Free Preparation Discussions
MENU
CompTIA PT0-003 Exam Questions
Nine of the ten objectives in this exam's largest domain open with the same three words: given a scenario. That is PT0-003 in miniature. Eighteen of its twenty-six objectives are scenario-framed and eleven name a tool or a script outright, which is why recognition-level study tends to stall somewhere around the halfway mark. Which is why the PT0-003 exam questions below are built the way they are: free to answer here, taken from the bank our candidates use before test day, and written against CompTIA's Version 3.0 objectives for PenTest+ rather than carried across from PT0-002. If your voucher is already booked, work the questions first and let the domain weightings decide where the rest of your time goes. If you are still holding V2 material, the revision timeline shows what moved, what was absorbed, and what is new.
| Exam name | CompTIA PenTest+ Exam |
| Exam code | PT0-003 |
| Certification | CompTIA PenTest+ |
| Practice questions in our bank | 365 |
| Questions on the real exam | 90 |
| Time allowed | 165 minutes |
| Passing score | 750 on a scale of 100 to 900 |
| Exam fee | USD 439 |
| Retake policy | No waiting period before the second attempt, then 14 calendar days from the third attempt onwards. Each attempt is paid |
| Certification validity | 3 years, renewed with 60 CEUs and USD 150 across the cycle |
| Launch date | 17 December 2024 |
| Recommended experience | 3 to 4 years in a penetration tester role, with Network+ and Security+ knowledge |
PT0-003 Exam Practice Questions
A free selection from our PT0-003 bank, opening on Attacks and Exploits because that is where the exam concentrates.
During a penetration test, a tester captures information about an SPN account. Which of the following attacks requires this information as a prerequisite to proceed?
Correct Answer: B
Kerberoasting is an attack that specifically targets Service Principal Name (SPN) accounts in a Windows Active Directory environment. Here's a detailed explanation:
Understanding SPN Accounts:
SPNs are unique identifiers for services in a network that allows Kerberos to authenticate service accounts. These accounts are often associated with services such as SQL Server, IIS, etc.
Kerberoasting Attack:
Prerequisite: Knowledge of the SPN account.
Process: An attacker requests a service ticket for the SPN account using the Kerberos protocol. The ticket is encrypted with the service account's NTLM hash. The attacker captures this ticket and attempts to crack the hash offline.
Objective: To obtain the plaintext password of the service account, which can then be used for lateral movement or privilege escalation.
Comparison with Other Attacks:
Golden Ticket: Involves forging Kerberos TGTs using the KRBTGT account hash, requiring domain admin credentials.
DCShadow: Involves manipulating Active Directory data by impersonating a domain controller, typically requiring high privileges.
LSASS Dumping: Involves extracting credentials from the LSASS process on a Windows machine, often requiring local admin privileges.
Kerberoasting specifically requires the SPN account information to proceed, making it the correct answer.
======
A penetration tester discovers a deprecated directory in which files are accessible to anyone. Which of the following would most likely assist the penetration tester in finding sensitive information without raising suspicion?
Correct Answer: A
When a penetration tester finds a deprecated web directory that's publicly accessible, the goal is to gather as much information as possible without triggering alerts.
Enumerating cached pages (such as those stored by Google Cache, the Wayback Machine, or local proxy caches) allows the tester to:
View historical or deleted content that might contain sensitive data, credentials, or configuration info.
Gather evidence without directly interacting with the target system, thus minimizing detection risk.
Why not the others:
B . Looking for externally available services: Useful for attack surface mapping, but not for extracting data from the discovered directory.
C . Scanning for exposed ports: Active probing that increases detection risk; unrelated to exploring a directory.
D . Searching for vulnerabilities/exploits: Premature; reconnaissance and content discovery come first.
CompTIA PT0-003 Mapping:
Domain 2.0: Information Gathering and Vulnerability Scanning
OSINT and passive reconnaissance to identify exposed data and files.
A penetration tester is conducting an assessment of a web application's login page. The tester needs to determine whether there are any hidden form fields of interest. Which of the following is the most effective technique?
Correct Answer: D
Hidden form fields in web applications can store user roles, session tokens, and security parameters that attackers may exploit.
HTML scraping (Option D):
Involves analyzing HTML source code to find hidden fields like:
<input type='hidden' name='admin_access' value='true'>
Attackers use tools like Burp Suite, ZAP, or browser developer tools (Ctrl+U or Inspect Element) to locate hidden fields.
Incorrect options:
Option A (XSS): Exploits JavaScript injection, not for finding hidden fields.
Option B (On-path attack): Involves MITM interception, not directly analyzing form fields.
Option C (SQL injection): Targets databases, not HTML forms
A penetration tester is enumerating a Linux system. The goal is to modify the following script to provide more comprehensive system information:
#!/bin/bash
ps aux >> linux_enum.txt
Which of the following lines would provide the most comprehensive enumeration of the system?
Correct Answer: A
This command gathers:
/etc/passwd -- lists all local user accounts.
netstat -tuln -- lists listening ports and associated services.
/etc/bash.bashrc -- contains environment variables and configurations that could reveal system behaviors or hidden persistence mechanisms.
This provides a much broader and deeper enumeration compared to other options.
While performing a penetration test, a tester executes the following command:
PS c:\tools> c:\hacks\PsExec.exe \\server01.cor.ptia.org -accepteula cmd.exe
Which of the following best explains what the tester is trying to do?
Correct Answer: B
PsExec is a Windows Sysinternals tool that allows users to execute commands on a remote system without needing an interactive login session. The command above is executing cmd.exe on a remote Windows Active Directory domain machine (server01.cor.ptia.org).
Option A (Test connectivity using PsExec) : The command does not check connectivity; it executes a command remotely.
Option B (Perform a lateral movement attack) : Correct. Lateral movement occurs when an attacker moves from one compromised machine to another within a network, using valid credentials. PsExec is often used for this purpose.
Option C (Send the PsExec binary) : The command runs cmd.exe remotely, but it does not transfer PsExec itself.
Option D (Enable cmd.exe) : cmd.exe is already enabled by default on most Windows systems.
Reference: CompTIA PenTest+ PT0-003 Official Guide -- Lateral Movement with PsExec
PT0-003 Exam Domains and Weightings
Domains and weightings follow CompTIA's published PenTest+ Version 3.0 objectives.
Attacks and Exploits
35%Network, authentication, host-based, web application, wireless, cloud and social engineering attacks, plus scripting to automate them and analysis of output to prioritise what to attack first. Cloud content covers container escape, metadata service attacks and identity misconfiguration; attacks against artificial intelligence systems, including prompt injection and model manipulation, appear here too. The largest domain by a wide margin and the one the whole exam pivots on.
Reconnaissance and Enumeration
21%Active and passive information gathering, enumeration of DNS, services and directories, tool selection across Nmap, Wireshark and Shodan, and modifying Python, PowerShell and Bash scripts to support both. Every objective in this domain is scenario-framed and two of the four name scripting or tooling explicitly, which makes it the densest source of performance-based items per percentage point.
Vulnerability Discovery and Analysis
17%Authenticated and unauthenticated scanning, static and dynamic application testing, analysing the output of reconnaissance and scanning, validating findings and discarding false positives. Physical security concepts sit here as the domain's one conceptual objective. New as a standalone domain in V3.
Post-exploitation and Lateral Movement
14%Establishing and maintaining persistence, moving laterally through an environment, staging and exfiltration concepts, and cleanup and restoration once the engagement ends. Split evenly between things you do and things you explain, which makes it a cheaper domain to raise than its size suggests. Also new as a standalone domain in V3.
Engagement Management
13%Pre-engagement activities including rules of engagement, scoping and authorisation, collaboration and communication, comparison of testing frameworks and methodologies, the anatomy of a penetration test report, and recommending remediation from a set of findings. Four of its five objectives are explain, summarise or compare, making this the most straightforwardly learnable part of the exam.
Official Revisions by CompTIA
17 December 2024 — : PT0-003 launched, replacing PT0-002. Reporting and Communication and Tools and Code Analysis disappeared as standalone domains, their content absorbed into Engagement Management and distributed through the technical objectives. Vulnerability Discovery and Analysis and Post-exploitation and Lateral Movement were added. Attacks and Exploits rose from 30% to 35% and the maximum question count went from 85 to 90.
17 June 2025 — : The English PT0-002 exam retired, leaving PT0-003 as the only current version of PenTest+.
Estimated 2027 — : CompTIA states that its exams usually retire about three years after launch and gives 2027 as an estimate for PT0-003, without committing to a date.
Source: CompTIA's PenTest+ certification page and its Version 3.0 exam objectives.
What the PT0-003 Exam Really Tests, and How
CompTIA phrases its objectives in a way that gives the question format away. Anything introduced with given a scenario turns into a situational item or a performance-based task, while anything introduced as explaining or comparing turns into a knowledge item. On PT0-003, eighteen of the twenty-six objectives fall on the applied side, and that split produces four recognisable shapes on test day.
Choosing the right tool and driving it correctly
Tested via: performance-based questionsSeven objectives in the attack domain are phrased as performing an attack using the appropriate tools, and two more cover modifying scripts and selecting tools for reconnaissance. On the exam that becomes a simulated interface or a command with parameters to complete. Syntax matters here in a way it does not on most CompTIA exams.
Reading raw output and deciding what happens next
Tested via: evidence-interpretation question setsScan results, enumeration output and reconnaissance data appear on screen and you determine which finding is real, which is noise, and what the next move is. These items consume time out of proportion to their marks, which is the pacing problem most first attempts run into.
Working inside the rules of an engagement
Tested via: scenario-based multiple-choice questionsScoping, authorisation, mandatory reporting, escalation paths and remediation recommendations are tested as situations rather than definitions: something has been found, or something is out of scope, and you choose the correct action. This is the domain where the right technical answer can be the wrong professional one.
Comparing methodologies and explaining concepts
Tested via: knowledge-recall multiple-choice questionsA minority of objectives ask you to explain or compare rather than do: testing frameworks and methodologies, report components, attacks against specialised systems, staging and exfiltration, and cleanup activities. Attacks against artificial intelligence systems sit in that group in V3, described rather than performed.
How to Pass PT0-003 on Your First Attempt
PenTest+ sits between Security+ and the hands-on offensive certifications, and that middle position is where candidates misjudge it. It is more practical than a knowledge exam and more structured than a lab exam. Four steps, ordered for someone with a date already in the diary.
Take a timed set before you revise anything. Time it from the first attempt rather than the third. Because the performance-based items dominate the early minutes, an untimed run tells you nothing about the risk that actually fails people on this exam.
Work backwards from a wrong answer to the objective that produced it. CompTIA publishes granular objectives for V3 and phrases exam items close to that wording, so the objective usually explains the miss better than the answer key would. One mistake understood this way turns into a pattern you recognise on sight later.
Give Attacks and Exploits the largest share of your hours. At 35% it is more than twice the size of Engagement Management, and it is where the cloud and artificial intelligence content added in V3 lives. Reconnaissance and Enumeration at 21% is the next priority, and its scripting objectives are worth practising rather than reading.
Do not leave Engagement Management until the end. It is 13% of the exam, four of its five objectives are conceptual, and it is the cheapest domain on the paper to raise from weak to strong. Technical candidates routinely postpone it and then lose marks on scoping and reporting items that were free.
What to Look for in PT0-003 Practice Questions
and Why Prefer Pass4Success Practice Material
CompTIA states plainly that it offers no free retests and no retake discounts, so a failed attempt means buying a voucher at full price. Set beside that, the question about practice material is not what it costs but whether it was written for V3 at all. Here is how to tell.
Written for PT0-003, not converted from PT0-002
V3 dissolved two domains, created two more, and moved reporting and tooling content into places V2 material never covered. Converted questions read convincingly while missing whole objectives, which is the most expensive kind of gap.
✓ Ours: the bank is maintained on a regular cycle to reflect how CompTIA actually tests, not only when the objectives change. When CompTIA does revise them, the affected questions are re-checked on top of that cycle, and the current bank date is shown in the exam details above.
Includes tool and output-driven items
If every practice question is a four-option definition check, the performance-based portion of the real exam will be the first time you have read a tool's output against the clock.
✓ Ours: the bank includes performance-based or output-interpretation items the practice test runs timed sessions, so pacing across the longer items is rehearsed before test day.
Covers the cloud and AI content V3 added
Container escape, metadata service attacks, identity misconfiguration and prompt injection are new to this version. Material predating December 2024 does not contain them at all.
✓ Ours: questions are written to the Version 3.0 objectives, including the newer attack surfaces coverage of the AI and cloud objectives.
Open to inspection before purchase
CompTIA's candidate agreement sets out what material a candidate may and may not use, and the consequences run to certification revocation. Reading a provider's questions before buying tells you what you are dealing with.
✓ Ours: a free demo of both formats, the PDF and the practice test, with nothing to pay first. The free questions on this page come from the same bank.
Priced sensibly against a second voucher
The sum worth doing is the cost of preparing once against the cost of a second voucher.
✓ Ours: Practice material costs $69 once. A second CompTIA exam voucher costs several times that if you walk in underprepared and have to retake it. Spending a little upfront is cheaper than paying for the exam twice.
PT0-003 Exam Discussion: What Recent Candidates Say
PT0-003 candidates report back here on the performance-based items and the clock, on how the cloud and AI objectives actually appeared, and on the lab work they wish they had done. Add your account if you have sat it.
Ready to Pass PT0-003 on Your First Attempt?
Get Premium AccessFrequently Asked Questions
What skills are measured on the PT0-003 exam?
Five domains: Attacks and Exploits (35%), Reconnaissance and Enumeration (21%), Vulnerability Discovery and Analysis (17%), Post-exploitation and Lateral Movement (14%), and Engagement Management (13%). The weightings come from CompTIA's Version 3.0 objectives and from its PenTest+ certification page.
What is the difference between PT0-003 and PT0-002?
V3 restructured the exam rather than refreshing it. Reporting and Communication and Tools and Code Analysis stopped being separate domains, with reporting folded into Engagement Management and tooling spread through the technical objectives. Two new domains appeared, Attacks and Exploits grew from 30% to 35%, the maximum question count rose from 85 to 90, and cloud and artificial intelligence attack content was added. The English PT0-002 exam retired on 17 June 2025.
How hard is the PT0-003 exam?
Harder than a knowledge exam and easier than a full practical certification. Eighteen of twenty-six objectives are scenario-framed and eleven name tools or scripting, so candidates without lab time struggle regardless of how much they have read. Those already working in offensive security usually find the technical domains fair and lose marks on scoping and reporting instead.
What types of questions are on the PT0-003 exam?
Multiple choice and performance-based items, a maximum of 90 of them in 165 minutes. The performance-based questions ask you to work with tools, output or code rather than pick an option, and they take considerably longer per mark than the multiple-choice items.
What are the most common mistakes on the PT0-003 exam?
Spending too long on early performance-based items and running short at the end, preparing the technical domains while ignoring Engagement Management, arriving with V2 knowledge and no exposure to the cloud and AI objectives, and studying tools by name rather than by use. The last one is specific to this exam, because the objectives ask you to perform attacks using the appropriate tools rather than describe them.
Do I need Security+ before taking PT0-003?
No. CompTIA enforces no prerequisite. It recommends Network+ and Security+ knowledge alongside three to four years in a penetration tester role, and most candidates do hold Security+ first, but you can book PT0-003 directly.
How do the PT0-003 domains connect in a real engagement?
They follow the engagement itself. You scope and get authorisation, gather information about the target, find and validate weaknesses, exploit what is exploitable, move through the environment and establish persistence, then clean up and report. Exam scenarios frequently span two of those stages in one item, which is why studying the domains as separate subjects leaves gaps.
What is an effective final-week review plan for PT0-003?
Put Attacks and Exploits and Reconnaissance and Enumeration first, since they carry 56% between them, and spend that time in a lab rather than in a book. Sit one full timed test midweek to check that the performance-based items are not eating the first hour. Leave the final day for Engagement Management: frameworks, report structure and scoping rules recall well under light revision.
Is PT0-003 worth it in 2026?
For penetration testers and red team roles it is the most widely recognised vendor-neutral credential below the hands-on practical certifications, and CompTIA confirms V3 keeps the same United States Department of Defense 8140 work role approvals as V2. Renewal costs 60 continuing education units and USD 150 across a three-year cycle.
Where does PT0-003 fit in the CompTIA certification path?
It sits at the intermediate offensive tier, usually after Security+ and often alongside or after CySA+, which covers the defensive side of the same ground. Candidates continuing upwards generally move on to CompTIA's advanced security credential.
Related CompTIA Certification Exams
On an exam built this heavily around tools, the software named in the objectives moves faster than the objectives do, so this bank is reviewed to a fixed internal schedule rather than on CompTIA's publication cycle. CompTIA has issued no revisions to the Version 3.0 objectives since the exam launched on 17 December 2024, and when it does the affected questions and answers are re-checked against the published objectives on top of the scheduled pass. The date of the most recent pass appears in the exam details table above.