Free CompTIA PenTest+ Sample Questions

Correct answer: D — Exclude them, because the provider is responsible for infrastructure beneath the guest operating system and only it can authorize testing.

• A. Paying for instances does not transfer ownership of the underlying infrastructure. The provider operates and secures the hosts, so the client cannot grant permission to test them.
• B. Authorization must come from whoever owns the asset. A letter from the client cannot cover systems belonging to the cloud provider, no matter how thoroughly it is worded.
• C. The provider's management plane is part of its own infrastructure and is not opened to customer testing. This claim reverses the model by assigning the most provider-controlled layer to the customer.
• D. Under the shared responsibility model the provider secures the physical and virtualization layers, while the customer secures the guest OS, applications, and configuration. Testing is limited to the customer's layer and any provider testing policy.

Correct answer: C — Stop examining the content, leave it unaltered, and promptly notify the designated client contact and the authorities as the law requires.

• A. Deleting suspected illegal content destroys evidence and exceeds the authorized test cases. The tester must not alter the material, even with good intentions.
• B. Confidentiality terms do not override mandatory reporting obligations. Waiting until the final report delays a legal duty that is triggered by the discovery itself.
• C. Some discoveries carry mandatory reporting requirements that an NDA cannot waive. Halting, preserving the material untouched, and reporting protects the tester from allegations of possession or tampering.
• D. Copying suspected illegal material onto the tester's own system creates serious legal risk for the tester. Delaying notification also compounds that risk instead of reducing it.

Correct answers: A, B — Maximum tolerable downtime and recovery time objectives for each business process that depends on affected systems; Relative criticality ratings of the systems and data that support revenue-generating or regulated business processes

• A. Correct. Tolerable downtime and recovery objectives show how quickly an outage hurts the business, so findings on systems with tight limits rise in priority.
• B. Correct. BIA criticality ratings tie each system to revenue or regulated processes, letting findings on the most critical assets be fixed first.
• C. Incorrect. Operating system version inventories describe technical assets and patch levels but are not a BIA output and say nothing about business consequence.
• D. Incorrect. Available exploit modules describe attacker capability, which affects likelihood, not the business impact that a BIA quantifies.
• E. Incorrect. Contributor names are report metadata used for accountability and have no bearing on how critical an affected business process is.

Correct answer: A — Threat modeling, where critical business assets and likely attacker profiles are identified and used to prioritize attack paths

• A. PTES places threat modeling directly after intelligence gathering; it uses the gathered data to identify high-value assets and relevant threat actors before testing begins.
• B. Vulnerability analysis comes after threat modeling and focuses on discovering and validating weaknesses, not on ranking assets and attacker profiles.
• C. Post exploitation happens after access has been obtained and evaluates the value of compromised systems, so it cannot precede scanning.
• D. Pre-engagement interactions occur before intelligence gathering and settle scope and rules; by this point those items have already been agreed.

Correct answer: D — Convert queries to parameterized statements with server-side validation, and meanwhile add a WAF rule and cut the database account's privileges

• A. Injection flaws come from how untrusted input is combined with queries, and NoSQL stores have injection variants of their own. Switching databases without fixing the input handling does not resolve the issue.
• B. Client-side filtering is trivially bypassed by sending requests directly to the server. It cannot be relied upon as a security control.
• C. A WAF rule is only a compensating control that signatures and encoding tricks can bypass. Marking the finding resolved hides the underlying flaw that still needs a code fix.
• D. Parameterized queries remove the root cause, while the WAF rule and least-privilege account limit exposure until the fix ships. Pairing a permanent fix with interim compensating controls is sound remediation guidance.

Correct answer: B — Adopt a secure software development life cycle that adds threat modeling, secure coding standards, automated SAST and dependency scanning, and peer review gates.

• A. Late external testing finds defects after they are written and does not change how the team builds software. The recurring pattern would continue between tests.
• B. A secure SDLC moves security into requirements, design, coding and review, so defect classes are prevented earlier and consistently. This addresses the recurring root cause rather than individual bugs.
• C. Hardening developer workstations reduces the risk of tampering with the build environment but has no influence on the quality of the code the developers write.
• D. RBAC on production limits who can deploy changes, which is a sound governance step. It does not prevent insecure code from being written in the first place.

Correct answer: A — It keeps harvested hosts, contacts, and credentials for one engagement in a separate database so results never mix

• A. Each Recon-ng workspace has its own database and settings, so data collected for one client stays isolated from other engagements.
• B. Workspaces are logical data containers. Modules still make normal outbound requests to the third-party services they query.
• C. API keys are stored in a keys database that is separate from workspaces, and workspaces do not encrypt anything.
• D. Recon-ng does not enforce a CIDR scope per workspace. Scope control is the tester's responsibility, using the seed records they insert.

Correct answer: B — Replace `-eq` with `-like 'Windows Server*'` so the trailing wildcard matches the full edition and version text

• A. Incorrect: `-ceq` is still an exact comparison, only case-sensitive, so the longer stored string would still fail to match.
• B. Correct: `-eq` requires an exact full-string match, while `-like` with a trailing wildcard accepts any edition suffix.
• C. Incorrect: casting a descriptive string to `[int]` throws a conversion error, and it would not select servers by name anyway.
• D. Incorrect: `Select-Object` chooses properties and does not filter objects, so it would return every computer in the directory.

Correct answers: C, D — Call `line.strip()` on each wordlist entry in Python before the path is appended to the base URL of the request; Convert the file with `dos2unix` or `tr -d '\r'` before the Bash loop reads the entries, then rerun the scan

• A. Incorrect: a POST does not move the path into the body; the request line still contains the bad character and the server still returns 404.
• B. Incorrect: a header affects bot detection, not the malformed path, so the resource would still be requested with a trailing `%0D`.
• C. Correct: `strip()` removes the trailing carriage return and newline so the request path matches the real resource.
• D. Correct: converting CRLF line endings to LF removes the stray `\r` before the loop variable ever contains it.
• E. Incorrect: percent-encoding keeps the carriage return in the path as `%0D`, which is exactly the broken request being sent.

Correct answer: B — Querying certificate transparency logs and public DNS datasets for hostnames tied to the client's registered domains

• A. Incorrect. A slow timing template reduces noise but every SYN probe still reaches the client's hosts, so it is active reconnaissance and breaks the restriction.
• B. Correct. Certificate transparency logs and third-party DNS datasets are maintained by others, so the tester collects hostnames without sending a single packet to the client.
• C. Incorrect. Crafted ICMP echo requests are delivered to the client's routers, which makes this active reconnaissance regardless of how little traffic is sent.
• D. Incorrect. Opening a TCP connection with Netcat and reading headers is banner grabbing, an active technique that contacts the client's server directly.

Correct answer: C — Record it as information disclosure from verbose error handling and use the framework version and paths to research targeted flaws

• A. Incorrect. A missing page is not an authorization failure, and the trace appears because debug output is enabled, not because access control was broken.
• B. Incorrect. A query fragment in an error is not proof of injection; no attacker-controlled input was shown to alter the query.
• C. Correct. Verbose errors that reveal versions, paths and query structure are information disclosure, and the details narrow later vulnerability research.
• D. Incorrect. The trace names application framework paths, so the application generated it, not a load balancer.

Correct answer: D — Search the downloaded JavaScript bundles and any exposed source maps for key-like strings, since client code ships to every visitor

• A. Incorrect because certificates contain names and public keys, never application API keys.
• B. Incorrect because SPF TXT records name authorized mail senders and hold no API tokens.
• C. Incorrect because robots.txt lists crawler directives and paths, not stored credentials.
• D. Correct because anything bundled into client-side code is downloadable by anyone, and keys embedded in scripts or source maps can be found by pattern matching.

Correct answer: C — Run Grype against the image or its SBOM so installed package versions are matched to published vulnerability data

• A. Incorrect. BloodHound analyzes Active Directory relationships and has no function for matching image packages to CVEs.
• B. Incorrect. kube-hunter hunts for weaknesses in Kubernetes clusters, not CVEs in the packages inside one container image.
• C. Correct. Grype is a software composition analysis tool that inventories packages in an image or SBOM and matches them against vulnerability databases without needing source code.
• D. Incorrect. Nikto tests a running web server for outdated software and dangerous files; it does not inventory the packages baked into an image.

Correct answer: A — Review the source to see exactly what it executes, remove any hardcoded callback addresses, and test it first on an isolated lab replica

• A. Public code may contain hardcoded addresses or extra functionality, so reading it and testing on a replica prevents data leakage, instability, or actions outside the rules of engagement.
• B. A Verified marker only indicates that the exploit worked as described; it does not guarantee safety or absence of side effects on the client's own environment.
• C. Uploads to public analysis services are generally visible to other users, which could disclose client details and does not substitute for reviewing the code.
• D. Building tools on the client's system alters the target and leaves artifacts, and compiling in a controlled lab produces the same behavior.

Correct answer: B — A firewall or filter dropped the probes or answered with ICMP unreachable, so open versus closed cannot be determined

• A. A SYN/ACK response is what Nmap reports as open, not filtered.
• B. Filtered means Nmap cannot tell whether the port is open because packet filtering prevents the probes from reaching it, typically shown as no response or an ICMP unreachable. This matters for completeness because filtered ports may hide services.
• C. A RST reply is how Nmap identifies a closed port, so the state is the opposite of filtered.
• D. Unidentified versions are shown against open ports as unknown service details, and do not relate to the filtered state.

Correct answers: B, C, E — Add multi-factor access, such as a PIN or biometric, at doors protecting sensitive areas; Issue RFID-blocking sleeves or wallets so cards are not readable while carried in public areas; Migrate to credentials that use mutual authentication and encrypted communication between card and reader

• A. Larger printed names help visual checks but do not affect what the card transmits over radio. A cloned badge with a legible name still opens the door.
• B. A second factor means a cloned card alone does not open the door. A PIN or biometric limits the damage when a credential is copied.
• C. Shielded sleeves block unwanted reads in crowded places, which removes the opportunity to capture a card from a short distance. It is a low-cost compensating control.
• D. Moving the card by a few centimeters does not defeat a reader held close to a person's body. Distance of that scale is irrelevant to short-range cloning.
• E. Mutual authentication and encryption remove the static identifier that cloning tools capture. This is the root-cause fix for the legacy technology.

Correct answer: A — Save the intercepted request to a file, run sqlmap with `-r` against it, limit testing to the suspect field with `-p`, and keep default level and risk values

• A. Feeding a saved request with `-r` preserves cookies, headers and body, and `-p` focuses testing on the one suspect parameter. Default level and risk keep the traffic low-impact on a shared staging system.
• B. Crawling the whole site at maximum level and risk generates huge request volume and risky payloads such as stacked or heavy time-based queries. That is not a controlled test of one suspected field.
• C. Wfuzz sends wordlist entries but does not analyze database error or timing behavior, and a 200 status says nothing about injection. Many non-vulnerable pages also return 200.
• D. Requesting an OS shell is a post-exploitation step that goes beyond proving injection and may exceed the rules of engagement. Detection should come first, with escalation only when authorized.

Correct answers: A, B, C — Sign the serialized data with a keyed hash on the server and reject any value whose signature does not verify; Avoid native object deserialization for untrusted input and use a data-only format such as JSON with strict schemas; Restrict deserialization to an allowlist of expected classes so that unexpected types are refused before instantiation

• A. Server-side integrity protection stops tampered objects from being processed, provided the signing key stays secret.
• B. Data-only formats with strict schemas avoid object instantiation from attacker-supplied input, removing the main attack surface.
• C. An allowlist of permitted classes prevents attacker-chosen types from being instantiated during deserialization.
• D. Extra encoding is reversible by anyone and offers no integrity protection, so an attacker can still craft a valid value.
• E. Allowing larger cookies provides more room for crafted data and does nothing to validate it.
• F. Compression is reversible and unauthenticated, so an attacker can decompress, alter and recompress the data.

Correct answer: D — Register manipulation, abusing the protocol's lack of authentication to write process values directly to the controller

• A. Incorrect. A replay attack resends previously captured traffic unchanged, whereas here the tester built a new frame with an attacker-chosen setpoint value.
• B. Incorrect. A CAN bus attack concerns vehicle and industrial CAN networks with arbitration IDs; this scenario uses Modbus/TCP to a PLC over Ethernet.
• C. Incorrect. A plaintext attack in this context concerns reading cleartext protocol data; no key is derived from plaintext and ciphertext pairs, and Modbus has no encryption layer at all.
• D. Correct. Writing a chosen value to a holding register with a crafted Modbus write function is register manipulation, possible because Modbus performs no authentication or authorization.

Correct answer: D — Require IMDSv2 session tokens with a hop limit of 1, so a forwarded SSRF GET request cannot fetch role credentials

• A. Incorrect. Certificate rotation protects transport identity and does nothing about an SSRF request that reaches the link-local metadata address from inside the instance.
• B. Incorrect. Flow logs only record traffic metadata for later analysis, and link-local metadata traffic never leaves the host, so they neither block nor capture it.
• C. Incorrect. Instance size has no bearing on metadata service behavior, and the original IMDSv1 endpoint answers plain requests regardless of the instance type.
• D. Correct. IMDSv2 demands a token obtained through a PUT request, and a hop limit of 1 keeps the response from crossing a proxy or container, which breaks simple SSRF-based credential theft.

Correct answer: C — Rank it highly, because default credentials on a management interface need no exploit development and can lead to code execution

• A. Incorrect. Valid default credentials already grant access; writing a custom exploit adds effort without any benefit here.
• B. Incorrect. Development hosts frequently connect to production networks or hold credentials and source code, so they can be a pivot toward valuable assets.
• C. Correct. A management console that accepts default credentials gives authenticated access with minimal effort, and deploying an application is a well-known route to command execution, so it is a quick high-value win.
• D. Incorrect. Default configurations are among the most commonly abused weaknesses and often provide the initial foothold, so treating them as informational understates the risk.

Correct answer: B — An attack path document that chains footholds, pivots, and privilege escalations toward the objective

• A. Incorrect. A severity matrix ranks isolated findings, so it cannot show how they connect into a chain leading to the domain controller.
• B. Correct. An attack path documents how individual weaknesses and access levels combine into a route from the initial foothold to the goal, which is exactly what was requested.
• C. Incorrect. A low-level diagram shows detailed infrastructure layout such as addressing or ports, not the exploitation sequence between systems.
• D. Incorrect. A storyboard illustrates the narrative or steps of a scenario for communication purposes, not the technical chain of hosts and privilege changes.

Correct answer: C — An attacker configures a host's NIC to negotiate trunk mode with the connected port, for example by mimicking DTP, so the host receives tagged traffic from every VLAN on that trunk.

• A. This describes MAC flooding, a separate attack against the switch's content-addressable memory table, not the trunk-negotiation technique that defines switch spoofing.
• B. This describes double tagging, a distinct VLAN hopping variant that abuses tag stripping at the first switch rather than negotiating trunk status with the attacker's own port.
• C. Switch spoofing works exactly this way: the attacking host imitates a trunking switch during negotiation so the real switch places the port into trunk mode and forwards every VLAN's tagged traffic to it.
• D. Simply connecting to an unused, unauthenticated port only grants access to whatever single VLAN that port is already assigned to, with no trunk negotiation or tag manipulation involved.

Correct answer: D — Try one or two common passwords across all usernames, then wait past the lockout window before the next password round.

• A. Concentrating many guesses on one account is a classic brute-force pattern that trips the five-failure lockout almost immediately.
• B. Replaying leaked pairs is credential stuffing. It relies on password reuse rather than staying under the per-account threshold, and high speed would still generate noise.
• C. Mask attacks are an offline cracking technique, and running many guesses per account in parallel would exceed the lockout threshold.
• D. Correct. This is password spraying: few guesses per account per window keeps each account below the lockout threshold while still testing many users against common passwords.

Correct answer: C — Maltego, which uses transforms to graph relationships between people, domains, and accounts

• A. BeEF manages hooked browsers after exploitation. It has no function for building relationship graphs from open sources.
• B. Gophish delivers and tracks campaigns after targets are chosen. It does not discover or graph relationships between people, domains, and accounts.
• C. Maltego runs transforms against public sources and renders entities and their relationships as a graph, which supports picking high-value targets and pretexts.
• D. Evilginx is a reverse proxy used for capturing sessions during phishing. It performs no reconnaissance or relationship mapping.

Correct answers: C, E, F — Following a courier through a secured door before it closes behind them; Sorting through discarded printouts left in an unlocked recycling bin; Reading a receptionist's password by watching the keyboard over their shoulder

• A. Injecting a hook into a visited website is a watering hole attack carried out remotely, so it is not a physical technique.
• B. Serving a cloned portal is credential harvesting performed over the network. It is remote activity and not an in-person technique.
• C. Tailgating behind another person through a secured door is a physical technique that needs no badge and fits the reception and floor scope.
• D. Texting a link to a cloned login page is smishing, which is delivered over a mobile messaging channel and does not rely on physical presence.
• E. Searching discarded paper is dumpster diving, a physical technique that requires access to bins within scope, not any network activity.
• F. Shoulder surfing means observing someone entering credentials in person, so it is a physical technique suited to a reception desk.

Correct answer: B — Impacket, a Python collection implementing SMB, Kerberos, and WMI primitives that a script can call directly.

• A. Atomic Red Team provides small technique tests for detection validation rather than protocol libraries that a script can invoke against remote hosts.
• B. Impacket provides Python classes that implement SMB, Kerberos, and related Windows protocols, which is exactly what a script needs to authenticate and act against remote servers.
• C. Scapy works at the packet layer and is used to craft and dissect traffic; it does not supply ready-made SMB or Kerberos client behaviour for remote operations.
• D. PowerSploit is a PowerShell module set for Windows reconnaissance and post-exploitation; it is not a Python protocol library.

Correct answer: D — Unquoted service path injection, since Windows resolves a space-containing path to an executable it finds earlier in the search order

• A. DLL search order hijacking depends on an unqualified or missing DLL being resolved from a writable directory, and it is not driven by how the service control manager parses the binary path itself.
• B. Process hollowing starts a legitimate process suspended and replaces its in-memory image with other code, which is unrelated to the parsing of a service binary path.
• C. Token impersonation reuses an access token from another process or session and does not follow from a service path that simply lacks quotation marks.
• D. An unquoted service path containing a space causes Windows to try each space-delimited prefix as a candidate executable before the intended binary, so a writable parent directory turns the misconfiguration into code execution as the service account.

Correct answers: B, C, E — The NTDS.dit database on a domain controller, which stores the hashes for domain accounts; The SAM registry database, which stores the local account password hashes for the host; LSASS process memory, which caches credential and ticket material for logged-on sessions

• A. Event trace log files hold provider telemetry about system and application activity and do not store account passwords or hashes.
• B. On a domain controller, the NTDS.dit database holds the password hashes for domain accounts and is therefore a high-value credential store.
• C. The SAM registry database stores the password hashes for the host's local accounts and is readable with sufficient privileges on that system.
• D. Prefetch holds execution metadata such as run counts and loaded modules, which supports forensic timeline work but contains no authentication material.
• E. LSASS process memory holds credential material such as password hashes and Kerberos tickets for logged-on sessions, which is why it is a primary credential access target.

Correct answer: B — Kismet, which keeps the adapter passive and alerts when new access points or management frames appear on monitored channels

• A. InSSIDer is a graphical site-survey utility that charts signal strength, channel usage, and overlap so facilities teams can plan coverage. It offers no rogue-AP alerting or management-frame monitoring, so it does not satisfy the monitoring requirement.
• B. Kismet operates the wireless adapter passively, enumerates access points and associated clients, and can raise alerts on rogue devices and unusual management frames. That alerting and management-frame visibility is exactly what continuous monitoring of a single site requires.
• C. WiGLE.net is a crowd-sourced database that plots GPS-tagged wireless scan results on an online map. It has no live monitoring or alerting capability for a single corporate site during an engagement.
• D. Aircrack-ng is built around capturing 802.11 frames and recovering keys from four-way handshakes with wordlists and rules. Its purpose is key recovery from captures rather than ongoing detection of unauthorized access points.

Correct answer: B — Compare the web root to the known-good deployment by hash, and have the client review server logs for later requests to it.

• A. Incorrect: a restart does not prove that no copies or modified files remain, and it disrupts a production service without verifying anything.
• B. Correct: a hash comparison against a trusted deployment shows unexpected or modified files, and the logs show whether the shell was accessed by anyone else.
• C. Incorrect: deleting matching names on other hosts risks removing legitimate files and goes beyond what the tester created.
• D. Incorrect: a permission change is a new unapproved configuration change that may break uploads and does not confirm that anything was removed.

Correct answer: B — NTFS alternate data streams, which store extra named data inside an existing file record

• A. The hidden attribute only suppresses a default listing. The file still appears with dir /a, and it is a separate file with its own size, so it does not match the described behavior.
• B. NTFS alternate data streams hang named streams off a host file such as report.txt:stage. The host's reported size does not change, and defenders can find the streams with dir /r or streams.exe.
• C. A junction redirects a path to another folder. Its target files remain ordinary, visible files, so it does not conceal data inside another file.
• D. Shadow copies keep point-in-time versions of files for recovery. They are not a way to attach extra data to a file or to hide staged content.

Correct answers: B, D — An entry added under `/etc/cron.d` that runs the implant on a fixed recurring schedule.; A unit file installed under `/etc/systemd/system` that starts the implant during system boot.

• A. A line in a user's `.bashrc` executes only when that user opens an interactive shell, so the mechanism depends on a person logging in and does not satisfy the requirement.
• B. A file processed from `/etc/cron.d` is handled by the system cron daemon on its schedule regardless of whether anyone is logged on, so it also survives a reboot.
• C. A bind shell started by hand exists only in the current session. A reboot terminates the process and nothing restarts it, so no persistence is achieved.
• D. A systemd unit placed in the system directory is started by the init system during boot, so it re-establishes access with no dependency on any user signing in.
• E. A message-of-the-day line only prints text at login time. It provides no execution path or reconnection capability and therefore no persistence.

Correct answer: D — Run Mimikatz with the `sekurlsa` module to read credential material that the Local Security Authority keeps in memory.

• A. Hashcat works offline against a hash file, so it can recover a local account password but not the in-memory tickets and plaintext credentials being sought.
• B. Mounting the administrative share reaches files and registry hives on disk, not the volatile credential structures held in the memory of the running system.
• C. Pulling the SAM and SYSTEM hives yields local account hashes only; it does not recover plaintext secrets or ticket material held in the live credential store.
• D. Mimikatz reads the credential material held in the memory of the Local Security Authority, including plaintext passwords and Kerberos tickets for logged-on sessions.

Correct answer: C — Relay the port with Netcat: one instance listening on the attack platform and piping to a second that connects out to the internal service.

• A. An ssh -R remote forward would publish the port, but the scenario states that SSH is not available on the foothold host.
• B. A static route only tells the attack platform where to send packets; the foothold does not forward them without a listening relay or tunnel.
• C. Chaining a listening Netcat on the attack platform to a second Netcat that connects out from the foothold forwards the single port without needing SSH or a framework session.
• D. A Meterpreter SOCKS proxy would also reach the interface, but it assumes an existing Meterpreter session that the scenario has not established.