CompTIA PenTest+ PT0-003 Practice Test & Mock Exam

Start with the free diagnostic or public sample questions. IT Mastery gives you a stable, exam-domain-mapped practice bank with timed mocks, topic drills, progress tracking, and detailed explanations across web and mobile.

Initial release: this CompTIA PenTest+ PT0-003 bank currently includes 780 questions. We expand high-demand banks first based on learner usage, feedback, and subscriber demand. Subscribers receive access to future additions automatically.

Free diagnostic: Try the 90-question CompTIA PenTest+ PT0-003 full-length practice exam before subscribing.

CompTIA PenTest+ (PT0-003) is CompTIA’s current penetration-testing route for candidates who need practical judgment across planning, scoping, reconnaissance, vulnerability discovery, exploitation, post-exploitation, reporting, and remediation guidance.

PT0-003 is the newer PenTest+ version, so current preparation should keep authorization, engagement scope, evidence validation, reporting, and remediation in view. This page includes original sample questions, exam guidance, and live IT Mastery practice.

Who PT0-003 is for

• penetration testers, vulnerability analysts, and security consultants who need a vendor-neutral offensive-security credential
• candidates comparing hands-on attack-surface testing with Security+, CySA+, SecurityX, or cloud-security routes
• learners who need legal scoping, reconnaissance, exploitation, reporting, and remediation judgment in one exam path

PT0-003 exam snapshot

• Vendor: CompTIA
• Official exam name: CompTIA PenTest+ (V3)
• Exam code: PT0-003
• Launch date shown by CompTIA: December 17, 2024
• Question count shown by CompTIA: maximum of 90, including multiple-choice and performance-based questions
• Exam time shown by CompTIA: 165 minutes
• Passing score shown by CompTIA: 750 on a 100-900 scale
• Recommended experience shown by CompTIA: 3-4 years in a penetration tester job role, with Network+ and Security+ or equivalent knowledge

PenTest+ questions usually reward the option that stays inside scope, uses evidence from the right phase, validates findings safely, and turns technical issues into useful remediation guidance.

Topic coverage for PT0-003

• planning, scoping, legal, and ethical requirements
• reconnaissance and enumeration
• vulnerability scanning and result validation
• network, host, web application, API, cloud, and IoT attack techniques
• post-exploitation, lateral movement, reporting, and remediation communication

Focused sample questions

Use these child pages when you want focused IT Mastery practice before returning to mixed sets and timed mocks.

• Free CompTIA PenTest+ PT0-003 Full-Length Practice Exam
• Engagement Management
• Reconnaissance and Enumeration
• Vulnerability Discovery and Analysis
• Attacks and Exploits
• Post-Exploitation and Lateral Movement

Free study resources

Need concept review first? Read the CompTIA PenTest+ PT0-003 Cheat Sheet on Tech Exam Lexicon, then return to IT Mastery for timed practice.

Sample Exam Questions

Try these 12 original sample questions for CompTIA PenTest+ PT0-003. Use them for study, self-assessment, and exam-scope review.

Question 1

What this tests: scope control

A tester discovers a public IP range that appears related to the client but is not listed in the signed rules of engagement. What should the tester do?

• A. Pause testing that range and request written scope clarification
• B. Test it quietly because it belongs to the same brand
• C. Scan it only during off-hours
• D. Exploit only low-risk findings on that range

Best answer: A

Explanation: PenTest+ emphasizes authorization and scope. A target not listed in the rules of engagement should not be tested until written scope clarification is obtained. Timing or perceived risk does not override authorization.

Question 2

What this tests: reconnaissance type

A tester reviews job postings, technology blogs, DNS records, and public code repositories before touching the client’s systems. What phase is this?

• A. Post-exploitation
• B. Persistence
• C. Passive reconnaissance
• D. Cleanup

Best answer: C

Explanation: Passive reconnaissance gathers information from public or third-party sources without directly interacting with target systems in a probing way. It helps build a target profile while reducing detection and operational impact.

Question 3

What this tests: vulnerability validation

A scanner reports a critical vulnerability on a production web server. Before including it as a confirmed finding, what should the tester do?

• A. Report every scanner result as confirmed
• B. Delete the scanner output because automated tools are unreliable
• C. Validate the finding safely using approved methods and evidence
• D. Exploit the server until service is disrupted

Best answer: C

Explanation: Automated scanner findings need validation to reduce false positives. Validation must stay within scope and avoid unnecessary damage. A good report distinguishes confirmed findings from tool output.

Question 4

What this tests: credential attack safety

The rules of engagement allow password spraying but limit attempts to avoid account lockouts. Which action best follows the rules?

• A. Use the approved attempt rate and lockout thresholds from the engagement plan
• B. Try every password against every account as quickly as possible
• C. Disable monitoring before the test
• D. Continue after lockouts occur because the client approved testing

Best answer: A

Explanation: Password attacks can create real operational impact. The tester should follow the approved rate, thresholds, timing, and notification requirements. Exceeding limits violates scope and can disrupt users.

Question 5

What this tests: web application finding

A web form places user input directly into a database query. The tester can alter the query logic by entering crafted input. What vulnerability is most likely present?

• A. Cross-site request forgery
• B. SQL injection
• C. Clickjacking
• D. DNS cache poisoning

Best answer: B

Explanation: SQL injection occurs when untrusted input changes database query structure or logic. CSRF abuses authenticated user actions, clickjacking tricks UI interaction, and DNS cache poisoning targets DNS resolution.

Question 6

What this tests: privilege escalation evidence

A tester gains low-privilege shell access on a Linux server. Which action is most appropriate before attempting privilege escalation?

• A. Enumerate the local system, permissions, services, kernel, and misconfigurations within scope
• B. Immediately install persistence
• C. Run destructive exploits first
• D. Delete log files to avoid detection

Best answer: A

Explanation: Privilege escalation should start with enumeration and evidence gathering. Destructive exploits, persistence, and log deletion are not appropriate unless explicitly authorized and necessary, and they often violate engagement rules.

Question 7

What this tests: cloud testing boundary

A penetration test includes an application deployed on AWS, but the rules of engagement exclude denial-of-service testing and attacks against AWS-managed infrastructure. Which action is acceptable only if it stays within the approved scope?

• A. Stress test the regional AWS control plane
• B. Attempt to bypass the client’s application authorization controls
• C. Attack unrelated AWS customer IP ranges
• D. Launch network flooding against AWS DNS services

Best answer: B

Explanation: Testing the client’s application authorization controls can be in scope if authorized. Attacks against AWS-managed infrastructure, unrelated customers, or denial-of-service targets are outside typical engagement boundaries and may violate provider rules.

Question 8

What this tests: reporting remediation

A report finding says an application allows SQL injection. Which remediation recommendation is strongest?

• A. “Fix the server soon”
• B. “Block all users from the application”
• C. “Ignore the issue unless it is exploited again”
• D. “Use parameterized queries, input validation, least-privilege database accounts, and regression testing”

Best answer: D

Explanation: A useful penetration-test report maps the finding to concrete remediation. Parameterized queries address SQL injection directly, while validation, least privilege, and testing support durable risk reduction.

Question 9

What this tests: cleanup and evidence handling

At the end of an engagement, a tester has temporary test accounts, uploaded tools, and screenshots containing sensitive data. What should happen?

• A. Leave everything in place in case a retest is needed someday
• B. Post the screenshots to a public portfolio
• C. Delete all client evidence without approval
• D. Follow the agreed cleanup, evidence retention, and secure transfer procedures

Best answer: D

Explanation: Cleanup and evidence handling should follow the rules of engagement and reporting agreement. Test artifacts should not remain unmanaged, and sensitive evidence should be protected according to the agreed process.

Question 10

What this tests: exploitation risk control

A tester finds a suspected remote code execution flaw on a production system. Exploitation might crash the service. What is the best next step?

• A. Exploit immediately because critical findings require proof
• B. Run destructive payloads until the system fails
• C. Coordinate with the client before attempting risky validation, and use the least disruptive proof needed
• D. Stop documenting the finding because it cannot be exploited safely

Best answer: C

Explanation: Penetration testing must balance validation with safety. When proof could disrupt production, the tester should coordinate, use controlled validation, or document constraints. Criticality does not justify unnecessary damage.

Question 11

What this tests: social engineering authorization

The client asks a tester informally to send phishing emails, but the signed scope does not mention social engineering. What is the correct action?

• A. Send the emails because the client verbally requested it
• B. Send only one email to test the idea
• C. Use personal accounts to avoid the formal process
• D. Obtain written authorization and updated scope before conducting social engineering

Best answer: D

Explanation: Social engineering is sensitive and requires explicit written authorization, target lists, timing, safety controls, and reporting expectations. Verbal requests are not enough for activities that can affect employees and business operations.

Question 12

What this tests: finding prioritization

Two findings are confirmed: one unauthenticated remote exploit on an internet-facing system and one low-impact information disclosure on an internal test page. How should they be prioritized?

• A. Alphabetically by finding title
• B. By exploitability, impact, exposure, business context, and compensating controls
• C. By the order in which the scanner found them
• D. By the length of the remediation section

Best answer: B

Explanation: PenTest+ expects risk-based prioritization. Exposure, impact, likelihood, exploitability, affected assets, and business context should guide severity and remediation order, not scanner order or formatting details.

PenTest+ engagement flow map

    flowchart LR
	    A["Written scope and rules"] --> B["Reconnaissance"]
	    B --> C["Scanning and enumeration"]
	    C --> D["Validate findings safely"]
	    D --> E["Exploit only when authorized"]
	    E --> F["Document impact and remediation"]
	    F --> G["Cleanup, retest, and evidence handling"]

Use the map when a PenTest+ item asks what the tester should do next. The best answer stays inside written scope, validates evidence without unnecessary disruption, and turns technical proof into useful remediation guidance.

Quick Cheat Sheet

Mini Glossary

• Rules of engagement: The written limits, contacts, targets, timing, and safety controls for the test.
• Passive reconnaissance: Public-source collection that does not directly probe the target environment.
• Enumeration: Active discovery of services, users, shares, versions, or other target details.
• Post-exploitation: Authorized actions after initial access that demonstrate impact, such as privilege or data-access validation.
• Retest: Follow-up validation that a reported finding has been remediated.

CompTIA PenTest+ PT0-003 practice update

Use this page to review PT0-003 sample questions and use the Notify me form for exam updates. The related pages below help you compare adjacent IT Mastery cybersecurity practice options before choosing what to study next.

Use these live IT Mastery pages now

Practice options

• Current status: Sample questions available
• Full practice bank: Not available yet
• Best use right now: confirm the PT0-003 offensive-security lane here, then practise with Security+, Network+, and cloud-security pages before the full PenTest+ bank is available
• Update form: use the Notify me form near the top of this page if PenTest+ is your actual target exam

Official sources

• CompTIA PenTest+

What to open next

• Need baseline security practice now? Open Security+ SY0-701 .
• Need analyst-route comparison? Open CySA+ CS0-003 .
• Need the CompTIA hub? Open CompTIA .

In this section

• CompTIA PenTest+ PT0-003: Engagement Management
  Try 10 focused CompTIA PenTest+ PT0-003 questions on Engagement Management, with explanations, then continue with IT Mastery.
• CompTIA PenTest+ PT0-003: Reconnaissance and Enumeration
  Try 10 focused CompTIA PenTest+ PT0-003 questions on Reconnaissance and Enumeration, with explanations, then continue with IT Mastery.
• CompTIA PenTest+ PT0-003: Vulnerability Discovery and Analysis
  Try 10 focused CompTIA PenTest+ PT0-003 questions on Vulnerability Discovery and Analysis, with explanations, then continue with IT Mastery.
• CompTIA PenTest+ PT0-003: Attacks and Exploits
  Try 10 focused CompTIA PenTest+ PT0-003 questions on Attacks and Exploits, with explanations, then continue with IT Mastery.
• CompTIA PenTest+ PT0-003: Post-Exploitation and Lateral Movement
  Try 10 focused CompTIA PenTest+ PT0-003 questions on Post-Exploitation and Lateral Movement, with explanations, then continue with IT Mastery.
• Free CompTIA PenTest+ PT0-003 Full-Length Practice Exam: 90 Questions
  Try 90 free CompTIA PenTest+ PT0-003 questions across the exam domains, with explanations, then continue with full IT Mastery practice.