How many Select Two (Multi-Select) Questions questions are on this page?

This page has 6 Select Two (Multi-Select) Questions scenario questions for the PT0-003 exam, each with detailed explanations and wrong-answer analysis.

How should I approach PT0-003 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to CompTIA PenTest+ (PT0-003) questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise CompTIA PenTest+ (PT0-003) practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

PT0-003

exam code

CompTIA

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummulti select

Full question →

A penetration tester has captured network traffic and wants to analyze it using Wireshark. Which two actions can the tester perform to focus on specific types of communication? (Choose TWO.)

A
Use the Conversations window
Conversations show traffic between specific endpoints.
B
Decrypt SSL/TLS traffic
Why wrong: Decryption is possible but not specifically for focusing on communication types.
C
Apply a display filter
Display filters show only packets matching criteria.
D
Run a port scan
Why wrong: Port scanning is not a Wireshark feature.
E
Generate a report with Nmap
Why wrong: Nmap is separate from Wireshark.

Full breakdown with real-world context →

Question 2hardmulti select

Full question →

During a penetration test, a tester successfully exploits a web application and gains a foothold. The tester needs to pivot to an internal network segment that is not directly accessible. Which THREE tools can the tester use to create a SOCKS proxy or tunnel for pivoting?

A
Chisel
Chisel is a fast TCP/UDP tunnel over HTTP.
B
Netcat
Why wrong: Netcat can create basic connections but not a SOCKS proxy directly.
C
Nmap
Why wrong: Nmap is a scanner, not a tunneling tool.
D
Ligolo-ng
Ligolo-ng creates a SOCKS5 proxy for pivoting.
E
SSH with -D flag
SSH -D creates a dynamic SOCKS tunnel.

Full breakdown with real-world context →

Question 3mediummulti select

Full question →

During a web application penetration test, a tester identifies a SQL injection vulnerability. Which TWO techniques could be used to extract data from the database? (Select TWO.)

A
Command injection
Why wrong: Command injection executes system commands, not SQL.
B
XXE injection
Why wrong: XXE targets XML processing.
C
Blind time-based SQL injection
Time-based blind uses delays to infer data.
D
Reflected XSS
Why wrong: XSS is client-side, not SQL injection.
E
UNION-based SQL injection
UNION query combines results to retrieve data.

Full breakdown with real-world context →

Question 4mediummulti select

Full question →

A penetration tester is performing a web application test and identifies a potential SQL injection vulnerability. Which TWO methods can the tester use to confirm the vulnerability and extract data?

A
XXE injection
Why wrong: XXE is XML entity injection.
B
Command injection
Why wrong: Command injection is OS command execution.
C
Blind time-based SQL injection
Uses time delays to infer data.
D
XSS injection
Why wrong: XSS is client-side script injection.
E
UNION-based SQL injection
Extracts data directly via UNION.

Full breakdown with real-world context →

Question 5hardmulti select

Full question →

During a cloud security assessment of AWS, a tester wants to identify misconfigurations using automated tools. Which THREE tools are specifically designed for AWS security auditing?

A
Hashcat
Why wrong: Hashcat is a password cracker, not cloud auditing.
B
Pacu
Correct: AWS exploitation framework.
C
Prowler
Correct: CIS benchmark tool for AWS.
D
CrackMapExec
Why wrong: CrackMapExec is for Windows/AD networks.
E
ScoutSuite
Correct: multi-cloud but supports AWS auditing.

Full breakdown with real-world context →

Question 6mediummulti select

Full question →

A penetration tester is preparing to present findings to the client's technical team. Which TWO practices are most effective for this audience?

A
Focus on the return on investment for fixing vulnerabilities.
Why wrong: This is more relevant for executives.
B
Use analogies to explain vulnerabilities in everyday terms.
Why wrong: Analogies may oversimplify; technical teams prefer precise details.
C
Include proof-of-concept code and remediation commands.
This provides actionable information for the technical team.
D
Explain the technical details of each vulnerability, including exploit steps.
This helps them understand and reproduce the issue.
E
Provide high-level business impact summaries only.
Why wrong: Technical teams need details, not just summaries.

Full breakdown with real-world context →

These PT0-003 practice questions are part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style PT0-003 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related PT0-003 topic practice pages

Post-exploitation and Lateral Movement practice questions

Vulnerability Discovery and Analysis practice questions

Engagement Management practice questions

Reconnaissance and Enumeration practice questions

Attacks and Exploits practice questions

PT0-003 fundamentals practice questions

PT0-003 scenario practice questions

PT0-003 troubleshooting practice questions

Practice scenarios

A penetration tester has captured network traffic and wants to analyze it using Wireshark. Which two actions can the tester perform to focus on specific types of communication? (Choose TWO.)

During a penetration test, a tester successfully exploits a web application and gains a foothold. The tester needs to pivot to an internal network segment that is not directly accessible. Which THREE tools can the tester use to create a SOCKS proxy or tunnel for pivoting?

During a web application penetration test, a tester identifies a SQL injection vulnerability. Which TWO techniques could be used to extract data from the database? (Select TWO.)

A penetration tester is performing a web application test and identifies a potential SQL injection vulnerability. Which TWO methods can the tester use to confirm the vulnerability and extract data?

During a cloud security assessment of AWS, a tester wants to identify misconfigurations using automated tools. Which THREE tools are specifically designed for AWS security auditing?

A penetration tester is preparing to present findings to the client's technical team. Which TWO practices are most effective for this audience?