Free CompTIA PenTest+ Sample Questions

Correct answer: A — Target selection, since the parties are agreeing on which URLs and hosts fall inside versus outside the assessment

• A. Target selection is correct because the client is explicitly identifying which URL is in scope and which subdomain is excluded, which is the definition of choosing the domains, IPs, or URLs to be tested.
• B. Shared responsibility mapping concerns who owns which security control between hosting provider, customer, and tester, not which hostnames get tested, so it does not describe this conversation.
• C. Agreement type selection covers legal documents like NDAs or SoWs that govern the engagement contractually, not the technical decision about which hosts are in or out of scope.
• D. Testing framework alignment refers to choosing a methodology such as PTES to structure the assessment, which is unrelated to deciding which subdomain gets excluded from testing.

Correct answers: A, B — Aligning evidence handling and documentation with the applicable regulatory framework identified for the client's industry; Building a mandatory reporting trigger into the plan so authorities are notified if the specified data exposure is found

• A. Aligning evidence handling with the applicable regulatory framework is correct because the scenario states the client's environment falls under a framework with specific evidence-handling and reporting requirements that the plan must satisfy.
• B. Building in a mandatory reporting trigger is correct because the scenario explicitly describes a legal requirement to notify authorities immediately upon discovering certain data exposure, which is a mandatory reporting obligation the plan must account for.
• C. Selecting a technical methodology like MITRE ATT&CK addresses how the assessment is executed, not the legal and regulatory obligations described in the scenario, so it is not one of the two required considerations here.
• D. An executive summary template concerns report formatting for stakeholders after testing concludes and is unrelated to the regulatory and mandatory reporting obligations raised in the scoping meeting.
• E. Defining CIDR ranges and domains is a target selection activity, which is a separate scoping task from the regulatory and legal notification obligations described in this scenario.

Correct answer: A — Conduct root cause analysis with the engineering team to confirm the actual network exposure and adjust the finding's likelihood if warranted

• A. This is correct because collaborative root cause analysis with the client's technical team is the standard way to resolve factual disputes about exposure, and the finding's likelihood or severity should be adjusted based on verified evidence.
• B. This is incorrect because a disputed claim should be investigated and verified, not deleted outright; removing a real vulnerability without confirmation risks under-reporting genuine risk.
• C. This is incorrect because ignoring a legitimate technical dispute without investigation can leave an inaccurate severity rating in the final report, undermining its credibility.
• D. This is incorrect because a technical disagreement over network exposure is resolved through technical root cause analysis, not by routing it to legal for a ruling.

Correct answer: A — Ask the original tester to re-examine the access requirements and adjust the severity rating to match the demonstrated evidence

• A. This is correct because peer review exists specifically to catch mismatches between evidence and assigned severity, and the appropriate corrective action is to have the original author reconcile the rating with the demonstrated access requirements.
• B. This is incorrect because severity ratings must be grounded in evidence such as access prerequisites and exploitability, not left unquestioned, which defeats the quality-control purpose of peer review.
• C. This is incorrect because a real, evidenced vulnerability should not be deleted over a rating disagreement; the finding is valid, only its severity needs correction.
• D. This is incorrect because severity rating is a technical determination made by the testing team using evidence, not a decision to be outsourced to the client during internal quality review.

Correct answers: A, B, C — Discovering files that appear to depict child exploitation material on a compromised host system; Discovering an active, ongoing breach currently exposing regulated payment card data to outsiders; Discovering credentials indicating an employee is actively committing fraud reportable to law enforcement

• A. Evidence of certain crimes, such as exploitation material, triggers a legal reporting obligation that exists independently of the engagement's confidentiality terms.
• B. An active breach currently exposing regulated cardholder data typically triggers breach notification and reporting duties that take precedence over standard contract confidentiality.
• C. Credentials indicating active fraud that must be reported to law enforcement represent an ongoing crime, which falls under mandatory reporting rather than routine findings handling.
• D. An outdated but unexploited software version is a standard technical finding to be documented in the report, not a legal reporting trigger.
• E. Password reuse across systems is a common security weakness to include in the findings, but it does not constitute evidence of a crime requiring mandatory reporting.
• F. An overly permissive firewall rule is a policy deviation to report as a finding, not an event that overrides contractual confidentiality.

Correct answer: A — Follow the escalation path in the rules of engagement to reach a secondary contact and log every attempt

• A. The rules of engagement typically define a multi-tier escalation path for exactly this situation, and documenting attempts protects the tester and demonstrates due diligence.
• B. An active, unrelated attacker represents an urgent security event; delaying notification to the next routine update ignores the severity and any escalation obligations.
• C. Publicly disclosing an active incident violates confidentiality obligations and could tip off the attacker or harm the client, rather than resolving the escalation properly.
• D. Stopping activity without escalating or documenting leaves an active threat unreported and fails the tester's obligation to notify the client promptly.

Correct answer: A — Test limitations and assumptions

• A. The test limitations and assumptions section exists specifically to document exclusions, constraints, and environmental assumptions so that the results are interpreted with the correct context.
• B. The executive summary is a high-level business-focused overview of risk and impact, not the place for cataloging technical scope exclusions and assumptions.
• C. The detailed findings appendix documents individual vulnerabilities with evidence, not the overall boundaries or assumptions of the engagement.
• D. The remediation recommendations section proposes fixes for identified issues; it does not describe what was excluded from testing or assumed about the environment.

Correct answer: A — Configure a SPAN/port mirroring session on the switch to duplicate the traffic to the tester's port

• A. A SPAN or port-mirroring session tells the switch to copy frames from the target ports to the tester's monitoring port, which is the standard supported way to observe traffic on a switched network.
• B. Hub-based repeater segments broadcast all traffic to every port, but this requires the hosts to already be on a hub, which is not stated and is rare on modern switched networks.
• C. Promiscuous mode only captures frames actually delivered to the interface, and a switch will still not deliver unicast frames destined for other ports, so this alone does not solve the problem.
• D. ARP spoofing actively manipulates the two hosts' traffic paths and is a disruptive technique rather than a standard passive capture method for this scenario.

Correct answer: A — Mapping firewall rule sets by observing which ports return RST responses to ACK packets

• A. An ACK scan sends packets with only the ACK flag set and observes RST responses to infer which ports are filtered by a stateful firewall, without determining open or closed state.
• B. Identifying service and version information is the role of version detection (`-sV`), not the ACK scan.
• C. Determining whether a host is online is host discovery, typically performed with ping-based probes, not the ACK scan.
• D. Capturing OS fingerprint data from stack behavior is the function of OS detection (`-O`), a separate technique from ACK-based firewall mapping.

Correct answer: A — safe

• A. This category groups scripts considered unlikely to crash the target service or consume excessive resources, which is why it is the default set run with `-sC`.
• B. This category actively checks hosts against known vulnerability signatures and must be requested explicitly with `--script`, since it is not part of the default script set.
• C. This category includes scripts that risk crashing services or triggering intrusion detection and must be explicitly selected, so it is excluded from the default run.
• D. This category performs credential brute-forcing against discovered services and is never run by default because it is noisy and can lock out accounts.

Correct answer: A — No ICMP port-unreachable reply arrived, so Nmap cannot tell an open port from a firewall-blocked one

• A. UDP scanning marks a port `open|filtered` when no response and no ICMP unreachable message arrive, since Nmap cannot distinguish a genuinely open port from one silently dropped by a firewall.
• B. An actual error response from the service would let Nmap report the port as closed outright, not as the ambiguous `open|filtered` state described in the scenario.
• C. TCP RST packets are not part of UDP scanning and would result in a definitive closed determination rather than the ambiguous state shown here.
• D. A valid application response would let Nmap confirm the port as open with certainty, not report the uncertain `open|filtered` state described.

Correct answer: A — SYN scan (`-sS`)

• A. SYN scan sends a SYN packet and evaluates the SYN/ACK or RST reply without sending the final ACK, so the three-way handshake never completes and fewer sessions are logged. It requires raw socket access, which root privileges provide.
• B. TCP connect scan completes the full three-way handshake through the OS socket API, producing a fully established connection that is more likely to appear in application-level logs.
• C. UDP scan probes connectionless UDP services and has no bearing on avoiding a TCP handshake, so it does not meet the stated goal.
• D. ACK scan sends only ACK packets to map firewall filtering rules and cannot reliably determine whether a TCP port is actually open.

Correct answer: A — crt.sh certificate transparency logs

• A. This resource searches certificate transparency logs, which record every publicly trusted certificate issued for a domain and often expose subdomain names that never appear in DNS wordlists.
• B. This resource archives historical snapshots of web page content over time and has no relationship to certificate issuance records.
• C. This resource catalogs wireless access points and their geolocation data, which is unrelated to SSL/TLS certificate records.
• D. This resource is a curated directory linking out to various OSINT tools and does not itself store or search certificate transparency data.

Correct answer: A — Tighten the pattern to `r'[\w.]+@[\w.]+\.[a-zA-Z]{2,}'` so the match needs a domain suffix.

• A. Requiring a dot followed by at least two letters after the domain forces the match to look like a real top-level domain, which filters out strings such as build tags that lack that structure.
• B. Case sensitivity is not the source of the false positives here, since the mismatched text is a version string, not a casing issue.
• C. `re.match` only checks for a match at the very start of the string, which would miss nearly all embedded email addresses in page text rather than fixing the false-positive problem.
• D. The `@` symbol has no special regex meaning and does not need escaping, so this change has no effect on which strings match.

Correct answers: A, B, C — Add `set -euo pipefail` near the top so the script exits on unhandled errors and unset variables.; Bound each connection attempt with `timeout 3 bash -c "..."` so a hung socket cannot stall the whole scan.; Log scan output to a timestamped file rather than only the terminal, so results survive a dropped session.

• A. Strict mode causes the script to stop on an error, an unset variable, or a failed command in a pipeline, which surfaces problems immediately instead of silently continuing on bad data.
• B. Wrapping each connection attempt in a timeout guarantees the script moves on if a socket never responds, preventing one unreachable host from stalling the entire scan.
• C. Persisting output to a file protects engagement evidence against a dropped terminal session or SSH disconnect, which is a real risk during long scans.
• D. Comments have no effect on script execution speed since Bash strips them during parsing; removing them only reduces readability.
• E. Hardcoding a single allowed target defeats the purpose of a reusable enumeration script and does not improve reliability or safety of the scan logic itself.
• F. Swapping control-flow constructs is a stylistic change that does not affect the script's runtime reliability or its handling of scan failures.

Correct answer: A — Interactive application security testing (IAST)

• A. Correct, since combining runtime instrumentation with observed traffic to trace vulnerable code paths during normal use is the defining trait of the interactive, agent-based approach.
• B. Incorrect because purely dynamic testing relies on external interaction alone and does not instrument the application internally to correlate traffic with code paths.
• C. Incorrect because static analysis does not observe live traffic or require the application to be running during a functional test cycle.
• D. Incorrect because composition analysis inspects dependency inventories rather than correlating live requests with executed code.

Correct answer: C — Selecting and executing a public proof-of-concept exploit against the target in a controlled manner

• A. Repeating the same scan template would reproduce the same detection logic and evidence, which does not add independent proof of exploitability beyond what the scanner already reported.
• B. Verbosity settings control how much detail appears in the exported report; they do not test whether the underlying vulnerability can actually be exploited.
• C. Selecting and running a suitable public exploit against the target directly tests whether the reported condition can be exploited in practice, which is the core method for confirming a finding beyond the scanner's own classification.
• D. Changing the testing window affects when scanning activity is permitted; it has no bearing on whether a specific finding is exploitable.

Correct answer: B — Whether the scan was run with valid administrative credentials for authenticated checks

• A. Domain membership of the scanning workstation itself does not grant the scanner access into the target host; what matters is the credentials supplied for the scan against the target.
• B. Authenticated checks require valid administrative credentials for the target so the scanner can query the registry, installed packages, and patch level directly on the host, which is the primary factor enabling detection of missing patches and local software.
• C. Report export format only changes how already-collected results are presented; it has no effect on what the scanner was able to detect during the scan itself.
• D. Running the scanner from a virtual machine versus physical hardware does not change whether it has valid credentials or local visibility into the target host.

Correct answer: A — Nikto

• A. Nikto is purpose-built to test web servers against a large database of dangerous files, outdated software banners, and common misconfigurations, matching the requested initial pass exactly.
• B. Tenable Nessus is a general-purpose vulnerability scanner better suited to broad host and service coverage than a focused, lightweight web-server misconfiguration pass.
• C. Greenbone/OpenVAS is a general vulnerability management platform built around NVTs across hosts and services, not a specialized web-server file and misconfiguration scanner.
• D. BloodHound maps Active Directory relationships and privilege escalation paths and has no role in scanning a web server for outdated software or dangerous files.

Correct answer: A — The credentialed scan could log in locally and enumerate installed package versions and configuration details that are not visible to external network-based probing

• A. Credentialed scanning lets Nessus log in locally and inspect installed package versions and configuration files directly, revealing far more than external network probing alone can see.
• B. Plugin feed freshness applies equally to both scan types run from the same scanner and is not tied specifically to whether credentials were supplied.
• C. Adding credentials does not change the CVSS base score calculation for existing findings; it changes what the scanner can detect in the first place.
• D. Authentication status does not determine which transport protocol ports a scan targets, so this port-based distinction does not explain the difference in findings.

Correct answer: A — Relay the captured NTLMv2 authentication to a host where SMB signing is not enforced

• A. Relaying is correct because forwarding the captured NTLMv2 authentication to a target that does not enforce SMB signing lets the tester authenticate as the victim without ever cracking the hash.
• B. Replaying the raw broadcast is incorrect because resending the original LLMNR query does not advance the attack; the value is in the captured response, not in retriggering the broadcast.
• C. Submitting an NTLM hash as a Kerberos ticket is incorrect because NTLMv2 challenge-response material is not a valid Kerberos ticket format and cannot be presented to a KDC this way.
• D. Sending the hash to a DHCP server is incorrect because DHCP lease negotiation has no mechanism for accepting NTLM credential material.

Correct answers: A, B — Exploit the Samba RCE vulnerability to gain code execution on the Linux hosts; Authenticate to the Windows management interface using the default administrator password

• A. This is correct because exploiting the known unauthenticated Samba RCE is a direct, validated finding described in the scenario and represents service exploitation.
• B. This is correct because logging in with the unchanged vendor-default password directly matches the default credential finding described for the Windows management interface.
• C. ARP poisoning is incorrect because the scenario describes an RCE vulnerability on the Linux hosts, not a need to intercept traffic between them.
• D. DTP trunk negotiation is incorrect because the finding on the Windows host is a default credential issue, not a VLAN segmentation problem requiring trunk access.
• E. Relaying NTLM authentication is incorrect because no NTLM capture was described, and the Samba hosts are Linux systems unrelated to NTLM relay targets.

Correct answer: A — CrackMapExec

• A. CrackMapExec is built to test a set of credentials, including hashes, against many hosts over SMB and report which ones succeed, matching the need to validate hash reuse before lateral movement.
• B. sqlmap automates detection and exploitation of SQL injection vulnerabilities in web applications and has no role in validating SMB credential reuse.
• C. Gobuster brute-forces directories, files, and DNS subdomains for web reconnaissance and does not test authentication against SMB hosts.
• D. TruffleHog scans repositories and file systems for accidentally committed secrets and does not perform network authentication testing.

Correct answer: A — Use pass-the-hash to authenticate to the confirmed file servers directly with the captured hash

• A. Pass-the-hash authenticates using the hash value itself and never requires recovering the plaintext password, which satisfies the restriction while still demonstrating access to the confirmed servers.
• B. Submitting the hash to any cracking service, online or offline, is an attempt to recover the plaintext password, which directly violates the stated restriction in the rules of engagement.
• C. A local dictionary attack against the hash is still a password-cracking activity aimed at recovering the plaintext, which the rules of engagement explicitly prohibit.
• D. Asking the account owner for their password is a social-engineering action outside the defined technical attack and does not reflect the pass-the-hash capability the tester already demonstrated.

Correct answer: A — Stored XSS

• A. Stored XSS occurs when the malicious script is persisted on the server, in this case inside the forum post, and executes for every user who later loads the page containing it.
• B. Reflected XSS requires the payload to be part of the current request and echoed immediately back in that same response, not persisted for future visitors as described here.
• C. DOM-based XSS results from vulnerable client-side JavaScript writing untrusted data into the DOM without any server round-trip, which does not match a payload stored server-side in a forum post.
• D. Blind SQL injection is a database attack technique relying on inferred true/false or timing signals, which is unrelated to a script tag executing in visitors' browsers.

Correct answer: A — DOM-based XSS

• A. DOM-based XSS occurs entirely within client-side JavaScript, where untrusted data such as the URL fragment is written unsafely into the DOM via `innerHTML` without any server response containing the payload.
• B. Stored XSS requires the payload to be saved server-side and served to other users later, which does not apply since the fragment is processed only in the browser and never sent to the server.
• C. Reflected XSS requires the server to receive the payload and echo it back in its response, but URL fragments are never transmitted to the server, ruling this out.
• D. Server-side request forgery tricks a server into making unintended requests to internal or external resources, which is unrelated to client-side script execution in a victim's browser.

Correct answer: A — Drop a malicious `Vendor.exe` in `C:\Program Files\` and restart the service so Windows launches it before the real target

• A. Correct. When a service path contains unescaped spaces, Windows tries each space-delimited segment as a candidate executable in order, so a writable parent directory lets an attacker plant a file that is launched with the service account's privileges before the real path is ever reached.
• B. Incorrect. Overwriting the actual target binary requires write access to that specific file, not the parent directory, and does not rely on or exploit the unquoted-path parsing behavior at all.
• C. Incorrect. Repointing `ImagePath` is a separate privilege escalation technique that requires registry write permissions on the service key; it does not exploit the unquoted-path ambiguity described here.
• D. Incorrect. `sc config` cannot append a second command to run alongside an existing binary path, and this approach does not use the space-parsing weakness that makes the unquoted path exploitable.

Correct answers: A, B, C — The container is started with the `--privileged` flag.; The container mounts the host's Docker socket.; The container runs with `CAP_SYS_ADMIN` retained.

• A. This is correct because `--privileged` disables cgroup device restrictions and confinement profiles, giving the container broad access to host devices.
• B. This is correct because a mounted Docker socket lets the container command the host's Docker daemon, which runs with host-level privileges.
• C. This is correct because `CAP_SYS_ADMIN` enables mount operations that can be abused, such as the cgroup `release_agent` escape.
• D. This is incorrect because pulling from a private registry is a supply-chain and access-control consideration, not a factor that expands a running container's escape surface.
• E. This is incorrect because a conservative memory limit restricts resource consumption and has no relationship to namespace or capability isolation.

Correct answer: A — Kube-hunter

• A. This is correct because Kube-hunter is purpose-built to probe Kubernetes clusters from an outsider or insider perspective, hunting for exposed APIs, dashboards, and other cluster-level weaknesses.
• B. This is incorrect because Prowler is an AWS-focused security and compliance assessment tool, not a Kubernetes cluster enumeration tool.
• C. This is incorrect because ScoutSuite audits multi-cloud provider configurations, such as AWS, Azure, and GCP, rather than probing live Kubernetes clusters.
• D. This is incorrect because Docker Bench evaluates a single Docker host's configuration against CIS benchmarks, it does not enumerate a Kubernetes cluster's attack surface.

Correct answer: A — Prompt injection, since the crafted user message directly overrides the system's prior instructions

• A. This is correct because the attacker's own message content directly overrode the model's original operating instructions, which is the defining mechanism of prompt injection. No separate data channel or model theft was involved, only crafted runtime input.
• B. This is incorrect because reconstructing training records requires many statistical queries against model outputs over time, not a single instruction that hijacks behavior. The scenario shows an instant behavior override, not a data-reconstruction process.
• C. This is incorrect because adversarial evasion targets classifiers with perturbed feature inputs to flip a label, which does not match a conversational text instruction overriding a chatbot's instructions.
• D. This is incorrect because nothing in the scenario describes resource exhaustion, elevated latency, or cost impact; the chatbot simply complied with the injected instruction and responded normally.

Correct answer: A — Insecure output handling, which covers downstream systems trusting LLM output without validation

• A. This is correct because the finding describes a downstream shell interpreter trusting and executing LLM output without validation, which is exactly the risk that insecure output handling addresses.
• B. This is incorrect because excessive agency concerns the scope of permissions and autonomous actions granted to an LLM, not the failure to sanitize its generated text before use elsewhere.
• C. This is incorrect because prompt injection concerns manipulating the model's own instruction-following behavior, whereas this finding concerns a downstream component blindly trusting the model's output.
• D. This is incorrect because the finding describes command execution from unsanitized output, not degraded availability or excessive resource consumption.

Correct answer: A — A rootkit hides malicious activity at the OS or kernel level, while a trojan poses as legitimate software

• A. A rootkit's defining trait is concealment at the operating system or kernel level so that processes, files, or connections stay hidden, whereas a trojan's defining trait is disguising itself as something benign to trick a user or process into running it.
• B. Neither category is limited to a single delivery channel; rootkits and trojans can both be installed locally or delivered over a network, so this network-versus-disk distinction is inaccurate.
• C. Rootkits are commonly deployed remotely after initial compromise rather than requiring physical access, and trojans arrive through many vectors beyond email, so this distinction does not hold.
• D. Rootkits exist for Windows, Linux, and other platforms, and trojans are not limited to Windows executable formats, so this platform-exclusive claim is incorrect.

Correct answer: A — To obtain additional valid credentials that enable further lateral movement

• A. Dumping credentials from process memory like LSASS harvests passwords, hashes, and tickets that a tester can reuse to authenticate to additional systems and expand access.
• B. Reading secrets out of memory does not disable the domain controller's authentication service; that would be a disruptive action outside the scope of credential dumping.
• C. Building a logon-event timeline is a log-analysis or forensic activity, not the goal of pulling credential material out of memory.
• D. Compressing and encrypting files relates to staging data for exfiltration, which is a separate activity from harvesting authentication material from memory.

Correct answer: A — The Common Vulnerability Scoring System (CVSS)

• A. CVSS is the standard framework penetration test reports use to derive a numeric severity score based on exploitability and impact factors, which is exactly what a client asking about a severity rating would expect to see referenced. It provides a defensible, repeatable scoring justification.
• B. The OWASP Top 10 is a categorized list of common web application risk categories, not a scoring methodology for assigning severity to an individual finding. It would not be cited to justify a numeric risk rating.
• C. The ATT&CK Navigator visualizes which techniques were used across a matrix, which is useful for narrative mapping but is not a severity scoring system. It does not produce the kind of risk rating the client is asking about.
• D. The Purdue model describes industrial control system network architecture layers and has no role in scoring the severity of a domain compromise finding. It is unrelated to risk rating methodology.

Correct answers: A, B, D — Conduct a periodic access review that removes unnecessary Domain Admins membership; Adopt a tiered administration model that separates workstation, server, and domain admin roles; Formalize a least-privilege policy requiring justification and approval for privileged group membership

• A. A periodic access review is a governance process that directly removes the excess Domain Admins membership causing the finding, making it a fitting administrative control. It matches the root cause of unchecked privilege accumulation over time.
• B. A tiered administration model is a policy-level structure that separates admin roles by scope, preventing the kind of broad privilege sprawl described in the finding. It is an administrative, governance-driven fix rather than a piece of technology.
• C. An intrusion prevention system is a technical control focused on network traffic inspection and does not change who holds Domain Admins membership. It belongs in a different remediation category from the one requested here.
• D. A formal least-privilege policy requiring justification and approval before granting privileged membership is a governance measure that prevents the finding from recurring. This fits the administrative-control category the question asks about.
• E. Credential Guard is a technical protection for LSASS memory and does not affect how many accounts are granted Domain Admins membership. It addresses a different technique than the privilege sprawl described in this finding.