CompTIA PenTest+ Exam (PT0-003) Free Practice Test

Question 1

A penetration tester needs to collect information over the network for further steps in an internal assessment. Which of the following would most likely accomplish this goal?

A. ntlmrelayx.py -t 192.168.1.0/24 -l 1234

B. crackmapexec smb 192.168.1.0/24 -u "user" -p "pass123"

C. nc -tulpn 1234 192.168.1.2

D. responder.py -I eth0 -wP

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

During a security assessment, a penetration tester gains access to an internal server and manipulates some data to hide its presence. Which of the following is the best way for the penetration tester to hide the activities performed?

A. Clear the Windows event logs.

B. Reduce the log retention settings.

C. Modify the system time.

D. Alter the log permissions.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

A Chief Information Security Officer wants to automate adversarial activities from penetration tests that are relevant to the organization. Which of the following should a penetration tester do first to accomplish this task?

A. Utilize the PowerShell PowerView tool with custom scripting additions based on test results.

B. Deploy a command-and-control server with custom profiles to facilitate execution.

C. Use Python 3 with added testing libraries and script the relevant action to test.

D. Implement Atomic Red Team to chain critical TTPs and perform the test.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

There is a low-level shell on a system, and a penetration tester has discovered a service with system-level privileges that is available in the following directory structure:
objectpath\imagepath=C:\Program Files\New Folder\bin\cutepanda.exe
Which of the following is the most likely attack the tester should perform on the host?

A. Unquoted service path injection

B. User-controlled access bypass

C. Library injection

D. Process hollowing injection

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

A penetration tester downloads a JAR file that is used in an organization's production environment. The tester evaluates the contents of the JAR file to identify potentially vulnerable components that can be targeted for exploit. Which of the following describes the tester's activities?

A. ICS

B. SCA

C. SBOM

D. SAST

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

During an assessment, a penetration tester plans to gather metadata from various online files, including pictures. Which of the following standards outlines the formats for pictures, audio, and additional tags that facilitate this type of reconnaissance?

A. EXIF

B. COFF

C. ELF

D. GIF

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

A client recently hired a penetration testing firm to conduct an assessment of their consumer- facing web application. Several days into the assessment, the client's networking team observes a substantial increase in DNS traffic. Which of the following would most likely explain the increase in DNS traffic?

A. DoS attack

B. HTML scrapping

C. Covert data exfiltration

D. URL spidering

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

A penetration tester performs the following scan:

The tester then manually uses snmpwalkagainst port 161 and receives valid SNMP responses.
Which of the following best explains the scan result for port 161?

A. The Nmap scan lacked root privileges, which reduced packet inspection accuracy.

B. Nmap marked the port as open|filteredbecause no response was received.

C. The scanned host applied rate limiting to its responses to prevent UDP fingerprinting.

D. The SNMP daemon delayed its response beyond Nmap's UDP scan timeout.

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 9

A penetration tester conducts a web application test and wants to enumerate the file folder structure https://testsite.com. Which of the following is the correct command?

A. wfuzz -c -w common.txt -u https://testsite.com/index.php -d "username=admin&password=FUZZ"

B. wfuzz -c -w common.txt -u https://testsite.com/FUZZ

C. wfuzz -c -w common.txt -u https://testsite.com?FUZZ=test

D. wfuzz -c -w common.txt -u https://testsite.com/index.php -H "Cookie;session=FUZZ"

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 10

Which of the following should a penetration tester do when conducting post-engagement cleanup?

A. Delete all activity logs.

B. Shut down the infected system.

C. Return the system to its original state.

D. Close any open ports.

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 11

A penetration tester is hired to test a client's systems. The client's systems are hosted by the client at its headquarters. The production environment is hosted by a private cloud-hosting company. Which of the following would be the most important for the penetration tester to determine before beginning the test?

A. Disallowed tests

B. Third-party asset restrictions

C. Time-of-day restrictions

D. Physical locations of the infrastructure

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 12

Which of the following differentiates MITRE ATT&CK from PTES?

A. MITRE ATT&CK defines risk scoring models for vulnerabilities, while PTES focuses on defensive controls.

B. MITRE ATT&CK emphasizes real-world adversary behavior patterns, while PTES outlines structured test phases

C. MITRE ATT&CK provides detailed exploit code samples, while PTES focuses on threat actor profiles

D. MITRE ATT&CK organizes asset inventories, while PTES provides data breach response procedures

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 13

During a security assessment, a penetration tester uses a tool to capture plaintext log-in credentials on the communication between a user and an authentication system. The tester wants to use this information for further unauthorized access. Which of the following tools is the tester using?

A. Metasploit

B. Burp Suite

C. Zed Attack Proxy

D. Wireshark

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 14

A client warns the assessment team that an ICS application is maintained by the manufacturer.
Any tampering of the host could void the enterprise support terms of use. Which of the following techniques would be most effective to validate whether the application encrypts communications in transit?

A. Utilizing port mirroring on a firewall appliance

B. Requesting that certificate pinning be disabled

C. Reconfiguring the application to use a proxy

D. Installing packet capture software on the server

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 15

A penetration tester identifies an exposed corporate directory containing first and last names and phone numbers for employees. Which of the following attack techniques would be the most effective to pursue if the penetration tester wants to compromise user accounts?

A. Whaling

B. Tailgating

C. Smishing

D. Impersonation

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

CompTIA PenTest+ (PT0-003) Free Practice Test