CompTIA PenTest+ (PT0-003) Full Course &
Practice Exam – Complete Practice Exam
Questions with 100% Verified Correct
Answers and Detailed Rationales | Latest
Update - 2026/2027 | Already Graded A+
Question 1
Which of the following is the most effective way to reduce a system's attack
surface during system hardening?
A. Disable unnecessary services
B. Enable SELinux
C. Implement transport layer security
D. Change default passwords
Answer: A
Rationale: Disabling unnecessary services reduces the number of potential entry
points an attacker could exploit, effectively minimizing the system's attack surface.
While enabling SELinux, implementing TLS, and changing default passwords all
improve security, they do not reduce the attack surface as directly as disabling
unneeded services.
Question 2
Which command in Bash is used to search through a file for a specific pattern of
text?
A. fsck
B. udp
C. grep
D. nmap
Answer: C
Rationale: The grep command is used to search through files for specific patterns
pg. 1
,of text using regular expressions. fsck is used for file system checks, udp is a
protocol, and nmap is a network scanning tool.
Question 3
Which tool helps simulate malware-like attacks to improve network security?
A. Cross-Site Request Forgery
B. Exploit-DB
C. Cobalt Strike
D. Infection Monkey
Answer: D
Rationale: Infection Monkey is an open-source tool that simulates malware-like
attacks to test network security and identify vulnerabilities. Exploit-DB is a
database of exploits, Cobalt Strike is a penetration testing tool for adversary
simulation, and CSRF is a type of attack, not a tool.
Question 4
Which phase of the PTES framework involves gaining knowledge about the target
system using both passive and active techniques?
A. Vulnerability Analysis
B. Banner Grabbing
C. Persistence
D. Information Gathering
Answer: D
Rationale: The Information Gathering phase of the PTES (Penetration Testing
Execution Standard) framework involves collecting data about the target using
both passive (OSINT) and active (scanning) techniques. Vulnerability analysis
comes after information gathering, and persistence is for maintaining access.
Question 5
What is the key difference between Bluejacking and Bluetooth spamming?
A. Bluejacking involves sending unsolicited messages to nearby Bluetooth
devices; Bluetooth spamming is a more intrusive method involving repeated
pg. 2
,messages or malicious files
B. Bluejacking is more intrusive than Bluetooth spamming
C. They are the same thing
D. Bluejacking requires Bluetooth to be disabled
Answer: A
Rationale: Bluejacking involves sending unsolicited messages to nearby Bluetooth
devices. Bluetooth spamming is a more intrusive method involving repeated
messages or malicious files. Overloading a device is related to spamming, and
Bluetooth doesn't need to be disabled to receive these attacks.
Question 6
Which command saves the captured network packets to a file for later analysis
using tcpdump?
A. xmas scan
B. aircrack-ng
C. tcpdump -w capture.pcap
D. masvs-crypto
Answer: C
Rationale: The command tcpdump -w capture.pcap saves captured packets to a
file named capture.pcap for later analysis. The -w flag writes the output to a file.
Xmas scan is an Nmap scan type; aircrack-ng is for cracking wireless encryption.
Question 7
Which type of DNS query attempts to replicate DNS records between DNS
servers?
A. Zone transfer
B. PowerShell
C. Reverse lookup zone
D. Record transfer
Answer: A
Rationale: A zone transfer (AXFR) is a type of DNS query that replicates DNS
records between DNS servers. It is used to synchronize DNS databases and can be
pg. 3
, a security risk if not properly restricted. Reverse lookup zones resolve IP addresses
to hostnames.
Question 8
Why is it important to validate scan results during a penetration test?
A. Validating scan results helps to automatically patch any vulnerabilities found
without manual intervention
B. Validating scan results ensures that the findings from automated tools are
accurate, helping to confirm true positives and avoid false positives or false
negatives
C. Validating scan results is primarily done to ensure the automated tools are
running at their maximum speed and efficiency
D. Validating scan results is necessary to confirm that the penetration tester has
followed all the steps in the methodology exactly
Answer: B
Rationale: Validating scan results ensures that findings from automated tools are
accurate, helping to confirm true positives and avoid false positives or false
negatives. This prevents wasting time on non-existent vulnerabilities and missing
real ones.
Question 9
What tool can be used to create a fake Wi-Fi access point for an Evil Twin attack?
A. CrackMapExec
B. Wi-Fi Pumpkin
C. Responder
D. Impacket
Answer: B
Rationale: Wi-Fi Pumpkin is a tool used to create fake Wi-Fi access points for
Evil Twin attacks. CrackMapExec is for Active Directory enumeration, Responder
is for LLMNR/NBT-NS poisoning, and Impacket is a collection of Python classes
for working with network protocols.
pg. 4
Practice Exam – Complete Practice Exam
Questions with 100% Verified Correct
Answers and Detailed Rationales | Latest
Update - 2026/2027 | Already Graded A+
Question 1
Which of the following is the most effective way to reduce a system's attack
surface during system hardening?
A. Disable unnecessary services
B. Enable SELinux
C. Implement transport layer security
D. Change default passwords
Answer: A
Rationale: Disabling unnecessary services reduces the number of potential entry
points an attacker could exploit, effectively minimizing the system's attack surface.
While enabling SELinux, implementing TLS, and changing default passwords all
improve security, they do not reduce the attack surface as directly as disabling
unneeded services.
Question 2
Which command in Bash is used to search through a file for a specific pattern of
text?
A. fsck
B. udp
C. grep
D. nmap
Answer: C
Rationale: The grep command is used to search through files for specific patterns
pg. 1
,of text using regular expressions. fsck is used for file system checks, udp is a
protocol, and nmap is a network scanning tool.
Question 3
Which tool helps simulate malware-like attacks to improve network security?
A. Cross-Site Request Forgery
B. Exploit-DB
C. Cobalt Strike
D. Infection Monkey
Answer: D
Rationale: Infection Monkey is an open-source tool that simulates malware-like
attacks to test network security and identify vulnerabilities. Exploit-DB is a
database of exploits, Cobalt Strike is a penetration testing tool for adversary
simulation, and CSRF is a type of attack, not a tool.
Question 4
Which phase of the PTES framework involves gaining knowledge about the target
system using both passive and active techniques?
A. Vulnerability Analysis
B. Banner Grabbing
C. Persistence
D. Information Gathering
Answer: D
Rationale: The Information Gathering phase of the PTES (Penetration Testing
Execution Standard) framework involves collecting data about the target using
both passive (OSINT) and active (scanning) techniques. Vulnerability analysis
comes after information gathering, and persistence is for maintaining access.
Question 5
What is the key difference between Bluejacking and Bluetooth spamming?
A. Bluejacking involves sending unsolicited messages to nearby Bluetooth
devices; Bluetooth spamming is a more intrusive method involving repeated
pg. 2
,messages or malicious files
B. Bluejacking is more intrusive than Bluetooth spamming
C. They are the same thing
D. Bluejacking requires Bluetooth to be disabled
Answer: A
Rationale: Bluejacking involves sending unsolicited messages to nearby Bluetooth
devices. Bluetooth spamming is a more intrusive method involving repeated
messages or malicious files. Overloading a device is related to spamming, and
Bluetooth doesn't need to be disabled to receive these attacks.
Question 6
Which command saves the captured network packets to a file for later analysis
using tcpdump?
A. xmas scan
B. aircrack-ng
C. tcpdump -w capture.pcap
D. masvs-crypto
Answer: C
Rationale: The command tcpdump -w capture.pcap saves captured packets to a
file named capture.pcap for later analysis. The -w flag writes the output to a file.
Xmas scan is an Nmap scan type; aircrack-ng is for cracking wireless encryption.
Question 7
Which type of DNS query attempts to replicate DNS records between DNS
servers?
A. Zone transfer
B. PowerShell
C. Reverse lookup zone
D. Record transfer
Answer: A
Rationale: A zone transfer (AXFR) is a type of DNS query that replicates DNS
records between DNS servers. It is used to synchronize DNS databases and can be
pg. 3
, a security risk if not properly restricted. Reverse lookup zones resolve IP addresses
to hostnames.
Question 8
Why is it important to validate scan results during a penetration test?
A. Validating scan results helps to automatically patch any vulnerabilities found
without manual intervention
B. Validating scan results ensures that the findings from automated tools are
accurate, helping to confirm true positives and avoid false positives or false
negatives
C. Validating scan results is primarily done to ensure the automated tools are
running at their maximum speed and efficiency
D. Validating scan results is necessary to confirm that the penetration tester has
followed all the steps in the methodology exactly
Answer: B
Rationale: Validating scan results ensures that findings from automated tools are
accurate, helping to confirm true positives and avoid false positives or false
negatives. This prevents wasting time on non-existent vulnerabilities and missing
real ones.
Question 9
What tool can be used to create a fake Wi-Fi access point for an Evil Twin attack?
A. CrackMapExec
B. Wi-Fi Pumpkin
C. Responder
D. Impacket
Answer: B
Rationale: Wi-Fi Pumpkin is a tool used to create fake Wi-Fi access points for
Evil Twin attacks. CrackMapExec is for Active Directory enumeration, Responder
is for LLMNR/NBT-NS poisoning, and Impacket is a collection of Python classes
for working with network protocols.
pg. 4
