CompTIA PenTest+ Post-exploitation and Lateral Movement Practice Questions

Question 1

After exploiting a host, which action helps preserve access for later testing within scope?

Accepted Answer

Establish approved persistence

Answer

Delete all logs without approval

Answer

Share credentials publicly

Answer

Expand scope silently

Question 2

Which technique abuses overly permissive SUID binaries on Linux?

Accepted Answer

Privilege escalation

Answer

Banner grabbing

Answer

Subnetting

Answer

Port forwarding only

Question 3

Which file should be reviewed on Linux to identify accounts with login shells?

Accepted Answer

/etc/passwd

Answer

/etc/mtab only

Answer

/var/tmp

Answer

/etc/hosts.allow only

Question 4

Which lateral movement technique uses stolen NTLM hashes without knowing plaintext passwords?

Accepted Answer

Pass-the-hash

Answer

Bluebugging

Answer

DNSSEC validation

Answer

Wardriving

Question 5

Which post-exploitation activity identifies sensitive files and databases reachable from a compromised account?

Accepted Answer

Data discovery

Answer

SSID hiding

Answer

Cable tracing

Answer

Scope removal

Question 6

Which technique maps internal network ranges after gaining a foothold?

Accepted Answer

Internal network discovery

Answer

Report proofreading

Answer

Disk wiping

Answer

Monitor calibration

Question 7

Which Windows technique authenticates using a captured NTLM hash without cracking it?

Accepted Answer

Pass-the-hash

Answer

Kerberoasting

Answer

Password spraying

Answer

Credential stuffing

Question 8

What is the purpose of lateral movement after initial compromise?

Accepted Answer

Reaching additional systems to progress toward the engagement objective

Answer

Removing all evidence of the test

Answer

Increasing privileges on the same host only

Answer

Reducing the target's attack surface

Question 9

Which Linux misconfiguration commonly enables local privilege escalation?

Accepted Answer

A SUID binary that can execute arbitrary commands

Answer

A user in the audio group

Answer

A non-root cron job with no privileges

Answer

An idle SSH session

Question 10

Which command reveals sudo rights available to the current Linux user?

Accepted Answer

sudo -l

Answer

whoami

Answer

uname -a

Answer

id -u

Question 11

What is the risk of an unquoted Windows service path?

Accepted Answer

A binary planted in a parent directory may run with service privileges

Answer

The registry becomes corrupted

Answer

The firewall is disabled

Answer

The service cannot start

Question 12

Which technique extracts credentials from Windows memory?

Accepted Answer

Dumping LSASS process memory

Answer

Reading the hosts file

Answer

Querying DNS

Answer

Listing scheduled tasks

Question 13

What should a tester do with persistence mechanisms created during an engagement?

Accepted Answer

Document them and remove them during cleanup

Answer

Leave them for the client to find

Answer

Transfer them to another client

Answer

Encrypt them and keep access

Question 14

Which activity is normally prohibited unless explicitly authorised in writing?

Accepted Answer

Deleting or altering logs to hide tester activity

Answer

Taking screenshots as evidence

Answer

Enumerating local users

Answer

Recording command output

Question 15

What is credential harvesting in post-exploitation?

Accepted Answer

Collecting stored passwords, hashes, keys, and tokens from a compromised host

Answer

Guessing passwords over the network

Answer

Scanning for open ports

Answer

Cracking WPA2 handshakes

Question 16

Which Active Directory attack replicates directory data as if the tester were a domain controller?

Accepted Answer

DCSync

Answer

AS-REP roasting

Answer

Kerberoasting

Answer

Password spraying

Question 17

Which technique moves between hosts using legitimate remote administration tools?

Accepted Answer

Living off the land using built-in utilities

Answer

Sending phishing emails

Answer

Deploying a custom rootkit

Answer

Running a port scan

Question 18

What does pivoting through a compromised host allow a tester to do?

Accepted Answer

Reach network segments not directly routable from the tester's position

Answer

Decrypt all network traffic

Answer

Escalate privileges automatically

Answer

Disable the target's firewall

Question 19

Which finding best demonstrates inadequate network segmentation?

Accepted Answer

A workstation subnet can reach server management interfaces directly

Answer

A VLAN uses tagged frames

Answer

Two servers share a rack

Answer

A firewall logs denied traffic

Question 20

Why should testers record timestamps and source addresses for all actions?

Accepted Answer

So the client can correlate tester activity against their own alerts

Answer

To increase the report's page count

Answer

To satisfy the scanner license

Answer

To prove the client was negligent

Question 21

Which post-exploitation action most clearly exceeds a standard test scope?

Accepted Answer

Exfiltrating real customer personal data to an external system

Answer

Listing directory names on a file share

Answer

Recording a screenshot of a shell prompt

Answer

Noting the operating system version

CompTIA PenTest+ Practice Questions: Post-exploitation and Lateral Movement

Mini Exam

Mock PenTest+ Exam

Daily Quiz

Standard Practice

Post-exploitation and Lateral Movement practice questions

Q1. After exploiting a host, which action helps preserve access for later testing within scope?

Q2. Which technique abuses overly permissive SUID binaries on Linux?

Q3. Which file should be reviewed on Linux to identify accounts with login shells?

Q4. Which lateral movement technique uses stolen NTLM hashes without knowing plaintext passwords?

Q5. Which post-exploitation activity identifies sensitive files and databases reachable from a compromised account?

Q6. Which technique maps internal network ranges after gaining a foothold?

Q7. Which Windows technique authenticates using a captured NTLM hash without cracking it?

Q8. What is the purpose of lateral movement after initial compromise?

Q9. Which Linux misconfiguration commonly enables local privilege escalation?

Q10. Which command reveals sudo rights available to the current Linux user?

Q11. What is the risk of an unquoted Windows service path?

Q12. Which technique extracts credentials from Windows memory?

Q13. What should a tester do with persistence mechanisms created during an engagement?

Q14. Which activity is normally prohibited unless explicitly authorised in writing?

Q15. What is credential harvesting in post-exploitation?

Q16. Which Active Directory attack replicates directory data as if the tester were a domain controller?

Q17. Which technique moves between hosts using legitimate remote administration tools?

Q18. What does pivoting through a compromised host allow a tester to do?

Q19. Which finding best demonstrates inadequate network segmentation?

Q20. Why should testers record timestamps and source addresses for all actions?

Q21. Which post-exploitation action most clearly exceeds a standard test scope?

More CompTIA PenTest+ practice topics

Keep studying CompTIA PenTest+