Questions & answers (free, no sign-in needed)
- View
10 beginner questions on the PenTest+ PT0-003 domains: engagement management (rules of engagement, approval), reconnaissance (passive OSINT, Nmap), vulnerability discovery (SAST), attacks (SQL injection, XSS, password attacks) and post-exploitation (persistence, lateral movement).
Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.
Before a penetration test starts, which document defines the targets, the allowed testing times and the techniques the testers may use?
- A. Non-disclosure agreement
- B. Rules of engagement ✔ correct
- C. Service level agreement
- D. Acceptable use policy
Answer: B. The rules of engagement (ROE) set the scope, schedule, allowed techniques and contacts for the test. An NDA covers confidentiality, an SLA covers service levels and an AUP covers how users may use systems.
Source: nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf · Domain: Engagement management
Management approval for a penetration test should be finalized and documented before any testing begins.
- A. True ✔ correct
- B. False
Answer: A. True. In the planning phase, the rules are set and management approval is finalized and documented; no testing happens yet. Testing without written approval can be illegal and disrupt the business.
Source: nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf · Domain: Engagement management
A tester wants to gather information about a target company without sending any traffic to the company's systems. Which activity fits this goal?
- A. Port scanning the company's public IP range
- B. Sending crafted packets to detect its firewall
- C. Reviewing public WHOIS records for its domains ✔ correct
- D. Trying default passwords on its VPN portal
Answer: C. Passive reconnaissance uses public sources such as WHOIS data held by registries, so the target sees no traffic. Port scans and crafted packets are active scanning, and password attempts are an attack.
Source: attack.mitre.org/tactics/TA0043/ · Domain: Reconnaissance and enumeration
A tester needs to find which hosts are up and which TCP ports are open on a target network. Which tool is designed for this?
- A. Nmap ✔ correct
- B. Hashcat
- C. John the Ripper
- D. Wireshark
Answer: A. Nmap discovers live hosts, open ports and running services. Hashcat and John the Ripper crack password hashes, and Wireshark captures and analyzes traffic but does not scan hosts.
Source: nmap.org/book/man.html · Domain: Reconnaissance and enumeration
A development team wants to find security flaws by analyzing an application's source code without running it. Which testing approach is this?
- A. Dynamic application security testing (DAST)
- B. Fuzzing
- C. Penetration testing
- D. Static application security testing (SAST) ✔ correct
Answer: D. SAST tools analyze source code or compiled code to find flaws without executing the application. DAST and fuzzing test the running application by sending it requests or unexpected input.
Source: owasp.org/www-community/Source_Code_Analysis_Tools · Domain: Vulnerability discovery and analysis
A tester types
' OR '1'='1into a login form's username field and is logged in without a valid password. Which vulnerability does this show?- A. Cross-site scripting
- B. SQL injection ✔ correct
- C. Directory traversal
- D. Clickjacking
Answer: B. The input changed the logic of the SQL query so that the condition is always true. This is SQL injection, caused by building queries from user input without parameterization or validation.
Source: owasp.org/www-community/attacks/SQL_Injection · Domain: Attacks and exploits
Which two of the following are password attacks? (Select TWO)
- A. Password spraying ✔ correct
- B. ARP spoofing
- C. Credential stuffing ✔ correct
- D. Cross-site request forgery
- E. DNS zone transfer
Answer: A, C. Password spraying tries a few common passwords against many accounts, and credential stuffing reuses username and password pairs leaked from other breaches. Both are brute-force sub-techniques in MITRE ATT&CK.
Source: attack.mitre.org/techniques/T1110/ · Domain: Attacks and exploits
A tester finds that a comment field saves a script, which then runs in the browser of every user who views the page. What is this vulnerability?
- A. Stored cross-site scripting ✔ correct
- B. Server-side request forgery
- C. SQL injection
- D. Insecure direct object reference
Answer: A. In stored (persistent) cross-site scripting, the injected script is saved by the application and served to other users, whose browsers run it. Output encoding and input validation prevent it.
Source: owasp.org/www-community/attacks/xss/ · Domain: Attacks and exploits
After gaining access to a Windows server, a tester creates a scheduled task that reconnects to the tester's system every time the server restarts. Which goal does this achieve?
- A. Reconnaissance
- B. Data exfiltration
- C. Persistence ✔ correct
- D. Initial access
Answer: C. Persistence keeps access across restarts or changed credentials. Scheduled tasks (MITRE ATT&CK T1053) are a common persistence method. Testers document such changes and remove them during cleanup.
Source: attack.mitre.org/techniques/T1053/ · Domain: Post-exploitation and lateral movement
Using credentials found on a compromised workstation, a tester signs in to a file server elsewhere on the internal network. What is this technique called?
- A. Privilege escalation
- B. Reconnaissance
- C. Defense evasion
- D. Lateral movement ✔ correct
Answer: D. Lateral movement means moving from one compromised system to others in the network, often with valid stolen credentials. Privilege escalation means gaining higher rights on a system.
Source: attack.mitre.org/tactics/TA0008/ · Domain: Post-exploitation and lateral movement
Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public CompTIA exam objectives (PenTest+ V3 (PT0-003) exam objectives, launched 2024-12-17), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by CompTIA; exam names are trademarks of their owners. Official exam page: www.comptia.org/en-us/certifications/pentest/.