How many free PT0-003 practice questions can I try?

You can answer 10 PT0-003 practice questions free without creating an account. Each one is graded instantly with a written explanation. A free account keeps your progress, and the full bank (300+ questions) unlocks with a subscription.

What topics does the PT0-003 exam cover?

The PT0-003 exam is organised into 5 domains: Attacks and Exploits (35%), Reconnaissance and Enumeration (21%), Vulnerability Discovery and Analysis (17%), Post-exploitation and Lateral Movement (14%), Engagement Management (13%). The weighting above shows how much of the exam each domain represents, so budget study time in the same proportion.

How long is the PT0-003 exam and how is it scored?

The PT0-003 exam has approximately 90 questions in 165 minutes, with a passing score of 750. Practice sets here are scored the same way as the real exam so you can see whether you are above or below the line before test day.

How should I start studying for CompTIA PenTest+ (PT0-003)?

Start with Attacks and Exploits, the highest-weighted domain, then work down the list. Answer a mixed set after each domain pass — mixing domains forces you to identify what a question is asking before recalling the content, which is what the real exam does.

Are these the same questions that appear on the real PT0-003 exam?

No. These are original practice questions written against the published PT0-003 exam objectives. They mirror the style, difficulty, and domain weighting of the real exam, but the actual exam content is confidential and is not reproduced here.

PT0-003 Practice Questions — CompTIA PenTest+

Domain	Exam weight	What it covers
Attacks and Exploits	35%	Execute exploits against networks, applications, wireless, and physical targets
Reconnaissance and Enumeration	21%	Gather intelligence on target systems using passive and active reconnaissance techniques
Vulnerability Discovery and Analysis	17%	Identify, validate, and analyze vulnerabilities in target systems and applications
Post-exploitation and Lateral Movement	14%	Establish persistence, move laterally, and exfiltrate data after initial compromise
Engagement Management	13%	Plan, scope, and manage penetration testing engagements including legal, ethics, and reporting

Sample question 1 — Attacks and Exploits

A web application reflects user-supplied text into the page, and a tester wants to prove that a script can run in another user's browser. The tester must show the client a repeatable, minimal proof of the flaw. Which test should the tester perform to demonstrate the issue?

A. Send the request with a script payload and observe it execute in the browser.
B. Overload the login form with many requests until the service stops.
C. Read the application's source code from the public repository.
D. Guess database table names from error messages the server returns.

Answer: A. Option A is correct because sending a script payload that the page reflects and the browser runs is a minimal, repeatable proof of the cross-site scripting flaw. Option B causes an outage rather than showing script execution. Option C reads code but does not demonstrate the flaw in the running application. Option D probes the database, which is a different class of issue.

Sample question 2 — Engagement Management

Two days before an external test, the client's procurement team says the signature page is still with legal, but the technical contact wants the team to start scanning the public range tonight. The firm's own policy requires a countersigned document and a defined window before any traffic is sent. Which action should the engagement lead take?

A. Begin passive scanning only, because collecting public data needs no paperwork.
B. Hold all activity until the countersigned document and window are confirmed.
C. Start the test and send the paperwork to the client after the first report.
D. Ask the technical contact to send an email approving the work in place of the contract.

Answer: B. Option B is correct: Hold all activity until the countersigned document and window are confirmed. The firm's policy ties the start of any traffic to a signed scope and a stated window, and the procurement delay is not something the delivery team can waive. Option A still sends traffic without the authorization that policy demands, whatever the collection method. Option C inverts the order and exposes the firm to work performed with no contract. Option D substitutes one person's email for the corporate signature the engagement requires.

Sample question 3 — Post-exploitation and Lateral Movement

During an authorized external penetration test, the tester discovers that a misconfigured cloud storage bucket exposes internal build artifacts belonging to a third-party contractor not listed in the rules of engagement. The artifacts contain source code for a product the client resells. The client's security manager is unavailable, and the tester must decide how to proceed while staying within contractual and legal boundaries. Which action best aligns with professional engagement management?

A. Notify the client contact and pause work on that asset
B. Download a sample of the artifacts to prove the exposure is real
C. Report the third-party exposure directly to the contractor's security team
D. Continue enumerating the bucket and document it in the final report

Answer: A. Option A is correct. the rules of engagement define the authorized scope, and an asset belonging to a third party falls outside it; the tester must notify the client point of contact and stop activity on that asset until scope is clarified in writing. Option B is incorrect because continued enumeration of an out-of-scope third-party asset constitutes unauthorized access regardless of how the finding is later documented. Option C is incorrect because downloading contractor source code exceeds the authorized scope and creates legal exposure and potential data-handling violations. Option D is incorrect because contacting the third party directly bypasses the client's authority over the engagement and may breach confidentiality obligations.

CompTIA PenTest+ (PT0-003) Practice Questions

CompTIA PenTest+ (PT0-003) Practice Questions

How the PT0-003 exam is structured

Worked sample PT0-003 questions