CompTIA PenTest+ (PT0-003) practice questions

Exam overview PT0-003

Domain coverage 5 domains

• Engagement Management (13%)
• Reconnaissance and Enumeration (21%)
• Vulnerability Discovery and Analysis (17%)
• Attacks and Exploits (35%)
• Post-Exploitation and Lateral Movement (14%)

Sample questions 12 of 120 shown

1. Q1 Engagement Management

   A penetration tester is preparing a proposal for a client that requires testing of a web application handling PCI DSS data. Which compliance requirement must be explicitly addressed in the Rules of Engagement?

   1. SOX compliance for financial reporting
   2. PCI DSS scoping and segmentation validation requirements
   3. HIPAA breach notification procedures
   4. GDPR data subject consent documentation

   When testing environments that process payment card data, the Rules of Engagement must address PCI DSS requirements. This includes validating network segmentation that isolates cardholder data environments and ensuring testing does not violate PCI DSS restrictions. SOX applies to financial reporting, HIPAA to healthcare, and GDPR to EU personal data.
2. Q2 Engagement Management

   During a penetration test, the tester discovers evidence of an active insider threat. According to standard engagement protocols, what is the appropriate immediate action?

   1. Document the finding and continue testing without alerting the client
   2. Immediately stop all testing activities and contact law enforcement
   3. Notify the client's designated point of contact through the established escalation channel
   4. Exploit the insider's access to gather more evidence

   The Rules of Engagement should define escalation procedures for critical findings. When discovering active criminal activity or insider threats, the tester must notify the designated client contact through agreed-upon channels. Stopping all testing or contacting law enforcement without client direction typically violates engagement terms.
3. Q3 Engagement Management

   A client requests a penetration test but cannot provide written authorization for three weeks. The project timeline is urgent. What is the appropriate response?

   1. Begin passive reconnaissance only while waiting for authorization
   2. Proceed with the test using verbal authorization from the IT manager
   3. Decline to begin any testing activities until written authorization is received
   4. Start with non-invasive scanning that won't affect production systems

   Written authorization is mandatory before any penetration testing activities. Testing without proper authorization is illegal and may violate computer fraud laws. Even passive reconnaissance without written consent can create legal liability. The tester must wait for documented authorization regardless of timeline pressures.
4. Q4 Engagement Management

   Which document specifies the technical boundaries of a penetration test, including approved IP ranges, excluded systems, and testing timeframes?

   1. Master Service Agreement (MSA)
   2. Statement of Work (SOW)
   3. Rules of Engagement (ROE)
   4. Non-Disclosure Agreement (NDA)

   The Rules of Engagement (ROE) defines the technical boundaries and operational parameters of the penetration test. It includes specific IP ranges, excluded systems, testing windows, authorized techniques, and emergency contacts. The SOW covers business terms, while the ROE covers technical testing boundaries.
5. Q5 Engagement Management

   A penetration testing firm is assessing the risk of testing a client's critical production environment. Which factor represents the highest potential business impact risk?

   1. Testing during off-peak hours
   2. Testing systems without a proper backup plan in place
   3. Using automated scanning tools with safe checks enabled
   4. Testing with read-only access credentials

   Testing production systems without verified backups represents the highest business impact risk. If testing causes system failure or data corruption without recovery options, the business could suffer significant downtime and financial loss. Testing during off-peak hours and using safe scan options actually reduces risk.
6. Q6 Engagement Management

   In a penetration test proposal, which component best helps the client understand the value and expected outcomes of the engagement?

   1. Detailed CVs of all assigned testers
   2. A clear statement of objectives and deliverables including risk ratings
   3. The history of similar tests performed by the firm
   4. Technical specifications of testing tools to be used

   A clear statement of objectives and deliverables helps clients understand what they will receive and how it addresses their security concerns. Including risk rating methodologies demonstrates how findings will be prioritized.
7. Q7 Engagement Management

   A bank hires a penetration tester who must ensure sensitive information remains confidential throughout the engagement. Which contract document enforces this requirement?

   1. Non-Disclosure Agreement (NDA)
   2. Master Service Agreement (MSA)
   3. Statement of Work (SoW)
   4. Service Level Agreement (SLA)

   A Non-Disclosure Agreement (NDA) is a legal contract that binds parties to keep sensitive information confidential. In penetration testing, the NDA ensures the tester does not disclose client confidential data encountered during the assessment.
8. Q8 Engagement Management

   A penetration tester is developing the rules of engagement for a potential client. Which of the following should be included in the ROE? (Select TWO)

   1. Billing rates for testers
   2. Testing window and authorized hours
   3. Detailed resumes of the testing team
   4. Escalation procedures and emergency contacts
   5. Marketing materials for the testing firm

   The Rules of Engagement document defines the operational parameters of the test. Testing windows specify when testing can occur, and escalation procedures define how to handle critical findings or emergencies. Billing, resumes, and marketing materials belong in separate business documents.
9. Q9 Engagement Management

   A penetration tester is getting ready to conduct a vulnerability scan to evaluate an environment. Which of the following should the tester confirm before beginning the scan?

   1. The client has backed up critical systems
   2. The tester has completed their security training
   3. The scanning tool has been purchased
   4. The client's IT staff have been dismissed for the day

   Before conducting vulnerability scans, the tester should confirm that the client has current, verified backups of critical systems. This ensures that if scanning causes instability or outages, systems can be restored. This is a standard pre-engagement safety measure.
10. Q10 Engagement Management

    An external legal firm is conducting a penetration test of a large corporation. Which of the following would be most appropriate for the legal firm to use in the subject line of a weekly email update?

    1. Action Required Status Update
    2. Urgent Status Update
    3. Important Weekly Status Update
    4. Privileged & Confidential Status Update

    When a legal firm is conducting the penetration test, communications should be marked as "Privileged & Confidential" to maintain attorney-client privilege and protect sensitive findings from disclosure. This helps ensure the test results are protected under legal professional privilege.
11. Q11 Engagement Management

    Which of the following explains why a tester would choose DREAD over PTES during the planning phase of a penetration test?

    1. The tester is performing a web application test
    2. The tester is evaluating a mobile application
    3. The tester is assessing a fat client application
    4. The tester is creating a threat model

    DREAD is a risk assessment model used for ranking and classifying threats (threat modeling). PTES (Penetration Testing Execution Standard) is a methodology for how to perform penetration tests, not for creating threat models. DREAD helps prioritize threats based on Damage, Reproducibility, Exploitability, Affected users, and Discoverability.
12. Q12 Engagement Management

    A company hires a penetration tester to perform an external attack surface review as part of a pre-engagement activity. The tester looks for assets to test. Which of the following is an example of a target that can be used for testing?

    1. API
    2. HTTP
    3. IPA
    4. ICMP

    An API (Application Programming Interface) is a common target for penetration testing, especially in modern web and mobile applications. APIs can be entry points for injection attacks, authentication bypasses, and data leakage. HTTP, IPA, and ICMP are protocols, not target types.

Answer all 120 questions with instant feedback →

Reader reviews 121 ratings

• The way the PT0-003 questions are broken down by domain is great. Let me focus on my weak spots without wasting time.

  ★★★★★★ Olivia H.

• I was really impressed by the depth of the PT0-003 answer explanations. Feels like having a tutor walk you through each question.

  ★★★★★★ Jack W.

• The review mode for PT0-003 is awesome. Being able to see all questions and explanations at once really helps with last-minute cramming.

  ★★★★★★ Ezra J.

• The PT0-003 bank has a good mix of easy, medium, and hard questions. Kept me engaged and prevented me from getting complacent.

  ★★★★★★ Skylar M.

• I bought access for the PT0-003 exam as a gift for my brother. He passed on his first try and said the questions were spot-on.

  ★★★★★★ Cameron J.

• Couldn’t have passed the PT0-003 exam without this. The questions are challenging, the explanations are thorough, and the value is unbeatable.

  ★★★★★ Hannah L.

Frequently asked questions

More CompTIA exams