CompTIA PenTest+ Practice Questions: More Practice Questions

24 free, exam-style CompTIA PenTest+ (PT0-003) practice questions covering More Practice Questions. Each question shows the correct answer and a clear explanation. Ready for the real thing? Take the full timed quiz below.

🚀 Take the full CompTIA PenTest+ quiz 📘 CompTIA PenTest+ study guide

Q1. Which reconnaissance method avoids directly interacting with the target systems?

Explanation: Passive reconnaissance gathers information from public or third-party sources without touching target systems directly. Learn more.

Q2. Which Nmap option attempts service and version detection?

Explanation: The -sV option probes open ports to identify service versions. Learn more.

Q3. Which scan type completes a TCP three-way handshake before closing the connection?

Explanation: A TCP connect scan uses the operating system to complete the full TCP handshake. Learn more.

Q4. Which finding indicates sensitive files may be exposed through a public code repository?

Explanation: Secrets committed to public repositories can allow unauthorized access to systems or services. Learn more.

Q5. What is the main purpose of directory brute forcing against a web server?

Explanation: Directory brute forcing checks common or generated paths to discover content not linked from the site. Learn more.

Q6. Which web vulnerability allows attacker-controlled JavaScript to run in another user browser?

Explanation: Cross-site scripting occurs when untrusted script content is executed in users browsers. Learn more.

Q7. Which payload type attempts to access files outside the intended web directory using ../ sequences?

Explanation: Directory traversal abuses path handling to reach files outside the web root or intended directory. Learn more.

Q8. Which test checks whether an application enforces authorization on object IDs a user can modify?

Explanation: Insecure direct object reference testing checks whether users can access or change objects they do not own. Learn more.

Q9. Which tool is commonly used to intercept and modify web requests during testing?

Explanation: Burp Suite acts as an intercepting proxy for web application security testing. Learn more.

Q10. Which code review issue most directly enables command injection?

Explanation: Command injection occurs when untrusted input is passed to shell commands without safe handling. Learn more.

Q11. Which tool is commonly used for password hash cracking?

Explanation: Hashcat is a common tool for offline password hash cracking. Learn more.

Q12. Which tool is commonly used for web server vulnerability scanning and misconfiguration checks?

Explanation: Nikto checks web servers for known dangerous files, outdated software, and misconfigurations. Learn more.

Q13. Which cloud model provides virtual machines?

Explanation: IaaS offers VM/hardware resources. Learn more.

Q14. Which cloud deployment model uses on-prem + cloud?

Explanation: Hybrid clouds integrate local infrastructure with cloud services. Learn more.

Q15. Which cloud service model provides virtual machines?

Explanation: Infrastructure-as-a-Service offers VM/hardware resources. Learn more.

Q16. Which component is critical for virtualization performance?

Explanation: Multiple CPU cores handle VM workloads. Learn more.

Q17. Which component is most critical for virtualization performance?

Explanation: Multiple CPU cores handle parallel VM workloads efficiently. Learn more.

Q18. What is the purpose of a VM hypervisor?

Explanation: Hypervisors (Type 1/2) manage host hardware for guest VMs. Learn more.

Q19. Which attack takes advantage of weak cloud storage permissions?

Explanation: Public cloud storage enumeration checks for exposed buckets or objects caused by weak permissions. Learn more.

Q20. Which attack abuses excessive permissions granted to a cloud instance role?

Explanation: Overprivileged cloud roles can let a compromised workload access or modify additional cloud resources. Learn more.

Q21. Which wireless attack attempts to capture a WPA handshake for offline cracking?

Explanation: Deauthentication can force clients to reconnect, allowing capture of the WPA handshake for offline password testing. Learn more.

Q22. Which vulnerability scanner mode uses valid credentials for deeper checks?

Explanation: Authenticated scans log in to systems to check patch levels, configurations, and local vulnerabilities more accurately. Learn more.

Q23. Which social engineering pretext risk is reduced by requiring callback verification through known numbers?

Explanation: Callback verification using trusted contact information helps prevent phone-based impersonation. Learn more.

Q24. Which mobile test issue allows a rooted device to read sensitive app tokens from local storage?

Explanation: Sensitive tokens stored insecurely on a mobile device can be recovered from local files or databases. Learn more.

More CompTIA PenTest+ practice topics