Question bank
CompTIA PenTest+
42 CompTIA PenTest+ questions with the correct answer and a written explanation, organised across 5 exam domains.
- 42 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Attacks and Exploits
14 questions in this domain
- Question 1Single Choice
What is SQL injection?
- AAn attack that manipulates backend database queries through unsanitized user inputCorrect answer
- BA client-side attack that executes JavaScript in the browser
- CA network attack that floods a server with traffic
- DA physical attack that uses a malicious USB device
Why this is the answer
SQL injection occurs when unsanitized input is passed to a database interpreter, allowing query manipulation.
- Question 2Multiple Select
Which of the following are recognized categories of Cross-Site Scripting (XSS)?
- AReflected XSSCorrect answer
- BStored XSSCorrect answer
- CDOM-based XSSCorrect answer
- DCommand injection
Why this is the answer
The three recognized XSS categories are Reflected, Stored, and DOM-based XSS.
- Question 3Interactive
Review the code block. What type of vulnerability is present?
- ASQL injectionCorrect answer
- BCross-site scripting
- CCommand injection
- DLDAP injection
Why this is the answer
The query concatenates unsanitized user input directly into a SQL statement, which is SQL injection.
- Question 4Single Choice
What is the main difference between Reflected XSS and Stored XSS?
- AReflected XSS executes transiently after a crafted link is clicked; Stored XSS persists on the server and executes when pages are loadedCorrect answer
- BReflected XSS is a server-side attack; Stored XSS is a client-side attack
- CReflected XSS uses the DOM; Stored XSS uses HTTP headers
- DReflected XSS is an SQL injection technique; Stored XSS is an XSS technique
Why this is the answer
Reflected XSS is transient and requires a crafted link, while Stored XSS is saved on the server and executes for every page load.
- Question 5Multiple Select
Which protocols commonly transmit credentials or data in cleartext?
- ATelnetCorrect answer
- BFTPCorrect answer
- CHTTPCorrect answer
- DSSHv2
Why this is the answer
Telnet, FTP, and HTTP transmit data in cleartext, while SSHv2 provides encrypted communication.
- Question 6Interactive
What is the primary purpose of this command?
- AList NFS exports from a remote hostCorrect answer
- BPerform a DNS zone transfer
- CEnumerate SMB shares
- DInitiate a WPA2 handshake capture
Why this is the answer
The showmount -e command lists exported NFS shares from a remote host.
- Question 7Single Choice
What is banner grabbing used for in a penetration test?
- AIdentifying software versions and services running on open portsCorrect answer
- BCracking password hashes offline
- CExploiting a buffer overflow
- DCloning RFID badges
Why this is the answer
Banner grabbing is used to identify running services and versions for matching known vulnerabilities.
- Question 8Multiple Select
Which of the following are examples of network service misconfigurations?
- ADefault SNMP community stringsCorrect answer
- BPermissive DNS zone transfersCorrect answer
- CSMB signing enforced
- DEncrypted SSHv2 in use
Why this is the answer
SNMP community strings and open DNS zone transfers are common misconfigurations; SMB signing and SSHv2 are security controls.
- Question 9Interactive
What is the purpose of this hashcat command?
- ACrack NTLM hashes offlineCorrect answer
- BPerform password spraying
- CCapture a WPA2 handshake
- DEnumerate SQL injection vulnerabilities
Why this is the answer
Hashcat is an offline password cracking tool; module 5600 targets NTLM hashes.
- Question 10Single Choice
Which statement best describes password spraying?
- ATrying one common password against many usernamesCorrect answer
- BTrying many passwords against a single username
- CUsing a list of known username-password pairs
- DHarvesting password hashes from memory
Why this is the answer
Password spraying uses one common password across many accounts to avoid account lockout.
- Question 11Multiple Select
Which Active Directory attacks rely on offline cracking of Kerberos ticket material?
- AKerberoastingCorrect answer
- BAS-REP roastingCorrect answer
- CPass-the-hash
- DCredential stuffing
Why this is the answer
Kerberoasting and AS-REP roasting retrieve Kerberos ticket material for offline cracking.
- Question 12Interactive
What type of password attack is shown in this loop?
- APassword sprayingCorrect answer
- BCredential stuffing
- CBrute-force attack
- DPass-the-hash
Why this is the answer
The same password is tried against many usernames, which is the definition of password spraying.
- Question 13Single Choice
Which description best matches spear phishing?
- ATargeted attack customized for a specific person using reconnaissanceCorrect answer
- BMass email sent to thousands of random users
- CAttack that requires no user interaction
- DTechnique for cracking NTLM hashes
Why this is the answer
Spear phishing uses reconnaissance to craft a targeted message for a specific individual.
- Question 14Multiple Select
Which options are examples of client-side attack techniques?
- ASpear phishingCorrect answer
- BWatering hole attackCorrect answer
- CCredential harvesting portalCorrect answer
- DNetwork port scanning
Why this is the answer
Spear phishing, watering holes, and credential harvesting target users or client-side interactions.
Engagement Management
6 questions in this domain
- Question 15Single Choice
What is the primary purpose of a Rules of Engagement document in a penetration testing engagement?
- ADefines legal and operational boundariesCorrect answer
- BLists all discovered vulnerabilities
- CProvides a remediation plan
- DReplaces written authorization
Why this is the answer
The Rules of Engagement is the definitive agreement defining permissions, limitations, timing, contacts, and protocols for the assessment.
- Question 16Multiple Select
Which of the following are typically included in the scope definition of a penetration test? (Select all that apply.)
- AAuthorized IP addresses and domainsCorrect answer
- BExplicitly excluded systems and applicationsCorrect answer
- CClient budget and profit margins
- DMarketing communication templates
Why this is the answer
Scope defines authorized targets and exclusions, such as IPs, domains, physical locations, applications, and social engineering vectors. Budget is a separate constraint.
- Question 17Interactive
Based on the engagement excerpt, which required element must be verified before intrusive testing can begin?
- ASigned Rules of EngagementCorrect answer
- BVulnerability scanner selection
- CExploit code repository
- DExecutive report template
Why this is the answer
The excerpt lists scope, window, and contact, but no formal sign-off. Signed authorization is required before any intrusive testing begins.
- Question 18Single Choice
Which document defines the overarching legal terms, liability limits, and general conditions between the testing firm and the client?
- AMaster Services AgreementCorrect answer
- BStatement of Work
- CRules of Engagement
- DGet-Out-of-Jail-Free letter
Why this is the answer
The MSA governs the overall business relationship, liability limits, and general conditions, while an SoW specifies targets and schedule.
- Question 19Multiple Select
Which of the following situations require formal written authorization before a penetration tester may proceed? (Select all that apply.)
- AExpanding scope to newly discovered subdomainsCorrect answer
- BTesting third-party hosted endpointsCorrect answer
- CScanning CIDR ranges listed in the SoW
- DUsing the approved exploitation framework
Why this is the answer
Any scope expansion or testing of third-party assets requires formal written authorization; existing SoW targets and approved tools are already permitted.
- Question 20Interactive
A tester runs the command shown in the exhibit during business hours. The RoE restricts active scanning to 2 AM-5 AM. What should the tester do first?
- AStop scanning and consult the Rules of EngagementCorrect answer
- BContinue scanning because the target is in scope
- CIncrease the scan timeout to reduce impact
- DExclude the out-of-scope third-party host
Why this is the answer
Active scanning outside authorized hours violates the Rules of Engagement. The tester must halt and follow the documented operational constraints.
Post-Exploitation and Lateral Movement
6 questions in this domain
- Question 21Single Choice
Which statement best describes the goal of maintaining persistent access during the post-exploitation phase of a penetration test?
- AContinued access after reboots or credential changesCorrect answer
- BInitial exploitation of a vulnerability
- CUsing Mimikatz to dump credentials
- DRunning a vulnerability scanner on the target
Why this is the answer
Persistence focuses on maintaining access after reboots, password changes, or defense updates, not on initial access or credential dumping.
- Question 22Multiple Select
Which of the following are recognized persistence mechanisms used to maintain access after a system reboot? Select all that apply.
- AModifying Windows Registry Run keysCorrect answer
- BCreating scheduled tasksCorrect answer
- CDeploying a web shellCorrect answer
- DOne-time SQL injection
Why this is the answer
Registry Run keys, scheduled tasks, and web shells all provide continued access. One-time SQL injection establishes initial access, not persistence.
- Question 23Interactive
What type of persistence mechanism is being configured by the commands in the code block shown below?
- AWindows service manipulationCorrect answer
- BScheduled task creation
- CWeb shell deployment
- DRegistry Run key modification
Why this is the answer
The sc.exe commands alter a Windows service binary path and start it, demonstrating service manipulation for persistence.
- Question 24Single Choice
Which Linux-based native utility is commonly used to schedule persistent jobs at defined intervals or system events?
- AcronCorrect answer
- BTask Scheduler
- Csc.exe
- Dwevtutil
Why this is the answer
cron is the standard Linux scheduler for recurring or event-based jobs. Task Scheduler and sc.exe are Windows tools.
- Question 25Multiple Select
Which Windows mechanisms can be configured to launch a program automatically when a user logs on? Select all that apply.
- ARegistry Run keysCorrect answer
- BStartup folderCorrect answer
- CScheduled TasksCorrect answer
- D/etc/rc.local
Why this is the answer
Registry Run keys, Startup folders, and Scheduled Tasks can run payloads at logon. /etc/rc.local is Linux-specific.
- Question 26Interactive
When performing privilege escalation on Linux, what is the primary purpose of the command shown in the code block?
- AFind SUID binariesCorrect answer
- BEnumerate running services
- CShow current user groups
- DList writable directories
Why this is the answer
The find command searches for files with the SUID bit set, a key Linux privilege escalation enumeration step.
Reconnaissance and Enumeration
9 questions in this domain
- Question 27Single Choice
Which activity is classified as passive reconnaissance using open-source intelligence to avoid direct interaction with the target?
- AQuerying Shodan for indexed bannersCorrect answer
- BRunning an Nmap SYN scan
- CBanner grabbing with Netcat
- DProbing target with Gobuster
Why this is the answer
Shodan is a passive search engine that indexes previously collected banner data. Direct scanning tools like Nmap, Netcat, and Gobuster actively touch the target.
- Question 28Multiple Select
Which two statements accurately describe passive reconnaissance using OSINT and its effect on target perimeter defenses?
- AIt involves zero direct target interactionCorrect answer
- BIt is undetectable by target perimeter defensesCorrect answer
- CIt generates logs on target firewalls
- DIt requires completing TCP handshakes
Why this is the answer
Passive reconnaissance involves zero direct interaction and is undetectable by target defenses. The other statements describe active techniques that create target-side logs.
- Question 29Interactive
Review the provided command block and identify the scanning technique being executed by the Nmap utility.
- ATCP SYN stealth scanCorrect answer
- BTCP Connect scan
- CUDP port scan
- DACK firewall mapping
Why this is the answer
The -sS flag sends a SYN packet and waits for a response without completing the handshake, making it a TCP SYN stealth scan.
- Question 30Single Choice
In Nmap output, what does the port state 'filtered' indicate about the target's response to probes?
- AA firewall or filter is blocking probesCorrect answer
- BThe port is closed
- CA service is actively listening
- DThe host is offline
Why this is the answer
A filtered state means a firewall or filter is preventing the probe from reaching the service. Closed ports return resets, open ports accept connections.
- Question 31Multiple Select
Which two tools are correctly categorized as passive OSINT gathering utilities during initial penetration testing?
- AtheHarvesterCorrect answer
- BShodanCorrect answer
- CGobuster
- DNetcat
Why this is the answer
theHarvester queries public sources for emails and subdomains, while Shodan indexes exposed services. Gobuster and Netcat actively interact with targets.
- Question 32Interactive
Review the provided command block and determine which DNS operation the command attempts to perform.
- AZone transferCorrect answer
- BReverse DNS lookup
- CMX record query
- DDNS cache poisoning
Why this is the answer
The axfr option requests a full zone transfer from the nameserver, which can reveal internal hostnames if misconfigured.
- Question 33Single Choice
Which statement best describes active reconnaissance during a penetration test engagement with the target network?
- AIt directly interacts with target systemsCorrect answer
- BIt relies on cached third-party data
- CIt avoids generating network traffic
- DIt only uses search engines
Why this is the answer
Active reconnaissance consists of direct packet-level interaction with target systems, while passive methods rely on third-party and public data.
- Question 34Multiple Select
Which two statements correctly pair Nmap scan types with their underlying network packet transmission and handshake mechanisms?
- ATCP Connect scan completes a full handshakeCorrect answer
- BSYN scan sends SYN and infers from replyCorrect answer
- CSYN scan completes the full handshake
- DUDP scan is fast and highly reliable
Why this is the answer
TCP Connect scans complete the full three-way handshake; SYN scans send an initial packet and infer states from the response. UDP scans are slower.
- Question 35Interactive
Review the provided command block and identify the tool being used to query DNS records.
- AdigCorrect answer
- BNmap
- CtheHarvester
- DMaltego
Why this is the answer
The command begins with dig, a standard DNS enumeration utility used to query records like MX, A, TXT, and NS.
Vulnerability Discovery and Analysis
7 questions in this domain
- Question 36Single Choice
During a penetration test, which statement best describes the primary characteristic of credentialed vulnerability scanning?
- AAuthenticates to target hosts for internal checks.Correct answer
- BInspects only external services and banners.
- CInjects crafted packets to map open ports.
- DMonitors network traffic passively.
Why this is the answer
Credentialed scans authenticate to target hosts, providing deep visibility into patches, local configurations, and permissions that non-credentialed scans cannot see.
- Question 37Multiple Select
Which two statements accurately describe the differences between passive and active vulnerability scanning methodologies in a network environment?
- AActive scans transmit packets that can disrupt fragile systems.Correct answer
- BPassive scans observe traffic without injecting packets.Correct answer
- CPassive scans send crafted payloads to verify vulnerabilities.
- DActive scans are always stealthier than passive scans.
Why this is the answer
Active scans generate traffic and can destabilize fragile systems, while passive scans monitor existing traffic without injecting packets; the other statements are incorrect.
- Question 38Interactive
Based on the Python code snippet in the code block, which vulnerability category is exhibited by the database query?
- ASQL InjectionCorrect answer
- BBroken Authentication
- CSecurity Misconfiguration
- DInsecure Deserialization
Why this is the answer
The code concatenates untrusted user input directly into a SQL statement, allowing attackers to manipulate the query; this is classic SQL injection.
- Question 39Single Choice
Which statement best describes the Common Weakness Enumeration (CWE) framework in the context of vulnerability discovery and analysis?
- ATop 10 web application risks list
- BDictionary of software and hardware weaknessesCorrect answer
- CCommercial vulnerability scanning tool
- DEnterprise patch management framework
Why this is the answer
CWE is a community-developed dictionary and taxonomy of software and hardware weakness types, providing standardized language for describing security flaws.
- Question 40Multiple Select
Which two statements correctly match Nessus, OpenVAS, and Qualys with their deployment model characteristics in automated scanning?
- AOn-premises and extensible via pluginsCorrect answer
- BCloud-native SaaS with lightweight agentsCorrect answer
- COnly available as commercial cloud product
- DUse identical plugin feeds and updates
Why this is the answer
Nessus is commonly deployed on-premises, while Qualys is a cloud-native SaaS platform; OpenVAS is open source, and the scanners do not share identical feeds.
- Question 41Interactive
What attack pattern is indicated by the encoded request shown in the access log code block?
- ASQL injectionCorrect answer
- BCross-site scripting
- CRemote code execution
- DDirectory traversal
Why this is the answer
The encoded OR '1'='1 pattern in the username parameter is a classic SQL injection attempt.
- Question 42Single Choice
In vulnerability scanning, how is a false positive defined when analyzing the output of an automated scanner?
- AAlert on vulnerability that does not existCorrect answer
- BVulnerability exists but scanner misses it
- CConfirmed exploit producing a reverse shell
- DHigh-severity finding without available patch
Why this is the answer
A false positive is a scanner alert for a vulnerability that is not actually present in the target environment; a missed issue is a false negative.
Frequently asked questions
Everything about the CompTIA PenTest+ question bank and how to use it.