CompTIA PenTest+ Attacks and Exploits Practice Questions

Question 1

What is the main purpose of directory brute forcing against a web server?

Accepted Answer

Discover hidden paths and files

Answer

Tune Wi-Fi channels

Answer

Encrypt database fields

Answer

Assign DHCP leases

Question 2

Which vulnerability allows an attacker to make a database run unintended queries?

Accepted Answer

SQL injection

Answer

Port security

Answer

Open relay only

Answer

DNS round robin

Question 3

Which attack captures and relays authentication attempts without knowing the password?

Accepted Answer

NTLM relay

Answer

ARP cache timeout

Answer

DHCP reservation

Answer

DNS zone transfer

Question 4

What is the purpose of a reverse shell?

Accepted Answer

Make a compromised host initiate a connection back to the tester

Answer

Create a DNS MX record

Answer

Patch a kernel

Answer

Encrypt backup tapes

Question 5

Which wireless attack attempts to capture a WPA handshake for offline cracking?

Accepted Answer

Deauthentication followed by handshake capture

Answer

DNS poisoning only

Answer

VLAN hopping only

Answer

ICMP redirect only

Question 6

Which password attack uses known breached username and password pairs against another service?

Accepted Answer

Credential stuffing

Answer

ARP spoofing

Answer

Kerberoasting only

Answer

Rainbow table creation only

Question 7

Which Kerberos attack targets service tickets for offline password cracking?

Accepted Answer

Kerberoasting

Answer

Bluejacking

Answer

DNS tunneling

Answer

Smurf attack

Question 8

Which web vulnerability allows attacker-controlled JavaScript to run in another user browser?

Accepted Answer

Cross-site scripting

Answer

Directory traversal only

Answer

Kerberoasting

Answer

ARP spoofing

Question 9

Which payload type attempts to access files outside the intended web directory using ../ sequences?

Accepted Answer

Directory traversal

Answer

DNS amplification

Answer

SQL injection

Answer

LDAP bind

Question 10

Which test checks whether an application enforces authorization on object IDs a user can modify?

Accepted Answer

IDOR testing

Answer

VLAN trunk testing

Answer

PoE budget testing

Answer

DNS recursion testing

Question 11

Which social engineering pretext risk is reduced by requiring callback verification through known numbers?

Accepted Answer

Impersonation by phone

Answer

Packet fragmentation

Answer

SQL injection

Answer

VLAN hopping

Question 12

Which attack takes advantage of weak cloud storage permissions?

Accepted Answer

Public bucket enumeration

Answer

Printer firmware downgrade

Answer

DHCP lease renewal

Answer

VGA spoofing

Question 13

Which exploit development protection makes memory addresses harder to predict?

Accepted Answer

ASLR

Answer

SMTP

Answer

NTP

Answer

SNMP

Question 14

Which mobile test issue allows a rooted device to read sensitive app tokens from local storage?

Accepted Answer

Insecure local storage

Answer

Least privilege permissions

Answer

Strong certificate pinning

Answer

Encrypted keychain use

Question 15

Which attack abuses excessive permissions granted to a cloud instance role?

Accepted Answer

Cloud privilege escalation

Answer

DHCP starvation only

Answer

RF jamming

Answer

Cable crosstalk

Question 16

Which attack tries one common password against many accounts to avoid lockouts?

Accepted Answer

Password spraying

Answer

Dictionary attack

Answer

Credential stuffing

Answer

Rainbow table attack

Question 17

Which attack reuses username and password pairs stolen from an unrelated breach?

Accepted Answer

Credential stuffing

Answer

Brute force

Answer

Kerberoasting

Answer

Password spraying

Question 18

What does a cross-site request forgery attack cause a victim to do?

Accepted Answer

Submit an unintended authenticated request to a site they are logged into

Answer

Download a malicious binary

Answer

Run attacker JavaScript in their browser

Answer

Disclose their password hash

Question 19

Which cross-site scripting variant is stored on the server and served to other users?

Accepted Answer

Persistent (stored) XSS

Answer

DOM-based XSS

Answer

Reflected XSS

Answer

Blind SQL injection

Question 20

Which injection flaw allows an attacker to run operating system commands through an application?

Accepted Answer

Command injection

Answer

Insecure deserialization

Answer

Cross-site scripting

Answer

Clickjacking

Question 21

What makes blind SQL injection harder to exploit than standard SQL injection?

Accepted Answer

The application returns no direct query output to the attacker

Answer

The database is hosted in the cloud

Answer

The application uses HTTPS

Answer

The database is encrypted

Question 22

Which technique confirms SQL injection when the application shows no error or data?

Accepted Answer

Time-based inference using a deliberate delay function

Answer

Sending a malformed TLS handshake

Answer

Running an ARP scan

Answer

Reading the server's private key

Question 23

What is the goal of a server-side request forgery attack?

Accepted Answer

Make the server issue requests to internal systems the attacker cannot reach

Answer

Crack password hashes offline

Answer

Intercept wireless traffic

Answer

Run JavaScript in another user's browser

Question 24

Which cloud attack does SSRF frequently enable?

Accepted Answer

Reading instance metadata to steal temporary credentials

Answer

Disabling the cloud provider's billing

Answer

Physically accessing the data centre

Answer

Rewriting the provider's DNS

Question 25

Which attack intercepts and potentially alters traffic between two parties?

Accepted Answer

On-path (man-in-the-middle) attack

Answer

Privilege escalation

Answer

Denial of service

Answer

Buffer overflow

Question 26

What does ARP spoofing achieve on a local network?

Accepted Answer

Redirects traffic for a target IP to the attacker's MAC address

Answer

Assigns new IP addresses to hosts

Answer

Encrypts traffic between switches

Answer

Disables the switch's power

Question 27

Which attack captures a WPA2 four-way handshake for offline password cracking?

Accepted Answer

Deauthentication followed by handshake capture

Answer

Bluetooth pairing attack

Answer

Evil twin portal only

Answer

WPS PIN brute force

Question 28

What is an evil twin attack?

Accepted Answer

A rogue access point impersonating a legitimate SSID

Answer

Two identical malware samples

Answer

A cloned MAC address on a switch

Answer

A duplicate DNS record

Question 29

Which social engineering technique uses a phone call to manipulate a target?

Accepted Answer

Vishing

Answer

Pharming

Answer

Smishing

Answer

Phishing

Question 30

What is pretexting in a social engineering engagement?

Accepted Answer

Inventing a believable scenario and identity to gain trust

Answer

Following an employee through a secure door

Answer

Leaving infected USB drives in a car park

Answer

Sending mass phishing emails

Question 31

Which physical attack involves following an authorised person through a controlled door?

Accepted Answer

Tailgating

Answer

Shoulder surfing

Answer

Dumpster diving

Answer

Badge cloning

Question 32

What is the purpose of a reverse shell rather than a bind shell?

Accepted Answer

The target connects outward to the tester, bypassing inbound filtering

Answer

It requires no exploit

Answer

It encrypts all traffic automatically

Answer

It escalates privileges automatically

Question 33

Which attack exploits a program writing more data than a buffer can hold?

Accepted Answer

Buffer overflow

Answer

Integer underflow only

Answer

Race condition

Answer

Format string only

Question 34

What does insecure deserialization allow in a vulnerable application?

Accepted Answer

Attacker-controlled objects that can lead to code execution

Answer

Reading the server's TLS certificate

Answer

Enumerating open UDP ports

Answer

Capturing wireless handshakes

Question 35

Which attack against Kerberos requests service tickets to crack offline?

Accepted Answer

Kerberoasting

Answer

Pass-the-hash

Answer

DCSync

Answer

Golden ticket creation

Question 36

Which weakness makes Kerberoasting particularly effective?

Accepted Answer

Service accounts with weak passwords and no rotation

Answer

Multi-factor authentication on workstations

Answer

Short ticket lifetimes

Answer

Use of AES encryption

Question 37

What is the purpose of a payload in an exploitation framework?

Accepted Answer

The code that runs on the target after the exploit succeeds

Answer

The report template

Answer

The network scan configuration

Answer

The vulnerability scanner signature

Question 38

Which factor should most influence whether a tester runs a known-unstable exploit?

Accepted Answer

The rules of engagement and the risk of disrupting the service

Answer

The programming language used

Answer

The exploit's popularity

Answer

The size of the exploit code

Question 39

Which attack manipulates a web application's logic to change an order's price?

Accepted Answer

Business logic abuse via parameter tampering

Answer

Cross-site scripting

Answer

Deauthentication

Answer

ARP spoofing

Question 40

Which vulnerability lets an attacker access another user's record by changing an ID value?

Accepted Answer

Insecure direct object reference

Answer

Command injection

Answer

Clickjacking

Answer

Cross-site scripting

Question 41

What does clickjacking rely on?

Accepted Answer

Overlaying invisible framed content over what the user thinks they are clicking

Answer

Capturing a wireless handshake

Answer

Injecting SQL into a query

Answer

Cracking a password hash

Question 42

Which attack targets a specific high-value individual with a tailored message?

Accepted Answer

Spear phishing

Answer

Smurf attack

Answer

Password spraying

Answer

Rainbow table

Question 43

Which weakness allows an attacker to upload and execute a web shell?

Accepted Answer

Unrestricted file upload that permits executable file types

Answer

Verbose error messages

Answer

TLS 1.2 support

Answer

Missing HSTS header

Question 44

Which mobile testing finding most directly exposes session tokens?

Accepted Answer

Sensitive tokens written to unprotected local storage

Answer

The app supporting dark mode

Answer

The app requesting camera permission

Answer

The app using a custom font

Question 45

What does a padding oracle attack exploit?

Accepted Answer

Differences in error responses that reveal information about decryption

Answer

Unrestricted file upload

Answer

Weak wireless encryption only

Answer

Missing input length checks

Question 46

Which is the most appropriate first step after gaining a low-privilege shell?

Accepted Answer

Enumerate the host for privilege escalation paths

Answer

Disable the antivirus service

Answer

Install persistent malware

Answer

Immediately delete system logs

Question 47

Which type of denial of service amplifies traffic using third-party servers?

Accepted Answer

Reflection and amplification attack

Answer

SYN flood from a single host

Answer

Ping of death

Answer

Slowloris

Question 48

Why is denial of service usually excluded from penetration test scope?

Accepted Answer

It risks business disruption without demonstrating access

Answer

It is technically impossible to perform

Answer

Scanners cannot detect it

Answer

It is always illegal in every jurisdiction

Question 49

Which attack forges a request to a cloud metadata endpoint to obtain credentials?

Accepted Answer

SSRF against the instance metadata service

Answer

DNS zone transfer

Answer

Wireless deauthentication

Answer

ARP cache poisoning

Question 50

What is the main risk of an overly permissive cloud storage bucket policy?

Accepted Answer

Anonymous users can list and read stored objects

Answer

The region cannot be changed

Answer

Costs will always increase

Answer

The bucket will be deleted automatically

Question 51

Which attack technique bypasses a web application firewall by altering payload representation?

Accepted Answer

Encoding and obfuscation of the payload

Answer

Increasing the request size only

Answer

Using a different browser

Answer

Sending the payload over UDP

Question 52

Which finding indicates a successful session fixation vulnerability?

Accepted Answer

The session identifier does not change after authentication

Answer

The session identifier is 128 bits

Answer

The session cookie has the Secure flag

Answer

The session expires after 15 minutes

CompTIA PenTest+ Practice Questions: Attacks and Exploits

Mini Exam

Mock PenTest+ Exam

Daily Quiz

Standard Practice

Attacks and Exploits practice questions

Q1. What is the main purpose of directory brute forcing against a web server?

Q2. Which vulnerability allows an attacker to make a database run unintended queries?

Q3. Which attack captures and relays authentication attempts without knowing the password?

Q4. What is the purpose of a reverse shell?

Q5. Which wireless attack attempts to capture a WPA handshake for offline cracking?

Q6. Which password attack uses known breached username and password pairs against another service?

Q7. Which Kerberos attack targets service tickets for offline password cracking?

Q8. Which web vulnerability allows attacker-controlled JavaScript to run in another user browser?

Q9. Which payload type attempts to access files outside the intended web directory using ../ sequences?

Q10. Which test checks whether an application enforces authorization on object IDs a user can modify?

Q11. Which social engineering pretext risk is reduced by requiring callback verification through known numbers?

Q12. Which attack takes advantage of weak cloud storage permissions?

Q13. Which exploit development protection makes memory addresses harder to predict?

Q14. Which mobile test issue allows a rooted device to read sensitive app tokens from local storage?

Q15. Which attack abuses excessive permissions granted to a cloud instance role?

Q16. Which attack tries one common password against many accounts to avoid lockouts?

Q17. Which attack reuses username and password pairs stolen from an unrelated breach?

Q18. What does a cross-site request forgery attack cause a victim to do?

Q19. Which cross-site scripting variant is stored on the server and served to other users?

Q20. Which injection flaw allows an attacker to run operating system commands through an application?

Q21. What makes blind SQL injection harder to exploit than standard SQL injection?

Q22. Which technique confirms SQL injection when the application shows no error or data?

Q23. What is the goal of a server-side request forgery attack?

Q24. Which cloud attack does SSRF frequently enable?

Q25. Which attack intercepts and potentially alters traffic between two parties?

Q26. What does ARP spoofing achieve on a local network?

Q27. Which attack captures a WPA2 four-way handshake for offline password cracking?

Q28. What is an evil twin attack?

Q29. Which social engineering technique uses a phone call to manipulate a target?

Q30. What is pretexting in a social engineering engagement?

Q31. Which physical attack involves following an authorised person through a controlled door?

Q32. What is the purpose of a reverse shell rather than a bind shell?

Q33. Which attack exploits a program writing more data than a buffer can hold?

Q34. What does insecure deserialization allow in a vulnerable application?

Q35. Which attack against Kerberos requests service tickets to crack offline?

Q36. Which weakness makes Kerberoasting particularly effective?

Q37. What is the purpose of a payload in an exploitation framework?

Q38. Which factor should most influence whether a tester runs a known-unstable exploit?

Q39. Which attack manipulates a web application's logic to change an order's price?

Q40. Which vulnerability lets an attacker access another user's record by changing an ID value?

Q41. What does clickjacking rely on?

Q42. Which attack targets a specific high-value individual with a tailored message?

Q43. Which weakness allows an attacker to upload and execute a web shell?

Q44. Which mobile testing finding most directly exposes session tokens?

Q45. What does a padding oracle attack exploit?

Q46. Which is the most appropriate first step after gaining a low-privilege shell?

Q47. Which type of denial of service amplifies traffic using third-party servers?

Q48. Why is denial of service usually excluded from penetration test scope?

Q49. Which attack forges a request to a cloud metadata endpoint to obtain credentials?

Q50. What is the main risk of an overly permissive cloud storage bucket policy?

Q51. Which attack technique bypasses a web application firewall by altering payload representation?

Q52. Which finding indicates a successful session fixation vulnerability?

More CompTIA PenTest+ practice topics

Keep studying CompTIA PenTest+