In a cloud environment, a security team discovers that an attacker accessed confidential information that was used to configure virtual machines during their initialization. Through which of the following features could this information have been accessed?

A. IAM

B. Block storage

C. Virtual private cloud

D. Metadata services

Which of the following is the most efficient way to infiltrate a file containing data that could be sensitive?

A. Use steganography and send the file over FTP

B. Compress the file and send it using TFTP

C. Split the file in tiny pieces and send it over dnscat

D. Encrypt and send the file over HTTPS

A penetration tester is evaluating a SCADA system. The tester receives local access to a workstation that is running a single application. While navigating through the application, the tester opens a terminal window and gains access to the underlying operating system. Which of the following attacks is the tester performing?

A. Kiosk escape

B. Arbitrary code execution

C. Process hollowing

D. Library injection

Which of the following elements in a lock should be aligned to a specific level to allow the key cylinder to turn?

A. Latches

B. Pins

C. Shackle

D. Plug

A tester performs a vulnerability scan and identifies several outdated libraries used within the customer SaaS product offering. Which of the following types of scans did the tester use to identify the libraries?

A. IAST

B. SBOM

C. DAST

D. SAST

A penetration tester needs to complete cleanup activities from the testing lead. Which of the following should the tester do to validate that reverse shell payloads are no longer running?

A. Run scripts to terminate the implant on affected hosts.

B. Spin down the C2 listeners.

C. Restore the firewall settings of the original affected hosts.

D. Exit from C2 listener active sessions.

A penetration tester is conducting reconnaissance on a target network. The tester runs the following Nmap command: nmap -sv -sT -p - 192.168.1.0/24. Which of the following describes the most likely purpose of this scan?

A. OS fingerprinting

B. Attack path mapping

C. Service discovery

D. User enumeration

A penetration tester gains access to a Windows machine and wants to further enumerate users with native operating system credentials. Which of the following should the tester use?

A. route.exe print

B. netstat.exe -ntp

C. net.exe commands

D. strings.exe -a

A penetration tester has found a web application that is running on a cloud virtual machine instance. Vulnerability scans show a potential SSRF for the same application URL path with an injectable parameter. Which of the following commands should the tester run to successfully test for secrets exposure exploitability?

A. curl <url>?param=http://169.254.169.254/latest/meta-data/

B. curl '<url>?param=http://127.0.0.1/etc/passwd'

C. curl '<url>?param=<script>alert(1)<script>/'

D. curl <url>?param=http://127.0.0.1/

A penetration tester plans to conduct reconnaissance during an engagement using readily available resources. Which of the following resources would most likely identify hardware and software being utilized by the client?

A. Cryptographic flaws

B. Protocol scanning

C. Cached pages

D. Job boards

Page 1 out of 9 Pages

CompTIA Pentest+ PT0-003 Exam Details

Exam Code: PT0-003
Exam Name: CompTIA Pentest+ Exam
Certification Name: Pentest+
Certification Provider: CompTIA
Exam Questions: 85
Type of Questions: MCQs and performance-based
Exam Time: 165 minutes
Passing Score: 700
Exam Price: $381

PT0-003 Exam Questions

Last Updated Exam : 15-Apr-2025

CompTIA Pentest+ PT0-003 Exam Details