CompTIA PenTest+ Practice Test

A penetration test must comply with PCI DSS requirements. Which scoping consideration is critical?

You’re reviewing a Bash script used in a pen test. Which command identifies a potential command injection flaw?

A client requests a report tailored for non-technical executives. Which section should you prioritize?

You’re tasked with exploiting a web app via cross-site scripting (XSS). Which payload tests for reflected XSS?

A scan reveals an open port 445 on a Windows host. Which command confirms if SMB is exploitable?

You need to analyze a Python script for potential vulnerabilities. Which tool identifies insecure coding practices?

After a penetration test, you identify a critical vulnerability. Which report section should detail steps to fix it?

A web server is vulnerable to SQL injection. Which payload tests for this without modifying data?

You’re conducting passive reconnaissance on a target. Which tool retrieves historical DNS records without alerting the target?

A client requires a penetration test but prohibits testing during business hours. Which document should you update to reflect this constraint?

Before beginning a penetration test, which document should explicitly define what actions are authorized, the testing window, and provide legal protection for the tester against prosecution for the agreed-upon activities?

A client wants a penetration test conducted with zero prior knowledge given to the testing team about internal systems or architecture, simulating an external attacker with no insider information. Which testing approach does this describe?

A client wants the testing team to have full access to network diagrams, source code, and credentials before beginning the engagement, to maximize testing depth within a limited timeframe. Which testing approach does this describe?

Which scoping consideration is critical when a penetration test target includes third-party cloud infrastructure, such as AWS or Azure resources, rather than solely on-premises systems?

Which type of engagement specifically tests an organization's detection and response capabilities without prior knowledge by the internal security team (blue team) that a test is occurring?

During a penetration test, a tester discovers evidence suggesting an active, unrelated compromise by a real malicious actor already present in the environment. What is the most appropriate immediate action?

Which contractual document specifically limits a penetration testing firm's financial liability in the event that testing activities inadvertently cause damage or disruption to the client's systems?

Which scoping element specifically defines the physical or logical systems, IP ranges, and applications that are explicitly excluded from testing, even if they might otherwise be reachable during the engagement?

A client requests that the penetration test be conducted using techniques and tools consistent with a specific compliance framework's testing requirements, such as PCI DSS. Which engagement management consideration does this represent?

Which type of penetration testing engagement specifically evaluates an organization's physical security controls, such as attempting to gain unauthorized physical access to a facility?

Which reconnaissance technique involves gathering information about a target using publicly available sources, such as social media, WHOIS records, and job postings, without directly interacting with the target's systems?

Which Nmap scan type sends TCP packets with the SYN flag set but never completes the three-way handshake, making it a fast and relatively stealthy method of identifying open ports?

Which Nmap scan technique is specifically used to help determine whether a stateful firewall is filtering traffic to a specific port, by analyzing the response to an ACK packet sent without an initial SYN?

Which DNS enumeration technique attempts to systematically guess and query common subdomain names, such as 'mail' or 'vpn,' to discover additional attack surface associated with a target domain?

Which DNS misconfiguration, if present, would allow a penetration tester to request an entire copy of a domain's DNS zone file in a single query, potentially revealing significant internal infrastructure details?

Which enumeration technique specifically targets the Server Message Block (SMB) protocol on Windows systems to identify shared folders, user accounts, and other information without authenticating?

During banner grabbing against a web server, a tester notices the server discloses a specific, outdated web server software version in its HTTP response headers. Which risk does this specific finding represent?

Which enumeration approach would a tester use to identify running services and their versions on open ports, going beyond simply knowing a port is open?

Which technique would a tester use to identify the operating system running on a target host based on subtle differences in how the host's TCP/IP stack responds to specially crafted packets?

A tester wants to enumerate valid usernames on a target web application's login page by observing subtle differences in error messages or response times between valid and invalid usernames. Which technique does this describe?

Which reconnaissance activity involves reviewing a target organization's publicly posted job listings to infer details about their internal technology stack, such as specific software or programming languages mentioned in required skills?

Which enumeration technique specifically targets Active Directory environments to identify user accounts, group memberships, and trust relationships, often using a tool such as BloodHound?

Which passive wireless reconnaissance technique involves capturing wireless traffic to identify SSIDs, encryption types, and connected client devices without transmitting any packets that could alert the target network?

Which cloud reconnaissance technique involves searching for publicly accessible, misconfigured cloud storage buckets that may inadvertently expose sensitive data?

Which technique would a tester use to enumerate valid API endpoints of a target web application, beyond what is documented in publicly available API documentation?

Which reconnaissance technique specifically searches historical, cached, or archived versions of a target's website to uncover information that may have since been removed from the live site?

Which technique would a tester use to identify email addresses and naming conventions used by employees at a target organization, useful for later phishing or password-guessing attacks?

A vulnerability scanner reports a critical vulnerability on a target system, but manual verification shows the specific vulnerable feature is not actually enabled or exploitable in this configuration. Which result classification applies?

Which type of vulnerability scan is performed using valid credentials on the target system, providing deeper visibility into missing patches and local misconfigurations than an unauthenticated scan?

Which vulnerability scanning approach specifically targets Industrial Control Systems (ICS) and must account for the risk that aggressive, standard scanning techniques could disrupt sensitive operational technology processes?

Which practice involves analyzing an application's source code directly, without executing it, to identify potential security vulnerabilities such as hardcoded credentials or insecure function calls?

Which vulnerability discovery technique involves reviewing Infrastructure as Code (IaC) templates, such as Terraform files, for security misconfigurations before the described infrastructure is actually provisioned?

Which vulnerability scoring system provides a standardized numerical score, typically from 0 to 10, that a penetration tester would reference to help prioritize which discovered vulnerabilities to attempt exploiting first?

A vulnerability scan fails to identify a vulnerability that a manual test later confirms is genuinely present and exploitable on the target system. Which result classification applies to the scanner's missed finding?

Which practice involves manually reviewing and interpreting the raw output of automated vulnerability scanning tools to distinguish genuine findings from noise, and to add context the automated tool cannot provide?

Which consideration must a tester evaluate to determine whether a vulnerability scan achieved reasonable coverage of the intended target scope, rather than missing significant portions due to scan configuration issues?

Which vulnerability analysis technique involves reviewing publicly available exploit code or proof-of-concept repositories to assess whether a reliable, working exploit exists for a specific discovered vulnerability?

Which vulnerability discovery technique is specifically applied to mobile applications, examining the compiled application package for hardcoded secrets, insecure data storage, or insufficient certificate pinning?

Which technique would a tester use to identify vulnerabilities in a web application by intercepting and manipulating HTTP requests and responses between the browser and the server, such as with a tool like Burp Suite?

Which vulnerability analysis consideration applies specifically to a discovered vulnerability affecting a legacy system that cannot be patched due to vendor end-of-life status, requiring an alternative approach in the final report?

Which port mirroring technique would a tester use to passively capture and analyze network traffic on a switch, without needing to compromise any individual host directly?

Which attack technique involves an attacker sending forged ARP messages on a local network to associate their own MAC address with the IP address of the default gateway, enabling traffic interception?

Which attack technique exploits weaknesses in VLAN trunk negotiation or uses double 802.1Q tagging to allow a tester to send or receive traffic on VLANs they should not otherwise have access to?

Which attack sets up a rogue DHCP server on a network to respond to client DHCP requests before the legitimate server, allowing the attacker to assign a malicious default gateway or DNS server to victim clients?

Which relay attack technique captures an NTLM authentication attempt from a victim and relays it in real time to another target system, potentially gaining unauthorized access without ever cracking the actual password hash?

Which attack technique uses a stolen NTLM password hash directly to authenticate to a system, without ever needing to know or crack the actual plaintext password?

Which attack technique floods a target server with numerous TCP SYN packets without completing the three-way handshake, exhausting the server's connection table and denying service to legitimate users?

Which injection attack involves a tester inserting malicious SQL statements into an application's input field to manipulate the underlying database query, potentially extracting unauthorized data?

Which injection attack exploits an application's XML parser to reference external entities, potentially allowing an attacker to read local files or perform server-side request forgery?

Which attack technique allows a tester to inject malicious client-side script into web content viewed by other users, executing in their browsers within the trusted context of the vulnerable site?

Which attack technique tricks a server into making unauthorized requests to internal or restricted resources on behalf of the attacker, exploiting an application's server-side request functionality?

Which attack technique tricks an authenticated user's browser into unknowingly submitting a malicious request to a site where the user is currently logged in, without the user's knowledge or consent?

Which attack technique manipulates file path input to access files and directories outside of an intended restricted directory, such as reading a web server's configuration file or password file?

Which wireless attack sets up a malicious access point mimicking the SSID and configuration of a legitimate network, tricking users into connecting so their traffic can be intercepted?

Which wireless attack forcibly disconnects a client from a legitimate access point by sending spoofed deauthentication frames, often used to capture a fresh WPA handshake for offline password cracking?

Which cloud-specific attack technique attempts to access a cloud instance's metadata service (such as 169.254.169.254) to steal temporary IAM credentials, often chained with a Server-Side Request Forgery vulnerability?

Which authentication attack systematically attempts a list of known, previously breached username/password pairs against a target login page, exploiting users who reuse passwords across multiple services?

Which attack technique captures a wireless network's WPA/WPA2 four-way handshake and then attempts to crack the pre-shared key offline using a dictionary or brute-force approach?

Which social engineering attack technique specifically targets a small, carefully selected group of high-value individuals within an organization, using highly personalized and researched pretexts, as opposed to a broad, generic phishing campaign?

Which local privilege escalation technique on a Windows system exploits a service configured to run with elevated privileges but with a modifiable executable path or weak file permissions?

Which physical social engineering technique involves an attacker following an authorized person through a secured door without providing their own credentials, exploiting simple human courtesy?

Which emerging AI-related attack technique crafts malicious input specifically designed to manipulate a generative AI system into ignoring its original instructions and performing an unintended, potentially harmful action?

Which local exploitation technique on a Linux system involves finding a SUID (Set User ID) binary that can be leveraged to execute arbitrary commands with the elevated privileges of the binary's owner?

Which physical attack technique involves connecting a small, inconspicuous hardware device between a keyboard and computer to covertly capture keystrokes, including passwords, typed by the victim?

Which attack technique attempts to escape the isolation boundary of a container to gain access to the underlying host operating system, often exploiting a misconfigured privileged container or a kernel vulnerability?

Which attack technique specifically targets weaknesses in a REST API's authorization logic, such as manipulating an object identifier in a request to access another user's data (an IDOR-style flaw)?

Which exploitation technique targets weaknesses in how a Kubernetes cluster's Role-Based Access Control (RBAC) is configured, potentially allowing a compromised pod to escalate privileges within the cluster?

Which attack technique exploits an application's insecure deserialization of untrusted data, potentially allowing an attacker to execute arbitrary code by crafting a malicious serialized object?

Which exploitation technique targets weaknesses in the OAuth 2.0 authorization flow, such as manipulating a redirect URI to steal an authorization code or access token intended for a legitimate application?

After gaining initial access to a host, which technique would a tester use to maintain access across reboots, ensuring their foothold persists even if the initial exploited service is restarted?

Which technique would a tester use to move from an initially compromised host to another system on the network, using harvested credentials or exploiting a trust relationship?

Which post-exploitation technique involves increasing a tester's level of access on an already-compromised system, such as moving from a standard user account to full administrator or root privileges?

Which technique would a tester use to extract cached credentials, such as plaintext passwords or hashes, from a compromised Windows system's memory, often using a tool like Mimikatz?

Which post-exploitation activity involves collecting and exfiltrating sample data from a compromised system to demonstrate real business impact to the client, within the boundaries defined by the Rules of Engagement?

Which technique would a tester use to pivot their network access through an already-compromised host, using it as a relay to reach otherwise unreachable internal network segments?

After completing all planned attack activities, which action must a tester take to ensure no persistent backdoors, tools, or artifacts are left behind on client systems?

Which lateral movement technique specifically abuses Windows Management Instrumentation (WMI) or PsExec-style remote execution to run commands on other systems using already-harvested credentials?

Which post-exploitation technique involves an attacker forging a Kerberos ticket-granting ticket to impersonate any user in an Active Directory domain, including a domain administrator, after compromising the domain's krbtgt account hash?

Which activity should a tester perform throughout post-exploitation to ensure all actions taken, commands executed, and systems accessed are accurately recorded for the final report and for legal/evidentiary purposes?

Which post-exploitation consideration is uniquely important when lateral movement activities risk impacting a fragile, safety-critical Industrial Control System (ICS) device discovered on the network during an engagement?