This is the free Comptia PT0-003 practice question bank —
110 of 220 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-04-24.
Every answer is verified against official Comptia documentation —
see our methodology.
Question 1
A penetration tester attempts to access a domain-joined Windows file server that requires authentication for access. Which of the following will most likely assist in gaining access?
A. Intercept proxy chains with tcpdump.
B. Create a reverse shell payload with msfvenom.
C. Generate a silver ticket with Impacket.
D. Conduct a relay attack using Responder.
Show Answer
Correct Answer: D
Explanation: An SMB/NTLM relay attack using Responder can capture and relay authentication attempts in a Windows domain to a file server, potentially granting access without knowing credentials, especially if SMB signing is not enforced. This is a common and practical method in real environments. A silver ticket requires prior access to a service account hash, which is less likely at the initial access stage.
Question 2
An internal penetration tester is on site assessing network access for company-owned mobile devices. Which of the following would be the best tool to identify the available networks?
A. Wireshark
B. theHarvester
C. Recon-ng
D. WiGLE.net
Show Answer
Correct Answer: D
Explanation: WiGLE.net is purpose-built for discovering and mapping wireless networks, providing information on available SSIDs, access points, and their locations. The other options focus on packet analysis (Wireshark) or OSINT for people/domains (theHarvester, Recon-ng), not identifying available wireless networks.
Question 3
A penetration tester wants to automatically enumerate all ciphers permitted on TLS/SSL configurations across a client's internet-facing and internal web servers. Which of the following tools or frameworks best supports this objective?
A. Nmap Scripting Engine
B. Shodan
C. Impacket
D. Netcat
E. Burp Suite
Show Answer
Correct Answer: A
Explanation: The Nmap Scripting Engine includes dedicated scripts such as ssl-enum-ciphers that automatically enumerate supported TLS/SSL cipher suites across multiple hosts and services. It is specifically designed for scalable, automated service and configuration discovery, making it the best fit for enumerating ciphers on both internet-facing and internal web servers. The other options lack built-in, automated cipher enumeration capabilities for this use case.
Question 4
A penetration tester gained a foothold within a network. The penetration tester needs to enumerate all users within the domain. Which of the following is the best way to accomplish this task?
A. pwd.exe
B. net.exe
C. sc.ехе
D. msconfig.exe
Show Answer
Correct Answer: B
Explanation: The net.exe utility supports commands such as `net user` and `net user /domain`, which enumerate local and domain user accounts respectively. This makes it the most effective built-in tool for listing all users within a Windows domain. The other options do not provide domain user enumeration functionality.
Question 5
A company's incident response team determines that a breach occurred because a penetration tester left a web shell. Which of the following should the penetration tester have done after the engagement?
A. Enable a host-based firewall on the machine
B. Remove utilized persistence mechanisms on client systems
C. Revert configuration changes made during the engagement
D. Turn off command-and-control infrastructure
Show Answer
Correct Answer: B
Explanation: A web shell is a persistence mechanism left behind on a compromised system. After a penetration test, the tester must clean up all artifacts introduced during the engagement, including removing any persistence mechanisms such as web shells, backdoors, or accounts. Failing to do so can enable real attackers to exploit them later. The other options do not directly address removing the cause of the breach.
Question 6
Which of the following differentiates MITRE ATT&CK from PTES?
A. MITRE ATT&CK emphasizes real-world adversary behavior patterns, while PTES outlines structured test phases
B. MITRE ATT&CK defines risk scoring models for vulnerabilities, while PTES focuses on defensive controls.
C. MITRE ATT&CK organizes asset inventories, while PTES provides data breach response procedures
D. MITRE ATT&CK provides detailed exploit code samples, while PTES focuses on threat actor profiles
Show Answer
Correct Answer: A
Explanation: MITRE ATT&CK is a knowledge base that catalogs real-world adversary tactics, techniques, and procedures based on observed behavior, whereas PTES (Penetration Testing Execution Standard) defines the structured phases and methodology for conducting a penetration test. The other options describe capabilities neither framework provides.
Question 7
A penetration tester identifies an exposed corporate directory containing first and last names and phone numbers for employees. Which of the following attack techniques would be the most effective to pursue if the penetration tester wants to compromise user accounts?
A. Smishing
B. Impersonation
C. Tailgating
D. Whaling
Show Answer
Correct Answer: A
Explanation: The exposed directory provides names and phone numbers, which directly enable targeted SMS-based social engineering. Smishing leverages phone numbers to send convincing messages that can trick users into revealing credentials or clicking malicious links, making it the most effective technique for compromising user accounts in this scenario. Impersonation is broader, but smishing specifically exploits the available data.
Question 8
HOTSPOT
-
A penetration tester is performing an assessment for an application that allows users to follow other individuals, if those individuals accept.
The request is performed from a newly created account that is not actively following or being followed by any other users and is targeting a private user profile.
INSTRUCTIONS
-
Use the drop-down menus to select the most appropriate code segment for each of the first two lines in the API request.
Then identify the issue within the response and select the appropriate remediation to resolve the vulnerability.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Show Answer
Correct Answer: POST
api.example.com
Private profile information is publicly accessible.
Enforce authorization for private profiles.
Explanation: A POST request to the public API endpoint returns full profile details even though "is_profile_private" is true and the requester has no approved relationship. This indicates missing access control on private profiles, which should be fixed by enforcing proper authorization checks.
Question 9
A penetration testing company is defining the rules of engagement with a client. Which of the following should the company include?
A. Non-disclosure agreement
B. Escalation process
C. URL list
D. Authorization letter
Show Answer
Correct Answer: B
Explanation: Rules of engagement define how the penetration test is conducted and managed, including communication and response procedures. An escalation process specifies who to contact and how to handle critical findings or outages during testing, making it a core ROE element. An authorization letter is a separate pre-engagement legal permission, not part of the ROE itself.
Question 10
A penetration tester wants to verify whether passwords from a leaked password list can be used to access an SSH server as a legitimate user.
Which of the following is the most appropriate tool for this task?
A. BloodHound
B. Responder
C. Burp Suite
D. Hydra
Show Answer
Correct Answer: D
Explanation: The task is to test whether known or leaked passwords can authenticate to an SSH service. Hydra is specifically designed for online password attacks against network services such as SSH, FTP, and HTTP, making it the most appropriate tool. BloodHound is for Active Directory relationship analysis, Responder is for poisoning and credential capture on local networks, and Burp Suite targets web application testing rather than SSH authentication.
$19
Get all 220 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
