Free tool · No sign-up needed
6 free, original PBQs for PenTest+ (PT0-003), with the Linux command line and drag-and-drop. Do each task, check it, and read why the answer is right.
Last updated
CompTIA PenTest+
You do each task instead of picking an answer. Every question is explained after you check it, and you get a score at the end.
Take it further in OpenpassAI
OpenpassAI’s practice sessions add performance-based questions, with command-line and network topology tasks, to full timed exams, AI explanations and a readiness score.
The questions
Each one with its scenario and task. Try it above first, then open the explanation.
Question 1 · Matching · Engagement Management
Before a penetration test begins, the client and the testing company sign several documents. A junior tester asks which one answers which question.
Match each description to the document.
The rules of engagement set how the test is carried out: targets, times, and techniques that are allowed or forbidden. The statement of work covers this one engagement’s deliverables, dates and price, under the general terms of the master service agreement. The non-disclosure agreement protects what the testers learn. The written authorization is the client’s signed permission, and without it the same activity is a crime.
Question 2 · Matching · Reconnaissance and Enumeration
You’re building the scan commands for an authorized test, and the scoping notes describe what each scan should do.
Match each option to what it does.
-sS is the SYN scan: it sends the first packet of a connection and never completes it. -sU scans UDP ports. -sV asks open ports what service and version they run, and -O guesses the operating system. -p- scans every port from 1 to 65535 instead of the most common thousand. -Pn skips the check for whether a host is up, which is needed when a firewall drops pings. The option for discovery with no port scan is -sn.
Question 3 · Linux command line · Reconnaissance and Enumeration
A colleague scanned the client’s test network, which is in scope and authorized, and saved the results in Nmap’s grepable format as scan.gnmap in your home directory. Each host has a Status line and a Ports line. You’re choosing what to look at first.
Answer the four questions from the file, using grep.
The grepable format puts each host’s ports on one line, so grep can pick hosts by port: “23/open” finds Telnet, which sends credentials in clear text and is a finding on its own. grep -c counts the matching lines, so counting “445/open” gives the number of hosts offering SMB file sharing, and searching for mysql finds the exposed database.
Question 4 · Sorting · Vulnerability Discovery and Analysis
The test plan lists the tools the team may use. The client’s security lead wants them grouped by purpose before approving the plan.
Put each tool under its main use.
Nmap discovers hosts and open ports, and Nessus and OpenVAS check what they find against databases of known vulnerabilities. Burp Suite and OWASP ZAP sit between the browser and a web application to inspect and replay requests, and sqlmap tests for SQL injection. Hashcat and John the Ripper recover passwords from captured hashes.
Question 5 · Ordering · Attacks and Exploits
During an authorized internal test of a Windows domain, the team plans to show the risk of weak service account passwords with a Kerberoasting attack. The report must describe its stages in the order they happen.
Arrange the six stages from first to last.
Kerberoasting needs only an ordinary domain account to begin. Any domain user can ask for a service ticket, and part of that ticket is encrypted with the service account’s password hash. The tester lists accounts that have a service principal name, requests their tickets and cracks them offline, where no lockout applies. A weak password falls quickly, and the service account often has far more access than the first account did. Long, random service account passwords, or managed service accounts, are the defense.
Question 6 · Matching · Post-exploitation and Lateral Movement
The draft report describes what the team did after its first foothold. Each paragraph needs the correct term as its heading.
Match each description to the term.
Privilege escalation raises the access of the account you already hold. Pass the hash authenticates with a captured hash, with no need to crack it. Pivoting routes traffic through a compromised host to reach networks behind it. Persistence is whatever lets the tester return after a restart. Data exfiltration shows the client what an attacker could have taken, and in a test it is done only with agreed sample data.
CompTIA lists PenTest+ among its certifications with simulation performance-based questions: tasks in an approximation of a real tool, such as a firewall, a network diagram or a terminal window. CompTIA’s page on performance-based questions, read on November 12, 2026.
Guide
CompTIA describes performance-based questions as exam items that test your ability to solve problems in real-world settings. Most are simulations: an approximation of a tool such as a firewall, a network diagram, a terminal window or an operating system.
You don’t pick an answer. You do the task, and there can be more than one correct way to do it.
Try each question cold. Getting it wrong first and then reading why teaches more than reading the answer and nodding along.
A right answer reached by guessing is a wrong answer waiting for exam day. Every question here explains why each part is what it is.
CompTIA says a simulation question can be skipped and returned to later, with your work saved. If one is eating your time, move on, answer the multiple-choice questions and come back.
14 free labs in your browser: Linux and Windows command line, firewall rules and SOHO router setup, checked as you go.
Open the toolFree performance-based questions for 19 CompTIA exams: firewall rules, network diagrams, command-line tasks and drag-and-drop.
Open the toolFree practice tests for 261 popular certification exams, with explanations and a score by exam domain.
Open the toolFAQs
Find quick answers or contact our support team.
Yes. CompTIA lists PenTest+ among its certifications with simulation performance-based questions: tasks in an approximation of a real tool, such as a firewall, a network diagram or a terminal window. That is from CompTIA’s page on performance-based questions, read on November 12, 2026.
No. They’re original tasks written to each exam’s published objectives. Using leaked real exam questions breaks every vendor’s exam rules.
CompTIA says a performance-based question can have more than one correct way through it, that its scoring allows for the different approaches, and that partial credit may be given. Here, each question is scored by its parts, so you can see which part you missed.
CompTIA says a simulation question can be skipped and returned to later, and that your work on it is saved when you move on. A virtual-environment question has to be completed when you reach it: a warning screen tells you so first.
No. It’s a practice terminal that runs in your browser. It understands the real commands the task needs and answers the way the real system would, but it isn’t a full operating system: nothing is installed, and nothing you type can break anything.
No. The questions run in your browser and nothing is saved. Sign up only if you want full practice exams and progress tracking.
OpenpassAI
Hi 👋 I’m OpenpassAI. Ready to prepare for your exam the smarter way?
Ready to explore OpenpassAI? I can show you how the platform helps you prepare, practice, and pass.
