Description
For learners studying for CompTIA PenTest+ PT0-003 (V3)
What you'll learn
Practice pack content
Domain 1 - Engagement Management
Domain 2 – Reconnaissance and Enumeration
Domain 3 – Vulnerability Discovery and Analysis
Domain 4 – Attacks and Exploits
Domain 5 – Post-exploitation and Lateral Movement
Final Exam Simulators
Exam Study Guide
Interactive Flashcards
Try 3 CompTIA PenTest+ PT0-003 (V3) practice questions
Choose an answer, explore the explanation, and see why the other options are less suitable. Three short scenarios. No sign-in required.
1. A responsive host outside the approved scope
During an authorized penetration test, a tester discovers a responsive server adjacent to the client’s approved CIDR range. The server is not listed in the scope or exclusions, and no written authorization covers it. What should the tester do next?
Answer and full explanation
Correct answer: B — Stop and follow the escalation process before testing the host.
Why B is correct
Penetration testing authority is bounded by the agreed scope and rules of engagement. The decisive clue is that the server falls outside the approved target range and no authorization covers it. CompTIA Objective 1.1 explicitly includes scope definition, rules of engagement, exclusions, escalation processes, testing windows, and target selection. NIST defines rules of engagement as the constraints that give a test team authority to conduct defined activities. The tester should therefore avoid interacting with the host until the client formally clarifies or expands the scope.
Why the other options are less suitable
- A — Passive fingerprinting: Whether an activity is passive does not automatically place an out-of-scope asset within the engagement. The tester still needs authorization that covers the target and the intended activity.
- C — Minimal port scan: A small scan is still active testing against a host that is not currently authorized. Ownership uncertainty is a reason to escalate, not a reason to probe first.
- D — Testing window: A testing window controls when authorized activity may occur. It does not expand which systems the tester is permitted to assess.
Key takeaway: Scope determines what may be tested; the escalation process should handle unexpected targets before any additional activity.
Read two more sample questions
2. Validating a scanner finding
A vulnerability scanner reports that a server is affected by a version-specific CVE. Manual verification shows the vendor backported the security fix without changing the displayed package version, and the reported weakness cannot be reproduced. How should the finding be classified?
Answer and full explanation
Correct answer: C — A false positive.
Why C is correct
A false positive occurs when a tool reports a vulnerability that is not actually present. The scanner appears to have relied on version information while missing the vendor’s backported fix. CompTIA Objective 3.2 explicitly requires validating reconnaissance, scanning, and enumeration results and distinguishes false positives, false negatives, and true positives. NIST likewise notes that vulnerability scanners can produce false positives and that knowledgeable assessors should interpret and validate results. Because manual verification does not confirm the reported weakness, the finding should be classified as a false positive.
Why the other options are less suitable
- A — False negative: A false negative occurs when a real vulnerability exists but the tool fails to report it. Here the scanner did report a vulnerability, but validation shows the vulnerability is not present.
- B — True positive: A true positive requires the reported condition to be genuinely vulnerable. Matching a version string is insufficient when the vendor has applied the fix through a backport.
- D — Incomplete scan: Scan completeness concerns whether the assessment covered the intended targets and checks. A disagreement resolved by manual validation is better described as an inaccurate finding than as missing coverage.
Key takeaway: Scanner output is evidence to validate, not a substitute for confirming whether the reported vulnerability actually exists.
3. Restoring the environment after testing
An authorized engagement is complete. During testing, the team created a temporary account, changed a configuration setting, and generated artifacts needed for the final report. Which cleanup approach best aligns with the engagement objectives?
Answer and full explanation
Correct answer: A — Remove tester-created access, restore changes, and preserve required evidence.
Why A is correct
Cleanup should return the environment to its agreed state while retaining evidence that must be preserved for reporting or engagement requirements. CompTIA Objective 5.4 explicitly lists removing persistence mechanisms, reverting configuration changes, removing tester-created credentials, removing tools, preserving artifacts, and secure data destruction. The scenario contains all three relevant elements: temporary access, a configuration change, and report evidence. NIST also recommends that assessment-specific accounts be disabled or deleted at the conclusion of an assessment. The best response therefore combines restoration with deliberate preservation of required artifacts.
Why the other options are less suitable
- B — Retaining the account: Disabling an account reduces immediate use, but the objective specifically includes removing tester-created credentials. Keeping unnecessary test access increases residual risk after the engagement.
- C — Deleting all artifacts: Cleanup includes secure destruction when appropriate, but it also includes preserving artifacts. Evidence needed for the final report or agreed documentation should not be destroyed prematurely.
- D — Leaving configuration changes: A penetration tester should not silently convert test changes into production changes. Configuration restoration or an explicitly approved handoff is required rather than assuming a security improvement should remain.
Key takeaway: End-of-engagement cleanup removes tester-created access and changes while preserving only the evidence the engagement requires.
Preview complete
You have tried all three samples
Review the explanations or try the samples again. This short preview covers only a small part of the exam objectives.
Your sample score resets when this page reloads.
Your practice pack includes
More ways to make each study session count
Focus on a topic, practise under a time limit, or return to the supporting resources before your next attempt.
Domain-based practice
Timed practice sets
Study guide
Flashcards
Requirements
- CompTIA recommends 3–4 years of experience in a penetration tester job role, reflecting the practical scope of PT0-003 across engagement management, reconnaissance, vulnerability analysis, testing, and post-engagement activities.
- If some objectives are unfamiliar, combine question practice with foundational study and your own authorized lab exercises involving reconnaissance, vulnerability validation, reporting, web and cloud security, scripting, and cleanup workflows.
- You will need an internet-connected device, a current web browser, and an ExamsDigest account to use the online practice product; this does not imply offline availability or a separate mobile application.
Know the exam you’re studying for
These details describe CompTIA’s official PenTest+ PT0-003 (V3) exam.
What our students say
“I used the PenTest+ practice exams during my final review and they helped me identify weak areas in reconnaissance, vulnerability analysis, and post-exploitation. The explanations were especially useful for understanding why one action was more appropriate for the scenario than the others.”
Dylan Mercer
✓ Verified Review
“The questions covered a strong mix of engagement planning, scanning, attacks, reporting, and cleanup. Reviewing the questions I missed helped me focus on the PT0-003 objectives that needed more attention before exam day.”
Elena Whitford
✓ Verified Review
“I had already worked through other PenTest+ study resources before trying ExamsDigest. What stood out to me was how clearly the explanations broke down each option, because it helped me understand the reasoning instead of simply memorizing the correct answer.”
Marcus Ellery
✓ Verified Review
Your questions, answered.
Which PenTest+ exam version do these practice questions target?
Who is PenTest+ PT0-003 practice intended for?
Who is PenTest+ PT0-003 practice intended for?
What should I do when I answer a question incorrectly?
What question formats appear on the official PT0-003 exam?
Does completing this practice earn the CompTIA PenTest+ certification?
30-day conditional refund policy
Eligible requests must be made within 30 calendar days, with no more than 20% of any included simulator completed. The purchase must not already be refunded or under a payment dispute or chargeback. Other provisions apply; mandatory consumer rights remain unaffected.
Useful links for your preparation
