CompTIA PenTest+ (PT0-003) Certification Exam 2026:
Comprehensive 200 Practice Questions & Verified Answers with
Rationales – Complete Study Guide||EXAM NEWEST 2026 TEST
BANK| COMPLETE 200 REAL EXAM QUESTIONS AND CORRECT
VERIFIED ANSWERS/ ALREADY GRADED A+| COMPTIA PENTEST+
(PT0-003) EXAM PREP (MOST RECENT!!)
1. Which document should be signed before a penetration test to ensure the
client's sensitive information remains confidential?
A. Rules of Engagement (RoE)
B. Non-Disclosure Agreement (NDA)
C. Statement of Work (SOW)
D. Service Level Agreement (SLA)
Answer: B
Rationale: A Non-Disclosure Agreement (NDA) is a legal document that
ensures any sensitive information accessed by the penetration tester during
the engagement remains confidential. The RoE defines the testing boundaries
and acceptable methods, while the SOW outlines the specific tasks and
deliverables. The SLA pertains to service performance and uptime. The NDA is
specifically designed to protect confidential information and is typically signed
before any engagement begins.
,2. Which technique uses detailed information about a company's publicly
available systems and services without interacting with them directly?
A. Active reconnaissance
B. Passive reconnaissance
C. Vulnerability scanning
D. Exploitation
Answer: B
Rationale: Passive reconnaissance involves gathering information about a
target without directly interacting with their systems. This includes using
public sources like WHOIS lookups, DNS records, social media, and job boards.
Active reconnaissance (A) involves direct interaction with the target, such as
port scanning or banner grabbing. Vulnerability scanning (C) and exploitation
(D) are later phases that involve direct interaction.
3. Which of the following tools is commonly used to automate exploit
development and execution against a vulnerable target system?
A. Hydra
B. John the Ripper
C. Metasploit
D. sqlmap
Answer: C
Rationale: Metasploit is a comprehensive penetration testing framework that
allows testers to develop, test, and execute exploits against target systems.
Hydra (A) is a password cracking tool. John the Ripper (B) is a password hash
cracker. sqlmap (D) is specifically designed for SQL injection attacks.
Metasploit is the most comprehensive tool for automating exploit
development and execution.
,4. Which of the following techniques is the best to maintain access to a
compromised system after a reboot or if the initial exploit is closed?
A. Clear system logs
B. Schedule a cron job
C. Escalate privileges
D. Use PsExec for lateral movement
Answer: B
Rationale: Scheduling a cron job (Linux) or scheduled task (Windows) ensures
that the payload executes at specific intervals or upon system startup,
maintaining persistence. Clearing system logs (A) is a covering tracks
technique, not persistence. Privilege escalation (C) is a separate objective.
PsExec (D) is used for lateral movement, not persistence.
5. In which section of a penetration test report should a non-technical
summary of key findings and their business impact be included?
A. Scope and Methodology
B. Findings and Evidence
C. Executive Summary
D. Remediation Recommendations
Answer: C
Rationale: The Executive Summary provides a high-level, non-technical
overview of the penetration test, its findings, and their business impact. It is
designed for non-technical stakeholders such as executives and board
members. The Scope and Methodology (A) section describes what was tested
and how. The Findings and Evidence (B) section provides technical details.
Remediation Recommendations (D) provide specific fixes.
, 6. Which regulation enforces strict rules on data protection within the EU,
including requirements like obtaining permission for data processing and
performing data impact assessments?
A. HIPAA
B. GDPR
C. GLBA
D. PCI DSS
Answer: B
Rationale:The General Data Protection Regulation (GDPR) is the EU regulation
that enforces strict rules on data protection, including obtaining consent for
data processing and conducting data protection impact assessments. HIPAA
(A) is a US healthcare regulation. GLBA (C) is a US financial services regulation.
PCI DSS (D) is a payment card industry standard.
7. Why is it important for penetration testers to understand and operate
within regulations such as GDPR and GLBA?
A. To ensure legal compliance and protect sensitive data
B. To increase the speed of the penetration test
C. To reduce the cost of the engagement
D. To avoid using automated tools
Answer: A
Rationale: Penetration testers must understand and operate within
regulations such as GDPR and GLBA to ensure legal compliance and protect
sensitive data. Violating these regulations can result in significant fines and
legal consequences. Speed (B), cost (C), and tool selection (D) are not the
primary reasons for regulatory compliance.
Comprehensive 200 Practice Questions & Verified Answers with
Rationales – Complete Study Guide||EXAM NEWEST 2026 TEST
BANK| COMPLETE 200 REAL EXAM QUESTIONS AND CORRECT
VERIFIED ANSWERS/ ALREADY GRADED A+| COMPTIA PENTEST+
(PT0-003) EXAM PREP (MOST RECENT!!)
1. Which document should be signed before a penetration test to ensure the
client's sensitive information remains confidential?
A. Rules of Engagement (RoE)
B. Non-Disclosure Agreement (NDA)
C. Statement of Work (SOW)
D. Service Level Agreement (SLA)
Answer: B
Rationale: A Non-Disclosure Agreement (NDA) is a legal document that
ensures any sensitive information accessed by the penetration tester during
the engagement remains confidential. The RoE defines the testing boundaries
and acceptable methods, while the SOW outlines the specific tasks and
deliverables. The SLA pertains to service performance and uptime. The NDA is
specifically designed to protect confidential information and is typically signed
before any engagement begins.
,2. Which technique uses detailed information about a company's publicly
available systems and services without interacting with them directly?
A. Active reconnaissance
B. Passive reconnaissance
C. Vulnerability scanning
D. Exploitation
Answer: B
Rationale: Passive reconnaissance involves gathering information about a
target without directly interacting with their systems. This includes using
public sources like WHOIS lookups, DNS records, social media, and job boards.
Active reconnaissance (A) involves direct interaction with the target, such as
port scanning or banner grabbing. Vulnerability scanning (C) and exploitation
(D) are later phases that involve direct interaction.
3. Which of the following tools is commonly used to automate exploit
development and execution against a vulnerable target system?
A. Hydra
B. John the Ripper
C. Metasploit
D. sqlmap
Answer: C
Rationale: Metasploit is a comprehensive penetration testing framework that
allows testers to develop, test, and execute exploits against target systems.
Hydra (A) is a password cracking tool. John the Ripper (B) is a password hash
cracker. sqlmap (D) is specifically designed for SQL injection attacks.
Metasploit is the most comprehensive tool for automating exploit
development and execution.
,4. Which of the following techniques is the best to maintain access to a
compromised system after a reboot or if the initial exploit is closed?
A. Clear system logs
B. Schedule a cron job
C. Escalate privileges
D. Use PsExec for lateral movement
Answer: B
Rationale: Scheduling a cron job (Linux) or scheduled task (Windows) ensures
that the payload executes at specific intervals or upon system startup,
maintaining persistence. Clearing system logs (A) is a covering tracks
technique, not persistence. Privilege escalation (C) is a separate objective.
PsExec (D) is used for lateral movement, not persistence.
5. In which section of a penetration test report should a non-technical
summary of key findings and their business impact be included?
A. Scope and Methodology
B. Findings and Evidence
C. Executive Summary
D. Remediation Recommendations
Answer: C
Rationale: The Executive Summary provides a high-level, non-technical
overview of the penetration test, its findings, and their business impact. It is
designed for non-technical stakeholders such as executives and board
members. The Scope and Methodology (A) section describes what was tested
and how. The Findings and Evidence (B) section provides technical details.
Remediation Recommendations (D) provide specific fixes.
, 6. Which regulation enforces strict rules on data protection within the EU,
including requirements like obtaining permission for data processing and
performing data impact assessments?
A. HIPAA
B. GDPR
C. GLBA
D. PCI DSS
Answer: B
Rationale:The General Data Protection Regulation (GDPR) is the EU regulation
that enforces strict rules on data protection, including obtaining consent for
data processing and conducting data protection impact assessments. HIPAA
(A) is a US healthcare regulation. GLBA (C) is a US financial services regulation.
PCI DSS (D) is a payment card industry standard.
7. Why is it important for penetration testers to understand and operate
within regulations such as GDPR and GLBA?
A. To ensure legal compliance and protect sensitive data
B. To increase the speed of the penetration test
C. To reduce the cost of the engagement
D. To avoid using automated tools
Answer: A
Rationale: Penetration testers must understand and operate within
regulations such as GDPR and GLBA to ensure legal compliance and protect
sensitive data. Violating these regulations can result in significant fines and
legal consequences. Speed (B), cost (C), and tool selection (D) are not the
primary reasons for regulatory compliance.
