Question bank
Registered Penetration Tester
40 Registered Penetration Tester questions with the correct answer and a written explanation, organised across 4 exam domains.
- 40 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Exploitation and Post-Exploitation
14 questions in this domain
- Question 1Single Choice
What type of XSS stores malicious script permanently on the server?
- AStored XSSCorrect answer
- BReflected XSS
- CDOM-based XSS
- DBlind XSS
Why this is the answer
Stored (persistent) XSS saves the script on the server, affecting any user viewing the page.
- Question 2Multiple Select
Which two protocols are commonly poisoned by Responder for credential capture?
- ALLMNRCorrect answer
- BNBT-NSCorrect answer
- CDNS
- DDHCP
Why this is the answer
Responder poisons LLMNR and NBT-NS (NetBIOS Name Service) to capture authentication attempts.
- Question 3Interactive
What does the following Metasploit command achieve?
- AAdds a route to subnet 192.168.1.0/24 through session 1Correct answer
- BRemoves route to subnet 192.168.1.0/24
- CSets the local IP to 192.168.1.0
- DChanges default gateway to session 1
Why this is the answer
The 'route add' command in Meterpreter instructs MSF to route traffic for the given subnet through the session.
- Question 4Single Choice
Which vulnerability forces an authenticated user to execute unintended actions?
- ACSRFCorrect answer
- BXSS
- CSSRF
- DSQL Injection
Why this is the answer
CSRF (Cross-Site Request Forgery) tricks the victim's browser into sending authenticated requests.
- Question 5Multiple Select
Which two hashes can be extracted from LSASS memory using Mimikatz?
- ANTLM hashCorrect answer
- BKerberos ticketsCorrect answer
- CSHA-512 hash
- DMD5 hash
Why this is the answer
Mimikatz extracts NTLM hashes and Kerberos tickets (e.g., TGT, TGS) from LSASS.
- Question 6Interactive
What does this Hashcat command mode indicate?
- ANTLMCorrect answer
- BNetNTLMv2
- CLM
- DKerberos TGS
Why this is the answer
Hashcat mode 1000 corresponds to NTLM hashes (Windows local hashes).
- Question 7Single Choice
What does SSRF allow an attacker to do?
- AAccess internal services via the serverCorrect answer
- BExecute arbitrary code on the client
- CSteal session cookies from users
- DInject SQL queries into the database
Why this is the answer
SSRF (Server-Side Request Forgery) tricks the server into making requests to internal or external resources.
- Question 8Multiple Select
Which two techniques are used for privilege escalation on Windows?
- AToken impersonationCorrect answer
- BUnquoted service pathsCorrect answer
- CPass-the-Hash
- DLLMNR poisoning
Why this is the answer
Token impersonation and unquoted service paths are local privilege escalation techniques. Pass-the-Hash is lateral movement; LLMNR poisoning is credential harvesting.
- Question 9Interactive
What does the following SSH command accomplish?
- AForwards local port 8080 to internal host's port 80 via the pivotCorrect answer
- BForwards remote port 8080 to attacker's port 80
- CCreates a SOCKS proxy on port 8080
- DStarts an SSH server on port 8080
Why this is the answer
Local port forwarding (-L) tunnels traffic from the attacker's local port to a target host through the SSH connection.
- Question 10Single Choice
Which tool is used to forge Kerberos golden tickets?
- AMimikatzCorrect answer
- BHashcat
- CJohn the Ripper
- DBloodHound
Why this is the answer
Mimikatz's kerberos::golden module creates a golden ticket (forged TGT) for persistent domain admin access.
- Question 11Multiple Select
Which two methods are used for lateral movement in Windows networks?
- APsExecCorrect answer
- BPass-the-HashCorrect answer
- CMimikatz sekurlsa
- DResponder
Why this is the answer
PsExec and Pass-the-Hash are lateral movement methods. Sekurlsa is credential dumping; Responder is network capture.
- Question 12Interactive
What vulnerability does this payload exploit?
- ASQL InjectionCorrect answer
- BXSS
- CCSRF
- DRCE
Why this is the answer
The payload attempts a UNION-based SQL injection to retrieve database information.
- Question 13Single Choice
What is the main purpose of a NOP sled in buffer overflow exploits?
- ATo increase chances of landing on shellcodeCorrect answer
- BTo bypass ASLR
- CTo encode the shellcode
- DTo trigger a crash
Why this is the answer
A NOP sled provides a buffer of no-operation instructions so that even if the jump address is slightly off, execution slides into the shellcode.
- Question 14Multiple Select
Which two defenses block simple stack buffer overflows?
- AASLRCorrect answer
- BDEPCorrect answer
- CUAC
- DFirewall
Why this is the answer
ASLR (Address Space Layout Randomization) and DEP (Data Execution Prevention) are mitigations against buffer overflows.
Information Gathering and Vulnerability Identification
10 questions in this domain
- Question 15Single Choice
What is the primary characteristic of passive reconnaissance?
- AGenerating traffic that is detectable by the target
- BGathering information without directly interacting with target systemsCorrect answer
- CPerforming a full TCP three-way handshake scan
- DSending crafted packets to probe for open ports
Why this is the answer
Passive reconnaissance relies on publicly available information and does not send any packets to the target, making it undetectable.
- Question 16Multiple Select
Which of the following are examples of Open Source Intelligence (OSINT) sources? (Select all that apply)
- AWHOIS recordsCorrect answer
- BNmap SYN scan results
- CSocial media profiles (LinkedIn, Twitter)Correct answer
- DA direct DNS zone transfer
Why this is the answer
OSINT involves collecting publicly available data from sources like WHOIS, social media, and search engines without active probing. A DNS zone transfer is an active technique.
- Question 17Interactive
Analyze the following command output and determine what type of reconnaissance was performed.
- APassive DNS enumeration
- BActive DNS zone transferCorrect answer
- COSINT via Shodan
- DPassive network scanning
Why this is the answer
The command attempts a DNS zone transfer using 'dig axfr', which is an active technique that sends a query to the target's DNS server.
- Question 18Single Choice
Which Nmap scan type sends a SYN packet and does not complete the three-way handshake?
- ATCP connect scan (-sT)
- BSYN scan (-sS)Correct answer
- CUDP scan (-sU)
- DFIN scan (-sF)
Why this is the answer
SYN scan (half-open) sends a SYN packet; if SYN/ACK is received, the port is open, and the scanner sends RST to avoid completing the handshake.
- Question 19Multiple Select
Which of the following are passive reconnaissance techniques? (Select all that apply)
- ASearching Shodan for target IP historyCorrect answer
- BPerforming a DNS zone transfer
- CUsing theHarvester to harvest email addresses from public sourcesCorrect answer
- DRunning an Nmap ping sweep
Why this is the answer
Shodan and theHarvester collect data from public records without sending packets to the target. Zone transfers and ping sweeps are active.
- Question 20Interactive
The following output was obtained from a tool. Identify the tool that produced it.
- ANmap
- BMasscan
- CtheHarvesterCorrect answer
- Ddnsrecon
Why this is the answer
The output shows email addresses and subdomains obtained from search engines and social media, typical of theHarvester.
- Question 21Single Choice
What is the primary purpose of service fingerprinting during a penetration test?
- AIdentify the operating system of the target
- BDetermine the specific software and version running on open portsCorrect answer
- CMap the network topology
- DDiscover hidden subdomains
Why this is the answer
Service fingerprinting identifies the exact application and version, enabling targeted vulnerability searches.
- Question 22Multiple Select
Which of the following statements about DNS enumeration are correct? (Select all that apply)
- APassive DNS enumeration queries authoritative DNS servers for cached records.
- BActive DNS enumeration includes zone transfers and subdomain brute-forcing.Correct answer
- CA zone transfer (AXFR) is always allowed by default.
- DDNS enumeration can reveal mail servers, nameservers, and subdomains.Correct answer
Why this is the answer
Active enumeration involves zone transfers and brute-forcing. Zone transfers are usually blocked. DNS enumeration indeed reveals infrastructure details.
- Question 23Interactive
Review the Nmap command below and choose the option that best describes its function.
- APerform a stealth SYN scan with service version detectionCorrect answer
- BPerform a full TCP connect scan with OS detection
- CExecute a UDP scan with default scripts
- DRun a ping sweep to discover live hosts
Why this is the answer
The command uses -sS (SYN scan) and -sV (version detection) with a timing template of sneaky (T1) to evade detection.
- Question 24Single Choice
What legal document explicitly authorizes a penetration tester to perform active scanning on a target?
- ANon-disclosure agreement (NDA)
- BRules of Engagement (RoE)Correct answer
- CData processing agreement (DPA)
- DVulnerability report
Why this is the answer
The RoE is a signed document that specifies scope, methods, and boundaries, providing legal safe harbor for the tester.
Reporting and Communication
8 questions in this domain
- Question 25Single Choice
What is the primary audience for the executive summary of a penetration test report?
- ANon-technical stakeholders and senior managementCorrect answer
- BSystem administrators and developers
- CExternal auditors only
- DThe penetration testing team itself
Why this is the answer
The executive summary is written for non-technical stakeholders to convey business impact and risk without technical jargon.
- Question 26Multiple Select
Which two elements are essential components of a professional penetration test report?
- AExecutive SummaryCorrect answer
- BRaw tool output in the main body
- CRisk Rating MethodologyCorrect answer
- DPersonal opinions about the client's security posture
Why this is the answer
A professional report must include an executive summary and a clear risk rating methodology; raw output belongs in appendices.
- Question 27Interactive
Based on the code snippet, which report section should contain this type of content?
- AExecutive SummaryCorrect answer
- BTechnical Findings Section
- CAppendices
- DScope and Limitations
Why this is the answer
The code shows a high-level risk statement suitable for non-technical readers, which is part of the executive summary.
- Question 28Single Choice
What does CVSS stand for in the context of vulnerability scoring?
- ACommon Vulnerability Scoring SystemCorrect answer
- BComputer Vulnerability Severity Standard
- CCritical Vulnerability Scoring Scheme
- DComprehensive Vulnerability Security Score
Why this is the answer
CVSS stands for Common Vulnerability Scoring System, a standard for rating vulnerability severity.
- Question 29Multiple Select
Which two metric groups are part of the CVSS v3.x scoring system?
- ABase MetricsCorrect answer
- BTemporal MetricsCorrect answer
- CEnvironmental Metrics
- DOperational Metrics
Why this is the answer
CVSS v3.x includes Base, Temporal, and Environmental metric groups. Two of these are Base and Temporal.
- Question 30Interactive
Given the CVSS vector, what is the Attack Vector (AV) metric value?
- ANetworkCorrect answer
- BAdjacent Network
- CLocal
- DPhysical
Why this is the answer
In the vector 'AV:N', the Attack Vector is Network (N).
- Question 31Single Choice
What is the primary purpose of the technical findings section in a penetration test report?
- ATo provide detailed, reproducible evidence of each vulnerabilityCorrect answer
- BTo summarize business impact for executives
- CTo list raw scan results without analysis
- DTo document the tester's personal observations
Why this is the answer
The technical findings section gives detailed, verifiable evidence and remediation steps for each vulnerability.
- Question 32Multiple Select
Which two elements are characteristic of a well-written executive summary?
- ABusiness impact statementsCorrect answer
- BCVSS vector strings
- CHigh-level risk themesCorrect answer
- DStep-by-step reproduction steps
Why this is the answer
An executive summary contains high-level risk themes and business impact, not technical details like CVSS vectors.
Web Application and API Security Testing
8 questions in this domain
- Question 33Single Choice
Which of the following best describes a SQL Injection vulnerability?
- AAn attacker injects malicious SQL queries through input fields to manipulate a database.Correct answer
- BAn attacker uses cross-site scripting to steal session cookies.
- CAn attacker modifies HTTP headers to bypass authentication.
- DAn attacker sends crafted XML to cause a denial of service.
Why this is the answer
SQL Injection occurs when user input is inserted into SQL queries without proper sanitization, allowing database manipulation.
- Question 34Multiple Select
Which of the following are common techniques used in SQL Injection attacks? (Select all that apply.)
- AError-based injectionCorrect answer
- BBlind injection (boolean/time-based)Correct answer
- CReflected XSS
- DCSRF token manipulation
Why this is the answer
Error-based and blind injection are SQLi techniques; XSS and CSRF are separate attack types.
- Question 35Interactive
Analyze the following code snippet and determine the type of vulnerability it demonstrates.
- ASQL InjectionCorrect answer
- BCommand Injection
- CLDAP Injection
- DBroken Authentication
Why this is the answer
The code concatenates user input directly into a SQL query, leading to SQL Injection.
- Question 36Single Choice
Which OWASP Top 10 category does 'Broken Authentication' primarily belong to?
- AA2 – Broken AuthenticationCorrect answer
- BA1 – Injection
- CA3 – Sensitive Data Exposure
- DA5 – Broken Access Control
Why this is the answer
In the OWASP Top 10, Broken Authentication is categorized as A2.
- Question 37Multiple Select
Which of the following are indicators of weak session management? (Select all that apply.)
- ASession IDs are sequential numbersCorrect answer
- BCookies lack the HttpOnly flagCorrect answer
- CAll API responses include CORS headers
- DSession tokens are regenerated after login
Why this is the answer
Sequential session IDs and missing HttpOnly flag indicate weak management. CORS headers and token regeneration are security measures.
- Question 38Interactive
Examine the following HTTP response header and identify a security misconfiguration.
- AMissing HttpOnly flag on session cookieCorrect answer
- BSecure flag is set unnecessarily
- CSameSite attribute is misconfigured
- DCookie domain is too restrictive
Why this is the answer
The Set-Cookie header lacks the HttpOnly flag, allowing JavaScript access to the session cookie.
- Question 39Single Choice
What is the primary purpose of using parameterized queries in web applications?
- ATo prevent SQL Injection attacksCorrect answer
- BTo improve page load speed
- CTo enable cross-origin requests
- DTo store session identifiers
Why this is the answer
Parameterized queries separate SQL logic from data, preventing injection by treating input as data.
- Question 40Multiple Select
Which of the following are common types of injection attacks? (Select all that apply.)
- ASQL InjectionCorrect answer
- BCommand InjectionCorrect answer
- CLDAP InjectionCorrect answer
- DCross-Site Request Forgery
Why this is the answer
SQL, Command, and LDAP are injection attacks; CSRF is a different category (forged requests).
Frequently asked questions
Everything about the Registered Penetration Tester question bank and how to use it.