PT0-003 practice questions

Q: Is this PT0-003 practice test free?

Yes. All 15 PT0-003 practice questions on this page are free, with instant scoring and a written explanation for each answer. You do not need an account and there is no time limit.

Q: How much does the real PT0-003 exam cost?

The official price is $439. Cyber VK sells the same official PT0-003 voucher for $224.99 — a saving of $214.01. The voucher is identical to one bought direct and is emailed within minutes of payment.

Q: Are these questions the same as the real PT0-003 exam?

No. These are original practice questions written to match the published exam objectives and difficulty. They are not real exam questions — sharing or reproducing live exam content breaches every certification body's candidate agreement and can void your certification.

Q: How should I use this practice test?

Use it as a readiness check rather than a study tool. Work through the questions without notes, read the explanation for every answer including the ones you got right, and treat any domain where you miss more than a third as the area to revise before booking your exam.

Question 1

During the pre-engagement phase, a client asks the penetration testing team to sign a document that legally prevents the testers from disclosing any findings or internal information to third parties. Which document satisfies this requirement?

Accepted Answer

The NDA is the specific legal instrument that binds the tester to confidentiality regarding client data and findings, while the MSA, SOW, and RoE define commercial terms, deliverables, and testing boundaries respectively.

Question 2

A tester is scoping an assessment and the client states that the production ERP server may only be tested between 01:00 and 04:00 on Sundays, and that denial-of-service testing is prohibited. Where should these constraints be formally documented?

Accepted Answer

Rules of Engagement define permitted testing windows, prohibited techniques, and target boundaries before testing begins, giving the tester documented authorization for exactly what was agreed.

Question 3

Midway through an external assessment, a tester discovers a cardholder data repository that is publicly exposed and appears to already contain indicators of an active third-party compromise. According to standard engagement practice, what should the tester do FIRST?

Accepted Answer

Evidence of an existing breach is a defined trigger for immediate escalation to the client's designated contacts, since the client — not the tester — owns incident response and regulatory notification decisions.

Question 4

Which Nmap command performs a TCP SYN scan of the top 1000 ports without completing the three-way handshake?

Accepted Answer

The -sS flag performs a half-open SYN scan that sends RST instead of ACK after receiving SYN/ACK, whereas -sT completes a full connect, -sU scans UDP, and -sn only performs host discovery.

Question 5

A tester needs to enumerate subdomains and historical DNS records for a target organization without sending any traffic to the organization's infrastructure. Which approach best meets this requirement?

Accepted Answer

Certificate transparency logs and third-party DNS datasets are fully passive sources held outside the target's infrastructure, while brute-forcing, zone transfers, and reverse sweeps all generate traffic to target-controlled or target-observable systems.

Question 6

After gaining an unauthenticated foothold on an internal network segment, a tester wants to identify Active Directory accounts that have a Service Principal Name set, in order to request their service tickets for offline cracking. Which enumeration technique is required?

Accepted Answer

Kerberoasting targets user accounts that have a servicePrincipalName populated, so LDAP enumeration of that attribute identifies the roastable accounts; the DONT_REQ_PREAUTH flag applies to AS-REP roasting instead.

Question 7

A vulnerability scan reports that a Windows server is missing a critical patch, but manual verification shows the patch is installed and the vulnerable service is disabled. How should this result be classified?

Accepted Answer

The scanner reported a vulnerability that does not actually exist on the host, which is by definition a false positive and should be removed from the findings after validation.

Question 8

A tester must scan a segment containing legacy SCADA controllers that are known to crash when probed aggressively. Which scanning configuration is MOST appropriate?

Accepted Answer

Fragile operational technology devices require throttled, non-intrusive scanning with destructive checks disabled, because aggressive probing or fuzzing can take safety-critical controllers offline.

Question 9

Two findings share a CVSS base score of 8.1. Finding A affects an internet-facing payment application; Finding B affects an isolated lab server with no sensitive data. The client asks why Finding A is ranked higher in the report. What is the BEST justification?

Accepted Answer

The CVSS base score measures intrinsic technical severity only, so testers apply environmental and business-context weighting — exposure, data sensitivity, and asset criticality — to produce meaningful risk rankings.

Question 10

A web application concatenates user input directly into a SQL query. A tester submits ' OR '1'='1 into the login field and is granted access. Which attack was performed?

Accepted Answer

Injecting SQL syntax that alters the WHERE clause logic to always evaluate true is a classic authentication-bypass SQL injection, which is possible because the input is not parameterized.

Question 11

A tester captures NTLMv2 hashes by responding to LLMNR and NBT-NS broadcasts on an internal VLAN. SMB signing is NOT enforced on several hosts. Which follow-on attack is MOST likely to yield remote code execution without cracking the hashes?

Accepted Answer

NTLMv2 hashes captured by a responder tool can be relayed to hosts where SMB signing is not enforced, authenticating the tester as the victim without ever recovering the plaintext password.

Question 12

A tester finds an internal reporting endpoint that accepts a user-supplied URL and returns the response body. Requests to 169.254.169.254 are blocked by a deny list, but requests to a tester-controlled domain succeed. Which technique is MOST likely to bypass the filter and reach the cloud metadata service?

Accepted Answer

A deny list matching on the literal address is defeated by DNS-based redirection, since the application resolves the tester's hostname at request time and connects to the metadata endpoint anyway.

Question 13

After compromising a Linux host, a tester adds an entry to the target user's crontab that reconnects to the tester's listener every 30 minutes. What is the tester establishing?

Accepted Answer

A scheduled task that repeatedly re-establishes access maintains the foothold across reboots and disconnects, which is the definition of persistence rather than movement or escalation.

Question 14

A tester has SYSTEM-level access on a workstation and recovers a local administrator NTLM hash that is reused across the environment. Which technique allows authentication to other hosts using that hash directly?

Accepted Answer

Pass-the-hash supplies the NTLM hash directly to the NTLM authentication exchange, so no plaintext recovery is needed when the same local account exists on other hosts.

Question 15

An engagement has concluded. The tester deployed a web shell, created a local account named svc_audit, and modified a registry Run key on three hosts. Which action best fulfills the tester's post-engagement obligations?

Accepted Answer

Cleanup requires restoring systems to their pre-engagement state and documenting every artifact removed, so the client can independently verify nothing exploitable was left behind; wiping hosts exceeds authorized scope.

PT0-003 — CompTIA PenTest+ PT0-003 Exam Voucher | Penetration Testing Certification Practice Test

Free Practice Test

PT0-003 practice test — common questions