CompTIA PenTest+ PT0-003 Exam 2026 – 190 Practice Questions
with Answers & Detailed Rationales, Engagement Management,
Reconnaissance, Vulnerability Analysis, Attacks & Exploits, Post-
Exploitation and Lateral Movement
DOMAIN 1: ENGAGEMENT MANAGEMENT (Questions 1–25)
Question 1
A penetration tester receives a signed authorization letter that lists the target scope as
"10.10.10.0/24." During active testing, the tester discovers a misconfigured router that
provides a direct path to 10.10.20.0/24, which contains production databases. The client's
CISO verbally states, "Go ahead and test that too, it's related." What is the MOST
appropriate action?
A. Immediately pivot to the newly discovered subnet since verbal authorization was granted.
B. Document the finding, halt testing on the unauthorized subnet, and request written scope
modification before proceeding.
C. Test only the database servers that appear to contain non-production data.
D. Continue testing the original scope and mention the discovery in the final report without
further action.
Correct Answer: B
Explanation: Verbal authorization does not satisfy scope change requirements; written
approval is mandatory before expanding testing boundaries.
Question 2
During an internal network assessment, a tester identifies a critical vulnerability in the
domain controller but notices that the client's IT director is in the room watching the screen.
The tester should:
,A. Exploit the vulnerability immediately to demonstrate value.
B. Hide the finding until the final report to avoid alarming the director.
C. Follow the pre-approved escalation path and communication plan defined in the rules of
engagement.
D. Ask the IT director verbally for permission to exploit the domain controller.
Correct Answer: C
Explanation: Rules of engagement define escalation procedures; testers must follow
established communication protocols rather than make ad hoc decisions.
Question 3
A client requests a penetration test for a web application but specifies that testing must not
cause any service interruptions during business hours (9 AM–5 PM). The tester discovers a
denial-of-service vulnerability. What is the BEST course of action?
A. Exploit the DoS vulnerability during business hours to prove impact.
B. Test the DoS vulnerability outside business hours with explicit written approval.
C. Report the DoS vulnerability as a theoretical risk without testing.
D. Test the vulnerability during lunch when traffic is lower.
Correct Answer: B
Explanation: DoS testing requires explicit authorization and should occur during approved
windows to avoid production impact while still validating the finding.
Question 4
A penetration tester is reviewing a statement of work (SOW) that includes a "get-out-of-jail-
free" clause. What does this clause typically address?
,A. The tester's ability to access any system without legal consequence.
B. The client's agreement not to pursue legal action for authorized testing activities.
C. The tester's right to retain all compromised data for personal use.
D. The client's obligation to pay for any damages caused during testing.
Correct Answer: B
Explanation: A get-out-of-jail-free clause protects the tester from legal liability for actions
performed within the authorized scope.
Question 5
During a cloud penetration test, the tester discovers that the client's AWS S3 bucket contains
publicly accessible customer data. The rules of engagement state that no actual customer
data may be accessed or downloaded. What should the tester do?
A. Download a single file to confirm the data is real, then delete it.
B. Document the misconfiguration based on metadata and bucket permissions without
accessing contents.
C. Access the bucket to inventory all exposed files for the report.
D. Ignore the finding since accessing data is prohibited.
Correct Answer: B
Explanation: The tester can confirm exposure through configuration analysis without
violating the explicit prohibition on data access.
Question 6
A penetration tester is preparing to conduct a social engineering assessment. Which
document MUST be in place before any pretexting activities begin?
, A. A vulnerability scan report from the previous quarter.
B. A network diagram of the target organization.
C. Written authorization from an executive with authority to approve social engineering
tests.
D. A list of employee personal email addresses.
Correct Answer: C
Explanation: Social engineering testing requires explicit executive-level authorization due to
potential psychological impact on employees.
Question 7
During an engagement, a tester discovers evidence of an ongoing criminal attack against the
client. What is the FIRST action the tester should take?
A. Continue testing to gather more evidence of the criminal activity.
B. Notify law enforcement directly without informing the client.
C. Immediately follow the pre-defined incident response escalation procedure in the rules of
engagement.
D. Shut down the affected systems to prevent further damage.
Correct Answer: C
Explanation: The rules of engagement should define incident response procedures; testers
must not deviate from agreed protocols during active threats.
Question 8
A client's legal team requests that all penetration testing data be encrypted at rest and
destroyed within 30 days of report delivery. This requirement falls under which category?
with Answers & Detailed Rationales, Engagement Management,
Reconnaissance, Vulnerability Analysis, Attacks & Exploits, Post-
Exploitation and Lateral Movement
DOMAIN 1: ENGAGEMENT MANAGEMENT (Questions 1–25)
Question 1
A penetration tester receives a signed authorization letter that lists the target scope as
"10.10.10.0/24." During active testing, the tester discovers a misconfigured router that
provides a direct path to 10.10.20.0/24, which contains production databases. The client's
CISO verbally states, "Go ahead and test that too, it's related." What is the MOST
appropriate action?
A. Immediately pivot to the newly discovered subnet since verbal authorization was granted.
B. Document the finding, halt testing on the unauthorized subnet, and request written scope
modification before proceeding.
C. Test only the database servers that appear to contain non-production data.
D. Continue testing the original scope and mention the discovery in the final report without
further action.
Correct Answer: B
Explanation: Verbal authorization does not satisfy scope change requirements; written
approval is mandatory before expanding testing boundaries.
Question 2
During an internal network assessment, a tester identifies a critical vulnerability in the
domain controller but notices that the client's IT director is in the room watching the screen.
The tester should:
,A. Exploit the vulnerability immediately to demonstrate value.
B. Hide the finding until the final report to avoid alarming the director.
C. Follow the pre-approved escalation path and communication plan defined in the rules of
engagement.
D. Ask the IT director verbally for permission to exploit the domain controller.
Correct Answer: C
Explanation: Rules of engagement define escalation procedures; testers must follow
established communication protocols rather than make ad hoc decisions.
Question 3
A client requests a penetration test for a web application but specifies that testing must not
cause any service interruptions during business hours (9 AM–5 PM). The tester discovers a
denial-of-service vulnerability. What is the BEST course of action?
A. Exploit the DoS vulnerability during business hours to prove impact.
B. Test the DoS vulnerability outside business hours with explicit written approval.
C. Report the DoS vulnerability as a theoretical risk without testing.
D. Test the vulnerability during lunch when traffic is lower.
Correct Answer: B
Explanation: DoS testing requires explicit authorization and should occur during approved
windows to avoid production impact while still validating the finding.
Question 4
A penetration tester is reviewing a statement of work (SOW) that includes a "get-out-of-jail-
free" clause. What does this clause typically address?
,A. The tester's ability to access any system without legal consequence.
B. The client's agreement not to pursue legal action for authorized testing activities.
C. The tester's right to retain all compromised data for personal use.
D. The client's obligation to pay for any damages caused during testing.
Correct Answer: B
Explanation: A get-out-of-jail-free clause protects the tester from legal liability for actions
performed within the authorized scope.
Question 5
During a cloud penetration test, the tester discovers that the client's AWS S3 bucket contains
publicly accessible customer data. The rules of engagement state that no actual customer
data may be accessed or downloaded. What should the tester do?
A. Download a single file to confirm the data is real, then delete it.
B. Document the misconfiguration based on metadata and bucket permissions without
accessing contents.
C. Access the bucket to inventory all exposed files for the report.
D. Ignore the finding since accessing data is prohibited.
Correct Answer: B
Explanation: The tester can confirm exposure through configuration analysis without
violating the explicit prohibition on data access.
Question 6
A penetration tester is preparing to conduct a social engineering assessment. Which
document MUST be in place before any pretexting activities begin?
, A. A vulnerability scan report from the previous quarter.
B. A network diagram of the target organization.
C. Written authorization from an executive with authority to approve social engineering
tests.
D. A list of employee personal email addresses.
Correct Answer: C
Explanation: Social engineering testing requires explicit executive-level authorization due to
potential psychological impact on employees.
Question 7
During an engagement, a tester discovers evidence of an ongoing criminal attack against the
client. What is the FIRST action the tester should take?
A. Continue testing to gather more evidence of the criminal activity.
B. Notify law enforcement directly without informing the client.
C. Immediately follow the pre-defined incident response escalation procedure in the rules of
engagement.
D. Shut down the affected systems to prevent further damage.
Correct Answer: C
Explanation: The rules of engagement should define incident response procedures; testers
must not deviate from agreed protocols during active threats.
Question 8
A client's legal team requests that all penetration testing data be encrypted at rest and
destroyed within 30 days of report delivery. This requirement falls under which category?
