CompTIA PenTest+ Exam Guide 2026: PT0-003 Prep Beyond Tool Names
Video
A penetration tester is preparing a proposal for a client that requires testing of a web application handling PCI DSS data. Which compliance requirement must be explicitly addressed in the Rules of Engagement?
Pentest Engagement Management
Question · Medium
Dad clicked the link: the malware removal order
Short
PenTest+ PT0-003 tests engagement judgment, recon, vulnerability analysis, exploitation, post-exploitation, and reporting. Study it hands-on.
Blog
During a penetration test, the tester discovers evidence of an active insider threat. According to standard engagement protocols, what is the appropriate immediate action?
Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts
Study guide
A client requests a penetration test but cannot provide written authorization for three weeks. The project timeline is urgent. What is the appropriate response?
Question · Easy
Tech Exam Prep Podcast
Listen on Spotify
Podcast
Which document specifies the technical boundaries of a penetration test, including approved IP ranges, excluded systems, and testing timeframes?
A penetration testing firm is assessing the risk of testing a client's critical production environment. Which factor represents the highest potential business impact risk?
In a penetration test proposal, which component best helps the client understand the value and expected outcomes of the engagement?
1.2 Format, PBQs, Scoring, and Retake Policy
A tester runs the command: `host -t mx example.com`. What information is being gathered?
Pentest Reconnaissance
During reconnaissance, a tester discovers that a company's website uses WordPress 5.8.1 based on generator meta tags. Which OSINT technique was primarily used?
A penetration tester uses theHarvester tool with the following command: `theHarvester -d target.com -b google,linkedin`. What is the primary purpose of this command?
When performing active reconnaissance with Nmap, which timing template option provides the slowest scan to avoid detection?
1.3 Recertification, CEUs, and Career Fit
A tester executes: `nmap -sV -p 21,22,80,443,3389 192.168.1.0/24`. What does this command accomplish?
Which SNMP operation is most useful for enumerating user accounts on a Windows system?
Question · Hard
A tester uses Shodan to search for: `apache country:US city:"San Francisco"`. What type of reconnaissance is being performed?
During enumeration, a tester runs `enum4linux -a 192.168.1.50` against a target system. What is the primary goal of this tool?
Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements
A penetration tester performs: `dig @ns1.target.com target.com AXFR`. What is being attempted?
A tester uses Recon-ng with the module `recon/domains-hosts/google_site_web`. What information is this module designed to discover?
A vulnerability scan reports that a system has CVE-2021-44228 (Log4Shell). What is the most appropriate next step in the validation process?
Pentest Vulnerability Discovery
A scanner reports multiple vulnerabilities on a target system. Which factor should have the HIGHEST priority when determining which vulnerabilities to exploit first?
2.2 Target Selection and Assessment Types
During a vulnerability scan, a tester notices that Nessus reports "SSL Certificate Cannot Be Trusted" and "SSL Certificate Expired". These findings indicate:
A vulnerability scanner reports that a web application is vulnerable to SQL injection. Which action BEST validates this finding before exploitation?
When using OpenVAS for vulnerability scanning, what is the purpose of the "scan config"?
A tester discovers default credentials "admin/admin" on a network device. According to CVSS v3.1, which attack vector would this vulnerability most likely have?
2.3 Shared Responsibility, Legal Authorization, and Ethics
Which of the following is a FALSE POSITIVE indicator when reviewing vulnerability scan results?
A penetration tester notices that a vulnerability scan takes significantly longer when using authenticated scans compared to unauthenticated scans. What is the primary reason for this difference?
When prioritizing vulnerabilities for remediation, which combination of factors typically represents the HIGHEST risk?
A tester intercepts HTTP traffic and notices the parameter: `page=../../../../etc/passwd`. This is an example of:
Pentest Attacks Exploits
Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication
In a web application penetration test, a tester enters `<script>alert(1)</script>` in a search field and an alert box appears. What type of vulnerability is confirmed?
A penetration tester discovers an input field that accepts: `; cat /etc/passwd #` and returns the contents of the passwd file. What vulnerability is being exploited?
A tester enters `admin' OR '1'='1` in a login form and gains unauthorized access. What type of attack was successful?
Which payload would be MOST effective for exploiting a buffer overflow vulnerability in a strcpy function?
3.2 Testing Frameworks and Methodologies
A web application includes a hidden form field with `role=user`. An attacker changes this to `role=admin` and gains administrative access. What is this vulnerability called?
An attacker crafts a malicious link: `https://bank.com/transfer?to=attacker&amount=10000`. When a victim clicks the link while logged into bank.com, the transfer executes. This is an example of:
A penetration tester uses Responder.py in a network and captures NTLM hashes from Windows machines. What technique is being employed?
Which Metasploit module type would be used to exploit a vulnerability in a network service listening on TCP port 445?
3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
In a cloud penetration test, a tester discovers an AWS S3 bucket with the policy allowing "s3:GetObject" from "Principal": "*". What is the security concern?
Loading more…
