Q1. Which tool is commonly used to intercept and modify web requests during testing?
- A.NTPd
- B.Burp Suite✓ Correct
- C.rsync
- D.Visio
Explanation: Burp Suite acts as an intercepting proxy for web application security testing. Learn more.
CompTIA PenTest+ Practice Questions: Vulnerability Discovery and Analysis
26 free, exam-style CompTIA PenTest+ (PT0-003) practice questions covering Vulnerability Discovery and Analysis, each with the correct answer and an explanation. Start a timed exam below, or scroll on to read through the questions.
Vulnerability Discovery and Analysis practice questions
Answers and explanations are shown. Take the timed exam above to test yourself first.
Q2. Which vulnerability scanner mode uses valid credentials for deeper checks?
- A.Ping sweep only
- B.Stealth SYN scan
- C.Passive OSINT scan
- D.Authenticated scan✓ Correct
Explanation: Authenticated scans log in to systems to check patch levels, configurations, and local vulnerabilities more accurately. Learn more.
Q3. Which code review issue most directly enables command injection?
- A.A read-only database query
- B.A variable name with underscores
- C.User input concatenated into an operating system command✓ Correct
- D.A comment above a function
Explanation: Command injection occurs when untrusted input is passed to shell commands without safe handling. Learn more.
Q4. Which tool is commonly used for password hash cracking?
- A.tcpdump only
- B.Hashcat✓ Correct
- C.Nmap only
- D.Nikto only
Explanation: Hashcat is a common tool for offline password hash cracking. Learn more.
Q5. Which tool is commonly used for web server vulnerability scanning and misconfiguration checks?
- A.NTPdate
- B.Visio
- C.Nikto✓ Correct
- D.Excel
Explanation: Nikto checks web servers for known dangerous files, outdated software, and misconfigurations. Learn more.
Q6. What is the main advantage of a credentialed vulnerability scan?
- A.It cannot be detected by the target
- B.It automatically exploits what it finds
- C.It runs faster than an unauthenticated scan
- D.It sees installed patch levels and configuration, producing fewer false results✓ Correct
Explanation: Authenticated scans read the actual system state instead of inferring it from banners, which sharply reduces both false positives and false negatives. Learn more.
Q7. A scanner reports a vulnerability that manual testing shows is not exploitable on this host. What is this?
- A.A true positive
- B.A false positive✓ Correct
- C.A zero day
- D.A false negative
Explanation: Validating scanner output is a core tester responsibility; reporting unverified findings damages credibility and wastes remediation effort. Learn more.
Q8. Which metric set expresses the intrinsic severity of a vulnerability independent of environment?
- A.EPSS
- B.CVSS environmental score
- C.CVSS base score✓ Correct
- D.CISA KEV listing
Explanation: Base metrics describe the flaw itself. Temporal and environmental metrics adjust for exploit availability and the specific deployment. Learn more.
Q9. What does EPSS estimate?
- A.The time required to patch
- B.The number of affected hosts
- C.The probability a vulnerability will be exploited in the wild✓ Correct
- D.The financial cost of a breach
Explanation: EPSS is a predictive likelihood score. It complements CVSS severity by helping prioritise what attackers are actually using. Learn more.
Q10. Why should a tester consult the CISA KEV catalog during analysis?
- A.It replaces the need for scanning
- B.It lists vulnerabilities with confirmed real-world exploitation✓ Correct
- C.It provides vendor patches directly
- D.It contains all known CVEs
Explanation: KEV entries are known to be exploited, which makes them a strong prioritisation signal regardless of CVSS score. Learn more.
Q11. Which finding should generally be prioritised for immediate remediation?
- A.An internet-facing service with a known exploited remote code execution flaw✓ Correct
- B.A self-signed certificate on a lab host
- C.A missing HTTP security header on an internal site
- D.An informational banner disclosure
Explanation: Prioritisation weighs exposure, exploitability, and impact together. Internet-facing plus known-exploited plus RCE is the highest-risk combination. Learn more.
Q12. What is the risk of running an aggressive vulnerability scan against fragile production systems?
- A.The scan will always be blocked
- B.The scanner will delete the findings
- C.The scan will encrypt the target
- D.Scan traffic can crash or degrade the service✓ Correct
Explanation: Legacy devices, SCADA equipment, and embedded systems are known to fail under scan load, which is why scan intensity is agreed during scoping. Learn more.
Q13. Which static analysis issue most directly enables SQL injection?
- A.String concatenation of user input into a query✓ Correct
- B.Input length validation
- C.Output encoding on render
- D.Use of prepared statements
Explanation: Concatenating untrusted input into query text lets the input change the query's structure. Parameterised queries are the fix. Learn more.
Q14. A web application returns detailed stack traces on error. How should this be classified?
- A.A privilege escalation vulnerability
- B.A cryptographic failure
- C.A denial of service vulnerability
- D.Information disclosure that assists further attacks✓ Correct
Explanation: Stack traces leak framework versions, file paths, and query structure, all of which make subsequent exploitation easier. Learn more.
Q15. Which factor is MOST important when deciding whether a scanner finding is worth reporting?
- A.Whether the scanner rated it high
- B.Whether the vendor has a patch
- C.Whether the CVE is recent
- D.Whether it was validated and is exploitable in this environment✓ Correct
Explanation: Context and validation determine real risk. An unvalidated high-severity finding may be inapplicable to the deployed configuration. Learn more.
Q16. What does a vulnerability with CVSS attack vector 'Network' and privileges required 'None' indicate?
- A.It only affects availability
- B.It requires administrative rights
- C.It can be attacked remotely without authentication✓ Correct
- D.It requires local console access
Explanation: Network plus no privileges required means remotely reachable and pre-authentication, which is the most exposed combination. Learn more.
Q17. Which approach best validates a suspected authentication bypass without causing damage?
- A.Demonstrate access to a single non-sensitive resource and stop✓ Correct
- B.Modify the application's source on the server
- C.Run a denial of service against the login page
- D.Delete the affected user accounts
Explanation: Proof of concept should be the minimum action that evidences the flaw, consistent with the do-no-harm principle in the rules of engagement. Learn more.
Q18. What is the purpose of reviewing a web application's JavaScript files during analysis?
- A.They show the database schema
- B.They often reveal API endpoints, parameters, and hardcoded keys✓ Correct
- C.They list all valid usernames
- D.They contain the server's private key
Explanation: Client-side code is fully readable by the tester and routinely exposes internal endpoints and secrets developers assumed were hidden. Learn more.
Q19. Which condition makes a directory traversal finding significantly more severe?
- A.The application uses HTTPS
- B.The application is written in Python
- C.The application runs with high privileges and can read sensitive system files✓ Correct
- D.The application has a login page
Explanation: Impact scales with what the process can reach. A high-privilege process turns traversal into disclosure of credentials and keys. Learn more.
Q20. Why should testers re-scan after the client applies remediation?
- A.To reset the CVSS scores
- B.To satisfy the scanner license
- C.To increase the number of findings
- D.To verify the fix and confirm no new issues were introduced✓ Correct
Explanation: Remediation validation is the step that confirms risk was actually reduced rather than assumed to be. Learn more.
Q21. Which tool category would you use to identify vulnerable third-party libraries in an application?
- A.Software composition analysis✓ Correct
- B.Password cracker
- C.Wireless survey tool
- D.Network port scanner
Explanation: SCA tools inventory dependencies and match them against known vulnerability data, catching risk inherited from libraries. Learn more.
Q22. A scan reports an outdated TLS version is supported. What is the practical risk?
- A.Weak protocol versions and ciphers can allow interception or downgrade✓ Correct
- B.The DNS records will be exposed
- C.The certificate will be revoked
- D.The server will refuse all connections
Explanation: Deprecated TLS versions carry known cryptographic weaknesses and enable downgrade attacks against otherwise secure sessions. Learn more.
Q23. What distinguishes a zero-day from a known vulnerability?
- A.No vendor patch or public fix exists for it yet✓ Correct
- B.It is listed in the CISA KEV catalog
- C.It has a CVSS score above 9.0
- D.It only affects Windows systems
Explanation: Zero-day refers to the absence of an available fix at the time of exploitation, not to a particular severity or platform. Learn more.
Q24. Which is the best evidence to include for a validated remote code execution finding?
- A.A screenshot of the login page
- B.The scanner's raw severity rating
- C.A command output proving code ran, with timestamp and target✓ Correct
- D.The CVE description text
Explanation: Evidence should demonstrate the tester's own successful execution against the specific target, so the client can reproduce and verify. Learn more.
Q25. Why is manual testing still required when automated scanners are available?
- A.Scanners never produce false positives
- B.Scanners cannot read banners
- C.Scanners miss business logic flaws and chained attack paths✓ Correct
- D.Scanners cannot detect open ports
Explanation: Logic flaws such as price manipulation or broken access control between roles require human understanding of the application's intent. Learn more.
Q26. Which finding indicates broken access control rather than a missing patch?
- A.A default SNMP community string is set
- B.The web server runs an unsupported version
- C.TLS 1.0 is enabled
- D.A standard user can reach an administrative function by changing a URL parameter✓ Correct
Explanation: Broken access control is an authorisation design failure: the check is missing or enforced only in the interface, not on the server. Learn more.
More CompTIA PenTest+ practice topics
Keep studying CompTIA PenTest+
Full CompTIA PenTest+ practice exam · CompTIA PenTest+ study guide · All CompTIA practice questions
Last updated