CompTIA PenTest+ (PT0-003) Full Course Complete Practice
Exam Questions with Correct Answers and Verified Detailed
Rationales| 2026/2027 Update | Graded A+
1. A penetration tester wants to determine which TCP ports are listening
on a target server. Which technique is most appropriate?
A. Port scanning
B. Password spraying
C. Data masking
D. File carving
Correct Answer: A. Port scanning
Explanation: Port scanning identifies accessible network ports and can help
determine which services may be exposed. The results provide an initial view
of the attack surface and can guide subsequent service enumeration and
vulnerability assessment. Scanning techniques should remain within the
authorized targets and rate limits defined by the engagement.
2. A vulnerable application is present on a server, but an automated
scanner fails to identify it. What type of scanning error has occurred?
A. False positive
B. False negative
C. Credential stuffing
D. Session fixation
Correct Answer: B. False negative
Explanation: A false negative occurs when a vulnerability exists but the
assessment tool fails to detect it. False negatives are particularly important
because they can create a misleading impression that an environment is
secure. Manual testing, authenticated scanning, multiple tools, and
appropriate test coverage can help reduce this risk.
,3. During reconnaissance, a tester wants to identify employee names,
email addresses, subdomains, and publicly available organizational
information without directly interacting with the target systems. Which
technique is most appropriate?
A. Passive reconnaissance
B. Active exploitation
C. Privilege escalation
D. Persistence
Correct Answer: A. Passive reconnaissance
Explanation: Passive reconnaissance gathers information from publicly
available sources without directly probing the target infrastructure. Examples
include search engines, public websites, social media, certificate transparency
records, public DNS information, and other open-source intelligence sources.
This approach can reveal useful information while minimizing interaction
with the target.
4. A tester performs DNS queries and directly interacts with a company's
internet-facing infrastructure to identify hosts and services. Which type
of reconnaissance is being performed?
A. Passive reconnaissance
B. Active reconnaissance
C. Social engineering
D. Data exfiltration
Correct Answer: B. Active reconnaissance
Explanation: Active reconnaissance involves directly interacting with target
systems to gather information. Examples include DNS enumeration, port
scanning, service discovery, banner grabbing, and network probing. Because
active reconnaissance generates traffic that may be logged or detected, it
should be performed only within the authorized scope.
,5. A penetration tester is preparing for an authorized assessment of a
company's external web application. The client has specified the target
domain, testing dates, permitted techniques, and emergency contact
procedures. Which document most directly establishes the authorization
and rules for the engagement?
A. Vulnerability scan report
B. Rules of engagement
C. Incident response plan
D. Security awareness policy
Correct Answer: B. Rules of engagement
Explanation: The rules of engagement (RoE) define how an authorized
penetration test will be conducted. They commonly establish the scope,
targets, testing windows, prohibited activities, communication procedures,
authorization boundaries, and emergency contacts. Clearly defined RoE help
prevent accidental testing of systems outside the client's authorization and
provide the tester with operational boundaries.
6. A tester discovers an open TCP port associated with an unknown
service. Which activity would provide more information about the
service and its configuration?
A. Service enumeration
B. Data destruction
C. Password rotation
D. Log deletion
Correct Answer: A. Service enumeration
Explanation: Service enumeration attempts to identify the software, version,
configuration, and characteristics associated with an exposed service.
Information such as product names and versions can help the tester
determine whether known vulnerabilities or configuration weaknesses may
exist.
, 7. A tester finds that a web server is running an outdated version of a
known application framework. What should the tester do first before
attempting exploitation?
A. Confirm the version and determine whether the vulnerability applies
B. Immediately delete the vulnerable application
C. Modify the production database
D. Disable the server's logging
Correct Answer: A. Confirm the version and determine whether the
vulnerability applies
Explanation: Vulnerability identification should be validated before
exploitation whenever practical. Version information can be inaccurate,
patched, backported, or misleading. Confirming the software version and
vulnerability applicability reduces false positives and helps the tester select
an appropriate, controlled validation method.
8. A vulnerability scanner reports that a server is vulnerable to a specific
issue, but the tester suspects the finding may be inaccurate. What is this
situation called?
A. False positive
B. False negative
C. Privilege escalation
D. Persistence
Correct Answer: A. False positive
Explanation: A false positive occurs when a security tool reports a
vulnerability that does not actually exist. Penetration testers should validate
important findings manually or through safe verification techniques. False
positives can otherwise result in inaccurate risk assessments and unnecessary
remediation efforts.
Exam Questions with Correct Answers and Verified Detailed
Rationales| 2026/2027 Update | Graded A+
1. A penetration tester wants to determine which TCP ports are listening
on a target server. Which technique is most appropriate?
A. Port scanning
B. Password spraying
C. Data masking
D. File carving
Correct Answer: A. Port scanning
Explanation: Port scanning identifies accessible network ports and can help
determine which services may be exposed. The results provide an initial view
of the attack surface and can guide subsequent service enumeration and
vulnerability assessment. Scanning techniques should remain within the
authorized targets and rate limits defined by the engagement.
2. A vulnerable application is present on a server, but an automated
scanner fails to identify it. What type of scanning error has occurred?
A. False positive
B. False negative
C. Credential stuffing
D. Session fixation
Correct Answer: B. False negative
Explanation: A false negative occurs when a vulnerability exists but the
assessment tool fails to detect it. False negatives are particularly important
because they can create a misleading impression that an environment is
secure. Manual testing, authenticated scanning, multiple tools, and
appropriate test coverage can help reduce this risk.
,3. During reconnaissance, a tester wants to identify employee names,
email addresses, subdomains, and publicly available organizational
information without directly interacting with the target systems. Which
technique is most appropriate?
A. Passive reconnaissance
B. Active exploitation
C. Privilege escalation
D. Persistence
Correct Answer: A. Passive reconnaissance
Explanation: Passive reconnaissance gathers information from publicly
available sources without directly probing the target infrastructure. Examples
include search engines, public websites, social media, certificate transparency
records, public DNS information, and other open-source intelligence sources.
This approach can reveal useful information while minimizing interaction
with the target.
4. A tester performs DNS queries and directly interacts with a company's
internet-facing infrastructure to identify hosts and services. Which type
of reconnaissance is being performed?
A. Passive reconnaissance
B. Active reconnaissance
C. Social engineering
D. Data exfiltration
Correct Answer: B. Active reconnaissance
Explanation: Active reconnaissance involves directly interacting with target
systems to gather information. Examples include DNS enumeration, port
scanning, service discovery, banner grabbing, and network probing. Because
active reconnaissance generates traffic that may be logged or detected, it
should be performed only within the authorized scope.
,5. A penetration tester is preparing for an authorized assessment of a
company's external web application. The client has specified the target
domain, testing dates, permitted techniques, and emergency contact
procedures. Which document most directly establishes the authorization
and rules for the engagement?
A. Vulnerability scan report
B. Rules of engagement
C. Incident response plan
D. Security awareness policy
Correct Answer: B. Rules of engagement
Explanation: The rules of engagement (RoE) define how an authorized
penetration test will be conducted. They commonly establish the scope,
targets, testing windows, prohibited activities, communication procedures,
authorization boundaries, and emergency contacts. Clearly defined RoE help
prevent accidental testing of systems outside the client's authorization and
provide the tester with operational boundaries.
6. A tester discovers an open TCP port associated with an unknown
service. Which activity would provide more information about the
service and its configuration?
A. Service enumeration
B. Data destruction
C. Password rotation
D. Log deletion
Correct Answer: A. Service enumeration
Explanation: Service enumeration attempts to identify the software, version,
configuration, and characteristics associated with an exposed service.
Information such as product names and versions can help the tester
determine whether known vulnerabilities or configuration weaknesses may
exist.
, 7. A tester finds that a web server is running an outdated version of a
known application framework. What should the tester do first before
attempting exploitation?
A. Confirm the version and determine whether the vulnerability applies
B. Immediately delete the vulnerable application
C. Modify the production database
D. Disable the server's logging
Correct Answer: A. Confirm the version and determine whether the
vulnerability applies
Explanation: Vulnerability identification should be validated before
exploitation whenever practical. Version information can be inaccurate,
patched, backported, or misleading. Confirming the software version and
vulnerability applicability reduces false positives and helps the tester select
an appropriate, controlled validation method.
8. A vulnerability scanner reports that a server is vulnerable to a specific
issue, but the tester suspects the finding may be inaccurate. What is this
situation called?
A. False positive
B. False negative
C. Privilege escalation
D. Persistence
Correct Answer: A. False positive
Explanation: A false positive occurs when a security tool reports a
vulnerability that does not actually exist. Penetration testers should validate
important findings manually or through safe verification techniques. False
positives can otherwise result in inaccurate risk assessments and unnecessary
remediation efforts.
