PenTest+ Free Practice Questions
This practice set exercises core knowledge and decision-making for the CompTIA PenTest+ exam. Questions cover penetration testing phases (reconnaissance, enumeration, exploitation, post-exploitation, reporting), social engineering tactics, security principles (least privilege), tool usage (Nmap, proxy tools), web application vulnerabilities (SQL injection, hardcoded credentials), lateral movement (pivoting), vulnerability scanning, credential protection, and evasion techniques. Users must choose the correct phase, tool, mitigation, or best practice based on scenario descriptions. Mastery requires understanding the purpose and sequence of each phase, common attack vectors, and appropriate countermeasures.
What this PenTest+ practice set measures
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
Penetration Testing Phases and Scoping
This practice bank emphasizes understanding the sequence and objectives of penetration testing phases. Reconnaissance (Question 1) is about gathering preliminary information. Enumeration (Question 9) involves identifying live hosts and open ports. Post-exploitation (Question 6) aims to maintain access. Scoping (Question 3) limits testing area to reduce legal risk. Each phase has distinct activities and goals; misidentifying a phase can lead to incorrect subsequent decisions.
- Reconnaissance is the initial information-gathering step; it does not involve active interaction with the target.
- Enumeration follows scanning; it extracts detailed data like user accounts and services from discovered hosts.
- Post-exploitation focuses on maintaining access and assessing impact after initial compromise.
- Scope definition protects both tester and client by setting authorized boundaries.
Social Engineering and Security Principles
Social engineering attacks like phishing (Question 2) exploit human psychology to trick users into revealing sensitive information. The principle of least privilege (Question 4) minimizes attack surface by granting only necessary access. Both concepts require testers to recognize deceptive techniques and recommend access controls. Understanding why phishing works (trust manipulation) and how least privilege reduces damage from compromised accounts is critical.
- Phishing relies on social engineering, not technical flaws; it deceives users via email or websites.
- Least privilege restricts user rights to the minimum needed for their role, limiting potential breach impact.
- Multi-factor authentication is a strong credential theft mitigation (Question 13), not a social engineering technique.
Network and Web Application Testing Tools
Tools like Nmap (Question 5) are used for network mapping to discover hosts and services. Proxy tools (Question 8) intercept and modify HTTP requests to test web applications. Lateral movement via pivoting (Question 11) uses a compromised system to access other network segments. Evasion techniques such as packet fragmentation (Question 15) help avoid detection by intrusion detection systems. Selecting the correct tool for each task is essential.
- Nmap is the standard tool for network discovery; it identifies live hosts and open ports.
- Proxy tools like Burp Suite allow testers to inspect and modify web traffic for vulnerability analysis.
- Pivoting expands access by routing traffic through a compromised host to internal networks.
- Packet fragmentation splits payloads across multiple packets to evade signature-based IDS.
Vulnerability Identification and Secure Development
Identifying vulnerabilities like hardcoded credentials (Question 7) requires code review and configuration checks. SQL injection (Question 10) is mitigated by parameterized queries, which separate data from code. Vulnerability scans (Question 12) produce lists of weaknesses with severity ratings. Thorough documentation (Question 14) provides evidence and remediation guidance. These practices help in reporting and fixing security flaws.
- Hardcoded secrets in source code indicate poor credential storage; code review can uncover them.
- Parameterized queries prevent SQL injection by ensuring user input is data, not executable code.
- Vulnerability scanners output prioritized lists of weaknesses but do not exploit or patch them.
- Clear documentation supports effective risk management and follow-up validation.
Practice PenTest+ with real flashcards
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Static practice bank
Start the 15-question diagnostic
The complete question bank is embedded in this pre-rendered page. There is no database request or second content download when you begin.
What is the primary purpose of reconnaissance in a penetration test?
Show hint
Given a scenario, determine the appropriate phase of a penetration test
Study workflow
Turn one PenTest+ attempt into a study plan
- 1
Define Scope and Rules of Engagement
Before testing, collaborate with stakeholders to outline targets, exclusions, testing windows, and legal boundaries. Document signed authorization to avoid legal issues. This step ensures all parties agree on the assessment's boundaries and reduces risk of unintended damage.
- 2
Perform Passive Reconnaissance
Collect publicly available information using OSINT techniques: search engines, DNS records, social media, job postings. Avoid direct interaction with target systems during this phase. Document all findings for later use in active tests.
- 3
Scan and Enumerate Network Services
Use tools like Nmap to identify live hosts, open ports, and running services. For each service, enumerate versions and configurations. Perform additional enumeration for user accounts, shares, and other details. Record all data to plan exploitation.
- 4
Conduct Controlled Exploitation and Pivoting
Attempt to exploit discovered vulnerabilities in a safe manner. After gaining initial access, use pivoting to move laterally through the network. Maintain access while documenting each step. Avoid destructive actions unless authorized.
- 5
Document and Report Findings
Compile all findings into a clear report: executive summary, technical details, risk ratings, and remediation recommendations. Include evidence like screenshots and logs. Present to stakeholders and validate fixes in a follow-up assessment.
FAQ
Questions about this exam practice page
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
What is the difference between a vulnerability scan and a penetration test?+
A vulnerability scan is an automated process that identifies potential weaknesses and assigns severity ratings. A penetration test simulates actual attacks to exploit flaws, assess real risk, and test defenses. Scans are broader but less thorough; pen tests are deeper and manual.
How does pivoting work during a penetration test?+
Pivoting uses a compromised host as a proxy to access other systems that are not directly reachable. The tester routes traffic through the controlled machine, effectively expanding the attack surface within the target network. It is essential for assessing internal security.
What are common evasion techniques to avoid intrusion detection systems?+
Common evasion techniques include packet fragmentation (splitting payloads), encoding payloads (e.g., base64), using SSL encryption, and varying timing to avoid signature detection. These methods help evade signature-based IDS but may not bypass advanced behavior-based systems.
Why is the principle of least privilege important in penetration testing?+
Least privilege limits accounts to minimal necessary permissions, reducing the blast radius if compromised. During a pen test, understanding this principle helps testers identify excessive privileges and recommend access controls to mitigate potential lateral movement or privilege escalation.
What should be included in a penetration test report?+
A penetration test report should include an executive summary, scope, methodology, detailed findings with severity ratings, evidence (screenshots, logs), and actionable remediation steps. It must be clear for both technical and non-technical stakeholders to support risk management decisions.
Build the next review session
Browse another free bank or use the study strategy guide to turn your misses into spaced review.