CompTIA PenTest+ Practice Questions: Post-Exploitation

6 free, exam-style CompTIA PenTest+ (PT0-003) practice questions covering Post-Exploitation. Each question shows the correct answer and a clear explanation. Ready for the real thing? Take the full timed quiz below.

🚀 Take the full CompTIA PenTest+ quiz 📘 CompTIA PenTest+ study guide

Q1. After exploiting a host, which action helps preserve access for later testing within scope?

A.Establish approved persistence✓ Correct
B.Delete all logs without approval
C.Expand scope silently
D.Share credentials publicly

Explanation: Persistence may be tested only when authorized and documented in the engagement scope. Learn more.

Q2. Which technique abuses overly permissive SUID binaries on Linux?

A.Privilege escalation✓ Correct
B.Subnetting
C.Banner grabbing
D.Port forwarding only

Explanation: Misconfigured SUID binaries may execute with elevated privileges and allow local privilege escalation. Learn more.

Q3. Which file should be reviewed on Linux to identify accounts with login shells?

A./etc/passwd✓ Correct
B./etc/mtab only
C./etc/hosts.allow only
D./var/tmp

Explanation: /etc/passwd lists local accounts, user IDs, home directories, and login shells. Learn more.

Q4. Which lateral movement technique uses stolen NTLM hashes without knowing plaintext passwords?

A.Pass-the-hash✓ Correct
B.Bluebugging
C.Wardriving
D.DNSSEC validation

Explanation: Pass-the-hash authenticates with captured NTLM hashes instead of plaintext credentials. Learn more.

Q5. Which post-exploitation activity identifies sensitive files and databases reachable from a compromised account?

A.Data discovery✓ Correct
B.Scope removal
C.Cable tracing
D.SSID hiding

Explanation: Data discovery determines what sensitive data the compromised access can reach, within authorized test scope. Learn more.

Q6. Which technique maps internal network ranges after gaining a foothold?

A.Internal network discovery✓ Correct
B.Report proofreading
C.Disk wiping
D.Monitor calibration

Explanation: Internal discovery identifies reachable networks, hosts, and services from the compromised position. Learn more.