CompTIA PT0-003: CompTIA PenTest+

Last checked October 22, 2026 against the official CompTIA exam page.

1. Question 1Attacks and Exploits

   A tester obtains a low-privilege shell on a Linux host. Which privilege escalation check is most useful early?

   1. AChanging the hostname to something more formal for corporate naming rules
   2. BDeleting the system's log files to hide the shell session from administrators
   3. CReviewing sudo rights, SUID binaries, and scheduled jobs that run with elevated privileges
   4. DRenaming the home directory to a name that matches the service account and its group
   Show answer and explanationHide answer

   Correct answer: C

   Sudo rules, SUID binaries and privileged scheduled jobs are common paths from a low-privilege shell to root. Hostnames, log deletion and renamed directories do not provide escalation paths and can damage evidence.

2. Question 2Information Gathering and Vulnerability Scanning

   A tester wants to find subdomains of a target organization without sending traffic directly to the target's systems. Which technique is most appropriate?

   1. ASending brute-force requests to the login page on the customer portal at scale
   2. BExploiting a known vulnerability on the web server running an unpatched Apache 2.4 build
   3. CPassive reconnaissance using certificate transparency logs and public DNS records
   4. DRunning a full port scan against each IP address with service version detection enabled
   Show answer and explanationHide answer

   Correct answer: C

   Passive reconnaissance uses public records such as certificate transparency logs and DNS data, which avoids touching the target. Port scans, brute force and exploitation all interact directly with target systems.

3. Question 3Planning and Scoping

   Before a penetration test begins, the client asks the tester to avoid all production databases. Which document should the tester confirm first to ensure the boundary is agreed?

   1. AThe vendor's marketing brochure for the scanner, with its feature list
   2. BThe client's holiday calendar for the office, listing staff vacation dates
   3. CThe tester's personal résumé, listing previous engagements and certifications
   4. DThe rules of engagement that define in-scope and out-of-scope systems and testing windows
   Show answer and explanationHide answer

   Correct answer: D

   The rules of engagement set scope, exclusions, timing and escalation contacts, which defines what the tester may touch. A résumé, a brochure and a calendar do not define authorization boundaries.

4. Question 4Tools and Code Analysis

   A tester reviews a script that builds SQL queries by concatenating user input. Which code review finding should be reported?

   1. AVariable names that are too long in the utility helper module
   2. BComments written in English and the team reviews them weekly
   3. CUse of tabs instead of spaces for indentation in the Python source files for consistency
   4. DSQL injection risk caused by unparameterized queries built from user input
   Show answer and explanationHide answer

   Correct answer: D

   Concatenating untrusted input into SQL allows injection, which parameterized queries prevent. Indentation, name length and comment language are style issues, not security findings.

5. Question 5Reporting and Communication

   A penetration test report must help the client prioritize fixes. Which element should accompany each finding?

   1. AA severity rating with justification, the affected asset, and a clear remediation recommendation
   2. BA list of unrelated improvements to the tester's own tools that the client did not request in writing
   3. CThe tester's favorite exploit name, listed in place of the affected asset, the risk, and the fix, with a short note
   4. DA statement that the systems are secure, based on the scanner output and the tester's judgment alone
   Show answer and explanationHide answer

   Correct answer: A

   Severity with justification, affected assets and remediation guidance let the client prioritize and fix issues. Exploit names alone, unrelated tool improvements and blanket security claims do not help remediation.