100 free scenario-based practice questions with detailed explanations across all 4 exam domains. Planning, reconnaissance, vulnerability scanning, exploitation, and post-exploitation for offensive security professionals and red team aspirants.
Free PenTest+ Practice Questions and Answers For Western Governors University Students
Domain-by-domain study guide with 20 realistic practice questions, expert exam tips, and detailed explanations to help you pass the CompTIA PenTest+ PT0-003 in 2026.
Why Free PenTest+ Practice Questions Matter for Exam Success
The CompTIA PenTest+ certification validates the hands-on skills required to plan, scope, and execute penetration tests against networks, web applications, cloud environments, and wireless infrastructure. The PT0-003 version launched in December 2024 and adds coverage for AI-based attacks, expanded cloud and API exploitation, and modern post-exploitation techniques used by today's offensive security professionals.
The PenTest+ exam is one of the most practical certifications in the CompTIA portfolio. With up to 90 questions including performance-based items that require you to use simulated tools, write commands, and interpret real scan output, memorizing definitions alone will not get you past the 750/900 passing threshold. You need to practice applying concepts to realistic offensive security scenarios, and quality practice questions are one of the most efficient ways to build that applied skill.
The PT0-003 exam covers five domains: Engagement Management (13%), Reconnaissance and Enumeration (21%), Vulnerability Discovery and Analysis (17%), Attacks and Exploits (35%), and Post-exploitation and Lateral Movement (14%). Domain 4 alone accounts for more than a third of the exam, making hands-on exploitation skills essential for passing. The questions below align with the current PT0-003 exam objectives and domain weights.
PenTest+ is approved under both the DoD 8570.01-M directive and the newer DoD 8140 framework, making it one of the most valuable certifications for government and defense contractor penetration testing roles. It is also ANSI accredited under ISO/IEC 17024.
Domain 1: Engagement Management - PenTest+ Practice Questions
Domain 1 of 5~13% of Exam
Domain 1 covers the planning, scoping, and management of penetration testing engagements. Topics include pre-engagement activities like defining rules of engagement, scoping documents, legal considerations, compliance requirements, and communication procedures. This domain also covers testing frameworks (PTES, OWASP, OSSTMM) and post-engagement cleanup responsibilities.
Practice Questions for Engagement Management
Question 1
Before beginning a penetration test, which document defines the authorized scope, boundaries, IP ranges, testing window, and emergency contacts?
A) Non-disclosure agreement (NDA)
B) Rules of engagement (ROE)
C) Master service agreement (MSA)
D) Privacy policy
✓Correct Answer: B) Rules of engagement (ROE)
Explanation: The Rules of Engagement document defines what the tester can and cannot do, including scope boundaries, authorized targets, testing hours, escalation procedures, and emergency contacts. The ROE is the tester's operational blueprint for the entire engagement.
Question 2
A tester discovers evidence of an active breach by an external threat actor during a penetration test. What should the tester do FIRST?
A) Continue testing to gather more evidence about the attacker
B) Stop testing and notify the client's designated emergency contact immediately
C) Attempt to block the attacker using the tools at hand
D) Document the breach and include it in the final report
✓Correct Answer: B) Stop testing and notify the client's designated emergency contact immediately
Explanation: Discovering an active breach requires immediate escalation per the ROE. Continuing to test could interfere with the real attacker's artifacts and contaminate evidence needed for incident response. The tester should stop, preserve the current state, and notify the client immediately.
💡 Exam Tip
Know the four key pre-engagement documents: ROE (what and how to test), SOW (deliverables and exclusions), NDA (confidentiality), and MSA (overall business terms). The exam will present scenarios where you must identify which document addresses a specific concern. Also know PTES, OWASP Testing Guide, OSSTMM, and NIST SP 800-115 as testing frameworks.
Domain 2: Reconnaissance and Enumeration - PenTest+ Practice Questions
Domain 2 of 5~21% of Exam
Domain 2 covers information gathering techniques used in the early phases of a penetration test. This includes passive reconnaissance (OSINT, WHOIS, Shodan, certificate transparency), active reconnaissance (port scanning, service enumeration, banner grabbing), and scripting for automation. You must understand the difference between passive and active techniques and know which tools to use for each.
Practice Questions for Reconnaissance and Enumeration
Question 3
A penetration tester uses WHOIS lookups, DNS record queries, and Shodan searches without sending any traffic to the target's infrastructure. What type of reconnaissance is this?
A) Active reconnaissance
B) Passive reconnaissance
C) Vulnerability scanning
D) Exploitation
✓Correct Answer: B) Passive reconnaissance
Explanation: Passive reconnaissance gathers information from publicly available sources without directly interacting with the target's systems. WHOIS, DNS records, Shodan, certificate transparency logs, job postings, and social media are all passive sources. The key distinction is that passive recon generates no traffic to the target.
Question 4
Which Nmap scan type sends SYN packets without completing the TCP three-way handshake, making it faster and stealthier than a full connect scan?
A) TCP connect scan (-sT)
B) SYN scan (-sS)
C) UDP scan (-sU)
D) FIN scan (-sF)
✓Correct Answer: B) SYN scan (-sS)
Explanation: A SYN scan (half-open scan) sends SYN packets and analyzes the response without completing the handshake. It is faster, uses fewer resources, and is less likely to be logged by applications compared to a full TCP connect scan. This is the default scan type for privileged users in Nmap.
Question 5
A tester uses Responder on an internal network and captures NTLMv2 hashes from several workstations. How does Responder achieve this?
A) By scanning open ports on each workstation
B) By poisoning LLMNR and NBT-NS broadcast responses to redirect authentication attempts
C) By performing SQL injection against a database server
D) By cracking password hashes stored in Active Directory
✓Correct Answer: B) By poisoning LLMNR and NBT-NS broadcast responses to redirect authentication attempts
Explanation: Responder listens for LLMNR and NBT-NS broadcast name resolution queries on the local network. When a system fails to resolve a hostname via DNS, it falls back to these broadcast protocols. Responder answers with its own IP, causing the victim to send NTLMv2 authentication hashes to the attacker, which can then be cracked offline or relayed to other services.
Question 6
A tester discovers an exposed .git directory on a target web server. Why is this a significant finding?
A) It confirms the server is running Linux
B) It may contain the entire source code repository, commit history, hardcoded credentials, and configuration files
C) It indicates the server is fully patched
D) It reveals the server's physical location
✓Correct Answer: B) It may contain the entire source code repository, commit history, hardcoded credentials, and configuration files
Explanation: An exposed .git directory can leak the complete source code, full commit history (including deleted sensitive data), hardcoded credentials, API keys, database connection strings, and internal comments. This is a high-severity information disclosure finding that can dramatically accelerate exploitation.
💡 Exam Tip
The exam heavily tests your knowledge of Nmap flags. Memorize: -sS (SYN scan), -sV (version detection), -O (OS fingerprinting), -sC (default scripts), -p- (all ports), -A (aggressive). Also know the difference between passive and active recon tools: Shodan, theHarvester, and Recon-ng are passive; Nmap, Gobuster, and Nikto are active.
Domain 3: Vulnerability Discovery and Analysis - PenTest+ Practice Questions
Domain 3 of 5~17% of Exam
Domain 3 covers vulnerability scanning, analysis, and prioritization. Topics include running and interpreting vulnerability scans, understanding CVSS scoring, validating findings versus false positives, and analyzing scan output to prioritize targets for exploitation. You must be able to look at scan results and determine the best attack path.
Practice Questions for Vulnerability Discovery and Analysis
Question 7
A vulnerability scanner reports a critical CVE on a production web server. The system owner claims it was patched last month. What should the tester do FIRST?
A) Immediately attempt to exploit the vulnerability
B) Validate the finding by confirming the actual software version and patch status
C) Ignore the finding since the owner says it was patched
D) Escalate directly to the CISO without verification
✓Correct Answer: B) Validate the finding by confirming the actual software version and patch status
Explanation: Always validate scanner findings before acting on them. Scanners can produce false positives based on version banners that were not updated after patching. Confirm the actual running version through banner grabbing, manual testing, or reviewing patch logs before adding the finding to your exploitation plan or final report.
Question 8
During a web application test, a tester enters a single quote followed by OR 1=1 and a comment sequence into a login field and successfully bypasses authentication. What vulnerability does this confirm?
A) Cross-site scripting (XSS)
B) SQL injection
C) Cross-site request forgery (CSRF)
D) Command injection
✓Correct Answer: B) SQL injection
Explanation: The classic SQL injection payload manipulates the backend SQL query to always evaluate as true, bypassing the authentication check entirely. This confirms the application is building SQL queries by concatenating user input without parameterization or proper input validation.
💡 Exam Tip
Know the CVSS Attack Vector component: Network (remote, most severe), Adjacent (same network segment), Local (local access needed), Physical (physical access needed). The exam will present scan output and ask you to prioritize findings. Always combine CVSS base score + exploit availability + asset criticality + network exposure for true risk-based prioritization.
Domain 4: Attacks and Exploits - PenTest+ Practice Questions
Domain 4 of 5~35% of Exam
Domain 4 is the largest and most critical section of the exam at 35%. It covers network attacks, host-based attacks, web application attacks, authentication attacks, wireless attacks, cloud-specific attacks, and social engineering. This domain requires deep practical knowledge of exploitation tools and techniques, including Metasploit, Burp Suite, sqlmap, and wireless attack toolsets. The PT0-003 also adds AI-based attack techniques.
Practice Questions for Attacks and Exploits
Question 9
A tester gains initial access to a Linux system with a low-privilege user account. What is the FIRST step toward privilege escalation?
A) Immediately attempt to brute-force the root password
B) Enumerate the system for misconfigurations, SUID binaries, writable cron jobs, and kernel version
C) Launch a denial-of-service attack against the system
D) Delete all system log files to cover tracks
✓Correct Answer: B) Enumerate the system for misconfigurations, SUID binaries, writable cron jobs, and kernel version
Explanation: Privilege escalation always starts with thorough local enumeration. Check for SUID/SGID binaries that run as root, writable cron jobs, kernel version for known exploits, sudo permissions, misconfigured services, and sensitive files with weak permissions. Tools like linpeas.sh and LinEnum automate this process.
Question 10
A tester performs a password spraying attack against an Active Directory environment. What technique is being used?
A) Trying thousands of passwords against a single account
B) Trying one or two common passwords against many accounts to stay below the lockout threshold
C) Using a rainbow table to reverse password hashes
D) Brute-forcing with every possible character combination
✓Correct Answer: B) Trying one or two common passwords against many accounts to stay below the lockout threshold
Explanation: Password spraying tests a small number of commonly used passwords (like Season+Year or CompanyName+123) against many user accounts. By limiting attempts per account, the attacker stays below account lockout thresholds while still having a high probability of finding at least one weak password across a large user population.
Question 11
Which Metasploit payload type creates a reverse connection from the target machine back to the attacker's listener?
A) bind_tcp
B) reverse_tcp
C) meterpreter_passive
D) single_exec
✓Correct Answer: B) reverse_tcp
Explanation: A reverse_tcp payload makes the compromised target initiate an outbound connection back to the attacker's listening handler. This is preferred over bind shells because outbound connections typically bypass inbound firewall rules that would block an attacker from connecting to a port opened on the target.
Question 12
A tester discovers that a web application is vulnerable to Server-Side Request Forgery (SSRF). What can this vulnerability allow the attacker to do?
A) Inject JavaScript into the web page viewed by other users
B) Make the server send HTTP requests to internal resources the attacker cannot directly reach
C) Overflow the application's memory buffers
D) Crack stored password hashes
✓Correct Answer: B) Make the server send HTTP requests to internal resources the attacker cannot directly reach
Explanation: SSRF allows an attacker to abuse the server's trusted network position by making it send requests to internal services, cloud metadata endpoints (like AWS 169.254.169.254 for IAM credentials), administrative interfaces, or other resources that are behind the firewall and inaccessible from the outside.
Question 13
A tester sets up a rogue wireless access point with the same SSID as the corporate Wi-Fi network near the office entrance. What type of attack is this?
A) Deauthentication attack
B) Evil twin attack
C) Bluetooth sniffing
D) RFID cloning
✓Correct Answer: B) Evil twin attack
Explanation: An evil twin mimics a legitimate access point by broadcasting the same SSID. Users who connect to the rogue AP send all their traffic through the attacker, enabling credential capture, session hijacking, and man-in-the-middle attacks. This is often combined with deauthentication attacks to force clients off the real AP.
Question 14
A tester performs Kerberoasting against Active Directory. What is the goal of this attack?
A) Crashing the domain controller
B) Requesting Kerberos service tickets for accounts with SPNs and cracking them offline to recover passwords
C) Deleting user accounts from Active Directory
D) Modifying Group Policy Objects
✓Correct Answer: B) Requesting Kerberos service tickets for accounts with SPNs and cracking them offline to recover passwords
Explanation: Kerberoasting requests TGS (Ticket Granting Service) tickets for accounts registered with Service Principal Names. These tickets are encrypted with the service account's password hash and can be cracked offline without triggering lockout alerts. Service accounts frequently have weak passwords and elevated privileges, making this a high-value attack.
💡 Exam Tip
Domain 4 is 35% of the exam. Focus heavily here. Know Metasploit workflow (search, use, set options, exploit), msfvenom for payload generation, common web attacks (SQLi, XSS, SSRF, IDOR, SSTI, XXE), Active Directory attacks (Kerberoasting, pass-the-hash, password spraying), and wireless attacks (evil twin, WPA2 handshake capture). Hands-on lab practice is essential for this domain.
Domain 5: Post-exploitation and Lateral Movement - PenTest+ Practice Questions
Domain 5 of 5~14% of Exam
Domain 5 covers what happens after initial access: maintaining persistence, escalating privileges, moving laterally through the network, harvesting credentials, exfiltrating data, and performing cleanup. Topics include Mimikatz, Golden and Silver Tickets, pivoting techniques, BloodHound for AD attack path discovery, and data exfiltration methods.
Practice Questions for Post-exploitation and Lateral Movement
Question 15
A tester has local administrator access on a Windows workstation and uses Mimikatz to extract credentials from LSASS memory. What types of credentials can Mimikatz recover?
A) Only encrypted, unusable password hashes
B) Plaintext passwords, NTLM hashes, Kerberos tickets, and WDigest credentials
C) Only the local administrator password
D) Only domain controller credentials
✓Correct Answer: B) Plaintext passwords, NTLM hashes, Kerberos tickets, and WDigest credentials
Explanation: Mimikatz can extract plaintext passwords (when WDigest authentication is enabled), NTLM password hashes, Kerberos TGT and TGS tickets, and certificates from the LSASS process memory. These credentials enable lateral movement through pass-the-hash, pass-the-ticket, and direct authentication to other systems.
Question 16
After compromising a domain user with DCSync privileges, a tester replicates the Active Directory database. This grants access to which critical credential?
A) Only the compromised user's own password
B) All domain password hashes, including the krbtgt hash needed for Golden Ticket attacks
C) Only email server credentials
D) Only local workstation passwords
✓Correct Answer: B) All domain password hashes, including the krbtgt hash needed for Golden Ticket attacks
Explanation: DCSync abuses the Directory Replication Service protocol to request all password hash data from a domain controller, exactly as another DC would during replication. This extracts every credential in the domain, including the krbtgt account hash which is used to forge Golden Tickets for persistent, unrestricted domain access.
Question 17
A tester uses BloodHound during post-exploitation of an Active Directory environment. What does BloodHound reveal?
A) Network traffic patterns and bandwidth usage
B) Attack paths and privilege escalation routes based on AD object relationships
C) Wireless network SSIDs and signal strength
D) Web application vulnerabilities
✓Correct Answer: B) Attack paths and privilege escalation routes based on AD object relationships
Explanation: BloodHound collects Active Directory data using SharpHound and maps object relationships to identify attack paths. It can reveal the shortest path from a compromised low-privilege user to Domain Admin through chains of group memberships, delegation permissions, session data, and other AD relationships that individually seem harmless but together create exploitable paths.
Question 18
A tester has compromised a system in the DMZ and needs to reach internal network servers that are not directly accessible. Which technique creates a tunnel through the compromised host?
A) DNS amplification attack
B) SSH tunneling or SOCKS proxy pivoting through the compromised host
C) ARP spoofing on the external network
D) Deauthentication of wireless clients
✓Correct Answer: B) SSH tunneling or SOCKS proxy pivoting through the compromised host
Explanation: Pivoting uses the compromised DMZ host as a relay to reach internal networks. SSH dynamic port forwarding (-D flag) creates a SOCKS proxy, and tools like Chisel, ligolo-ng, and Metasploit's autoroute module provide alternative pivoting methods. This technique is essential for expanding access beyond the initial foothold.
💡 Exam Tip
Know the AD attack chain: initial access, credential harvesting (Mimikatz), lateral movement (pass-the-hash, PsExec, wmiexec), privilege escalation (Kerberoasting, DCSync), and persistence (Golden Tickets, scheduled tasks, services). Also understand pivoting (SSH tunnels, SOCKS proxies, Chisel) and data exfiltration methods (DNS tunneling, HTTPS, cloud storage). The exam expects you to know the full post-exploitation workflow.
How to Use These Free PenTest+ Practice Questions Effectively
The PenTest+ is one of the most hands-on certifications CompTIA offers. Simply reading through practice questions is not enough to pass. You need to combine question practice with real lab work to develop the practical skills tested on performance-based questions. Follow these proven strategies:
1
Build a penetration testing lab. Set up Kali Linux as your attack machine and deploy vulnerable targets like Metasploitable, DVWA, VulnHub boxes, and HackTheBox machines. The PBQs on exam day will test your ability to use real tools, not just recognize their names.
2
Focus on Domain 4 first. At 35% of the exam, Attacks and Exploits is your highest-impact study area. Practice exploitation with Metasploit, web application testing with Burp Suite, and Active Directory attacks with CrackMapExec and Mimikatz in your lab environment.
3
Master the tools on the exam objectives list. The PT0-003 objectives include a specific tools list. Get hands-on with Nmap, Metasploit, Burp Suite, sqlmap, Hashcat, Gobuster, Responder, BloodHound, and Wireshark. Even basic familiarity gives you an advantage on PBQs.
4
Simulate real exam conditions. Set a 165-minute timer and work through 90 questions without referencing materials. The PBQs take significantly longer than multiple-choice questions, so practice time management. Many testers recommend answering all multiple-choice questions first, then returning to PBQs.
5
Review every explanation, even for correct answers. Understanding why wrong answers are wrong builds the elimination skills you need for exam day. The PenTest+ often presents multiple plausible answers where understanding the nuance determines the correct choice.
6
Think like a penetration tester, not a defender. The PenTest+ tests offensive skills. When reading scenarios, ask: What would I exploit first? What tool is most efficient here? What is the fastest path to escalation? Train yourself to think in attack chains from initial access through domain compromise.
Frequently Asked Questions About the PenTest+ Exam
How many questions are on the PenTest+ exam?
The CompTIA PenTest+ PT0-003 exam contains a maximum of 90 questions, including both multiple-choice and performance-based questions (PBQs). You have 165 minutes to complete the exam. PBQs test hands-on skills and may require you to use simulated tools, write commands, interpret scan output, or analyze exploit scenarios.
What is the passing score for the PenTest+ exam?
You need a minimum score of 750 on a scale of 100 to 900 to pass the PenTest+ PT0-003 exam. CompTIA uses a scaled scoring model, so there is no simple percentage. The score accounts for question difficulty across all five domains.
What experience is recommended before taking PenTest+?
CompTIA recommends 3 to 4 years of hands-on experience in a penetration testing job role. Network+, Security+, or equivalent knowledge is recommended as a foundation. While there are no strict prerequisites, the PenTest+ is an intermediate certification that assumes familiarity with networking, security fundamentals, and basic exploitation concepts.
Are free PenTest+ practice questions enough to pass the exam?
Free practice questions are an excellent supplement but should not be your only resource. The PenTest+ is heavily hands-on, so combine questions with lab practice using tools like Metasploit, Nmap, Burp Suite, and Kali Linux. Build a vulnerable lab with targets like Metasploitable, DVWA, and HackTheBox to develop the practical skills tested on performance-based questions.
What is the difference between PenTest+ and CEH?
PenTest+ is a vendor-neutral CompTIA certification focused on hands-on penetration testing skills with performance-based questions that test practical ability. CEH (Certified Ethical Hacker) from EC-Council is more knowledge-based and theoretical, focusing on understanding hacking tools and methodologies. PenTest+ is generally considered more practical and hands-on, while CEH covers a broader range of topics at a higher level. Both are recognized under DoD 8570/8140.
How long is the PenTest+ certification valid?
The PenTest+ certification is valid for three years. To renew, you must earn 60 Continuing Education Units (CEUs) during the three-year cycle and pay the annual CE fee of $50 per year or $150 for the full three-year period. CEUs can be earned through training, higher certifications, teaching, publishing, or participating in industry activities.
Is PenTest+ approved for DoD 8570 and 8140?
Yes, CompTIA PenTest+ is approved under the DoD 8570.01-M directive and is recognized under the newer DoD 8140 framework. This makes it one of the most valuable certifications for government and defense contractor penetration testing and vulnerability assessment positions.
What tools should I know for the PenTest+ exam?
You should be familiar with Nmap, Metasploit, Burp Suite, Wireshark, sqlmap, Hashcat, John the Ripper, Gobuster, Nikto, Responder, BloodHound, CrackMapExec, Mimikatz, and Nessus among others. The PT0-003 exam objectives include a specific hardware and software list. Hands-on experience with these tools in a lab environment significantly improves your chances of passing, especially on performance-based questions.
Which PenTest+ domain is the hardest?
Domain 4 (Attacks and Exploits) is both the largest at 35 percent of the exam and the most challenging for many candidates because it requires deep practical knowledge of network, web application, wireless, authentication, and host-based attacks. Candidates without hands-on exploitation experience often struggle here. Domain 5 (Post-exploitation and Lateral Movement) is also difficult for those unfamiliar with Active Directory attacks, persistence mechanisms, and credential harvesting techniques. Focus your study time on whichever domains feel least familiar.
