PT0-003 Practice Questions

Question 1

A penetration tester is writing the executive summary for the final report. The CEO needs to understand the overall risk level and the business impact of the findings. Which of the following should be included in the executive summary?

Accepted Answer

A high-level overview of the most critical vulnerabilities and their potential business impact.. The executive summary is intended for non-technical stakeholders like the CEO, who need to grasp the overall risk posture and business implications without technical jargon. Option A provides a high-level overview of critical vulnerabilities and their potential business impact, directly addressing the CEO's need to understand risk level and business impact, which aligns with the PT0-002 objective for effective reporting and communication.

Answer

Detailed exploit steps with screenshots.

Answer

A list of all CVSS scores without context.

Answer

The exact commands used during testing.

Question 2

A penetration tester has identified a critical misconfiguration in a cloud storage bucket that exposes sensitive customer data. The client's technical team has already applied a fix, but the tester wants to ensure the report accurately reflects the risk and the remediation. Which section of the report should include the steps to reproduce the vulnerability?

Accepted Answer

Technical details and proof of concept. The technical details and proof of concept (POC) section is the correct place to include step-by-step reproduction steps because it provides the client's technical team with the exact commands, API calls, or configuration checks needed to verify the vulnerability and the fix. This section is distinct from the executive summary (which targets non-technical stakeholders) and the findings and risk rating (which focuses on impact and severity). By including reproduction steps here, the tester ensures the remediation can be validated without ambiguity.

Answer

Executive summary

Answer

Findings and risk rating

Answer

Remediation recommendations

Question 3

A penetration tester needs to describe a stored XSS vulnerability to a web developer who will fix it. Which level of detail is most appropriate for this audience?

Accepted Answer

Include the specific vulnerable URL, the request parameters, the payload used, and a code snippet for proper output encoding.. A web developer needs precise, actionable technical details to remediate the vulnerability: the exact URL, request parameters, the payload that triggered the stored XSS, and a code snippet showing proper output encoding (e.g., using OWASP ESAPI or context-specific escaping). This level of detail enables the developer to locate the vulnerable code, understand the injection point, and apply the correct fix without ambiguity.

Answer

Provide the CVSS score and risk rating.

Answer

Describe the business impact and potential regulatory fines.

Answer

Use a graph showing the number of vulnerabilities by severity across the application.

Question 4

A penetration tester runs the following command: nmap -sS -p 1-65535 -T4 -A -O --reason target. What is the primary purpose of the -A option in this command?

Accepted Answer

Enables OS detection, version detection, script scanning, and traceroute.. The -A option in nmap is a composite flag that enables OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (--traceroute) in a single switch. This is explicitly documented in nmap's man page and is designed to provide comprehensive reconnaissance in one command, making option A correct.

Answer

Sets the timing template to aggressive (level 4).

Answer

Enables aggressive scanning that is more likely to be detected by the target.

Answer

Performs a SYN (half-open) scan.

Question 5

A penetration tester is preparing a report for a client that includes both a technical security team and an executive leadership team. The executive team needs to understand the overall risk posture, while the technical team requires detailed reproduction steps. Which reporting structure best serves both audiences?

Accepted Answer

A single report with an executive summary and technical appendices. A single report with an executive summary and technical appendices is the correct structure because it satisfies both audiences: the executive summary provides a high-level risk posture overview (e.g., CVSS scores, business impact), while the technical appendices contain detailed reproduction steps (e.g., exact commands, payloads, and packet captures) for the technical team. This approach aligns with the PT0-002 objective of tailoring communication to stakeholders without losing technical rigor.

Answer

Two completely separate reports: one for executives and one for technical staff

Answer

Only an executive summary, omitting technical details

Answer

Only a technical report with all details

Question 6

A penetration tester is reviewing a Python script that attempts to exploit a command injection vulnerability. The script uses the 'subprocess' module with the 'shell=True' argument. Which of the following code changes would be MOST effective to reduce the risk of unintended consequences when executing system commands?

Accepted Answer

Avoid using shell=True and pass the command as a list of arguments. Setting `shell=True` in Python's `subprocess` module causes the command string to be interpreted by the system shell, which introduces command injection risks if any part of the string is user-controlled. By passing the command as a list of arguments (e.g., `['ls', '-l', filename]`) and omitting `shell=True`, the subprocess module directly executes the binary without shell interpretation, eliminating shell metacharacter injection. This is the most effective mitigation as it avoids shell parsing entirely, which is the root cause of the vulnerability.

Answer

Replace subprocess with os.system()

Answer

Use the 'shlex.quote()' function to sanitize user input before passing to subprocess

Answer

Use the 'exec()' function to run the command

Question 7

A penetration tester is attempting to exploit a buffer overflow vulnerability in a Linux binary. The binary has Data Execution Prevention (DEP) enabled but Address Space Layout Randomization (ASLR) is disabled. Which exploitation technique would be the MOST effective to achieve code execution?

Accepted Answer

Perform a return-to-libc attack to call system("/bin/sh"). With DEP enabled, the stack is non-executable, so injecting shellcode directly into the buffer (Option A) would fail. Since ASLR is disabled, library addresses are fixed, making a return-to-libc attack viable. Option C exploits this by overwriting the return address with the address of system() and placing the string "/bin/sh" in memory, achieving code execution without needing an executable stack.

Answer

Inject shellcode into the buffer and redirect execution to it

Answer

Use a ROP chain to call mprotect() to make the stack executable, then jump to shellcode

Answer

Use a heap spray to place shellcode at a known address and then trigger the overflow

Question 8

A penetration tester has discovered a critical SQL injection vulnerability in a web application. The developer team will fix the issue. Which level of detail is most appropriate for this audience?

Accepted Answer

Include the full proof-of-concept code and the exact HTTP requests used.. The developer team needs the exact technical details to reproduce and fix the vulnerability. Providing the full proof-of-concept code and exact HTTP requests allows developers to understand the injection point, the payload structure, and the vulnerable parameter, enabling them to implement a precise fix such as parameterized queries or input validation.

Answer

Provide the CVSS score and a brief description.

Answer

Describe the business impact in financial terms.

Answer

List all findings in a bullet-point summary without additional context.

Question 9

A client hires a penetration testing firm to assess a web application. The client uses a third-party content delivery network (CDN) for static assets and explicitly wants to exclude the CDN infrastructure from testing. In which document should this restriction be formally documented?

Accepted Answer

Rules of Engagement (ROE). The Rules of Engagement (ROE) document is the correct place to formally document restrictions such as excluding the CDN infrastructure from testing. The ROE defines the scope, boundaries, and specific constraints for the penetration test, including which IP ranges, domains, or systems are off-limits. This ensures the testing team does not inadvertently target the third-party CDN, which could violate contractual agreements or cause unintended disruptions.

Answer

Statement of Work (SOW)

Answer

Non-Disclosure Agreement (NDA)

Answer

Master Services Agreement (MSA)

Question 10

A penetration tester is analyzing a Python script that uses the 'paramiko' library. The script reads a list of IP addresses from a file and attempts to connect to each host using the same username and a list of common passwords. Which attack technique is the script most likely performing?

Accepted Answer

Brute-force attack against SSH credentials. The script uses the 'paramiko' library, which is a Python implementation of the SSHv2 protocol. By reading a list of IP addresses and attempting connections with the same username and a list of common passwords, it is performing a brute-force attack against SSH credentials. This technique systematically tries multiple password guesses to gain unauthorized access to SSH services.

Answer

SQL injection attack against a database

Answer

Cross-site scripting (XSS) attack against a web application

Answer

ARP spoofing attack to intercept network traffic

Question 11

During a web application test, a penetration tester discovers that the application exposes internal object references (e.g., user ID in a URL) and does not properly authorize access. The tester can view other users' private data by simply changing the ID parameter. Which type of vulnerability does this represent?

Accepted Answer

Insecure Direct Object Reference (IDOR). The vulnerability is Insecure Direct Object Reference (IDOR) because the application exposes internal object references (e.g., user ID in a URL) and fails to enforce proper authorization checks. By simply changing the ID parameter, the tester can access other users' private data without authentication or permission validation, which is the hallmark of IDOR.

Answer

Cross-Site Request Forgery (CSRF)

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)

Question 12

A penetration tester is preparing a report for a client's CISO who is not technical. The CISO needs to understand the overall risk posture and the business impact of the findings. Which section of the report should be tailored for this audience?

Accepted Answer

Executive summary. The executive summary is designed for non-technical stakeholders like a CISO to quickly grasp the overall risk posture and business impact without needing to interpret raw data or technical jargon. It synthesizes findings into high-level business risks, such as potential financial loss or regulatory exposure, rather than detailing specific vulnerabilities or exploit chains. This section ensures the audience can make informed decisions about resource allocation and risk acceptance.

Answer

Technical findings

Answer

Appendices with raw scan data

Answer

Remediation details

Question 13

During an internal penetration test, a tester compromises a server that is part of a Kubernetes cluster. The tester has access to the node's operating system but not to the cluster's administrative credentials. Which of the following techniques would most likely allow the tester to escalate privileges to cluster-admin or access sensitive resources within the cluster?

Accepted Answer

Extracting a service account token from a running container and using it to access the Kubernetes API. Service account tokens are automatically mounted into pods at /var/run/secrets/kubernetes.io/serviceaccount/token. An attacker with node-level access can extract this token from a running container's filesystem and use it to authenticate to the Kubernetes API server. Since service accounts are often granted broad permissions via RBAC bindings, this token may allow the tester to access sensitive resources or even escalate to cluster-admin if the service account has such privileges.

Answer

Exploiting a kernel vulnerability on the node to escape to the host and then compromise the Kubernetes API server

Answer

Searching for a kubeconfig file on the node that contains a cluster-admin token

Answer

Modifying a ConfigMap to inject a malicious pod that runs with elevated privileges

Question 14

A client requests a penetration test of their network and provides a list of IP addresses. During scoping, the tester notices that several IP addresses belong to a major cloud service provider. What should the tester do FIRST before including those IP addresses in the test?

Accepted Answer

Ask the client to verify ownership and obtain written authorization from the cloud provider if needed. Testing cloud provider IP addresses without explicit authorization violates the cloud provider's terms of service and could be considered unauthorized access, potentially leading to legal action. The tester must first verify that the client actually owns those IPs (e.g., via ARIN WHOIS or cloud provider documentation) and obtain written authorization from the cloud provider, as the provider's shared infrastructure means the tester's traffic could impact other tenants. This aligns with the PT0-002 scoping requirement to confirm all targets are within the authorized boundary.

Answer

Proceed with testing since the client provided the IP addresses

Answer

Exclude the cloud IP addresses from the scope without further discussion

Answer

Perform a quick port scan to determine if the IPs are responsive before deciding

Question 15

A penetration tester is analyzing a Python script that uses the 'scapy' library to craft custom network packets. The relevant code is: ```python from scapy.all import * packet = IP(dst="192.168.1.1")/TCP(dport=80, flags="S") response = sr1(packet, timeout=2) if response.haslayer(TCP): print(response.getlayer(TCP).flags) ``` What is the primary goal of this script?

Accepted Answer

To perform a SYN scan and determine if port 80 is open. The script uses Scapy to craft a TCP SYN packet (flags='S') to port 80 and sends it with sr1(), which waits for a single response. If a TCP layer is present in the reply, it prints the flags. This is the classic behavior of a SYN scan (half-open scan): it sends a SYN and analyzes the response to determine if the port is open (SYN-ACK) or closed (RST), without completing the handshake. Option B correctly identifies this as a SYN scan to check if port 80 is open.

Answer

To perform a TCP connect scan by completing the three-way handshake

Answer

To send an HTTP GET request and capture the web page

Answer

To perform a UDP scan on port 80

CompTIA PenTest+ (PT0-003) PT0-003 practice test

Three ways to study

Study PT0-003 by domain

Study PT0-003 by topic

Post-exploitation and Lateral Movement practice questions

Vulnerability Discovery and Analysis practice questions

Engagement Management practice questions

Reconnaissance and Enumeration practice questions

Attacks and Exploits practice questions

PT0-003 fundamentals practice questions

PT0-003 scenario practice questions

PT0-003 troubleshooting practice questions

Top PT0-003 questions

CompTIA PenTest+ (PT0-003) practice questions

How to use these PT0-003 questions

Quick answer