CompTIA PenTest+ Practice Questions: Reconnaissance and Enumeration

31 free, exam-style CompTIA PenTest+ (PT0-003) practice questions covering Reconnaissance and Enumeration, each with the correct answer and an explanation. Start a timed exam below, or scroll on to read through the questions.

🧠

Mini Exam

25 Questions · 50 minutes

Start Quiz 🚀
🏆

Mock PenTest+ Exam

85 Questions · 165 minutes

Start Quiz 🚀
📅

Daily Quiz

10 Questions · 20 minutes

Start Quiz 🚀
🎯

Standard Practice

50 Questions · 100 minutes

Start Quiz 🚀

Reconnaissance and Enumeration practice questions

Answers and explanations are shown. Take the timed exam above to test yourself first.

Q1. Which reconnaissance method avoids directly interacting with the target systems?

  • A.Exploit attempt
  • B.Passive OSINT collection✓ Correct
  • C.Authenticated vulnerability scan
  • D.Password spraying
Explanation: Passive reconnaissance gathers information from public or third-party sources without touching target systems directly. Learn more.

Q2. Which Nmap option attempts service and version detection?

  • A.-oA only
  • B.-sn
  • C.-sV✓ Correct
  • D.-Pn only
Explanation: The -sV option probes open ports to identify service versions. Learn more.

Q3. Which scan type completes a TCP three-way handshake before closing the connection?

  • A.Null scan
  • B.SYN half-open scan
  • C.TCP connect scan✓ Correct
  • D.UDP scan
Explanation: A TCP connect scan uses the operating system to complete the full TCP handshake. Learn more.

Q4. Which finding indicates sensitive files may be exposed through a public code repository?

  • A.Expired monitor warranty
  • B.Committed API keys✓ Correct
  • C.Printer tray mismatch
  • D.Low wireless signal
Explanation: Secrets committed to public repositories can allow unauthorized access to systems or services. Learn more.

Q5. Which Nmap flag performs a TCP SYN (half-open) scan?

  • A.-sn
  • B.-sU
  • C.-sT
  • D.-sS✓ Correct
Explanation: -sS sends a SYN and never completes the handshake, which is faster and historically less likely to be logged by the application than a full connect scan. Learn more.

Q6. Which Nmap option skips host discovery and treats all targets as online?

  • A.-sn
  • B.-Pn✓ Correct
  • C.-oA
  • D.-A
Explanation: -Pn is used when ICMP and other discovery probes are filtered, so hosts would otherwise be wrongly marked down and never scanned. Learn more.

Q7. What does the Nmap flag -sn accomplish?

  • A.A scan of the top 1000 TCP ports
  • B.Host discovery only, with no port scan✓ Correct
  • C.A UDP scan of all ports
  • D.An aggressive OS detection scan
Explanation: -sn performs a ping sweep to enumerate live hosts without scanning ports, useful for quickly mapping a range. Learn more.

Q8. Which record type would you query to enumerate a domain's mail servers?

  • A.PTR
  • B.A
  • C.CNAME
  • D.MX✓ Correct
Explanation: MX records identify mail exchangers, which often expose additional infrastructure and third-party mail providers. Learn more.

Q9. Which technique attempts to retrieve an entire DNS zone from a misconfigured name server?

  • A.DNSSEC validation
  • B.DNS cache poisoning
  • C.Zone transfer (AXFR)✓ Correct
  • D.Reverse lookup
Explanation: A permitted AXFR hands over every record in the zone at once, which is a significant information disclosure and a classic misconfiguration. Learn more.

Q10. Which of these is an example of passive reconnaissance?

  • A.Sending a phishing email to a target employee
  • B.Running a port scan against the target
  • C.Performing banner grabbing on a web server
  • D.Reviewing the target's public certificate transparency logs✓ Correct
Explanation: Passive reconnaissance gathers information without touching the target's systems. Certificate transparency logs are third-party public data. Learn more.

Q11. What is the main penetration testing value of certificate transparency logs?

  • A.They reveal subdomains and hostnames the organization has issued certificates for✓ Correct
  • B.They list open ports on the web server
  • C.They contain the private keys for the domain
  • D.They show which users have logged in
Explanation: CT logs are public and routinely expose internal-sounding hostnames such as vpn, dev, and staging, expanding the attack surface map. Learn more.

Q12. Which tool is most commonly associated with querying domain registration and ownership data?

  • A.whois✓ Correct
  • B.netcat
  • C.hashcat
  • D.hydra
Explanation: whois returns registrar, registrant, and often technical contact details useful for both scoping and social engineering pretexts. Learn more.

Q13. Which technique enumerates valid usernames by comparing the application's responses to login attempts?

  • A.Password spraying
  • B.Pass-the-hash
  • C.Username enumeration through response differences✓ Correct
  • D.Credential stuffing
Explanation: If an application says 'user not found' versus 'incorrect password', or responds measurably faster for invalid users, valid accounts can be enumerated. Learn more.

Q14. Which SMB enumeration result would most interest a tester on an internal network?

  • A.A share readable by anonymous or guest access✓ Correct
  • B.A host running SMBv3
  • C.A server responding to ping
  • D.A share with an unusual name
Explanation: Anonymously readable shares frequently contain scripts, backups, and configuration files holding credentials. Learn more.

Q15. What is the purpose of banner grabbing?

  • A.Identifying the service and version listening on a port✓ Correct
  • B.Capturing user credentials in transit
  • C.Bypassing a web application firewall
  • D.Denying service to the target
Explanation: Service banners reveal software and version strings, which map directly to known vulnerabilities during analysis. Learn more.

Q16. Which Nmap option runs the default script set for additional enumeration?

  • A.-T4
  • B.-sV
  • C.-sC✓ Correct
  • D.-p-
Explanation: -sC runs the default NSE script category, adding enumeration detail beyond the port state and version information. Learn more.

Q17. Which Nmap flag scans all 65535 TCP ports?

  • A.--open
  • B.-p-✓ Correct
  • C.-F
  • D.-top-ports 100
Explanation: -p- covers the full TCP range. Services on high, non-standard ports are routinely missed by default scans. Learn more.

Q18. A tester wants to identify live hosts on an internal /24 without sending traffic to every port. Which approach is most efficient?

  • A.A UDP scan of all ports on all hosts
  • B.A full TCP connect scan of all ports on all hosts
  • C.An OS detection scan of all hosts
  • D.An ARP-based host discovery sweep of the local segment✓ Correct
Explanation: On a local segment ARP discovery is fast and highly reliable because hosts must answer ARP to communicate at all. Learn more.

Q19. Which of the following best describes OSINT in a penetration test?

  • A.Scanning the target's internal network
  • B.Exploiting a public-facing service
  • C.Reviewing the target's source code with their permission
  • D.Collecting publicly available information about the target✓ Correct
Explanation: Open source intelligence draws only on public sources: sites, filings, social media, job listings, code repositories, and public records. Learn more.

Q20. Why are job postings useful during reconnaissance?

  • A.They often name specific technologies and versions in use✓ Correct
  • B.They provide VPN configuration files
  • C.They contain employee passwords
  • D.They list open firewall ports
Explanation: Postings asking for experience with named products and versions effectively disclose the internal technology stack. Learn more.

Q21. Which type of scan is most likely to be missed if a tester only scans TCP?

  • A.SSH on port 22
  • B.Web servers on port 443
  • C.Services on UDP such as SNMP, DNS, and TFTP✓ Correct
  • D.SMB on port 445
Explanation: UDP services are frequently overlooked, yet SNMP with default community strings is a common and high-value finding. Learn more.

Q22. What does an SNMP community string of 'public' typically allow?

  • A.The ability to reboot the device only
  • B.Read access to device configuration and system information✓ Correct
  • C.Full administrative shell access
  • D.Encrypted management access
Explanation: Default read community strings expose interface details, routes, running configuration fragments, and sometimes far more. Learn more.

Q23. Which enumeration step best identifies the technology stack behind a web application?

  • A.Checking the WHOIS record
  • B.Running a UDP scan
  • C.Performing a zone transfer
  • D.Inspecting response headers, cookies, and error pages✓ Correct
Explanation: Server and X-Powered-By headers, framework-specific cookie names, and default error pages all fingerprint the stack. Learn more.

Q24. What is the purpose of subdomain enumeration?

  • A.To crack password hashes
  • B.To discover additional hosts that expand the testable attack surface✓ Correct
  • C.To capture wireless handshakes
  • D.To escalate privileges on a compromised host
Explanation: Forgotten development, staging, and legacy subdomains are frequently less hardened than the primary site. Learn more.

Q25. Which is the safest reconnaissance approach when a client requires minimal detection risk?

  • A.Rely primarily on passive sources and low-and-slow active probes✓ Correct
  • B.Run an aggressive full-port scan with -T5
  • C.Perform a denial-of-service test
  • D.Launch a credential brute-force attack
Explanation: Passive collection plus deliberately slow, targeted probing minimises the traffic footprint that would trigger alerting. Learn more.

Q26. What does the 'traceroute' or 'tracert' output help a tester understand?

  • A.The target's password policy
  • B.The target's installed software
  • C.The network path and intermediate devices toward the target✓ Correct
  • D.The list of users on the target host
Explanation: Path information reveals routing, perimeter devices, and sometimes internal addressing where filtering is weak. Learn more.

Q27. Which of these would be considered active reconnaissance?

  • A.Reading the target's annual report
  • B.Running a port scan against in-scope hosts✓ Correct
  • C.Browsing the target's LinkedIn presence
  • D.Searching public breach data for the target's domain
Explanation: Active reconnaissance sends traffic to the target, which can be logged and detected. The other options touch only third-party sources. Learn more.

Q28. A tester finds an exposed .git directory on a web server. What is the primary risk?

  • A.The server will crash under load
  • B.The application's full source code and history can be reconstructed✓ Correct
  • C.The DNS records can be modified
  • D.The TLS certificate can be forged
Explanation: An exposed repository lets an attacker recover source, and very often hardcoded credentials and API keys from the commit history. Learn more.

Q29. Which file frequently reveals hidden application paths during web reconnaissance?

  • A.favicon.ico
  • B.robots.txt✓ Correct
  • C.style.css
  • D.index.html
Explanation: robots.txt lists paths the owner does not want indexed, which is exactly the set of paths a tester wants to look at. Learn more.

Q30. What is the value of enumerating a target's email address format?

  • A.It reveals the mail server's password
  • B.It discloses the internal IP range
  • C.It supports username guessing and social engineering pretexts✓ Correct
  • D.It bypasses multi-factor authentication
Explanation: A known format such as first.last@ lets a tester construct plausible usernames for spraying and phishing from public staff lists. Learn more.

Q31. Which enumeration finding most strongly suggests a legacy, under-maintained host?

  • A.A host with port 443 open
  • B.A host responding to ICMP
  • C.Services advertising end-of-life software versions✓ Correct
  • D.A host behind a load balancer
Explanation: End-of-life versions receive no security patches, so known vulnerabilities remain permanently exploitable. Learn more.

More CompTIA PenTest+ practice topics

Keep studying CompTIA PenTest+

Full CompTIA PenTest+ practice exam · CompTIA PenTest+ study guide · All CompTIA practice questions

Last updated