Free Preparation Discussions
MENU
CompTIA PT0-003 Exam Questions
Free CompTIA PT0-003 Exam Actual Questions
Note: Premium Questions for PT0-003 were last updated On May. 30, 2026 (see below)
While performing a penetration test, a tester executes the following command:
PS c:\tools> c:\hacks\PsExec.exe \\server01.cor.ptia.org -accepteula cmd.exe
Which of the following best explains what the tester is trying to do?
PsExec is a Windows Sysinternals tool that allows users to execute commands on a remote system without needing an interactive login session. The command above is executing cmd.exe on a remote Windows Active Directory domain machine (server01.cor.ptia.org).
Option A (Test connectivity using PsExec) : The command does not check connectivity; it executes a command remotely.
Option B (Perform a lateral movement attack) : Correct. Lateral movement occurs when an attacker moves from one compromised machine to another within a network, using valid credentials. PsExec is often used for this purpose.
Option C (Send the PsExec binary) : The command runs cmd.exe remotely, but it does not transfer PsExec itself.
Option D (Enable cmd.exe) : cmd.exe is already enabled by default on most Windows systems.
Reference: CompTIA PenTest+ PT0-003 Official Guide -- Lateral Movement with PsExec
A penetration tester gained a foothold within a network. The penetration tester needs to enumerate all users within the domain. Which of the following is the best way to accomplish this task?
Comprehensive and Detailed Explanation From Exact Extract:
net.exe is the classic Windows networking utility that includes commands for enumerating domain resources and accounts from a compromised host where the tester has any authenticated domain context. Typical commands used by penetration testers to enumerate domain users with net.exe include:
net user /domain --- lists domain user accounts (name and some properties).
net group 'Domain Users' /domain --- lists members of the Domain Users group.
net view /domain --- lists computers in the domain (useful to find targets for further enumeration).
Why net.exe is the best option here:
It is installed by default on Windows systems and works with the current authenticated domain credentials (common after gaining a foothold).
It provides a quick, low-noise way to enumerate user accounts and groups without requiring additional tooling or elevated privileges beyond an authenticated domain user.
Results can be scripted and parsed for further enumeration and pivoting.
Why the other options are not appropriate:
A . pwd.exe --- Not a standard Windows tool for domain enumeration (and not present by default).
C . sc.exe --- Service Controller tool for managing services; not used to enumerate domain users.
D . msconfig.exe --- System configuration GUI utility for startup/services; not for domain account enumeration.
Related alternatives (contextual, commonly used in pentests):
dsquery user -limit 0 (on systems with RSAT/AD tools) to query AD directly.
Get-ADUser -Filter * (PowerShell, requires the ActiveDirectory module and appropriate rights).
Tools like PowerView (PowerShell) or BloodHound (collection phase) can provide richer AD enumeration, but net.exe is the simplest built-in option to enumerate domain users from an authenticated foothold.
CompTIA PT0-003 Objective Mapping (summary):
Domain 2.0 Information Gathering and Vulnerability Scanning --- enumerate network and Active Directory objects using native tools and scripts (e.g., net.exe for domain user enumeration).
[Attacks and Exploits]
A penetration tester assesses an application allow list and has limited command-line access on the Windows system. Which of the following would give the penetration tester information that could aid in continuing the test?
When a penetration tester has limited command-line access on a Windows system, the choice of tool is critical for gathering information to aid in furthering the test. Here's an explanation for each option:
mmc.exe (Microsoft Management Console):
Primarily used for managing Windows and its services. It's not typically useful for gathering information about the system from the command line in a limited access scenario.
icacls.exe:
This tool is used for modifying file and folder permissions. While useful for modifying security settings, it does not directly aid in gathering system information or enumeration.
nltest.exe:
This is a powerful command-line utility for network testing and gathering information about domain controllers, trusts, and replication status. Key functionalities include:
Listing domain controllers: nltest /dclist:<DomainName>
Querying domain trusts: nltest /domain_trusts
Checking secure channel: nltest /sc_query:<DomainName>
These capabilities make nltest very useful for understanding the network environment, especially in a domain context, which is essential for penetration testing.
rundll.exe:
This utility is used to run DLLs as programs. While it can be used for executing code, it does not provide direct information about the system or network environment.
Conclusion: nltest.exe is the best choice among the given options as it provides valuable information about the network, domain controllers, and trust relationships. This information is crucial for a penetration tester to plan further actions and understand the domain environment.
[Attacks and Exploits]
A penetration tester is unable to identify the Wi-Fi SSID on a client's cell phone.
Which of the following techniques would be most effective to troubleshoot this issue?
Since SSID broadcast might be hidden, channel scanning allows the tester to identify active Wi-Fi networks.
Option A (Sidecar scanning) : Not a recognized Wi-Fi testing method.
Option B (Channel scanning) : Correct.
Identifies hidden SSIDs by monitoring probe requests and responses.
Option C (Stealth scanning) : Typically refers to evading detection, not Wi-Fi analysis.
Option D (Static analysis scanning) : Static analysis applies to code security, not Wi-Fi networks.
Reference: CompTIA PenTest+ PT0-003 Official Guide -- Wireless Reconnaissance Techniques
A tester is finishing an engagement and needs to ensure that artifacts resulting from the test are safely handled. Which of the following is the best procedure for maintaining client data privacy?
At the end of a penetration test, handling sensitive data properly ensures compliance with legal, regulatory, and ethical guidelines.
Securely destroy or remove all engagement-related data (Option B):
Ensures confidentiality of test results.
Prevents unauthorized access to client information.
Methods include secure wiping tools (shred, sdelete), and encrypted storage deletion.
Incorrect options:
Option A (Remove configuration changes): Necessary but does not ensure complete data destruction.
Option C (Search for sensitive credentials): Important but does not address all artifacts.
Option D (Shut down C2 infrastructure): Important for OPSEC but does not address client data privacy.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Harold Smith
3 days agoSarah Baker
12 days agoDennis Phillips
26 days agoDonna Mitchell
1 month agoChristopher Lopez
1 month agoRachel Hill
1 month agoRyan Campbell
1 month agoPaul Ramirez
1 month agoElizabeth Stewart
20 days agoBroderick
2 months agoBuddy
2 months agoPaulina
2 months agoAmber
3 months agoFrancis
3 months agoMarguerita
3 months agoEladia
3 months agoColetta
4 months agoDorothy
4 months agoCorrina
4 months agoCristina
4 months agoSharika
5 months agoBarabara
5 months agoSharen
5 months agoRessie
5 months agoCarey
6 months agoCarmen
6 months agoEmogene
6 months agoBuck
6 months agoLashawn
7 months agoMelissa
7 months agoMaryrose
7 months agoKristian
7 months agoRasheeda
8 months agoHuey
8 months agoLeslee
8 months agoAlishia
8 months agoDomitila
8 months agoAudra
9 months agoStephen
9 months agoCaitlin
11 months agoJerilyn
11 months agoMarion
11 months agoCorrina
12 months agoMel
12 months agoLindsey
1 year agoRachael
1 year agoDaren
1 year agoFrederick
1 year agoSunshine
1 year agoBoris
1 year agoMelita
1 year agoNieves
1 year agoVeronica
1 year agoJosefa
1 year agoOmer
1 year agoWillow
1 year agoYoulanda
1 year agoNorah
1 year agoAngelica
1 year agoKattie
1 year agoQueen
1 year agoJannette
1 year agoVirgina
1 year agoTheola
1 year agoYuki
2 years agoElmer
2 years agoCatarina
2 years agoCheryl
2 years agoViva
2 years agoMalcolm
2 years agoHelga
2 years agoGlory
2 years agoMee
2 years agoMaxima
2 years agoDacia
2 years agoNoah
2 years agoAlexia
2 years agoTracie
2 years agoJade
2 years agoDwight
2 years ago