SUID binaries that run with elevated privileges and are commonly abused to escalate to root.

Question 55: What is the significance of a vulnerability assessment report?

To document vulnerabilities and suggest mitigation steps (Correct answer)
To keep the vulnerabilities undisclosed.
To minimize the importance of vulnerabilities.
To limit the number of systems tested.

Correct answer: To document vulnerabilities and suggest mitigation steps

A vulnerability assessment report is a critical deliverable that summarizes the findings of a security assessment. Its significance lies in clearly documenting all identified security weaknesses, categorizing them by severity, and providing detailed information about their potential impact. Crucially, the report also includes actionable recommendations and mitigation strategies, enabling organizations to understand their risks and implement necessary improvements to enhance their security posture.

Question 56: What is 'double pivoting' in penetration testing?

Using two Metasploit sessions on the same target
Exploiting two different vulnerabilities on one host simultaneously
Running two reverse shells in parallel for redundancy
Chaining two compromised hosts to reach a third, deeper network segment (Correct answer)

Correct answer: Chaining two compromised hosts to reach a third, deeper network segment

Double pivoting chains two compromised hosts sequentially, routing traffic through the first pivot to reach the second, which then provides access to an even deeper network.

Question 57: Why is it important to document the scope of a penetration test?

To limit the number of systems tested.
To increase the test's duration.
To ensure alignment between stakeholders (Correct answer)
To make the test more complex.

Correct answer: To ensure alignment between stakeholders

Documenting the scope of a penetration test is critical for ensuring that all parties involved, including the client, management, and the testing team, have a shared understanding of what will and will not be tested. This clarity prevents misunderstandings, manages expectations, and ensures the test focuses on the agreed-upon objectives. It acts as a formal agreement, preventing scope creep or disputes later on.

Question 58: An attacker manipulates a URL parameter so the web server makes HTTP requests to internal network resources. What is this attack called?

Open Redirect
Command Injection
Remote File Inclusion (RFI)
Server-Side Request Forgery (SSRF) (Correct answer)

Correct answer: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) forces the server to make requests to internal or external resources, potentially exposing internal services not directly accessible to the attacker.

Question 59: A client's legal team requests a copy of all raw evidence (logs, screenshots, captured credentials) collected during a pentest. What should the tester consider FIRST?

Provide all evidence immediately without question
Provide only the final report
Review the contract to determine what data sharing obligations exist and consult with the testing firm's legal counsel (Correct answer)
Destroy all evidence before it can be subpoenaed

Correct answer: Review the contract to determine what data sharing obligations exist and consult with the testing firm's legal counsel

Sharing raw evidence with legal teams requires reviewing contractual obligations and consulting legal counsel, as it may involve sensitive data and legal implications.

Question 60: Which Metasploit post-exploitation module is used to add routes through a Meterpreter session for pivoting?

exploit/multi/handler
post/multi/manage/autoroute (Correct answer)
auxiliary/scanner/portscan/tcp
auxiliary/gather/enum_dns

Correct answer: post/multi/manage/autoroute

The autoroute post module adds network routes through an active Meterpreter session, enabling traffic to be proxied through the compromised host.

Question 61: A tester performs a credentialed vulnerability scan versus an uncredentialed scan. What is the PRIMARY advantage of a credentialed scan?

It requires no access to the target network
It is faster because it skips authentication checks
It bypasses firewall rules more effectively
It identifies vulnerabilities that are only visible from an authenticated perspective, such as patch levels (Correct answer)

Correct answer: It identifies vulnerabilities that are only visible from an authenticated perspective, such as patch levels

Credentialed scans authenticate to target systems and can inspect installed software versions, registry settings, and local configurations not visible externally.

Question 62: An attacker exploits a race condition between a privilege check and file operation in a SUID program. What classic vulnerability type does this represent?

Integer overflow
Double free
Time-of-check to time-of-use (TOCTOU) (Correct answer)
Use-after-free

Correct answer: Time-of-check to time-of-use (TOCTOU)

TOCTOU (Time-of-Check to Time-of-Use) exploits the window between a security check and the subsequent use of the checked resource.

Question 63: A tester discovers a web server running PHP with the allow_url_include directive enabled. An attacker supplies a remote URL as a file parameter. What attack is possible?

Remote File Inclusion (RFI) (Correct answer)
Local File Inclusion (LFI)
Server-Side Request Forgery (SSRF)
XML External Entity (XXE)

Correct answer: Remote File Inclusion (RFI)

Remote File Inclusion (RFI) allows attackers to include and execute remote files when the server fetches and processes URLs passed as parameters.

Question 64: During a red team engagement, an operator uses Cobalt Strike's sleep command combined with jitter. What is the primary purpose of this technique?

Encrypt C2 traffic
Evade network-based anomaly detection (Correct answer)
Increase beacon speed
Bypass endpoint AV scanning

Correct answer: Evade network-based anomaly detection

Sleep with jitter adds randomized delays to beacon check-ins, making traffic patterns irregular and harder to detect via network behavioral analysis.

Question 65: Which tool is widely used to extract plaintext passwords and NTLM hashes from Windows LSASS memory?

Hashcat
Mimikatz (Correct answer)
John the Ripper
Responder

Correct answer: Mimikatz

Mimikatz is the standard tool for dumping plaintext credentials, NTLM hashes, and Kerberos tickets directly from Windows LSASS process memory.

Question 66: A penetration test report recommends implementing network segmentation as a remediation for multiple findings. What type of recommendation is this?

A compensating control recommendation
A compliance-only recommendation
A strategic or architectural remediation recommendation addressing root cause across multiple findings (Correct answer)
A tactical quick-fix recommendation

Correct answer: A strategic or architectural remediation recommendation addressing root cause across multiple findings

Network segmentation addresses root causes affecting multiple findings simultaneously and represents a strategic architectural improvement rather than a tactical per-vulnerability fix.

Question 67: What is a zero-day attack?

An attack that tests physical security.
An attack targeting an unpatched, unknown vulnerability (Correct answer)
An attack that uses social engineering.
An attack that occurs after a patch is released.

Correct answer: An attack targeting an unpatched, unknown vulnerability

A zero-day attack refers to an exploit that targets a software vulnerability that is unknown to the vendor or for which no patch has yet been publicly released. The term "zero-day" signifies that the developers have had zero days to fix the vulnerability since it became known to the attackers. These attacks are particularly dangerous because there are no existing defenses or patches available to protect against them, making them highly effective until a fix is developed and deployed.

Question 68: Which stakeholder engagement strategy is MOST effective for PenTest+ professionals leading initiatives?

Engage stakeholders only when their approval is needed
Limit engagement to senior leadership only
Inform stakeholders only after decisions are made
Identify stakeholders early, understand their interests, and maintain regular communication (Correct answer)

Correct answer: Identify stakeholders early, understand their interests, and maintain regular communication

Early stakeholder identification, understanding their interests and concerns, and maintaining regular communication builds support, prevents surprises, and ensures diverse perspectives inform decision-making throughout the initiative.

Question 69: Which section of a penetration test report provides the highest-level summary intended for executives and decision-makers?

Appendices
Executive summary (Correct answer)
Methodology section
Technical findings section

Correct answer: Executive summary

The executive summary translates technical findings into business risk language for non-technical stakeholders who make strategic decisions.

Question 70: During pre-engagement scoping, a client states 'test everything.' What should the penetration tester do?

Decline the engagement due to vague scope
Require the client to define a specific, documented scope (Correct answer)
Begin testing immediately with maximum scope
Test only publicly accessible systems

Correct answer: Require the client to define a specific, documented scope

Vague scope definitions create legal and operational risk; the tester must work with the client to document specific targets, boundaries, and exclusions.

Question 71: Which phase of the penetration testing process involves documenting discovered vulnerabilities, their potential impact, and remediation recommendations?

Exploitation
Planning and scoping
Reporting (Correct answer)
Post-exploitation

Correct answer: Reporting

The reporting phase documents all findings including vulnerability details, evidence, business impact, and prioritized remediation guidance for the client.

Question 72: What does a 'get-out-of-jail-free letter' represent in the context of a penetration testing engagement?

A legal agreement preventing the client from suing the tester
A waiver releasing the client from paying for the engagement
A document granting immunity from reporting vulnerabilities
Written authorization proving the tester has permission to conduct the assessment (Correct answer)

Correct answer: Written authorization proving the tester has permission to conduct the assessment

A get-out-of-jail-free letter is written authorization from the client that a tester can present to law enforcement if questioned during the engagement.

Question 73: Which tool is used during physical penetration testing to read and clone RFID/NFC access badges?

USB Rubber Ducky
LAN Turtle
HackRF One SDR
Proxmark or Flipper Zero (Correct answer)

Correct answer: Proxmark or Flipper Zero

Proxmark and Flipper Zero are dedicated RFID/NFC research tools capable of reading, storing, and emulating proximity access card data for physical security testing.

Question 74: Which assessment method provides the MOST reliable data for PenTest+ professionals making critical decisions?

Social media reviews and testimonials
Informal verbal feedback alone
Standardized tools combined with professional observation (Correct answer)
Single-source data from one stakeholder

Correct answer: Standardized tools combined with professional observation

Combining standardized assessment tools with professional observation provides the most reliable and comprehensive data. Standardized tools ensure consistency and validity, while professional observation captures nuances that tools might miss.

Question 75: When assessment results for a CompTIA PenTest+ Certification evaluation are inconclusive, the BEST practice is to:

Report the results as definitive anyway
Discard the results and start over completely
Delay reporting until results are favorable
Conduct additional assessment using alternative methods (Correct answer)

Correct answer: Conduct additional assessment using alternative methods

Question 76: What is the significance of specifying IP address ranges versus domain names in a penetration test scope document?

Domain names expand the scope automatically to include all subdomains
IP ranges are more precise but domain names may resolve to shared hosting affecting third parties (Correct answer)
There is no practical difference between specifying IPs or domain names
Domain names are always preferred because IPs can change

Correct answer: IP ranges are more precise but domain names may resolve to shared hosting affecting third parties

Domain names may resolve to shared infrastructure used by multiple organizations, so testing based on IP ranges prevents inadvertent testing of third-party systems sharing the same host.

Question 77: How is SSH port forwarding used for pivoting during a penetration test?

To forward traffic through an SSH connection and reach internal hosts not directly accessible (Correct answer)
To bypass SSL certificate validation on internal servers
To brute-force SSH credentials on internal hosts
To encrypt all captured network traffic

Correct answer: To forward traffic through an SSH connection and reach internal hosts not directly accessible

SSH local (-L) and remote (-R) port forwarding tunnels traffic through an SSH connection, allowing access to internal services behind firewalls.

Question 78: What is the purpose of footprinting in penetration testing?

To limit the test’s duration.
To gather information for identifying vulnerabilities (Correct answer)
To assess security postures.
To conduct physical attacks.

Correct answer: To gather information for identifying vulnerabilities

Footprinting is the initial phase of reconnaissance in penetration testing, where an attacker or tester passively gathers as much information as possible about a target system or network. The primary purpose is to build a comprehensive profile of the target, including its infrastructure, services, and potential points of entry. This detailed intelligence is then used to identify specific vulnerabilities that can be exploited in later stages of the penetration test.

Question 79: An attacker sends an email appearing to come from an executive asking an employee to wire funds immediately. Which social engineering technique is this?

Vishing
Whaling
Business Email Compromise (BEC) (Correct answer)
Spear phishing

Correct answer: Business Email Compromise (BEC)

Business Email Compromise (BEC) involves impersonating executives or vendors to trick employees into transferring money or sensitive data.

Question 80: A penetration test scope document lists '192.168.1.0/24' as an in-scope target. During testing, the tester discovers a pivot to 10.10.0.0/16. What should they do?

Immediately test the 10.10.0.0/16 range since it was discovered organically
Document it but continue testing without notifying the client
Stop testing and notify the client before proceeding into out-of-scope systems (Correct answer)
Add the range to the scope document independently

Correct answer: Stop testing and notify the client before proceeding into out-of-scope systems

Accessing out-of-scope systems without authorization violates the rules of engagement and potentially the law; client notification and approval are required first.

Question 81: Which tool is specifically designed for conducting social engineering campaigns and phishing simulations during pentests?

Social-Engineer Toolkit (SET) (Correct answer)
Burp Suite
Aircrack-ng
Metasploit Framework

Correct answer: Social-Engineer Toolkit (SET)

The Social-Engineer Toolkit (SET) is an open-source framework built specifically for social engineering attacks including phishing, credential harvesting, and payload delivery.

Question 82: During a pentest, a tester accidentally accesses data that appears to be personally identifiable information (PII) outside the agreed scope. What is the correct action?

Document it in the final report only
Copy the data as evidence and continue
Delete the data to protect privacy
Immediately stop accessing the data and notify the client and legal counsel (Correct answer)

Correct answer: Immediately stop accessing the data and notify the client and legal counsel

Unintended access to out-of-scope PII requires immediate cessation of access and notification to the client and potentially legal counsel due to regulatory implications.

Question 83: When performing passive DNS reconnaissance, which resource provides historical DNS records including past IP addresses associated with a domain?

Passive DNS databases (e.g., RiskIQ, SecurityTrails) (Correct answer)
WHOIS database
Certificate transparency logs
ARIN IP allocation records

Correct answer: Passive DNS databases (e.g., RiskIQ, SecurityTrails)

Passive DNS databases aggregate historical DNS resolution data, allowing testers to find past IP addresses and infrastructure changes for a domain.

Question 84: Which tool is commonly used to exploit network vulnerabilities?

John the Ripper
Wireshark
Metasploit (Correct answer)
Nmap

Correct answer: Metasploit

Metasploit is a widely recognized and powerful open-source penetration testing framework. It provides a vast collection of exploits, payloads, and tools designed to discover, exploit, and validate vulnerabilities in various systems and applications. While other tools like Wireshark, Nmap, and John the Ripper serve different purposes, Metasploit is specifically engineered for the exploitation phase of a penetration test.

Question 85: When documenting assessment findings in PenTest+ practice, which approach is MOST appropriate?

Record objective findings, measurements, and professional observations factually (Correct answer)
Use technical jargon that only experts can understand
Include only positive findings to maintain optimism
Summarize findings verbally without written documentation

Correct answer: Record objective findings, measurements, and professional observations factually

Assessment documentation must be objective, factual, and comprehensive. Recording measurements, observations, and findings without bias ensures that the documentation is useful for decision-making and withstands scrutiny.

Question 86: Which Burp Suite feature is most useful for intercepting and modifying HTTP requests between a browser and a web server during a pentest?

Proxy (Correct answer)
Scanner
Repeater
Intruder

Correct answer: Proxy

Burp Suite's Proxy intercepts HTTP/HTTPS traffic between the browser and server, allowing a tester to view and modify requests and responses in real time.

Question 87: Which Metasploit auxiliary module creates a SOCKS proxy through an active Meterpreter session?

auxiliary/scanner/http/dir_scanner
auxiliary/server/capture/http
auxiliary/server/socks_proxy (Correct answer)
post/windows/gather/credentials

Correct answer: auxiliary/server/socks_proxy

The socks_proxy auxiliary module creates a local SOCKS listener that routes all traffic through the Meterpreter session for seamless pivoting.

Question 88: What is the purpose of a denial-of-service (DoS) attack?

To cause service interruption (Correct answer)
To gather sensitive information.
To decrease network bandwidth.
To increase system speed.

Correct answer: To cause service interruption

The primary purpose of a Denial-of-Service (DoS) attack is to make a machine or network resource unavailable to its intended users. This is typically achieved by overwhelming the target system with a flood of traffic or requests, or by exploiting a vulnerability that causes the system to crash or become unresponsive. The goal is to disrupt normal operations and prevent legitimate users from accessing services.

Question 89: A red team operator uses a signed binary (living off the land) to download and execute a payload, evading application whitelisting. Which category of technique does this represent?

LOLBin (Living Off the Land Binary) abuse (Correct answer)
Reflective DLL injection
Process injection
DLL sideloading

Correct answer: LOLBin (Living Off the Land Binary) abuse

LOLBin abuse leverages trusted, pre-installed system binaries like certutil, mshta, or regsvr32 to execute malicious code while evading whitelisting controls.

Question 90: Which document formally authorizes a penetration tester to perform testing activities and provides legal protection?

Rules of engagement (ROE)
Get-out-of-jail-free letter (Correct answer)
Statement of work (SOW)
Non-disclosure agreement (NDA)

Correct answer: Get-out-of-jail-free letter

A get-out-of-jail-free letter (authorization letter) from the client explicitly grants permission to test and provides legal protection if the tester is questioned by law enforcement.

CompTIA PenTest+ (PT0-003)

The CompTIA PenTest+ certification validates intermediate-level penetration testing skills, covering planning, reconnaissance, vulnerability analysis, attacks and exploits, and post-exploitation techniques used by ethical hackers and security professionals.

Questions

165 min

Time Limit

83%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds