CertBlaze

Comptia

PT0-003 Free Practice Questions

This is the free Comptia PT0-003 practice question bank — 180 of 342 total questions, each with a full explanation, free to read with no signup required. Updated 2026-10-13.

Every answer is verified against official Comptia documentation — see our methodology.

Question 1

After exploiting a vulnerability in an insecure service to gain access to a Linux system, a penetration tester executes the following commands: sudo -l route netstat -a last who Which of the following best describes the tester's purpose for running these commands?

A. To obtain information about other systems in the network
B. To enumerate users and services in order to identify additional targets
C. To prepare for establishing persistence on the system
D. To gather data to prepare for lateral movement
Show Answer
Correct Answer: D
Explanation:
These commands perform post-compromise reconnaissance: they reveal available sudo privileges, reachable networks and connections, and recent or active users. Together, that information can help the tester identify paths and accounts for moving to other systems in the environment.

Question 1

A penetration tester cannot use Nmap and must perform port discovery and banner grabbing for potential vulnerable SSH services. Given the following script: Which of the following commands will best help the tester achieve this objective?

Illustration for PT0-003 question 1
A. ping -с 22 "$ip_address$i"
B. nc "$ip_address$i" ":22"
C. arp "$ip_address$i" ":22"
D. curl scp://"$ip_address$i" ":22"
Show Answer
Correct Answer: B
Explanation:
Netcat is the appropriate tool for checking whether TCP port 22 is open and reading an SSH banner. The command as written should use the port without a colon: `nc "$ip_address$i" 22`.

Question 1

SIMULATION - A penetration tester performs several Nmap scans against the web application for a client. INSTRUCTIONS - Click on the WAF and servers to review the results of the Nmap scans. Then click on each tab to select the appropriate vulnerability and remediation options. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

Illustration for PT0-003 question 1 Illustration for PT0-003 question 1 Illustration for PT0-003 question 1 Illustration for PT0-003 question 1 Illustration for PT0-003 question 1
Show Answer
Correct Answer: Vulnerability: Bypass the WAF to communicate directly with App01.example.com. Remediation: Restrict direct communications to App01.example.com to only approved components. Require an additional authentication header value between CDN.example.com and App01.example.com.
Explanation:
The scans show the application server is directly reachable on HTTP/HTTPS while the CDN/WAF is also exposed, indicating the origin can be accessed without going through the WAF. Limiting direct origin access and validating requests from the CDN mitigates WAF bypass.

Question 2

A penetration tester uses Burp Suite to send the following request: Which of the following options best describes what the tester is executing?

Illustration for PT0-003 question 2
A. SQL injection
B. Session hijack
C. Brute-force attack on usernames or/and password
D. Cross-site scripting
Show Answer
Correct Answer: A
Explanation:
The password field contains an SQL-style `' OR '` payload intended to alter the backend login query and potentially bypass authentication. This is SQL injection.

Question 2

A tester infiltrates an internal network and wants to move laterally. The tester conducts host and service discovery and finds the following: • A number of internal web servers require user login (one HTTPS and five HTTP). • Two SQL servers are running PostgreSQL. • Two fileshare servers are running SMB 3. • There are multiple Windows and *NIX user endpoints. The tester has not found any usable credentials on the compromised machine. During preengagement activities, the tester teams that the client's password policy has the following requirements: • Passwords must have a minimum of 16 characters • Passwords must have both alphanumeric and special characters. Which of the following will best achieve the tester's objective?

A. Attempting a DCSync attack
B. Performing mask attacks against service logins
C. Conducting an on-path attack against the fileshares
D. Capturing web server traffic
Show Answer
Correct Answer: C
Explanation:
An on-path attack against SMB fileshares can capture or relay NTLM authentication, enabling lateral movement without needing to crack very strong 16-character passwords. A DCSync attack requires high privileges that the tester does not have, mask attacks are impractical against the stated password policy, and simply capturing HTTPS/HTTP web traffic is less likely to yield usable credentials, especially with HTTPS present.

Question 3

A penetration tester completes an assessment for a healthcare company. Several findings indicate the potential exposure of sensitive patient data. Which of the following steps must the penetration tester complete before dosing the engagement?

A. Copy the patient data to an external hard disk drive.
B. Ensure local copies of patient data are deleted.
C. Encrypt any sensitive patient data that may be needed later.
D. Capture the cryptographic hash of the patient data files.
Show Answer
Correct Answer: B
Explanation:
Before closing a penetration test, sensitive client data obtained during the engagement should not be retained unnecessarily. The tester should securely delete any local copies of patient data in accordance with the rules of engagement and applicable data handling requirements. Copying data externally is inappropriate, encrypting it for later retention is not required unless explicitly authorized, and hashing the files does not address proper disposal of sensitive data.

Question 3

Given the following output: Which of the following did the penetration tester most likely execute?

Illustration for PT0-003 question 3
A. Exploits on discovered hosts and services
B. A series of Nmap scans for host discovery
C. An automated script to confirm true positives
D. A ping sweep of the 10.0.10.0/24 network segment
Show Answer
Correct Answer: C
Explanation:
The output shows an automated scan checking hosts and then validating a specific finding—anonymous access to FTP on port 21. This is most consistent with a script used to confirm true positives, rather than merely discovering hosts or exploiting services.

Question 3

During a penetration test, the tester configures a backdoor to maintain access to a compromised system. In addition, the tester keeps a time card on the desktop of the compromised host. Which of the following is the most important activity for the tester to perform after the engagement concludes?

A. Revert configuration changes.
B. Preserve artifacts.
C. Remove persistence mechanisms.
D. Secure the data destruction.
Show Answer
Correct Answer: C
Explanation:
Remove the backdoor and any other persistence mechanisms so the compromised system is not left accessible after the engagement. Other cleanup tasks may also be appropriate, but eliminating the tester’s persistent access is the priority.

Question 4

A penetration tester is working on an engagement in which a main objective is to collect confidential information that could be used to exfiltrate data and perform a ransomware attack. During the engagement, the tester is able to obtain an internal foothold on the target network. Which of the following is the next task the tester should complete to accomplish the objective?

A. Initiate a social engineering campaign.
B. Perform credential dumping.
C. Compromise an endpoint.
D. Share enumeration.
Show Answer
Correct Answer: B
Explanation:
After gaining an internal foothold, the tester should perform credential dumping to obtain credentials that may enable privilege escalation, lateral movement, and access to confidential data. Social engineering is more relevant to gaining initial access, while share enumeration alone does not provide the broader access needed for the objective. Sources: https://blog.barracuda.com/2026/05/19/nightmare-eclipse-zero-days-grudge

Question 4

Which of the following is the best mechanism to covertly and quickly exfiltrate a large amount of data?

A. Network Time Protocol
B. Internet Control Message Protocol
C. Simple Mail Transport Protocol
D. Domain Name System Protocol
Show Answer
Correct Answer: D
Explanation:
Domain Name System (DNS) is a common choice for covert data exfiltration because DNS traffic is typically permitted through network boundaries and can tunnel encoded data within queries and responses. While DNS has limited payload size per request, it is widely recognized as an effective covert exfiltration channel. ICMP can also be abused, but DNS is generally the best answer in security exam contexts. SMTP is more conspicuous and NTP is not commonly used for large covert transfers.

$19

Get all 342 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full PT0-003 study guide →