10 free CompTIA PenTest+ PT0-003 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 344 questions. Work through them, then open each answer to check your reasoning.
Get all 344 questions (US$39) · Download these 10 as a PDF
Question 1
A penetration tester wants to send a specific network packet with custom flags and sequence numbers to a vulnerable target.
Which of the following should the tester use?
Show answer and explanation
Correct answer: C. Scapy
Scapy is a powerful Python library that allows penetration testers to craft, send, and manipulate network packets with custom flags, sequence numbers, and other fields. It provides programmatic control over packet construction at the protocol level, making it ideal for sending specially crafted packets to vulnerable targets.
Why the other options are wrong
- A. tcprelay is a tool for relaying TCP connections, not for crafting custom packets.
- B. Bluecrack is a Bluetooth cracking tool, not relevant for crafting IP-level network packets.
- D. tcpdump is a packet capture and analysis tool, not for creating and sending custom packets.
Question 2
Which of the following explains the reason a tester would opt to use DREAD over PTES during the planning phase of a penetration test?
Show answer and explanation
Correct answer: D. The tester is creating a threat model.
DREAD is a threat modeling methodology used to identify and prioritize threats based on Damage, Reproducibility, Exploitability, Affected users, and Discoverability. PTES is a comprehensive penetration testing execution standard. DREAD is specifically chosen during the planning phase when the goal is to create a threat model and understand potential risks before conducting the actual test.
Why the other options are wrong
- A. Web application testing does not specifically require DREAD over PTES.
- B. Mobile application assessment would use similar methodologies but doesn't distinguish DREAD as the primary reason.
- C. Thick client application testing doesn't specifically mandate DREAD over PTES.
Question 3
A penetration tester is performing a security review of a web application.
Which of the following should the tester leverage to identify the presence of vulnerable open-source libraries?
Show answer and explanation
Correct answer: D. SCA
Software Composition Analysis (SCA) is specifically designed to identify vulnerable ope-ource libraries and dependencies within applications. It scans source code and binaries to locate third-party components and checks them against known vulnerability databases to detect security issues in dependencies.
Why the other options are wrong
- A. VM (Virtual Machine) is an execution environment, not a tool for identifying vulnerable libraries.
- B. IAST (Interactive Application Security Testing) analyzes running applications but is not specialized for open-source library detection.
- C. DAST (Dynamic Application Security Testing) tests running applications but is not optimized for dependency vulnerability identification.
Question 4
A penetration tester finds that an application responds with the contents of the /etc/passwd file when the following payload is sent:
Which of the following should the tester recommend in the report to best prevent this type of vulnerability?
Show answer and explanation
Correct answer: C. Disable the use of external entities.
The payload shown is an XML External Entity (XXE) attack that defines a SYSTEM entity pointing to file:///etc/passwd. When the XML is parsed, the external entity is resolved and the file contents are returned in the response. This is a classic XXE vulnerability. The best prevention is to disable the parsing of external entities in the XML parser, which prevents the application from resolving external DTD declarations and SYSTEM entities. This directly addresses the root cause of the vulnerability.
Why the other options are wrong
- A. File permissions on /etc/passwd are not the issue; the vulnerability is in the application's XML parsing, not the OS.
- B. Reviewing access logs is a detection mechanism, not a prevention control, and does nothing to stop the XXE attack.
- D. A WAF may help filter some XXE payloads but is not the best solution; disabling external entity parsing is the proper fix at the application level.
Question 5
A penetration tester is conducting reconnaissance for an upcoming assessment of a large corporate client. The client authorized spear phishing in the rules of engagement.
Which of the following should the tester do first when developing the phishing campaign?
Show answer and explanation
Correct answer: C. Social media
Social media is the first step in developing a phishing campaign as it provides publicly available information about target employees, their roles, interests, and relationships. This information is essential for crafting convincing spear phishing emails that appear legitimate and increase the likelihood of success.
Why the other options are wrong
- A. Shoulder surfing is a physical social engineering technique, not part of initial phishing campaign development.
- B. Recon-ng is useful but would be secondary to gathering basic target information from social media.
- D. Password dumps would only be relevant after identifying and targeting specific individuals.
Question 6
A penetration tester needs to test a very large number of URLs for public access. Given the following code snippet:
Which of the following changes is required?
Show answer and explanation
Correct answer: A. The condition on line 6
The code currently only prints 'URL accessible' when the status code equals 401 (Unauthorized), which is not a successful response. For a penetration tester testing URLs for public access, the condition should check for successful status codes (200-299 range, typically 200 OK). The condition on line 6 needs to be changed from `== 401` to something like `== 200` or `< 400` to properly identify accessible URLs.
Why the other options are wrong
- B. The requests.get() method on line 5 is the correct method for retrieving URLs and returns a response object with status code attributes.
- C. The import requests library on line 1 is correct and necessary for making HTTP requests.
- D. The delimiter 'n' on line 4 is correct for splitting lines from a text file containing URLs.
Question 7
During a penetration test, a tester captures information about an SPN account.
Which of the following attacks requires this information as a prerequisite to proceed?
Show answer and explanation
Correct answer: B. Kerberoasting
Kerberoasting is an attack that specifically targets Service Principal Names (SPNs). The attacker requests a Kerberos ticket for an SPN account and then attempts to crack the ticket offline. Knowledge of SPN accounts is an absolute prerequisite to launch this attack, as the attacker must know which service accounts to target.
Why the other options are wrong
- A. Golden Ticket attacks require knowledge of the krbtgt password hash, not SPN information.
- C. DCShadow is a domain controller impersonation attack that doesn't require SPN capture as a prerequisite.
- D. LSASS dumping requires access to a compromised system, not SPN information.
Question 8
While performing an internal assessment, a tester uses the following command: crackmapexec smb 192.168.1.0/24 -u user.txt -p Summer123@
Which of the following is the main purpose of the command?
Show answer and explanation
Correct answer: C. To perform password spraying on internal systems
The crackmapexec command with the syntax 'smb 192.168.1.0/24 -u user.txt -p Summer123@' is performing password spraying across a subnet. It attempts to authenticate to multiple SMB endpoints using a list of usernames with a single password, which is the definition of password spraying, trying one password against many accounts.
Why the other options are wrong
- A. Pass-the-hash would use the -H flag for NTLM hashes, not plaintext passwords with -p.
- B. Protocol scanning would use tools like nmap, not credential-based authentication attempts.
- D. Command execution would require the -x flag to specify a command to execute.
Question 9
A penetration testing team needs to determine whether it is possible to disrupt the wireless communications for PCs deployed in the client's offices.
Which of the following techniques should the penetration tester leverage?
Show answer and explanation
Correct answer: D. Channel scanning
Channel scanning identifies which Wi-Fi channels and frequencies the client devices use, which is the prerequisite for testing whether those wireless communications can be disrupted, for example by jamming or deauthentication on the channel in use.
Why the other options are wrong
- A. Port mirroring copies traffic on a wired switch port for monitoring and does nothing with wireless channels.
- B. Sidecar scanning is an agentless method for assessing cloud and container workloads, unrelated to wireless testing.
- C. ARP poisoning redirects Layer 2 traffic to intercept it; it does not evaluate whether the wireless link itself can be disrupted.
Question 10
Which of the following tasks would ensure the key outputs from a penetration test are not lost as part of the cleanup and restoration activities?
Show answer and explanation
Correct answer: A. Preserving artifacts
Preserving artifacts ensures that all key outputs, findings, evidence, and documentation from the penetration test are retained and not lost during cleanup and restoration activities. This is critical for maintaining the integrity of the assessment results and supporting compliance and follow-up activities.
Why the other options are wrong
- B. Reverting configuration changes is important for cleanup but doesn't directly preserve test outputs.
- C. Keeping chain of custody relates to evidence handling but is secondary to preserving the actual test artifacts.
- D. Exporting credential data is a security risk and should not be part of post-test activities.
That was 10 of 344.
The full CompTIA PenTest+ PT0-003 pack has all 344 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.