1
CompTIA PenTest+ (PT0-003) Final Comprehensive
Exam 2026: 200 Complex Scenario Questions &
Verified Answers with Detailed Rationales –
Complete Study Guide
1. During a penetration test for a financial institution, you discover that a
database server is running an outdated version of MySQL with a known
remote code execution vulnerability. However, the server is located in a
network segment that is only accessible after compromising an internal
workstation. The client's primary concern is data exfiltration. Which of the
following BEST describes the appropriate sequence of actions?**
A. Immediately exploit the MySQL vulnerability to demonstrate impact
B. Document the vulnerability, continue testing other in-scope systems, and
report the finding with a recommendation for network segmentation
C. Attempt to compromise the internal workstation first, then exploit the
MySQL server to demonstrate the full attack chain
D. Ignore the vulnerability since it requires internal access and is therefore not
exploitable by an external attacker
Answer: C
Rationale: The best approach is to demonstrate the full attack chain by
compromising the internal workstation first and then exploiting the MySQL
server. This shows the client the real-world impact of the vulnerability in the
context of their network architecture. Option A skips the necessary steps and
may not be feasible without internal access. Option B documents the finding
but does not demonstrate the full impact, which is the purpose of a
penetration test. Option D ignores a valid vulnerability that could be exploited
by an attacker who gains internal access through phishing or other means.
,2
2. You are conducting a penetration test for a healthcare organization subject
to HIPAA regulations. During your testing, you discover a database containing
protected health information (PHI) that is accessible due to a misconfigured
access control list. The client has explicitly stated that no actual PHI should be
accessed or exfiltrated. What is the MOST appropriate course of action?
A. Access the database to confirm the PHI is present, then document the
finding
B. Do not access the database, document the misconfiguration based on your
scan results, and immediately notify the client
C. Access a single record to confirm the vulnerability, then immediately delete
the evidence
D. Continue testing other systems and mention the finding in the final report
Answer: B
Rationale: The client explicitly stated that no actual PHI should be accessed or
exfiltrated. The tester must respect this constraint. The appropriate action is
to not access the database, document the misconfiguration based on scan
results (which show the access control issue), and immediately notify the
client because PHI exposure is a critical finding. Option A violates the client's
explicit instruction. Option C violates the instruction and destroys evidence.
Option D delays notification of a critical finding.
,3
3. A penetration tester is conducting an internal network assessment. After
successfully compromising a low-privileged user account, the tester discovers
a service running as SYSTEM with an unquoted service path. The tester
attempts to exploit this vulnerability but fails because the directory containing
the malicious executable is not writable. Which of the following BEST
describes the next step?
A. Abandon the privilege escalation attempt and move to another target
B. Document the unquoted service path as a finding with a note that
exploitation was not possible due to directory permissions
C. Attempt to modify the permissions on the directory using the compromised
low-privileged account
D. Search for other privilege escalation vectors and document this finding as a
potential risk
Answer: D
Rationale: The best approach is to search for other privilege escalation vectors
while documenting the unquoted service path as a potential risk. Just because
this particular path is not exploitable doesn't mean it couldn't become
exploitable if permissions change or if combined with another vulnerability.
Option A abandons a valid finding. Option B documents the finding but
doesn't continue searching for other escalation paths. Option C may not be
possible with low privileges and could cause unintended changes.
4. During a web application penetration test, you discover that the application
uses JWTs for authentication. You notice that the JWT header contains "alg":
"none" and the application accepts tokens without a signature. What is the
MOST critical implication of this finding?
A. The application is vulnerable to token replay attacks
B. The application is vulnerable to privilege escalation through token forgery
C. The application is vulnerable to cross-site scripting
D. The application is vulnerable to SQL injection
, 4
Answer: B
Rationale: The "alg": "none" vulnerability in JWT allows attackers to forge
tokens with arbitrary claims without needing a valid signature. This means an
attacker could change their role from "user" to "admin" by simply modifying
the token and setting the algorithm to "none". This is a privilege escalation
vulnerability. Option A is a different attack. Options C and D are unrelated to
JWT handling.
5. You are testing a wireless network and successfully capture a WPA2
handshake. After attempting to crack the handshake with a dictionary attack
for several hours, you are unsuccessful. What is the MOST likely explanation
for this?
A. The handshake was captured incorrectly
B. The password is not in your dictionary and is likely complex
C. WPA2 cannot be cracked with dictionary attacks
D. The wireless network uses WPA3 instead of WPA2
Answer: B
Rationale: If a dictionary attack is unsuccessful after several hours, the most
likely explanation is that the password is not in the dictionary and is likely
complex. A complex password that is not based on common words or patterns
would not be found in a standard dictionary. Option A is possible but less
likely if the handshake was properly captured. Option C is incorrect because
WPA2 is vulnerable to dictionary attacks. Option D is incorrect because the
scenario states WPA2.
CompTIA PenTest+ (PT0-003) Final Comprehensive
Exam 2026: 200 Complex Scenario Questions &
Verified Answers with Detailed Rationales –
Complete Study Guide
1. During a penetration test for a financial institution, you discover that a
database server is running an outdated version of MySQL with a known
remote code execution vulnerability. However, the server is located in a
network segment that is only accessible after compromising an internal
workstation. The client's primary concern is data exfiltration. Which of the
following BEST describes the appropriate sequence of actions?**
A. Immediately exploit the MySQL vulnerability to demonstrate impact
B. Document the vulnerability, continue testing other in-scope systems, and
report the finding with a recommendation for network segmentation
C. Attempt to compromise the internal workstation first, then exploit the
MySQL server to demonstrate the full attack chain
D. Ignore the vulnerability since it requires internal access and is therefore not
exploitable by an external attacker
Answer: C
Rationale: The best approach is to demonstrate the full attack chain by
compromising the internal workstation first and then exploiting the MySQL
server. This shows the client the real-world impact of the vulnerability in the
context of their network architecture. Option A skips the necessary steps and
may not be feasible without internal access. Option B documents the finding
but does not demonstrate the full impact, which is the purpose of a
penetration test. Option D ignores a valid vulnerability that could be exploited
by an attacker who gains internal access through phishing or other means.
,2
2. You are conducting a penetration test for a healthcare organization subject
to HIPAA regulations. During your testing, you discover a database containing
protected health information (PHI) that is accessible due to a misconfigured
access control list. The client has explicitly stated that no actual PHI should be
accessed or exfiltrated. What is the MOST appropriate course of action?
A. Access the database to confirm the PHI is present, then document the
finding
B. Do not access the database, document the misconfiguration based on your
scan results, and immediately notify the client
C. Access a single record to confirm the vulnerability, then immediately delete
the evidence
D. Continue testing other systems and mention the finding in the final report
Answer: B
Rationale: The client explicitly stated that no actual PHI should be accessed or
exfiltrated. The tester must respect this constraint. The appropriate action is
to not access the database, document the misconfiguration based on scan
results (which show the access control issue), and immediately notify the
client because PHI exposure is a critical finding. Option A violates the client's
explicit instruction. Option C violates the instruction and destroys evidence.
Option D delays notification of a critical finding.
,3
3. A penetration tester is conducting an internal network assessment. After
successfully compromising a low-privileged user account, the tester discovers
a service running as SYSTEM with an unquoted service path. The tester
attempts to exploit this vulnerability but fails because the directory containing
the malicious executable is not writable. Which of the following BEST
describes the next step?
A. Abandon the privilege escalation attempt and move to another target
B. Document the unquoted service path as a finding with a note that
exploitation was not possible due to directory permissions
C. Attempt to modify the permissions on the directory using the compromised
low-privileged account
D. Search for other privilege escalation vectors and document this finding as a
potential risk
Answer: D
Rationale: The best approach is to search for other privilege escalation vectors
while documenting the unquoted service path as a potential risk. Just because
this particular path is not exploitable doesn't mean it couldn't become
exploitable if permissions change or if combined with another vulnerability.
Option A abandons a valid finding. Option B documents the finding but
doesn't continue searching for other escalation paths. Option C may not be
possible with low privileges and could cause unintended changes.
4. During a web application penetration test, you discover that the application
uses JWTs for authentication. You notice that the JWT header contains "alg":
"none" and the application accepts tokens without a signature. What is the
MOST critical implication of this finding?
A. The application is vulnerable to token replay attacks
B. The application is vulnerable to privilege escalation through token forgery
C. The application is vulnerable to cross-site scripting
D. The application is vulnerable to SQL injection
, 4
Answer: B
Rationale: The "alg": "none" vulnerability in JWT allows attackers to forge
tokens with arbitrary claims without needing a valid signature. This means an
attacker could change their role from "user" to "admin" by simply modifying
the token and setting the algorithm to "none". This is a privilege escalation
vulnerability. Option A is a different attack. Options C and D are unrelated to
JWT handling.
5. You are testing a wireless network and successfully capture a WPA2
handshake. After attempting to crack the handshake with a dictionary attack
for several hours, you are unsuccessful. What is the MOST likely explanation
for this?
A. The handshake was captured incorrectly
B. The password is not in your dictionary and is likely complex
C. WPA2 cannot be cracked with dictionary attacks
D. The wireless network uses WPA3 instead of WPA2
Answer: B
Rationale: If a dictionary attack is unsuccessful after several hours, the most
likely explanation is that the password is not in the dictionary and is likely
complex. A complex password that is not based on common words or patterns
would not be found in a standard dictionary. Option A is possible but less
likely if the handshake was properly captured. Option C is incorrect because
WPA2 is vulnerable to dictionary attacks. Option D is incorrect because the
scenario states WPA2.
