Free CompTIA PenTest+ Practice Test (PT0-003) 2026

Right answer (C): That's correct! The excerpt's content (testing window, source IP allow-list, scope boundaries, permitted/forbidden techniques, emergency POC) is the textbook structure of a Rules of Engagement (RoE) or authorization letter, which provides legal cover for the tester and operational guardrails.

Wrong answers:

• A): An NDA only covers confidentiality of information learned during the engagement; it does not list IP ranges, time windows, or permitted techniques as shown.
• B): The SOW describes deliverables, timelines, and pricing at a project level, not the technical testing boundaries shown in the excerpt.
• D): The MSA governs the overall commercial relationship and would not contain test-specific details such as source IPs or attack techniques.

Right answer (B): That's correct! As soon as the sqlmap output revealed data from the out-of-scope acme_payroll_prod database, the tester must stop, preserve the dump as evidence, and immediately notify the client POC defined in the RoE so legal and compliance teams can handle the spillover.

Wrong answers:

• A): Continuing to exploit (e.g., dumping further tables) compounds the scope violation and exposes the tester to civil and possibly criminal liability under CFAA-style statutes.
• C): Ignoring 12,481 leaked PII records would be negligent and a breach of the tester's professional duty to disclose.
• D): Pivoting to acme_shop_staging is still unauthorized because the RoE only covered the production shop application and explicitly excluded other databases.

Right answer (A): That's correct! Every row in the table uses third-party data sources (WHOIS, crt.sh, Shodan, LinkedIn, Google) that return target intelligence without ever touching the client's network — the textbook definition of passive reconnaissance / OSINT.

Wrong answers:

• B): Active reconnaissance directly probes the target with scans and banner grabbing, generating traffic that can be detected by IDS/IPS.
• C): Network scanning is a specific form of active recon using tools like Nmap to identify open ports and services.
• D): Fuzzing is an exploitation technique that sends malformed input to applications to find crashes, not a reconnaissance method.

Right answer (D): That's correct! The output line "Not shown: 65530 closed tcp ports" confirms all 65,535 ports were probed (-p-). The VERSION column proves -sV ran, the OS CPE/details lines prove -O ran, and -sS made it a half-open SYN stealth scan.

Wrong answers:

• A): A full TCP connect scan would use -sT instead of -sS, and this command also includes service versioning so OS-only is wrong.
• B): A UDP scan would require the -sU flag, which is not present in this command.
• C): Without -p- Nmap defaults to the top 1000 ports, but -p- explicitly tells it to scan every port from 1 to 65,535.

Right answer (B): That's correct! The Nmap NSE script literally returned "VULNERABLE" for smb-vuln-ms17-010 — that is EternalBlue, the SMBv1 RCE leaked from the NSA and weaponized by WannaCry/NotPetya. exploit/windows/smb/ms17_010_eternalblue in Metasploit is the textbook follow-up.

Wrong answers:

• A): BlueKeep targets Remote Desktop Protocol on port 3389, not SMB on port 445.
• C): Heartbleed is an OpenSSL vulnerability affecting HTTPS services on port 443, not Windows SMB.
• D): Log4Shell is a Java deserialization flaw in the Log4j logging library, not present on a Windows SMB service.

Right answer (C): That's correct! The verbose SQL error on a single quote and the recovered concatenated query are the classic indicators of SQL injection. A payload like admin' OR '1'='1'-- in the username field will bypass authentication because the back end does not parameterize the query.

Wrong answers:

• A): ARP spoofing is a Layer 2 network attack that redirects local traffic and has no direct effect on web application login forms.
• B): DNS cache poisoning redirects users to malicious servers but does not bypass authentication on the legitimate application.
• D): A SYN flood is a denial-of-service attack that overwhelms a server and would not help in testing login security.

Right answer (A): That's correct! Running run autoroute -s 10.0.0.0/24 in the existing Meterpreter session, then auxiliary/server/socks_proxy, lets the tester wrap external tools with proxychains so that scans against DC01/FILE01/HRAPP are tunneled through web01 — exactly the pivot the diagram requires.

Wrong answers:

• B): Wireshark only passively captures traffic and does not allow active scanning or exploitation of internal hosts.
• C): Nikto is a web vulnerability scanner, not a network pivoting tool, and cannot route traffic through a compromised host.
• D): Brute-forcing SSH on the already-compromised web server is pointless since the tester already has access to it.

Right answer (D): That's correct! The sekurlsa::logonpasswords command and the "kiwi" Meterpreter extension are signature features of Mimikatz — the industry-standard Windows credential dumper that extracts NTLM hashes, Kerberos tickets, and cached plaintext passwords from LSASS memory.

Wrong answers:

• A): Nmap is a network scanner used for host discovery and port scanning, not for post-exploitation credential harvesting.
• B): Burp Suite is a web application proxy for intercepting HTTP/HTTPS traffic, not for local Windows credential extraction.
• C): Wireshark is a network protocol analyzer that captures packets but cannot access the local SAM database or LSASS memory.

Right answer (B): That's correct! The transcript shows a 0777 script executed by root via cron, so any user (including www-data, uid=33) can rewrite cleanup.sh and have it run as uid=0 within 5 minutes — a classic vertical privilege escalation from low-priv user to root.

Wrong answers:

• A): Horizontal privilege escalation moves to another account at the same privilege level, not from user to root.
• C): Pass-the-hash is a Windows-specific NTLM technique not applicable to this Linux cron job scenario.
• D): A man-in-the-middle attack intercepts network communications and has nothing to do with local privilege escalation via cron misconfiguration.

Right answer (A): That's correct! Section A is the executive summary (business risk, dollar impact, leadership audience) and Section B is the technical findings section (CVEs, CVSS, PoC modules, KBs). Pairing both is the PT0-003 standard for a professional report.

Wrong answers:

• B): A risk register is an ongoing risk management document, not a standard section of a penetration test report.
• C): The scope document is created before the engagement during planning, not as a report deliverable after testing.
• D): Threat models and attack trees are analysis tools representing a specific methodology, not the standard report structure.