CompTIA PenTest+ (PT0-003) Full Course & Practice Exam –
Complete Practice Exam Questions with 100% Verified Correct
Answers and Detailed Explanations | Latest Update -
2026/2027 | Already Graded A+
1. A penetration tester is preparing for an authorized assessment of a
company's external web application. The client has specified the target
domain, testing dates, permitted techniques, and emergency contact
procedures. Which document most directly establishes the authorization
and rules for the engagement?
A. Vulnerability scan report
B. Rules of engagement
C. Incident response plan
D. Security awareness policy
Correct Answer: B. Rules of engagement
Explanation: The rules of engagement (RoE) define how an authorized
penetration test will be conducted. They commonly establish the scope,
targets, testing windows, prohibited activities, communication procedures,
authorization boundaries, and emergency contacts. Clearly defined RoE help
prevent accidental testing of systems outside the client's authorization and
provide the tester with operational boundaries.
2. A penetration tester discovers that the client's IP address range
contains several systems owned by a third-party cloud provider. What
should the tester do before actively testing those systems?
A. Test them because they resolve to the client's domain
B. Obtain authorization covering the third-party systems
C. Launch a vulnerability scan immediately
D. Exploit the systems to determine ownership
Correct Answer: B. Obtain authorization covering the third-party
systems
,Explanation: Ownership and authorization are critical during penetration
testing. A client's use of a cloud provider does not automatically authorize
testing of every system within the provider's infrastructure. The tester should
verify that the specific assets are within scope and that appropriate
permission exists, particularly when third-party infrastructure is involved.
3. During reconnaissance, a tester wants to identify employee names,
email addresses, subdomains, and publicly available organizational
information without directly interacting with the target systems. Which
technique is most appropriate?
A. Passive reconnaissance
B. Active exploitation
C. Privilege escalation
D. Persistence
Correct Answer: A. Passive reconnaissance
Explanation: Passive reconnaissance gathers information from publicly
available sources without directly probing the target infrastructure. Examples
include search engines, public websites, social media, certificate transparency
records, public DNS information, and other open-source intelligence sources.
This approach can reveal useful information while minimizing interaction
with the target.
4. A tester performs DNS queries and directly interacts with a company's
internet-facing infrastructure to identify hosts and services. Which type
of reconnaissance is being performed?
A. Passive reconnaissance
B. Active reconnaissance
C. Social engineering
D. Data exfiltration
Correct Answer: B. Active reconnaissance
,Explanation: Active reconnaissance involves directly interacting with target
systems to gather information. Examples include DNS enumeration, port
scanning, service discovery, banner grabbing, and network probing. Because
active reconnaissance generates traffic that may be logged or detected, it
should be performed only within the authorized scope.
5. A penetration tester wants to determine which TCP ports are listening
on a target server. Which technique is most appropriate?
A. Port scanning
B. Password spraying
C. Data masking
D. File carving
Correct Answer: A. Port scanning
Explanation: Port scanning identifies accessible network ports and can help
determine which services may be exposed. The results provide an initial view
of the attack surface and can guide subsequent service enumeration and
vulnerability assessment. Scanning techniques should remain within the
authorized targets and rate limits defined by the engagement.
6. A tester discovers an open TCP port associated with an unknown
service. Which activity would provide more information about the
service and its configuration?
A. Service enumeration
B. Data destruction
C. Password rotation
D. Log deletion
Correct Answer: A. Service enumeration
Explanation: Service enumeration attempts to identify the software, version,
configuration, and characteristics associated with an exposed service.
Information such as product names and versions can help the tester
, determine whether known vulnerabilities or configuration weaknesses may
exist.
7. A tester finds that a web server is running an outdated version of a
known application framework. What should the tester do first before
attempting exploitation?
A. Confirm the version and determine whether the vulnerability applies
B. Immediately delete the vulnerable application
C. Modify the production database
D. Disable the server's logging
Correct Answer: A. Confirm the version and determine whether the
vulnerability applies
Explanation: Vulnerability identification should be validated before
exploitation whenever practical. Version information can be inaccurate,
patched, backported, or misleading. Confirming the software version and
vulnerability applicability reduces false positives and helps the tester select
an appropriate, controlled validation method.
8. A vulnerability scanner reports that a server is vulnerable to a specific
issue, but the tester suspects the finding may be inaccurate. What is this
situation called?
A. False positive
B. False negative
C. Privilege escalation
D. Persistence
Correct Answer: A. False positive
Explanation: A false positive occurs when a security tool reports a
vulnerability that does not actually exist. Penetration testers should validate
important findings manually or through safe verification techniques. False
positives can otherwise result in inaccurate risk assessments and unnecessary
remediation efforts.
Complete Practice Exam Questions with 100% Verified Correct
Answers and Detailed Explanations | Latest Update -
2026/2027 | Already Graded A+
1. A penetration tester is preparing for an authorized assessment of a
company's external web application. The client has specified the target
domain, testing dates, permitted techniques, and emergency contact
procedures. Which document most directly establishes the authorization
and rules for the engagement?
A. Vulnerability scan report
B. Rules of engagement
C. Incident response plan
D. Security awareness policy
Correct Answer: B. Rules of engagement
Explanation: The rules of engagement (RoE) define how an authorized
penetration test will be conducted. They commonly establish the scope,
targets, testing windows, prohibited activities, communication procedures,
authorization boundaries, and emergency contacts. Clearly defined RoE help
prevent accidental testing of systems outside the client's authorization and
provide the tester with operational boundaries.
2. A penetration tester discovers that the client's IP address range
contains several systems owned by a third-party cloud provider. What
should the tester do before actively testing those systems?
A. Test them because they resolve to the client's domain
B. Obtain authorization covering the third-party systems
C. Launch a vulnerability scan immediately
D. Exploit the systems to determine ownership
Correct Answer: B. Obtain authorization covering the third-party
systems
,Explanation: Ownership and authorization are critical during penetration
testing. A client's use of a cloud provider does not automatically authorize
testing of every system within the provider's infrastructure. The tester should
verify that the specific assets are within scope and that appropriate
permission exists, particularly when third-party infrastructure is involved.
3. During reconnaissance, a tester wants to identify employee names,
email addresses, subdomains, and publicly available organizational
information without directly interacting with the target systems. Which
technique is most appropriate?
A. Passive reconnaissance
B. Active exploitation
C. Privilege escalation
D. Persistence
Correct Answer: A. Passive reconnaissance
Explanation: Passive reconnaissance gathers information from publicly
available sources without directly probing the target infrastructure. Examples
include search engines, public websites, social media, certificate transparency
records, public DNS information, and other open-source intelligence sources.
This approach can reveal useful information while minimizing interaction
with the target.
4. A tester performs DNS queries and directly interacts with a company's
internet-facing infrastructure to identify hosts and services. Which type
of reconnaissance is being performed?
A. Passive reconnaissance
B. Active reconnaissance
C. Social engineering
D. Data exfiltration
Correct Answer: B. Active reconnaissance
,Explanation: Active reconnaissance involves directly interacting with target
systems to gather information. Examples include DNS enumeration, port
scanning, service discovery, banner grabbing, and network probing. Because
active reconnaissance generates traffic that may be logged or detected, it
should be performed only within the authorized scope.
5. A penetration tester wants to determine which TCP ports are listening
on a target server. Which technique is most appropriate?
A. Port scanning
B. Password spraying
C. Data masking
D. File carving
Correct Answer: A. Port scanning
Explanation: Port scanning identifies accessible network ports and can help
determine which services may be exposed. The results provide an initial view
of the attack surface and can guide subsequent service enumeration and
vulnerability assessment. Scanning techniques should remain within the
authorized targets and rate limits defined by the engagement.
6. A tester discovers an open TCP port associated with an unknown
service. Which activity would provide more information about the
service and its configuration?
A. Service enumeration
B. Data destruction
C. Password rotation
D. Log deletion
Correct Answer: A. Service enumeration
Explanation: Service enumeration attempts to identify the software, version,
configuration, and characteristics associated with an exposed service.
Information such as product names and versions can help the tester
, determine whether known vulnerabilities or configuration weaknesses may
exist.
7. A tester finds that a web server is running an outdated version of a
known application framework. What should the tester do first before
attempting exploitation?
A. Confirm the version and determine whether the vulnerability applies
B. Immediately delete the vulnerable application
C. Modify the production database
D. Disable the server's logging
Correct Answer: A. Confirm the version and determine whether the
vulnerability applies
Explanation: Vulnerability identification should be validated before
exploitation whenever practical. Version information can be inaccurate,
patched, backported, or misleading. Confirming the software version and
vulnerability applicability reduces false positives and helps the tester select
an appropriate, controlled validation method.
8. A vulnerability scanner reports that a server is vulnerable to a specific
issue, but the tester suspects the finding may be inaccurate. What is this
situation called?
A. False positive
B. False negative
C. Privilege escalation
D. Persistence
Correct Answer: A. False positive
Explanation: A false positive occurs when a security tool reports a
vulnerability that does not actually exist. Penetration testers should validate
important findings manually or through safe verification techniques. False
positives can otherwise result in inaccurate risk assessments and unnecessary
remediation efforts.
