Free PenTest+ practice questions 2026
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About
Try 20 questions free →

Free PenTest+ practice questions 2026: 20 questions without signup

Start the free PenTest+ practice questions

20 questions from the real bank, every option explained. No signup, no card.

Start free PenTest+ practice questions →
5 domains 870 questions 165 min exam
Questions on the exam
90
Time allowed
165 minutes format →
Passing score
750 of 900 — vendor, checked October 5, 2026 detail →

870 practice questions for CompTIA PenTest+ PT0-003, grouped by exam domain. Every question below shows all four options, which one is correct, and why each of the other three is not — the wrong answers are where most candidates lose marks.

Not sure where you stand? Take the free 5-min PenTest+ readiness check →

PenTest+ certification: requirements, cost and exam format → ·  PenTest+ exam format →  ·  PenTest+ passing score →

Questions by domain

Sample questions

CVSS shows technical severity: Which conclusion best interprets the evidence?

Attacks and Exploits Hard
In a fictional cloud tenant, a database host has CVSS 9.8. It is reachable only from an isolated development subnet, contains synthetic records, and has no observed public route. No exploitation evidence exists. Exhibit: `asset=dev-db-01`; `public_route=false`; `records=synthetic`; `cvss=9.8`; `kev_match=false`. Which conclusion best interprets the evidence?
  1. The finding automatically outranks every issue with a lower score.
    Risk prioritization cannot be determined by CVSS alone; contextual exposure and business consequences also matter.
  2. No public route makes the issue harmless.
    Isolation may reduce exposure but does not eliminate internal reachability, compromise paths, or technical severity.
  3. The score proves active exploitation of the database host.
    A CVSS score does not provide evidence that exploitation is occurring.
  4. CVSS shows technical severity; context determines risk. ✓
    CVSS describes technical severity, while practical priority also depends on reachability, controls, asset importance, exploit conditions, and impact.
The trap
Treats one control as eliminating risk. Confuses severity with observed exploitation. Uses the base score as a universal priority rule.

All 304 Attacks and Exploits questions →

nmap -sn 198.51.100.0/24: Which Nmap command meets that requirement?

Reconnaissance and Enumeration Medium
During an approved internal assessment, the team must determine which fictional hosts respond on a subnet while avoiding port scanning. Which Nmap command meets that requirement?
  1. nmap -Pn 198.51.100.0/24
    -Pn skips host discovery, so it does not perform the requested responsiveness check.
  2. nmap -sV 198.51.100.0/24
    -sV probes reachable ports for service versions, exceeding the stated host-discovery requirement.
  3. nmap -sS 198.51.100.0/24
    -sS performs SYN port scanning rather than host discovery without port scanning.
  4. nmap -sn 198.51.100.0/24 ✓
    Nmap -sn performs host discovery without conducting a port scan, matching the stated assessment requirement.
The trap
Selects a port-scanning method for a host-discovery requirement. Confuses service enumeration with basic host discovery. Confuses disabling discovery with conducting discovery.

All 183 Reconnaissance and Enumeration questions →

The finding is not confirmed: What is the strongest supported conclusion?

Vulnerability Discovery and Analysis Medium
A staging scanner flags an old web-library version. Supplied records show the vendor package includes a documented security backport, and the application uses that installed package. No exploit behavior was observed. What is the strongest supported conclusion?
  1. The vulnerability is confirmed because exploitation was not attempted.
    Non-exploitation neither confirms nor disproves vulnerability.
  2. Remove the package immediately regardless of vendor support or application dependency.
    Disruptive removal is not justified before validating the supported package and its security status.
  3. The finding is not confirmed; validate the backport before prioritizing remediation. ✓
    The upstream version match does not establish applicability when the vendor may have backported the fix.
  4. The host is definitely vulnerable because scanners cannot recognize backports.
    A scanner limitation does not prove that the installed build is vulnerable.
The trap
Confuses lack of testing with confirmation. Treats a detection limitation as proof. Prescribes remediation before applicability validation.

All 148 Vulnerability Discovery and Analysis questions →

The route supports pivoting to another reachable resource: What is the strongest supported conclusion?

Post-exploitation and Lateral Movement Easy
In a software delivery lab, evidence shows a low-privilege account on runner.training.local can reach build.training.local through an approved route. No new rights were granted, no persistence mechanism was observed, and the same account remains restricted. What is the strongest supported conclusion?
  1. Data exfiltration was confirmed.
    Reachability does not show that data was collected or transferred to any destination.
  2. The route supports pivoting to another reachable resource. ✓
    Pivoting uses an accessible host or route to reach another resource without requiring privilege escalation.
  3. Privilege escalation occurred.
    The account retained the same restricted rights, so increased privilege was not demonstrated.
  4. Persistence was established across restart or credential changes.
    No mechanism showing survival across restart or credential events was observed.
The trap
Infers data movement from network-path availability. Confuses access to another host with greater local privilege. Mistakes current connectivity for persistence.

All 122 Post-exploitation and Lateral Movement questions →

Stop and escalate: What should the tester do next?

Engagement Management Easy
During an authorized assessment of an isolated training network, a request reaches an explicitly excluded host and returns synthetic records. The rules require immediate escalation for any scope breach.

Exhibit:[14:03] In-scope target: lab-web-02 [14:03] Excluded target: lab-db-02 [14:11] GET /admin/export sent to lab-db-02 [14:11] Response: HTTP 200; synthetic records returnedWhat should the tester do next?
  1. Continue because the training network is isolated.
    Network isolation does not expand the authorized target list or remove the documented escalation requirement.
  2. Request an informal scope expansion and continue.
    An informal change does not alter the written boundary, and continuing would compound the breach.
  3. Stop and escalate. ✓
    The request reached an excluded host and returned records, confirming a scope breach that requires stopping and escalating.
  4. Record the event as an unverified scan artifact.
    An HTTP 200 response containing records confirms more than an unverified connection or scan artifact.
The trap
Treats informal approval as sufficient Dismisses confirmed application evidence Confuses isolation with authorization

All 113 Engagement Management questions →

Classify it as vishing and verify reporting: What is the next bounded validation step?

Attacks and Exploits Medium
During an approved simulation for a fictional nonproduction service, a recorded voice call claims to be the help desk and requests a callback. Only listed participants are included, and no credentials are collected. What is the next bounded validation step?
  1. Collect credentials through a simulated login page.
    Credential collection is outside the stated measurement and is unnecessary for validating reporting behavior.
  2. Test the same scenario through SMS.
    SMS would test smishing, a different delivery channel, rather than validate the observed voice scenario.
  3. Call it spearphishing because named participants were targeted.
    Targeting may be specific, but the defining channel in this observation is voice, not email or messaging.
  4. Classify it as vishing and verify reporting. ✓
    A phishing attempt delivered by voice is vishing. Reporting can be checked within the approved cohort without collecting credentials.
The trap
Changes the communication channel. Escalates a bounded exercise into sensitive-data collection. Confuses targeting style with delivery channel.

All 304 Attacks and Exploits questions →

28: What integer does it print?

Reconnaissance and Enumeration Easy
In an authorized office assessment, an analyst must interpret this exact offline Python3 snippet using only its literal synthetic data. What integer does it print?counts = [5, 9, 7, 1, 4, 3] print(sum(x for x in counts if x >= 3))
  1. 30
    This total miscalculates the qualifying values after applying the greater-than-or-equal filter.
  2. 28 ✓
    The qualifying values are 5, 9, 7, 4, and 3, whose sum is 28.
  3. 29
    This value results from adding an element that does not satisfy the filter condition.
  4. 25
    This value omits one qualifying list element from the sum.
The trap
Arithmetic error after otherwise recognizing the filter. Includes the value one, which fails the threshold. Incorrectly excludes a value meeting the threshold.

All 183 Reconnaissance and Enumeration questions →

Trace the setting in the test build and observe validation: Which next step best validates the finding while p

Vulnerability Discovery and Analysis Hard
A SAST review of a mobile application identifies a branch that disables certificate validation under a debug configuration. The designated test device has the corresponding test build, and validation may use only a controlled endpoint. Which next step best validates the finding while preserving scope?
  1. Treat every release as vulnerable because the debug branch exists in source.
    Build profiles can compile different behavior, so a source path does not prove all releases are affected.
  2. Trace the setting in the test build and observe validation against the controlled endpoint. ✓
    This connects the source condition to the designated build and observes runtime behavior within scope.
  3. Review the source configuration.
    Static review alone does not establish whether the relevant behavior exists or executes in the test build.
  4. Replace the device trust store and exercise the application against several endpoints.
    Changing trust material and using multiple endpoints expands the test unnecessarily and does not first establish that the debug branch is active.
The trap
Stops at static evidence. Alters the environment and broadens testing prematurely. Generalizes a configuration-dependent path.

All 148 Vulnerability Discovery and Analysis questions →

PenTest+ exam: the facts

How many questions are on the PenTest+ exam?

90, as published by the exam vendor.

How long is the PenTest+ exam?

165 minutes. Across 90 questions that is about 110 seconds per question.

What topics does the PenTest+ exam cover?

5 domains: Attacks and Exploits, Reconnaissance and Enumeration, Vulnerability Discovery and Analysis, Post-exploitation and Lateral Movement, Engagement Management. Weights: Attacks and Exploits 35%, Reconnaissance and Enumeration 21%, Vulnerability Discovery and Analysis 17%, Post-exploitation and Lateral Movement 14%, Engagement Management 13%.

How many PenTest+ practice questions does Certsqill have?

870, spread across 5 exam domains. Every one shows all options, which is correct, and why each of the others is not.

PT0-003 dumps vs practice questions

PT0-003 dumps and practice questions can look alike on screen, but they are different things. A dump claims to be the live exam — questions copied from real sittings. Practice questions are written against CompTIA’s published PT0-003 objectives to test the same skills, without reproducing the exam.

CompTIA’s policy on this is explicit. It calls such sources “unauthorized training materials”: websites, PDFs or chat sessions whose content is the same as or substantially similar to questions on a CompTIA exam. Because CompTIA never releases exam content to the public, preparing with them counts as cheating.

If CompTIA finds that a candidate memorised such content to pass, the candidate is banned from CompTIA exams for at least 12 months, loses the certification and has the test scores invalidated — and CompTIA states this applies even without fraudulent intent.

How to use PenTest+ practice questions well

Work by domain first. Attacks and exploits carry 35% of PT0-003, so a weak score there costs the most; engagement management at 13% is small but often under-studied. The readiness score on Certsqill is broken down by domain for exactly this reason.

Read the explanation for every option, including the ones you ruled out. A wrong option can be a real tool or technique that simply belongs to a different stage of an engagement, and knowing why it does not fit is what transfers to new questions.

Then close the gap the questions cannot cover. The exam also contains performance-based questions, which our bank does not simulate, so add hands-on practice in a lab of your own before you book.

PenTest+ practice: questions people ask

Are PT0-003 dumps allowed?

No. CompTIA treats material matching live exam content as unauthorized training material; candidates found using it face a ban of at least 12 months and loss of the certification. Source: CompTIA, checked 9 October 2026.

Are Certsqill’s PenTest+ questions taken from the real exam?

No. They are expert-developed against CompTIA’s published PT0-003 objectives, with an explanation for every answer option.

Do the practice questions include performance-based questions?

No. The bank is multiple-choice; practise the performance-based part hands-on in a lab.

Would you pass PenTest+ today?

Five minutes, and you get a score per domain — not one number, but which section to open tonight.

Test your PenTest+ readiness — free
Certsqill PenTest+ question bank · 870 questions across 5 domains · Every answer, right and wrong, comes with its own explanation.