PenTest+ Free Practice Questions

Question 1

What is the primary purpose of reconnaissance in a penetration test?

Accepted Answer

Gathering preliminary information about the target

Question 2

Which of the following best describes a phishing attack?

Accepted Answer

Tricking users into revealing sensitive information

Question 3

Why is it important to define the scope of a penetration test?

Accepted Answer

To limit the testing area and reduce legal risk

Question 4

What does the principle of least privilege aim to achieve?

Accepted Answer

Minimize the attack surface for user accounts

Question 5

Which tool is commonly used for network mapping during a penetration test?

Accepted Answer

Nmap

Question 6

What is a common goal of post-exploitation activities?

Accepted Answer

Maintaining access for future operations

Question 7

Which practice helps in identifying insecure storage of credentials in an application?

Accepted Answer

Checking for hardcoded secrets in source code

Question 8

What is the purpose of using a proxy tool during web application testing?

Accepted Answer

To intercept and modify HTTP requests

Question 9

Which activity is most likely to be performed during the enumeration phase of a network assessment?

Accepted Answer

Identifying live hosts and open ports

Question 10

What is a common mitigation for SQL injection vulnerabilities?

Accepted Answer

Using parameterized queries

Question 11

Which statement best describes the role of a pivot in a penetration test?

Accepted Answer

Using a compromised system to access additional network segments

Question 12

What is a typical outcome of a vulnerability scan?

Accepted Answer

A list of identified weaknesses with severity ratings

Question 13

Which practice is recommended to reduce the risk of credential theft?

Accepted Answer

Using the same password across multiple systems

Question 14

What is the purpose of documenting findings during a penetration test?

Accepted Answer

To provide clear evidence and remediation guidance

Question 15

Which technique is commonly used to evade basic network-based intrusion detection systems?

Accepted Answer

Fragmenting packets to avoid signature detection

A lot more is already mapped out