2026 Actual CompTIA PT0-003 Dumps, Updated Exam Questions for Guaranteed Pass

PT0-003 free sample questions and answers

CompTIA PT0-003 practice quiz with correct answers for search indexing.

1. Question 1

   A penetration tester gains shell access to a Windows host. The tester needs to permanently turn off protections in order to install additional payload. Which of the following commands is most appropriate?

   Asc config <svc_name> start=disabled
   

   Bsc query state= all
   

   Cpskill
   

   Dnet config <svc_name>
   

   Correct answer: A

   Command

   The sc config command is used to configure service startup settings in Windows. Using start=disabled will permanently disable a specific service, effectively turning off protections such as antivirus or other monitoring services.

   Why Not Other Options?

   B (sc query state= all): This command lists all services and their states but does not disable or modify any service.

   C (pskill): This command is used to terminate a process temporarily, but it does not permanently disable the service.

   D (net config): This command is used for configuring network settings, not for managing services.

   CompTIA Pentest+ Reference:

   Domain 3.0 (Attacks and Exploits)

   Windows Service Exploitation Guidelines

   
   

2. Question 2

   During an engagement, a penetration tester needs to break the key for the Wi-Fi network that uses WPA2 encryption. Which of the following attacks would accomplish this objective?

   AChopChop
   

   BReplay
   

   CInitialization vector
   

   DKRACK
   

   Correct answer: D

   To break the key for a Wi-Fi network that uses WPA2 encryption, the penetration tester should use the KRACK (Key Reinstallation Attack) attack.

   KRACK (Key Reinstallation Attack):

   Definition: KRACK is a vulnerability in the WPA2 protocol that allows attackers to decrypt and potentially inject packets into a Wi-Fi network by manipulating and replaying cryptographic handshake messages.

   Impact: This attack exploits flaws in the WPA2 handshake process, allowing an attacker to break the encryption and gain access to the network.

   Other Attacks:

   ChopChop: Targets WEP encryption, not WPA2.

   Replay: Involves capturing and replaying packets to create effects such as duplicating transactions; it does not break WPA2 encryption.

   Initialization Vector (IV): Related to weaknesses in WEP, not WPA2.

   Pentest Reference:

   Wireless Security: Understanding vulnerabilities in Wi-Fi encryption protocols, such as WPA2, and how they can be exploited.

   KRACK Attack: A significant vulnerability in WPA2 that requires specific techniques to exploit.

   By using the KRACK attack, the penetration tester can break WPA2 encryption and gain unauthorized access to the Wi-Fi network.

   Top of Form

   Bottom of Form

   ======

   
   

3. Question 3

   A tester compromises a target host and then wants to maintain persistent access. Which of the following is the best way for the attacker to accomplish the objective?

   AConfigure and register a service.
   

   BInstall and run remote desktop software.
   

   CSet up a script to be run when users log in.
   

   DPerform a kerberoasting attack on the host.
   

   Correct answer: A

   Configuring and Registering a Service:

   Registering a malicious service ensures that it starts automatically with the system, providing persistence even after reboots.

   This method is stealthier than others and is commonly used in advanced persistent threat (APT) scenarios.

   Why Not Other Options?

   B (Remote desktop software): Installing such software is noisy and can easily be detected by monitoring tools.

   C (User logon script): While it provides persistence, it is less reliable and more detectable than a system service.

   D (Kerberoasting): This is a credential-stealing technique and does not establish persistence.

   CompTIA Pentest+ Reference:

   Domain 3.0 (Attacks and Exploits)

   Domain 4.0 (Penetration Testing Tools)

   
   

4. Question 4

   A penetration tester finishes an initial discovery scan for hosts on a /24 customer subnet. The customer states that the production network is composed of Windows servers but no container clusters. The following are the last several lines from the scan log:

   Line 1: 112 hosts found... trying ports

   Line 2: FOUND 22 with OpenSSH 1.2p2 open on 99 hosts

   Line 3: FOUND 161 with UNKNOWN banner open on 110 hosts

   Line 4: TCP RST received on ports 21, 3389, 80

   Line 5: Scan complete.

   Which of the following is the most likely reason for the results?

   AMultiple honeypots were encountered
   

   BThe wrong subnet was scanned
   

   CWindows is using WSL
   

   DIPS is blocking the ports
   

   Correct answer: A

   Seeing services like OpenSSH 1.2p2 open on 99 hosts, and port 161 (SNMP) with unknown banners on 110 hosts suggests a high level of uniformity, which is uncommon in real-world Windows environments. This strongly points to honeypots being present, possibly for detection or deception.

   The official CompTIA guide discusses this under scan anomalies:

   ''Identical responses from a large number of hosts, especially deprecated versions or unchanging banners, could indicate the presence of honeypots or decoy systems.''

   
   

5. Question 5

   During a web application assessment, a penetration tester accesses the site unauthenticated and receives the following Set-Cookie on the first response:

   auth=yYKGORbrpabgr842ajbvrpbptau42342

   When the tester logs in, the server sends only one Set-Cookie header, and the value is exactly the same as shown above. Which of the following vulnerabilities has the tester discovered?

   AJWT manipulation
   

   BCookie poisoning
   

   CSession fixation
   

   DCollision attack
   

   Correct answer: C

   This is a session fixation vulnerability because the application is reusing the same session identifier before and after authentication instead of issuing a new one upon successful login. In secure session management, the server should regenerate the session token after a user authenticates so that any pre-authenticated session identifier cannot be abused. If an attacker can force or predict a victim's session ID before login, and the application keeps that same ID after authentication, the attacker may be able to hijack the authenticated session. That is the essence of session fixation. This is not JWT manipulation because there is no indication of token tampering, not cookie poisoning because the issue is not altered cookie content, and not a collision attack because no hash collision scenario is described. The flaw is improper session regeneration after authentication.