PenTest+ (PT0-003). Set it up and run it.

1. Refer to the exhibit. The signed authorization lists three ranges, but a later kickoff email mentioned a fourth range. Until the discrepancy is resolved in writing, the tester should treat scope as what?

• A. The four ranges combined, to be thorough
• B. Whatever the client verbally prefers today
• C. The three ranges in the signed letter only
• D. The fourth range only, as the newest instruction

Correct answer: C. Authorization flows from the signed document, not an informal email. Until an amendment or written clarification adds the fourth range, only the three formally authorized ranges are in scope, and the tester must not assume the extra one.

Why the others are wrong. Combining all four tests an unauthorized range on the strength of an email. Relying on a shifting verbal preference carries no contractual weight and cannot be evidenced later. Treating only the fourth as authoritative discards the actually signed scope and acts on the least formal source available.

2. Refer to the exhibit. A tester reads an nmap table. Which two services shown are commonly associated with remote administration? (Choose two.)

• A. SMTP on 25
• B. SSH on 22
• C. RDP on 3389
• D. POP3 on 110
• E. DNS on 53

Correct answer: B. SSH on port 22 provides remote command-line administration and RDP on port 3389 provides remote graphical administration, so both are administration services. They are the two ports in the table associated with managing a system remotely.

Why the others are wrong. SMTP on 25 is a mail transport service, not remote administration. POP3 on 110 retrieves email for clients. DNS on 53, which is not even open in this table, resolves names; none of these three provide interactive remote administration the way SSH and RDP do.

3. A rules of engagement document lists testing hours as 0200 to 0500 on weekends only. A tester finds a critical flaw at 1400 on Tuesday and wants to verify it. What is appropriate?

• A. Verify it right away because critical flaws override the schedule
• B. Continue quietly and document the deviation afterward
• C. Verify from a personal account to avoid attribution
• D. Wait until the authorized testing window to continue verification

Correct answer: D. ROE testing windows are contractual limits set to protect production availability, and a critical finding does not authorize working outside the agreed hours. The tester waits for the window, though notifying the client of the finding is a separate step.

Why the others are wrong. Verifying immediately because a flaw is critical ignores a contractual boundary set to protect the business, regardless of severity. Continuing quietly and documenting later still violates the window and hides the deviation. Using a personal account to avoid attribution is evasion, not authorization, and only compounds the ROE breach.

4. A tester needs to enumerate subdomains of example.com without querying the organization's own name servers. Searching public certificate transparency logs reveals hostnames from issued TLS certificates. What category of activity is this?

• A. Active reconnaissance
• B. Passive reconnaissance
• C. Port scanning
• D. Service enumeration

Correct answer: B. Passive reconnaissance collects information from third-party and public sources, such as certificate transparency logs, without ever sending packets to the target's own systems. Because no traffic reaches the client, the activity leaves nothing in their logs.

Why the others are wrong. Active reconnaissance sends probes directly to the target, which querying public logs avoids entirely. Port scanning transmits packets to the client's hosts to find open ports, and service enumeration interacts with those services to identify them; both would appear in the client's logs, so neither describes reading third-party certificate data.

5. A team wants their scan to detect missing OS patches, weak local file permissions, and installed software versions accurately on each host. What scanning approach best meets this need?

• A. An unauthenticated network scan from outside the subnet
• B. A credentialed scan using valid host login accounts
• C. A passive scan that only observes network traffic
• D. A simple TCP port sweep of the address range

Correct answer: B. A credentialed (authenticated) scan logs into each host with valid accounts, so it can read the patch level, local permissions, registry, and installed package versions directly. That inside view yields far more accurate results and fewer false positives than probing from the network.

Why the others are wrong. An unauthenticated network scan only sees what an outside probe exposes, so it infers patch state from banners and misses local settings. A passive scan merely watches traffic and cannot enumerate installed software. A TCP port sweep lists open ports but reports nothing about patches, permissions, or software versions.

6. During an authorized engagement a tester tries one common password against every account in the directory rather than many passwords against one account. Which technique is this?

• A. Password spraying
• B. Credential stuffing
• C. Brute force
• D. Rainbow table attack

Correct answer: A. Password spraying reverses the usual ratio: one password, many accounts. It is chosen specifically because lockout policies count failures per account, so a single attempt against each user stays under the threshold.

Why the others are wrong. Credential stuffing replays username and password pairs already stolen from another breach, so the passwords are not guessed. Brute force works through many passwords against one account, which is what triggers lockout. A rainbow table is a precomputed lookup used offline against captured hashes, not an online guessing technique.

7. An engagement is being scoped and the team is drafting the rules of engagement. Which items belong in the ROE rather than the statement of work? (Choose two.)

• A. Authorized testing hours and blackout periods
• B. Total project fee and payment schedule
• C. The vendor's tax identification number
• D. Company logo and marketing terms
• E. Permitted techniques and off-limits actions

Correct answer: A. The ROE defines operational boundaries: when testing may occur and which techniques are allowed or forbidden. Fees, payment terms, and administrative details belong in the SOW or contract, not in the rules of engagement.

Why the others are wrong. The total fee and payment schedule are commercial terms belonging in the SOW or MSA, not the ROE. A tax identification number is a billing detail. A company logo and marketing terms are irrelevant to engagement conduct. None of these three govern how or when testing is performed.

8. During OSINT a tester downloads PDF and Word files from a company's public website and extracts author names, usernames and software versions embedded in the file properties. What is being examined?

• A. Zone transfer
• B. Metadata
• C. Banner grabbing
• D. Certificate pinning

Correct answer: B. Author names, usernames and software versions stored inside a document's file properties are metadata. Harvesting metadata from publicly posted files is a common passive OSINT technique that can expose internal naming and software details.

Why the others are wrong. A zone transfer copies DNS records from a name server, not document properties. Banner grabbing reads a network service's response header from a live host, which requires touching the target. Certificate pinning is a defensive control that ties an app to a specific certificate and has nothing to do with reading file properties.