This is the free Comptia PT0-003 practice question bank —
180 of 342 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-08-04.
Every answer is verified against official Comptia documentation —
see our methodology.
Question 1
SIMULATION
-
A penetration tester performs several Nmap scans against the web application for a client.
INSTRUCTIONS
-
Click on the WAF and servers to review the results of the Nmap scans. Then click on each tab to select the appropriate vulnerability and remediation options.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Show Answer
Correct Answer: Vulnerability:
Bypass the WAF to communicate directly with App01.example.com.
Remediation:
Restrict direct communications to App01.example.com to only approved components.
Require an additional authentication header value between CDN.example.com and App01.example.com.
Explanation: The scans show the application server is directly reachable on HTTP/HTTPS while the CDN/WAF is also exposed, indicating the origin can be accessed without going through the WAF. Limiting direct origin access and validating requests from the CDN mitigates WAF bypass.
Question 2
A tester infiltrates an internal network and wants to move laterally. The tester conducts host and service discovery and finds the following:
• A number of internal web servers require user login (one HTTPS and five HTTP).
• Two SQL servers are running PostgreSQL.
• Two fileshare servers are running SMB 3.
• There are multiple Windows and *NIX user endpoints.
The tester has not found any usable credentials on the compromised machine. During preengagement activities, the tester teams that the client's password policy has the following requirements:
• Passwords must have a minimum of 16 characters
• Passwords must have both alphanumeric and special characters.
Which of the following will best achieve the tester's objective?
A. Attempting a DCSync attack
B. Performing mask attacks against service logins
C. Conducting an on-path attack against the fileshares
D. Capturing web server traffic
Show Answer
Correct Answer: C
Explanation: An on-path attack against SMB fileshares can capture or relay NTLM authentication, enabling lateral movement without needing to crack very strong 16-character passwords. A DCSync attack requires high privileges that the tester does not have, mask attacks are impractical against the stated password policy, and simply capturing HTTPS/HTTP web traffic is less likely to yield usable credentials, especially with HTTPS present.
Question 3
A penetration tester completes an assessment for a healthcare company. Several findings indicate the potential exposure of sensitive patient data. Which of the following steps must the penetration tester complete before dosing the engagement?
A. Copy the patient data to an external hard disk drive.
B. Ensure local copies of patient data are deleted.
C. Encrypt any sensitive patient data that may be needed later.
D. Capture the cryptographic hash of the patient data files.
Show Answer
Correct Answer: B
Explanation: Before closing a penetration test, sensitive client data obtained during the engagement should not be retained unnecessarily. The tester should securely delete any local copies of patient data in accordance with the rules of engagement and applicable data handling requirements. Copying data externally is inappropriate, encrypting it for later retention is not required unless explicitly authorized, and hashing the files does not address proper disposal of sensitive data.
Question 4
Which of the following is the best mechanism to covertly and quickly exfiltrate a large amount of data?
A. Network Time Protocol
B. Internet Control Message Protocol
C. Simple Mail Transport Protocol
D. Domain Name System Protocol
Show Answer
Correct Answer: D
Explanation: Domain Name System (DNS) is a common choice for covert data exfiltration because DNS traffic is typically permitted through network boundaries and can tunnel encoded data within queries and responses. While DNS has limited payload size per request, it is widely recognized as an effective covert exfiltration channel. ICMP can also be abused, but DNS is generally the best answer in security exam contexts. SMTP is more conspicuous and NTP is not commonly used for large covert transfers.
Question 5
A penetration tester obtains a copy of the file that contains password hashes of a Linux system. Which of the following toots should the penetration tester use first?
A. Hydra
B. unshadow
C. hashcat
D. John the Ripper
Show Answer
Correct Answer: B
Explanation: If the tester has the Linux password hash file and the corresponding account information, the first step before using John the Ripper is to run unshadow to combine the /etc/passwd and /etc/shadow files into the format expected by the cracker. Hydra is an online login attack tool, while Hashcat and John the Ripper perform password cracking after the hashes are prepared.
Question 6
A penetration tester must obtain network credentials. The penetration tester has not previously accessed the systems. The target subnet within the network is mainly used by employee workstations for daily tasks. Which of the following actions will most likely achieve this goal?
A. Execute Responder to collect account hashes
B. Run secretsdump to retrieve stored credentials.
C. Use msfvenom to create exploit executables.
D. Conduct Nmap scans to gain knowledge about the hosts.
Show Answer
Correct Answer: A
Explanation: Responder is designed for internal network credential capture by poisoning LLMNR/NBT-NS/mDNS and collecting NetNTLM challenge-response hashes from workstation authentication attempts. It does not require prior access to target hosts, making it well suited to a workstation subnet. Secretsdump requires privileged access to systems, msfvenom generates payloads rather than obtaining credentials directly, and Nmap performs reconnaissance but does not capture credentials.
Question 7
A tester disables the C2 infrastructure, ensures all sessions are exited, and verifies that removal scripts were run. However, firewall logs still show a few hosts issue connectivity attempts every hour. Which of the following is the most likely reason for the continued connectivity attempts?
A. The tester has not issued the correct process termination commands.
B. The tester has not restarted the affected endpoints after removal.
C. The tester has not checked for lingering cron jobs and scheduled tasks.
D. The tester has not restored the Run or Winlogon registry key values.
Show Answer
Correct Answer: C
Explanation: Hourly outbound connection attempts after C2 shutdown, session termination, and removal scripts indicate a persistence mechanism is still executing on a schedule. Lingering cron jobs (Linux/macOS) or Windows Scheduled Tasks commonly trigger periodic beaconing. Process termination would not explain recurring hourly launches, endpoint reboot is not generally required for scheduled persistence to stop once removed, and Run/Winlogon registry persistence is typically tied to logon rather than fixed hourly intervals.
Question 8
A penetration tester reviews the TTL values obtained from different systems. Which of the following best explains what the penetration tester wants to accomplish?
A. Network reconnaissance
B. Host discovery
C. Attack path mapping
D. Operating system fingerprinting
Show Answer
Correct Answer: D
Explanation: Reviewing IP Time To Live (TTL) values is a classic passive fingerprinting technique. Different operating systems use characteristic default TTL values (commonly 64, 128, or 255), and after accounting for hop count, a tester can infer the likely operating system of a target. While TTL is observed during reconnaissance, its specific purpose here is operating system fingerprinting.
Question 9
A penetration tester wants to collect a client's confidential information during an internal penetration test. Which of the following best meets the tester's objective?
A. Performing LDAP port scanning
B. Dumping Active Directory data
C. Scanning for HTTPS service banners
D. Enumerating SMB using null sessions
Show Answer
Correct Answer: B
Explanation: Dumping Active Directory data is the action most directly aligned with collecting confidential information during an internal penetration test. An AD dump can reveal users, groups, computer objects, group memberships, policies, trusts, service accounts, and potentially password hashes or other sensitive directory information. The other options are primarily reconnaissance or enumeration techniques that identify services or accessible resources rather than directly collecting the broad set of confidential information sought.
Question 10
A penetration tester conducts a web application test and wants to enumerate the file folder structure https://testsite.com. Which of the following is the correct command?
A. wfuzz -с -w common.txt -u https://testsite.com/index.php -d "username=admin&password=FUZZ"
B. wfuzz -c -w common.txt -u https://testsite.com/FUZZ
C. wfuzz -c -w common.txt -u https://testsite.com/index.php -H "Cookie;session=FUZZ"
D. wfuzz -c -w common.txt -u https://testsite.com?FUZZ=test
Show Answer
Correct Answer: B
Explanation: Directory and file enumeration with wfuzz is performed by placing the FUZZ keyword in the URL path and supplying a wordlist. Wfuzz replaces FUZZ with each entry from common.txt to discover valid directories or files. The other options fuzz POST parameters, cookies, or query-string parameter names rather than the folder structure.
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
