Free PenTest+ PT0-003 Sample Questions With Answers (2026)

Here are 20 CompTIA PenTest+ (PT0-003) sample questions with the answers and the reasoning, four from each of the five exam domains. They are written to the current PT0-003 objectives — the version that launched December 17, 2024 and replaced PT0-002 ^[1] — not recycled PT0-002 material. No PDF download, no email gate: read them here, then take a full timed exam free.

Two notes before you start. First, PT0-003 weights Attacks and Exploits at 35%, so that domain gets the same four questions here as everyone else but deserves double the study time. Second, the real exam mixes these multiple-choice items with performance-based questions (PBQs) that hand you tool output and ask what to do next — the questions below mirror that scenario style on purpose. When you want the full 90-question experience, the PenTest+ practice test gives you 3 complete exams free from a bank of 552 questions.

1.0 Engagement Management (13%)

Scoping, rules of engagement, legal boundaries, and the remediation advice that goes in the report. Small domain, easy points if you know the process.

1. Halfway through an internal test you recover domain credentials that would also unlock a sister company’s network reachable over a trust relationship. That network is not named in the Statement of Work. What do you do?

1. Pivot into it while the credentials are valid — the trust makes it in scope
2. Note the trust in the report but do not test the sister network without a scope change
3. Test it quietly and only mention it if you find something serious
4. Delete the credentials so you are not tempted to cross the boundary

2. At the report review the client asks you to drop a medium-severity finding because they have decided not to fix it. What is the correct way to handle the request?

1. Remove it — the client owns the report and the risk decision
2. Keep the finding but downgrade it to informational to satisfy them
3. Keep the finding and record that the client has formally accepted the risk
4. Replace it with a more general recommendation that does not name the system

3. You are about to run an on-site physical and social-engineering test. Which document should you carry to prove the engagement is authorized if a guard or employee challenges you?

1. The Master Service Agreement
2. A signed authorization letter naming a client point of contact to call
3. The non-disclosure agreement
4. A copy of your PenTest+ certification

4. For a single engagement, which document defines the exact systems in scope, the testing dates, and the types of testing allowed?

1. The Master Service Agreement
2. The Statement of Work
3. The Rules of Engagement appendix in the final report
4. The mutual non-disclosure agreement

2.0 Reconnaissance and Enumeration (21%)

Passive OSINT, active discovery, and service enumeration. Expect questions that name a constraint (no active traffic yet, one open port, a default community string) and ask for the technique that still works.

5. The client wants the lightest possible footprint during early recon and has asked you not to send traffic to their servers yet. Which technique still lets you enumerate subdomains?

1. Brute-forcing hostnames against the target’s DNS server
2. Running a full port scan of the public IP range
3. Searching public certificate-transparency logs for issued hostnames
4. Sending crafted HTTP requests with different Host headers

6. A network device has UDP 161 open and is using a default read community string. What is the most direct way to pull its interface list, routing table, and running-configuration details?

1. Run an SNMP walk against it with the community string
2. Open an SSH session and read the config manually
3. Send ICMP timestamp requests and infer the config
4. Perform a reverse DNS lookup on every interface

7. A hardened host exposes only TCP 22 and drops everything else. You need to identify the operating system and the SSH implementation. What is the most reliable approach?

1. Assume it is Linux because port 22 is open
2. Grab the SSH service banner and run OS and stack fingerprinting against the open port
3. Launch a UDP scan of the top 1,000 ports
4. Send a malformed HTTP request and read the error page

8. You are mapping a web application’s attack surface and want to find administrative paths the developers kept out of the navigation. What is the fastest first check before any brute-forcing?

1. Read robots.txt and the sitemap for disallowed or listed paths
2. Fuzz the login form with a wordlist
3. Scan the whole IP range for other web servers
4. Decompile the site’s JavaScript for API keys

3.0 Vulnerability Discovery and Analysis (17%)

Choosing the right scan type, reading results, and deciding what is real. PT0-003 added more application-security and container content here than PT0-002 had.

9. A scan of a client environment returns 240 findings and you have two days. Two of them share the same CVSS base score of 9.8. How should you decide which to pursue first?

1. Alphabetically, so the report is easy to follow
2. By which one is exposed to the network and has a working public exploit
3. By whichever host has more open ports
4. By the order the scanner reported them

10. Before a container image is deployed, the client wants to know whether its base layers ship known-vulnerable packages. Which scan answers that most directly?

1. A dynamic scan of the running container’s web endpoints
2. A container image scan that inventories each layer’s packages against vulnerability databases
3. A port scan of the host running the container
4. A password-strength audit of the container’s accounts

11. You are assessing a proprietary service that speaks an undocumented binary protocol on a custom port. You want to surface memory-corruption bugs in how it parses input. Which technique fits best?

1. Static analysis of the public documentation
2. Fuzzing the service with malformed and mutated inputs while watching for crashes
3. A credentialed vulnerability scan of the host
4. Reviewing the TLS certificate chain

12. You have full source code to a Python API and need to catch hardcoded secrets and dangerous function calls before the service is ever run. Which analysis type fits?

1. Dynamic application security testing against a deployed instance
2. Static application security testing of the source code
3. Software composition analysis of the container registry
4. An unauthenticated network scan

4.0 Attacks and Exploits (35%)

The biggest domain by a wide margin: network, wireless, application, cloud, mobile, and social-engineering attacks, plus the tools that run them. If your practice scores are weak anywhere, make it not here.

13. You have a foothold on a Windows domain and want service-account passwords without triggering account lockouts. You request Kerberos service tickets for accounts that have a Service Principal Name and crack them offline. What is this technique called?

1. Kerberoasting
2. Pass-the-hash
3. LLMNR poisoning
4. Golden ticket forgery

14. Testing a billing portal, you change the invoice number in the URL from 4471 to 4470 and the application returns another customer’s invoice. Which vulnerability class is this?

1. Cross-site scripting
2. Insecure direct object reference
3. Server-side request forgery
4. SQL injection

15. You are assessing a corporate wireless network protected by WPA2-PSK. Which sequence lets you recover the passphrase offline?

1. Set up a rogue DHCP server and wait for clients
2. Deauthenticate a connected client, capture the 4-way handshake, then crack it offline against a wordlist
3. ARP-spoof the access point to intercept plaintext
4. Send oversized frames until the AP reboots into an open state

16. You have a low-privilege shell on a Linux host. Running sudo -l shows you may run /usr/bin/vim as root without a password. What is the most direct path to a root shell?

1. Edit /etc/passwd by hand in a normal editor session
2. Use vim’s shell-escape to spawn a root shell from within the editor
3. Recompile the kernel with a backdoor
4. Brute-force the root password locally

5.0 Post-exploitation and Lateral Movement (14%)

What you do after the first shell: enumerate, persist, move, exfiltrate, and clean up. New as a standalone domain in PT0-003, so older study guides cover it thinly.

17. You have a shell on a Windows workstation and need access to survive a reboot with as little noise as possible. Which technique fits best?

1. Leave the interactive shell open and hope no one reboots
2. Register a scheduled task that re-establishes your access at logon
3. Disable the host firewall entirely
4. Change the local administrator password to lock others out

18. From a compromised host you hold a local administrator NTLM hash that is reused on other workstations. You want to run commands on a second machine without cracking the password. Which technique applies?

1. Pass-the-hash over SMB to authenticate as that admin on the second host
2. A dictionary attack against the domain controller
3. DNS cache poisoning of the second host
4. Downgrading the second host to LM hashing

19. The compromised network allows only DNS traffic outbound; HTTP, HTTPS, and everything else are blocked at the egress firewall. How can you exfiltrate a small amount of data?

1. Email the data from the host’s mail client
2. Encode the data into DNS queries to a name server you control (DNS tunneling)
3. Upload it to a cloud storage bucket over HTTPS
4. Open a reverse shell on port 4444

20. You have compromised a dual-homed host that can reach an internal segment your testing laptop cannot route to. What is the standard way to reach that segment through the host?

1. Reconfigure the client’s core router to add a static route to your laptop
2. Set up a pivot such as a SOCKS proxy or port forwarding through the compromised host
3. Ask the client to place your laptop on the internal VLAN
4. Broadcast your laptop’s ARP entry across both segments

What the Real PT0-003 Exam Looks Like

Here is the format these 20 questions are modeled on. The domain weights are CompTIA’s published figures for PT0-003 ^[1]; the question estimates assume the full 90.

If you missed more than three of the twenty above, work the domain you missed them in against the PT0-003 exam objectives before buying a voucher. If you missed one or two, you are ready for full-length timed practice: the PenTest+ practice test runs 25 exams built the same way, with per-answer explanations, and the first 3 are free.

References

1. CompTIA. "CompTIA PenTest+ (PT0-003)." comptia.org/certifications/pentest. Domain weights, 90-question maximum, 165-minute length, 750 passing score, December 17, 2024 launch and June 17, 2025 PT0-002 retirement. Accessed August 25, 2026.

These questions are original SecuSpark items written to the PT0-003 objectives. They are not, and are not meant to resemble, actual CompTIA exam content.