CompTIA
PenTest+
Planning, Recon, Attacks & Exploits, Reporting & Tools — Mirrors Real Exam
Exam: PT0-003
85 Questions & Verified Answers
Domain 1: Planning and Scoping (Q01–Q13)
Q01. A penetration tester is hired to assess a company's web application. Before starting any
testing, what document must be obtained and signed by the APPROPRIATE company authority?
A. A non-disclosure agreement signed by the penetration tester
B. A written Rules of Engagement (RoE) document authorized by the company's legal authority
— defining scope, testing methods, timelines, out-of-scope systems, emergency contacts, and
providing legal protection for the tester
C. A vulnerability assessment report from a previous engagement
D. An NDA signed by the CEO only
Answer: B. Written Rules of Engagement authorized by the appropriate company authority
— defines scope, methods, timelines, legal protection
RoE is the FIRST required document before any testing begins — ethical and legal requirement.
Must be signed by someone with authority to authorize the testing (e.g., CISO, CTO, legal counsel).
Defines: in-scope IPs/systems, testing hours, allowed techniques, emergency stop conditions.
Get-out-of-jail letter: physical copy that proves authorization if law enforcement questions the tester.
Q02. During scoping, a client wants the penetration tester to assess their web application and the
underlying server infrastructure, but explicitly excludes their third-party payment processor. Which
document formally records this exclusion?
A. The penetration test report
B. The master service agreement
C. The Statement of Work (SoW) or scoping document — clearly delineating in-scope and out-
of-scope systems, including the payment processor exclusion
D. The penetration tester's professional liability insurance
Answer: C. The Statement of Work (SoW) or scoping document — clearly delineates in-
scope and out-of-scope systems
SoW: the contract that defines exactly what will and will not be tested.
, Explicit exclusions: listing the payment processor prevents the tester from accidentally testing third-
party systems.
Legal risk: testing out-of-scope systems — even accidentally — can constitute unauthorized
computer access.
Review with client: walk through the scope document together before signing to ensure mutual
understanding.
Q03. A penetration tester is asked to perform an assessment simulating an attack from a malicious
insider with domain user credentials and knowledge of internal network topology. Which type of
assessment does this describe?
A. Black box — no prior knowledge
B. White box — full knowledge of the environment
C. Red team — physical and social engineering included
D. Grey box — partial knowledge provided to the tester. Simulates an insider threat or supply
chain compromise where the attacker has some legitimate access and internal knowledge
Answer: D. Grey box — partial knowledge simulating an insider threat or partially-informed
external attacker
Black box: no credentials, no network info — simulates complete external attacker.
White box: full access to source code, architecture diagrams, credentials — most thorough, least
realistic.
Grey box: most common for real engagements — balances realism with thoroughness.
Red team: extended engagement, stealth, physical access, social engineering — broader scope
than a pentest.
Q04. A penetration tester discovers during reconnaissance that the target organization uses AWS
cloud infrastructure. The client has authorized testing of their applications. What must the tester
verify BEFORE scanning or exploiting AWS infrastructure?
A. That the client has AWS Business support plan
B. That the client's IAM policies allow external scanning
C. AWS policy: AWS allows customers to perform security testing against their own AWS
resources without prior approval for most services — the tester must confirm the client's
authorization covers AWS resources and review the AWS Penetration Testing Policy for any
service-specific restrictions
D. That the AWS account is in a dedicated VPC
Answer: C. Confirm client authorization covers AWS and review AWS Penetration Testing
Policy for service-specific restrictions
AWS permits testing of resources you own without prior approval for EC2, RDS, ELB, CloudFront,
API Gateway, Lambda, Lightsail.
Prohibited: DoS attacks against AWS infrastructure, DNS zone walking, port flooding.
Cloud-specific risks: testing shared infrastructure could affect other AWS customers.
Document: include cloud provider's permission policy in the engagement's authorization
documentation.
Q05. A client wants to understand their security posture without providing any prior information to
the penetration tester, to simulate a realistic external attacker. What type of assessment is
requested?
, A. White box
B. Grey box
C. Black box — the tester receives NO prior knowledge of the target environment, simulating a
real-world external attacker who must discover everything through reconnaissance
D. Crystal box
Answer: C. Black box — no prior knowledge, simulates a real-world external attacker who
must discover everything
Black box: most realistic simulation of an opportunistic external attacker.
Limitation: takes more time — tester must first perform extensive reconnaissance.
Best for: testing the effectiveness of security controls against unknown attackers.
Tester receives only: company name (or IP range) and a signed authorization letter.
Q06. During the pre-engagement phase, a penetration tester must determine the methodology
they will follow. Which framework provides a standardized 7-phase penetration testing
methodology?
A. OWASP Testing Guide — focused on web applications only
B. MITRE ATT&CK — a knowledge base of adversary TTPs, not a testing methodology
C. PTES (Penetration Testing Execution Standard) — a comprehensive 7-phase standard:
Pre-engagement, Intelligence Gathering, Threat Modeling, Vulnerability Analysis, Exploitation,
Post-Exploitation, and Reporting
D. NIST SP 800-115 — a technical guide for information security testing
Answer: C. PTES — 7 phases: Pre-engagement, Intelligence Gathering, Threat Modeling,
Vulnerability Analysis, Exploitation, Post-Exploitation, Reporting
PTES provides a standard structure for conducting and documenting penetration tests.
Phase 1 Pre-engagement: scope, authorization, rules of engagement.
Phase 6 Post-Exploitation: persistence, lateral movement, data exfiltration simulation.
Phase 7 Reporting: executive summary + technical findings with remediation.
Q07. A penetration tester is asked to evaluate a third-party SaaS application used by the client.
The application is hosted entirely by the SaaS vendor. What is the MOST important consideration
before testing?
A. Whether the client has administrator access to the SaaS application
B. The SaaS vendor's terms of service and whether testing is permitted — testing a third-party
hosted application without the vendor's authorization may violate computer crime laws
regardless of the client's authorization
C. Whether the SaaS application uses HTTPS
D. Whether the client pays for premium SaaS support
Answer: B. SaaS vendor's terms of service — testing third-party infrastructure without
vendor authorization may violate computer crime laws
Client authorization ≠ vendor authorization: the client can authorize testing of systems they own —
not systems they rent.
Obtain: either the vendor's written permission to test, or exclude the SaaS from scope.
Common SaaS providers: Salesforce, Workday, ServiceNow — all have bug bounty or penetration
testing policies.
Risk: testing without vendor authorization could result in criminal prosecution under CFAA
(Computer Fraud and Abuse Act).
, Q08. What does the term 'threat modeling' refer to in the context of penetration testing planning?
A. Creating a list of all known malware signatures
B. Identifying the most likely and impactful attack paths against the target — based on threat
actors relevant to the industry, the organization's asset value, and known vulnerabilities — to
prioritize penetration testing efforts
C. Installing threat detection software on target systems
D. Calculating the financial cost of each potential security incident
Answer: B. Identifying likely and impactful attack paths based on relevant threat actors,
asset value, and known vulnerabilities to prioritize testing
STRIDE: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of
Privilege — common threat categories.
DREAD: Damage, Reproducibility, Exploitability, Affected users, Discoverability — risk scoring
model.
Output: a ranked list of threats to address during the assessment — not all threats are equally likely.
Aligns with: MITRE ATT&CK threat groups relevant to the target industry.
Q09. A penetration tester completes an engagement and provides the report to the client. Two
weeks later, the client shares the report with a business partner. What should have been addressed
in the pre-engagement documentation?
A. The client's right to share results with partners should be covered in the confidentiality and
data handling section of the Rules of Engagement or master service agreement
B. This is always acceptable — clients own their reports
C. The penetration tester should have watermarked every page
D. Report sharing should be discussed after the engagement, not before
Answer: A. Confidentiality and data handling provisions in the RoE or MSA — who can
receive the report and under what conditions
Pre-engagement should address: report distribution list, who can receive the findings, NDA
requirements for third parties.
Sensitive findings: reports contain exploit details that could be misused — control distribution
carefully.
Business partners: if sharing is expected, the MSA should require the partner to sign an NDA.
Data retention: agreement should also specify how long the tester retains client data and test
artifacts.
Q10. A client requests that a penetration tester test their payment processing application, which
stores and transmits credit card data. Which compliance framework governs security requirements
for this environment?
A. HIPAA — Health Insurance Portability and Accountability Act
B. GDPR — General Data Protection Regulation
C. SOX — Sarbanes-Oxley Act
D. PCI-DSS — Payment Card Industry Data Security Standard — governs organizations that
store, process, or transmit cardholder data and defines security testing requirements
Answer: D. PCI-DSS — governs organizations handling cardholder data and defines security
testing requirements
PenTest+
Planning, Recon, Attacks & Exploits, Reporting & Tools — Mirrors Real Exam
Exam: PT0-003
85 Questions & Verified Answers
Domain 1: Planning and Scoping (Q01–Q13)
Q01. A penetration tester is hired to assess a company's web application. Before starting any
testing, what document must be obtained and signed by the APPROPRIATE company authority?
A. A non-disclosure agreement signed by the penetration tester
B. A written Rules of Engagement (RoE) document authorized by the company's legal authority
— defining scope, testing methods, timelines, out-of-scope systems, emergency contacts, and
providing legal protection for the tester
C. A vulnerability assessment report from a previous engagement
D. An NDA signed by the CEO only
Answer: B. Written Rules of Engagement authorized by the appropriate company authority
— defines scope, methods, timelines, legal protection
RoE is the FIRST required document before any testing begins — ethical and legal requirement.
Must be signed by someone with authority to authorize the testing (e.g., CISO, CTO, legal counsel).
Defines: in-scope IPs/systems, testing hours, allowed techniques, emergency stop conditions.
Get-out-of-jail letter: physical copy that proves authorization if law enforcement questions the tester.
Q02. During scoping, a client wants the penetration tester to assess their web application and the
underlying server infrastructure, but explicitly excludes their third-party payment processor. Which
document formally records this exclusion?
A. The penetration test report
B. The master service agreement
C. The Statement of Work (SoW) or scoping document — clearly delineating in-scope and out-
of-scope systems, including the payment processor exclusion
D. The penetration tester's professional liability insurance
Answer: C. The Statement of Work (SoW) or scoping document — clearly delineates in-
scope and out-of-scope systems
SoW: the contract that defines exactly what will and will not be tested.
, Explicit exclusions: listing the payment processor prevents the tester from accidentally testing third-
party systems.
Legal risk: testing out-of-scope systems — even accidentally — can constitute unauthorized
computer access.
Review with client: walk through the scope document together before signing to ensure mutual
understanding.
Q03. A penetration tester is asked to perform an assessment simulating an attack from a malicious
insider with domain user credentials and knowledge of internal network topology. Which type of
assessment does this describe?
A. Black box — no prior knowledge
B. White box — full knowledge of the environment
C. Red team — physical and social engineering included
D. Grey box — partial knowledge provided to the tester. Simulates an insider threat or supply
chain compromise where the attacker has some legitimate access and internal knowledge
Answer: D. Grey box — partial knowledge simulating an insider threat or partially-informed
external attacker
Black box: no credentials, no network info — simulates complete external attacker.
White box: full access to source code, architecture diagrams, credentials — most thorough, least
realistic.
Grey box: most common for real engagements — balances realism with thoroughness.
Red team: extended engagement, stealth, physical access, social engineering — broader scope
than a pentest.
Q04. A penetration tester discovers during reconnaissance that the target organization uses AWS
cloud infrastructure. The client has authorized testing of their applications. What must the tester
verify BEFORE scanning or exploiting AWS infrastructure?
A. That the client has AWS Business support plan
B. That the client's IAM policies allow external scanning
C. AWS policy: AWS allows customers to perform security testing against their own AWS
resources without prior approval for most services — the tester must confirm the client's
authorization covers AWS resources and review the AWS Penetration Testing Policy for any
service-specific restrictions
D. That the AWS account is in a dedicated VPC
Answer: C. Confirm client authorization covers AWS and review AWS Penetration Testing
Policy for service-specific restrictions
AWS permits testing of resources you own without prior approval for EC2, RDS, ELB, CloudFront,
API Gateway, Lambda, Lightsail.
Prohibited: DoS attacks against AWS infrastructure, DNS zone walking, port flooding.
Cloud-specific risks: testing shared infrastructure could affect other AWS customers.
Document: include cloud provider's permission policy in the engagement's authorization
documentation.
Q05. A client wants to understand their security posture without providing any prior information to
the penetration tester, to simulate a realistic external attacker. What type of assessment is
requested?
, A. White box
B. Grey box
C. Black box — the tester receives NO prior knowledge of the target environment, simulating a
real-world external attacker who must discover everything through reconnaissance
D. Crystal box
Answer: C. Black box — no prior knowledge, simulates a real-world external attacker who
must discover everything
Black box: most realistic simulation of an opportunistic external attacker.
Limitation: takes more time — tester must first perform extensive reconnaissance.
Best for: testing the effectiveness of security controls against unknown attackers.
Tester receives only: company name (or IP range) and a signed authorization letter.
Q06. During the pre-engagement phase, a penetration tester must determine the methodology
they will follow. Which framework provides a standardized 7-phase penetration testing
methodology?
A. OWASP Testing Guide — focused on web applications only
B. MITRE ATT&CK — a knowledge base of adversary TTPs, not a testing methodology
C. PTES (Penetration Testing Execution Standard) — a comprehensive 7-phase standard:
Pre-engagement, Intelligence Gathering, Threat Modeling, Vulnerability Analysis, Exploitation,
Post-Exploitation, and Reporting
D. NIST SP 800-115 — a technical guide for information security testing
Answer: C. PTES — 7 phases: Pre-engagement, Intelligence Gathering, Threat Modeling,
Vulnerability Analysis, Exploitation, Post-Exploitation, Reporting
PTES provides a standard structure for conducting and documenting penetration tests.
Phase 1 Pre-engagement: scope, authorization, rules of engagement.
Phase 6 Post-Exploitation: persistence, lateral movement, data exfiltration simulation.
Phase 7 Reporting: executive summary + technical findings with remediation.
Q07. A penetration tester is asked to evaluate a third-party SaaS application used by the client.
The application is hosted entirely by the SaaS vendor. What is the MOST important consideration
before testing?
A. Whether the client has administrator access to the SaaS application
B. The SaaS vendor's terms of service and whether testing is permitted — testing a third-party
hosted application without the vendor's authorization may violate computer crime laws
regardless of the client's authorization
C. Whether the SaaS application uses HTTPS
D. Whether the client pays for premium SaaS support
Answer: B. SaaS vendor's terms of service — testing third-party infrastructure without
vendor authorization may violate computer crime laws
Client authorization ≠ vendor authorization: the client can authorize testing of systems they own —
not systems they rent.
Obtain: either the vendor's written permission to test, or exclude the SaaS from scope.
Common SaaS providers: Salesforce, Workday, ServiceNow — all have bug bounty or penetration
testing policies.
Risk: testing without vendor authorization could result in criminal prosecution under CFAA
(Computer Fraud and Abuse Act).
, Q08. What does the term 'threat modeling' refer to in the context of penetration testing planning?
A. Creating a list of all known malware signatures
B. Identifying the most likely and impactful attack paths against the target — based on threat
actors relevant to the industry, the organization's asset value, and known vulnerabilities — to
prioritize penetration testing efforts
C. Installing threat detection software on target systems
D. Calculating the financial cost of each potential security incident
Answer: B. Identifying likely and impactful attack paths based on relevant threat actors,
asset value, and known vulnerabilities to prioritize testing
STRIDE: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of
Privilege — common threat categories.
DREAD: Damage, Reproducibility, Exploitability, Affected users, Discoverability — risk scoring
model.
Output: a ranked list of threats to address during the assessment — not all threats are equally likely.
Aligns with: MITRE ATT&CK threat groups relevant to the target industry.
Q09. A penetration tester completes an engagement and provides the report to the client. Two
weeks later, the client shares the report with a business partner. What should have been addressed
in the pre-engagement documentation?
A. The client's right to share results with partners should be covered in the confidentiality and
data handling section of the Rules of Engagement or master service agreement
B. This is always acceptable — clients own their reports
C. The penetration tester should have watermarked every page
D. Report sharing should be discussed after the engagement, not before
Answer: A. Confidentiality and data handling provisions in the RoE or MSA — who can
receive the report and under what conditions
Pre-engagement should address: report distribution list, who can receive the findings, NDA
requirements for third parties.
Sensitive findings: reports contain exploit details that could be misused — control distribution
carefully.
Business partners: if sharing is expected, the MSA should require the partner to sign an NDA.
Data retention: agreement should also specify how long the tester retains client data and test
artifacts.
Q10. A client requests that a penetration tester test their payment processing application, which
stores and transmits credit card data. Which compliance framework governs security requirements
for this environment?
A. HIPAA — Health Insurance Portability and Accountability Act
B. GDPR — General Data Protection Regulation
C. SOX — Sarbanes-Oxley Act
D. PCI-DSS — Payment Card Industry Data Security Standard — governs organizations that
store, process, or transmit cardholder data and defines security testing requirements
Answer: D. PCI-DSS — governs organizations handling cardholder data and defines security
testing requirements
