PT0-003 Practice Questions

Question 1

A penetration tester has completed the test and is preparing the final report. The client asks the tester to include a section that describes the scope, methodology, and tools used. In which section should this information be placed?

Accepted Answer

Appendices. Appendices are the appropriate place for supplementary information such as scope, methodology, and tools used.

Answer

Remediation section

Answer

Technical findings

Answer

Executive summary

Question 2

Which SQL injection technique involves injecting a query that causes a delay in response, allowing the attacker to infer information based on response time?

Accepted Answer

Blind time-based SQL injection. Blind time-based SQL injection uses delays (e.g., WAITFOR DELAY) to infer true/false conditions.

Answer

Error-based SQL injection

Answer

UNION-based SQL injection

Answer

Boolean-blind SQL injection

Question 3

During the reconnaissance phase, a penetration tester wants to identify subdomains of a target domain without making direct requests to the target's own DNS servers. Which technique would be BEST for this purpose?

Accepted Answer

Using search engines and public certificate transparency logs. Search engines (e.g., Google dorking) and public certificate transparency logs (e.g., crt.sh) allow a tester to discover subdomains by querying aggregated historical DNS and TLS certificate data, without sending any queries to the target's authoritative DNS servers. This passive reconnaissance technique avoids alerting the target's infrastructure and complies with the requirement of no direct requests to the target's DNS servers.

Answer

Using the 'nslookup' command interactively

Answer

Performing a zone transfer

Answer

Using the 'host' command

Question 4

A tester wants to enumerate SMB shares and execute commands remotely on a Windows target using captured credentials. Which tool is most appropriate?

Accepted Answer

CrackMapExec. CrackMapExec is a versatile tool for SMB enumeration, command execution, and lateral movement with credentials.

Answer

Hashcat

Answer

Responder

Answer

Bettercap

Question 5

A penetration tester has gained access to a Linux server and wants to move laterally to a Windows server. The tester captured a hash of a domain user. Which tool can be used to authenticate to the Windows server using the hash?

Accepted Answer

evil-winrm. evil-winrm supports pass-the-hash authentication over WinRM, allowing lateral movement.

Answer

Ligolo-ng

Answer

SSH

Answer

Chisel

Question 6

You are conducting a penetration test and need to identify subdomains of a target domain using a passive approach that does not generate traffic to the target's servers. Which technique should you use?

Accepted Answer

Certificate transparency logs. Certificate transparency logs (e.g., crt.sh) are public logs of SSL/TLS certificates, often containing subdomain names. Querying them is passive and does not interact with the target.

Answer

DNS cache snooping

Answer

Subdomain bruteforce with gobuster

Answer

DNS zone transfer

Question 7

A penetration tester wants to discover email addresses associated with a target domain (example.com) without sending any network packets to the target's systems. Which technique is BEST suited for this?

Accepted Answer

Google dorking. Google dorking uses advanced search operators (e.g., site:example.com intext:@example.com) to index publicly available information from Google's cached pages, allowing discovery of email addresses without sending any packets to the target's infrastructure. This passive reconnaissance technique relies solely on pre-existing search engine data, making it ideal for avoiding direct interaction with the target.

Answer

DNS brute forcing

Answer

WHOIS lookup

Answer

SMB enumeration

Question 8

A penetration tester is compiling the final report. The client's compliance officer requires a section that maps each finding to specific regulatory requirements (e.g., PCI DSS, HIPAA). Which section of the report is best suited for this mapping?

Accepted Answer

Compliance Mapping. The Compliance Mapping section is specifically designed to cross-reference each technical finding with relevant regulatory frameworks such as PCI DSS, HIPAA, or GDPR. This allows the compliance officer to quickly verify that all required controls are addressed and that the report meets audit or legal standards. The other sections focus on summarizing or detailing technical issues, not on mapping findings to specific regulations.

Answer

Executive Summary

Answer

Technical Findings

Answer

Appendices

Question 9

A penetration tester discovers a critical vulnerability during an assessment. According to best practices, when should the tester communicate this finding to the client?

Accepted Answer

Immediately upon discovery. Critical findings should be reported immediately to allow the client to take urgent action.

Answer

Only in the final report

Answer

After the test is complete

Answer

At the next scheduled status meeting

Question 10

In a Python script for a penetration test, you need to craft a custom TCP packet with specific flags. Which library is best suited for low-level packet manipulation?

Accepted Answer

scapy. Scapy allows crafting, sending, and sniffing network packets at a low level, supporting custom TCP flags.

Answer

requests

Answer

socket

Answer

impacket

Question 11

A penetration tester is reviewing source code and wants to identify common hardcoded credentials and input validation gaps. Which three checks should the tester perform? (Choose THREE.)

Accepted Answer

Identify usage of eval, exec, or system with user input. Hardcoded credentials, concatenated SQL queries, and dangerous functions like eval/exec/system are common vulnerabilities.

Answer

Verify the use of HTTPS

Answer

Check for proper session timeout implementation

Question 12

During a penetration test, a tester captures NTLMv2 hashes by spoofing LLMNR responses. Which tool is most commonly used for this purpose?

Accepted Answer

Responder. Responder is the standard tool for LLMNR/NBT-NS/mDNS poisoning to capture NTLM hashes.

Answer

John the Ripper

Answer

Bettercap

Answer

Hashcat

Question 13

During a penetration test, the tester gains access to a domain-joined Windows machine and wants to perform Kerberoasting. Which THREE conditions are necessary for a successful Kerberoasting attack?

Accepted Answer

Ability to request TGS-REP tickets. The user must have domain credentials, there must be service accounts with SPNs, and the attacker must be able to request TGS tickets. Plaintext passwords are not required, and local admin is not needed.

Answer

Local administrator privileges on the target

Answer

Plaintext password of the service account

Question 14

A penetration tester is conducting passive reconnaissance and wants to gather information about a target organization's employees, email addresses, and internal structure. Which TWO tools are best suited for this purpose? (Select TWO.)

Accepted Answer

Maltego. Maltego is a data mining tool that visualizes relationships and can collect info from social media, DNS, and other sources. theHarvester gathers emails, subdomains, and names from public sources. LinkedIn is also used for organizational chart mapping, but the question asks for tools specifically.

Answer

Gobuster

Answer

Nmap

Answer

Nikto

Question 15

During post-engagement, a penetration tester needs to ensure proper data handling. Which THREE actions should the tester take?

Accepted Answer

Securely destroy test artifacts after the client accepts the report. After the engagement, test artifacts should be securely destroyed, data should be purged from test systems, and confidential information must be handled per agreement.

Answer

Retain all test data indefinitely for future reference

Answer

Share findings with other clients to demonstrate expertise

CompTIA PenTest+ PT0-003 practice test

Three ways to study

Study PT0-003 by domain

Study PT0-003 by topic

Engagement Management practice questions

Attacks and Exploits practice questions

Post-exploitation and Lateral Movement practice questions

Vulnerability Discovery and Analysis practice questions

Reconnaissance and Enumeration practice questions

PT0-003 fundamentals practice questions

PT0-003 scenario practice questions

PT0-003 troubleshooting practice questions

Top PT0-003 questions

CompTIA PenTest+ (PT0-003) practice questions