PT0003 CompTIA PenTest+ Free Practice Test — 30 Questions

Question 1

During a simulated external network penetration test, your team discovers that the target organization has recently deployed a sophisticated, undocumented Host-based Intrusion Detection System (HIDS) across its critical servers. This HIDS is actively blocking your previously successful exploitation techniques and generating alerts that are quickly addressed by the client\'s security operations center (SOC). Your engagement contract allows for dynamic adjustments to methodology based on discovered defenses, provided all actions remain within the agreed-upon scope and legal boundaries. Which of the following behavioral competencies is MOST critical for the penetration testing team to demonstrate effectively in this evolving situation?

Accepted Answer

Adaptability and Flexibility

Question 2

During a network penetration test, a critical exploit that was deemed highly probable to succeed is rendered ineffective by a recently deployed intrusion prevention system (IPS) signature. Simultaneously, the client\'s security team has highlighted a newly developed, proprietary internal web application that is considered a high-value target, but its internal architecture and potential vulnerabilities are largely undocumented. What is the most effective course of action to maintain momentum and achieve the engagement\'s objectives?

Accepted Answer

Leverage existing reconnaissance data and available tooling to perform an initial vulnerability assessment and targeted reconnaissance on the new internal web application.

Question 3

A penetration testing engagement initially focused on identifying internal network vulnerabilities and lateral movement capabilities. Midway through the assessment, the client informs the engagement team that their primary concern has shifted to potential data exfiltration via cloud storage services and compromised endpoints accessible from the internet, due to a recent internal policy change. The original scope and methodology are no longer fully aligned with this new priority. Which behavioral competency is MOST critically demonstrated by the penetration tester who successfully adjusts their approach to address the client\'s updated concerns, ensuring continued effectiveness and value delivery?

Accepted Answer

Adaptability and Flexibility

Question 4

During a penetration test of a client\'s public-facing web infrastructure, your team discovers a zero-day vulnerability in a custom-built internal administrative portal that was explicitly excluded from the Statement of Work (SOW). This portal, however, is accessible from the internet due to a misconfiguration and appears to control critical business functions. The vulnerability, if exploited, could lead to complete system compromise. What is the most appropriate next step?

Accepted Answer

Immediately notify the client's primary point of contact about the critical out-of-scope finding and discuss potential options for assessment, such as amending the SOW or initiating a separate engagement.

Question 5

During a penetration test targeting a healthcare provider\'s network, a security analyst discovers a previously unknown vulnerability in the firmware of a critical medical device. This vulnerability, if exploited, could allow unauthorized access to sensitive patient records, directly contravening the Health Insurance Portability and Accountability Act (HIPAA) regulations. The engagement contract specifies that all findings are to be included in the final report submitted at the conclusion of the testing period. Given the potential for immediate and severe harm to patient data confidentiality, what is the most ethically sound and professionally responsible immediate action the analyst should take?

Accepted Answer

Immediately cease testing the affected medical device and notify the client's designated security contact through an out-of-band communication channel about the critical finding, while continuing testing on other network segments as per the original scope.

Question 6

During an external penetration test targeting a multinational corporation\'s web infrastructure, your team initially assessed the regulatory environment based on publicly available information, assuming compliance primarily with US federal data privacy laws. Midway through the reconnaissance phase, advanced network mapping and subdomain enumeration reveal a significant presence of customer-facing services hosted in the European Union, strongly suggesting the applicability of the General Data Protection Regulation (GDPR). Given this critical update, which of the following actions best reflects a professional and effective response, demonstrating adaptability and adherence to ethical guidelines?

Accepted Answer

Immediately halt all active testing procedures, convene with the client's legal and compliance teams to clarify the exact data protection regulations applicable to the discovered EU-hosted services, and revise the penetration testing plan to ensure strict adherence to all identified requirements before resuming any offensive operations.

Question 7

Anya, a penetration tester engaged for a network security assessment, is examining a client\'s environment. The agreed-upon scope explicitly excludes a specific server cluster designated for legacy financial operations due to their critical, uninterrupted uptime requirements. During her authorized testing of the primary web application, Anya discovers an unpatched vulnerability that, when exploited, provides access to a database containing sensitive customer information. Further investigation reveals that this database is directly synchronized with the excluded legacy server cluster, and a compromised account within the legacy cluster can be used to pivot and gain administrative access to the in-scope web application server. What is Anya\'s most appropriate immediate course of action?

Accepted Answer

Immediately notify the client's point of contact about the critical finding, explaining the connection between the out-of-scope segment and the in-scope systems, and request permission to investigate further or adjust the scope.

Question 8

During a scheduled external network penetration test for a financial institution, a tester discovers a previously unknown, critical vulnerability in an internal system that is explicitly excluded from the authorized testing scope. The vulnerability appears to be exploitable and could have significant ramifications for customer data. What is the most ethically sound and legally compliant course of action for the penetration tester?

Accepted Answer

Immediately cease all further interaction with the out-of-scope vulnerability, document the finding, and report it to the client's designated point of contact through the agreed-upon secure communication channel.

Question 9

During an authorized penetration test targeting a specific web application, a tester identifies a previously unknown, critical vulnerability in an adjacent, unrelated internal network service that is accessible from the application\'s infrastructure. This newly discovered vulnerability, if exploited, could allow for widespread access to sensitive corporate financial data, far exceeding the initial scope of the engagement. The tester has the technical capability to exploit this vulnerability further and confirm its impact. What is the most ethically sound and professionally responsible course of action?

Accepted Answer

Immediately cease further exploitation of the out-of-scope vulnerability and promptly notify the client's designated point of contact, providing details of the discovery and awaiting further instructions.

Question 10

Consider a scenario where a penetration testing engagement initially targets an organization\'s on-premises Active Directory infrastructure. Midway through the engagement, the client reveals significant, unannounced changes to their network architecture, including the migration of critical authentication services to a new cloud-based identity provider. They now urgently request a validation of the security posture of this new cloud authentication system, with limited time remaining in the original contract. Which of the following actions best demonstrates the penetration tester\'s adaptability and problem-solving under these evolving conditions?

Accepted Answer

Re-prioritize testing efforts to focus on the cloud authentication system, adjusting the methodology to conduct targeted tests against its exposed interfaces and configurations, while communicating the revised scope and limitations to the client.

Question 11

During a penetration test of a critical infrastructure client\'s industrial control system (ICS) network, a tester discovers a previously uncatalogued vulnerability in a proprietary supervisory control and data acquisition (SCADA) component. The client\'s engagement contract strictly prohibits any actions that could lead to operational disruption, and the defined scope is limited to vulnerability identification and reporting. The tester has successfully identified a unique behavior that suggests a potential command injection vector, but the specific exploit path and its impact are entirely unknown due to the system\'s proprietary nature. Which of the following actions best aligns with the penetration tester\'s ethical obligations and the engagement\'s constraints?

Accepted Answer

Document the observed behavior, its potential implications for system integrity, and recommend a collaborative, out-of-band investigation by the client's internal security team, providing all gathered technical details for their analysis.

Question 12

A penetration tester, operating under a strict statement of work for a web application security assessment, uncovers a severe SQL injection vulnerability that grants unfettered access to sensitive customer data. The tester has successfully exfiltrated a small sample of this data to confirm the exploit\'s efficacy and has identified the precise injection vector. Given the critical nature of this discovery and the need to balance thoroughness with timely risk mitigation, what is the most appropriate immediate action for the penetration tester to take?

Accepted Answer

Immediately notify the client's designated point of contact, providing a concise summary of the critical vulnerability and its potential impact.

Question 13

Following a successful initial compromise during a network penetration test, a security analyst discovers a zero-day exploit targeting a widely used enterprise application, which, if leveraged, could lead to unauthorized access to sensitive customer data and significant operational disruption. The engagement contract clearly outlines the scope, rules of engagement, and communication protocols, including a designated primary contact for critical findings. The analyst has already validated the exploit\'s effectiveness in a controlled manner within the test environment.

Which immediate course of action best demonstrates responsible disclosure and adherence to professional penetration testing practices in this scenario?

Accepted Answer

Immediately inform the designated primary contact via a secure, out-of-band communication channel about the critical vulnerability and its potential impact, while concurrently preparing detailed documentation for the final report.

Question 14

During a post-engagement debrief, a penetration testing team leader learns that a client, previously focused on GDPR compliance, experienced a significant data breach impacting a substantial number of residents in California. The client has now urgently requested a revised testing plan that prioritizes compliance with the California Consumer Privacy Act (CCPA) for the upcoming quarter, while still acknowledging the need for ongoing security posture evaluation. Which strategic adjustment best reflects adaptability and flexibility in this scenario?

Accepted Answer

Revising the scope to prioritize CCPA-relevant data flows and access controls, while maintaining a baseline assessment of other critical systems.

Question 15

A penetration tester, while conducting a black-box assessment of a financial institution\'s e-commerce platform, uncovers a zero-day SQL injection vulnerability that could allow for complete database exfiltration. The client\'s Statement of Work (SOW) mandates a 72-hour notification period for all critical findings before the final report submission. The tester\'s assessment is scheduled to conclude in 48 hours, and the final report is due in 96 hours. Given the potential for catastrophic data loss, what is the most ethically sound and professionally responsible course of action?

Accepted Answer

Adhere to the 72-hour notification period as stipulated in the SOW, while preparing a comprehensive report detailing the vulnerability and its potential impact for immediate submission upon the expiry of the notification period.

Question 16

A penetration tester, engaged to assess the security of a specific web application, discovers a zero-day vulnerability in an adjacent, unpatched server that is directly accessible from the internet and appears to host sensitive customer data. This server was explicitly excluded from the engagement\'s scope document, which clearly states that any findings outside the defined parameters should be disregarded. However, the vulnerability could allow for widespread data exfiltration and compromise of the client\'s entire network infrastructure. What is the most ethically sound and professionally responsible action for the penetration tester to take?

Accepted Answer

Immediately notify the client's primary point of contact about the critical out-of-scope vulnerability, detailing its potential impact, and request explicit authorization to investigate and report on it.

Question 17

During a simulated network penetration test targeting a legacy industrial control system (ICS) environment, the assigned team discovers an undocumented communication protocol being used by a critical supervisory control unit. Standard network mapping tools and known exploit databases yield no relevant information, rendering the initial attack plan ineffective. The team lead must decide on the next course of action to maintain progress and achieve the engagement\'s objectives. Which of the following approaches best demonstrates the required behavioral competencies for this situation?

Accepted Answer

Immediately halt further testing on the ICS segment and document the discovery as an out-of-scope finding to avoid potential disruption, then refocus on other network areas.

Question 18

Anya, a penetration tester engaged for a routine web application assessment of a financial institution, uncovers a severe, unauthenticated SQL injection vulnerability during her initial reconnaissance. This flaw, if exploited, could lead to the compromise of sensitive customer Personally Identifiable Information (PII), a scenario that would likely incur substantial regulatory fines under frameworks like GDPR or CCPA due to the nature of the data and the industry. The agreed-upon scope of work was limited to identifying common web vulnerabilities, and this specific, high-impact flaw was not explicitly included. Anya must now decide on the most responsible course of action, considering her professional obligations and the potential for significant harm to the client. Which of the following actions best demonstrates adherence to ethical penetration testing principles and effective client management in this situation?

Accepted Answer

Immediately notify the client's primary point of contact with a detailed report of the critical vulnerability, its potential impact, and a recommendation for an urgent scope amendment to address it thoroughly, while also providing preliminary mitigation advice.

Question 19

During an authorized penetration test of a financial institution\'s web application, a tester discovers a database query that inadvertently returns a significant volume of customer account numbers and social security numbers due to a poorly implemented authorization bypass. What is the most ethically and legally sound immediate course of action for the penetration tester?

Accepted Answer

Immediately cease all further testing on that specific vulnerability and securely document the discovery, then promptly report the nature and location of the exposed data to the client's primary point of contact for incident response.

Question 20

A penetration testing team was engaged for a comprehensive external network assessment of a financial institution. Midway through the engagement, a significant internal data breach occurs, diverting the client\'s entire IT security focus to incident response and containment. The client\'s CISO expresses concern about the ongoing external assessment\'s relevance given the internal crisis. How should the penetration testing team best demonstrate the behavioral competency of Adaptability and Flexibility in this context?

Accepted Answer

Proactively propose a re-scoping of the external assessment to include a limited internal reconnaissance phase, leveraging existing access, to identify potential lateral movement paths related to the breach, while clearly communicating the benefits of this adjusted approach to the client's immediate needs.

Question 21

A penetration tester, engaged to assess the security posture of a regional credit union, discovers an unpatched, internet-facing server running an outdated operating system during the initial reconnaissance phase. While this server is explicitly excluded from the defined scope of the engagement, the tester identifies a clear, exploitable vulnerability that provides a direct lateral movement path to a segment of the internal network containing sensitive customer data, which *is* within the defined scope. What is the most appropriate and professional course of action for the penetration tester in this situation?

Accepted Answer

Immediately inform the client's designated point of contact about the discovery, its potential impact, and request authorization to include the system in the assessment.

Question 22

A penetration tester, engaged in a black-box assessment with a clearly defined scope, uncovers a critical vulnerability leading to unauthorized access of customer Personally Identifiable Information (PII). While documenting this finding, the tester also identifies a separate, high-severity vulnerability in a system explicitly excluded from the engagement\'s scope, which could lead to the exfiltration of proprietary company secrets. The contract mandates immediate reporting of all findings and strictly defines the engagement\'s boundaries. What is the most ethically sound and professionally responsible course of action for the penetration tester?

Accepted Answer

Report both the in-scope PII vulnerability and the out-of-scope intellectual property vulnerability to the client immediately, explaining the rationale for reporting the out-of-scope finding due to its severity and potential impact.

Question 23

Following a successful initial compromise of a web server, a penetration tester has established a low-privilege shell. The immediate goal is to access critical system configuration files that are protected by stricter access controls. The current user context does not possess the necessary read permissions for these files. Which of the following post-exploitation actions would be the most direct and effective method to achieve the objective of reading these sensitive configuration files?

Accepted Answer

Identify and exploit a local privilege escalation vulnerability on the compromised host.

Question 24

A penetration testing engagement has been authorized to assess the security posture of a financial institution\'s customer-facing web application. During the testing, the tester discovers an internal administrative interface accessible via a default, unpatched gateway device that was not explicitly included in the scope of work. This interface reveals a critical zero-day vulnerability in the institution\'s core banking system, which could lead to widespread data compromise. What is the most appropriate immediate course of action for the penetration tester?

Accepted Answer

Immediately cease all activity on the unauthorized network segment and report the discovery and unauthorized access to the client, awaiting further instructions.

Question 25

A penetration testing team, engaged to assess an organization\'s external attack surface, discovers during their initial reconnaissance that the client has recently received a critical advisory from a national cybersecurity agency regarding a zero-day vulnerability affecting a core internal application. This advisory mandates immediate internal network hardening and data flow monitoring. The client, now prioritizing this new threat, requests the team to shift focus from external testing to an expedited internal assessment of critical systems and data exfiltration pathways, with a revised deadline. Which behavioral competency is most directly demonstrated by the penetration tester\'s required response to this situation?

Accepted Answer

Adaptability and Flexibility

Question 26

A penetration testing engagement for a mid-sized financial institution has entered its second week. The primary point of contact, a busy department manager, has repeatedly changed the scope of the test, initially focusing on external network vulnerabilities, then shifting to internal application testing, and most recently expressing concern about cloud service configurations. During status calls, the manager often provides vague directives and seems overwhelmed by the technical details, frequently asking the penetration tester to \"just figure out what\'s most important.\" The penetration testing team is struggling to maintain consistent progress and faces potential delays if a clear direction isn\'t established soon. Which of the following approaches best addresses the penetration tester\'s need to adapt to this dynamic and ambiguous client environment while ensuring the engagement\'s success?

Accepted Answer

Proactively develop a risk-based testing matrix that categorizes potential vulnerabilities based on likelihood and impact, presenting it to the client to facilitate a more structured discussion and joint prioritization of testing areas.

Question 27

A penetration testing team is conducting a comprehensive assessment of a financial institution. Their initial reconnaissance phase identified a perimeter with several known vulnerabilities in legacy web applications, suggesting a specific attack path. During the execution phase, after gaining initial access to a less critical system, the team discovers that the target organization has recently implemented significant network segmentation and deployed advanced endpoint detection and response (EDR) solutions that were not apparent during the initial information gathering. The original exploitation plan, relying on known unpatched services, is now largely invalidated. What core behavioral competency is most critical for the penetration testing team to effectively navigate this situation and continue the engagement successfully?

Accepted Answer

Adaptability and Flexibility

Question 28

A penetration testing team is engaged to assess the security posture of a financial institution. The client has provided strict guidelines prohibiting any actions that could lead to the disruption of internal services, particularly those supporting critical operations. During the reconnaissance phase, the team identifies a web application hosted on an internal server, accessible only from the corporate network, which exhibits a common injection flaw. Further investigation reveals that a remotely accessible, yet poorly secured, IoT device on the organization\'s perimeter network could potentially be compromised. If compromised, this IoT device could serve as an initial pivot point, enabling the team to exploit the internal web application vulnerability. Given the client\'s explicit prohibition against actions that might cause service disruption, which of the following represents the most appropriate course of action for the penetration testing team?

Accepted Answer

Document the discovered internal web application vulnerability and the potential attack path via the IoT device, including the associated risks of service disruption, and report it to the client without attempting exploitation through the IoT device.

Question 29

A penetration testing team is conducting a red team exercise for a global logistics company. The initial scope focused on identifying critical vulnerabilities within the corporate network perimeter and key operational technology (OT) systems. Midway through the engagement, intelligence reports emerge indicating a rise in targeted supply chain attacks using compromised third-party vendor credentials, a vector not explicitly detailed in the original engagement plan. The client expresses concern about the security posture of their vendor management process. Which of the following actions best demonstrates the team\'s adaptability and flexibility in response to this evolving threat landscape and client feedback?

Accepted Answer

Re-allocating resources to perform a deep dive into the security of the company's primary cloud infrastructure, as this was a stated secondary objective in the original scope.

Question 30

A penetration testing team is engaged to assess the security of a financial institution\'s online banking portal. During the initial phase, they discovered an SQL injection vulnerability that they planned to exploit. However, before the exploitation phase could commence, the client deployed an emergency patch that mitigated the identified vulnerability. The team\'s lead tester, Anya Sharma, needs to guide her team through this unexpected change. Which behavioral competency is most critical for Anya to demonstrate to effectively manage this situation and ensure the engagement\'s success?

Accepted Answer

Adaptability and Flexibility

PT0003 CompTIA PenTest+ Free Practice Test — 30 Questions

A lot more is already mapped out

About the PT0003 CompTIA PenTest+ Certification