CompTIA PenTest+ v1.0
Question 1
A penetration tester attempts to run an automated web-application scanner against a target URL. The tester validates that the web page is accessible from a different device. The tester analyzes the following HTTP request header logging output:
Which of the following actions should the tester take to get the scans to work properly?
- A. Modify the scanner to slow down the scan.
- B. Change the source IP with a VPN.
- C. Modify the scanner to only use HTTP GET requests.
- D. Modify the scanner user agent.
Answer : D
Question 2
During an assessment, a penetration tester runs the following command: setspn.exe -Q */*
Which of the following attacks is the penetration tester preparing for?
- A. LDAP injection
- B. Pass-the-hash
- C. Kerberoasting
- D. Dictionary
Answer : C
Question 3
While conducting an assessment, a penetration tester identifies the details for several unreleased products announced at a company-wide meeting. Which of the following attacks did the tester most likely use to discover this information?
- A. Eavesdropping
- B. Bluesnarfing
- C. Credential harvesting
- D. SQL injection attack
Answer : A
Question 4
A penetration tester wants to attack a server, exhausting its resources and making it unavailable to legitimate users. Which of the following attacks would be best to achieve this result?
- A. IP spoofing
- B. TCP hijacking
- C. Port redirection
- D. SYN flooding
Answer : D
Question 5
During an internal penetration test, a tester compromises a Windows OS-based endpoint and bypasses the defensive mechanism on that system. The tester also discovers the endpoint is part of an Active Directory local domain. The tester’s main goal is to leverage credentials to authenticate into other systems within the Active Directory environment. Which of the following steps should the tester take to complete the goal?
- A. Use Mimikatz to collect information about the accounts and try to authenticate in other systems.
- B. Use hasheat to crack a password for the local user on the compromised endpoint.
- C. Use Evil-WinRM to access other systems in the network within the endpoint credentials.
- D. Use Metasploit to create and execute a payload and try to upload the payload into other systems.
Answer : A
Question 6
A penetration tester is conducting a wireless security assessment for a client with 2.4GHz and 5GHz access points. The tester places a wireless USB dongle in the laptop to start capturing WPA2 handshakes. Which of the following steps should the tester take next?
- A. Enable monitoring mode using Aircrack-ng.
- B. Use Kismet to automatically place the wireless dongle in monitor mode and collect handshakes.
- C. Run KARMA to break the password.
- D. Research WIGLE.net for potential nearby client access points.
Answer : A
Question 7
A tester performs a vulnerability scan and identifies several outdated libraries used within the customer SaaS product offering. Which of the following types of scans did the tester use to identify the libraries?
- A. IAST
- B. SBOM
- C. DAST
- D. SAST
Answer : B
Question 8
A penetration tester reviews a SAST vulnerability scan report. The following vulnerability has been reported as high severity:
The tester inspects the source file and finds the variable response is defined as a constant and is not referred to or used in other sections of the code. Which of the following describes how the tester should classify this reported vulnerability?
- A. False negative
- B. False positive
- C. True positive
- D. Low severity
Answer : B
Question 9
A penetration tester would like to leverage a CSRF vulnerability to gather sensitive details from an application's end users. Which of the following tools should the tester use for this task?
- A. Browser Exploitation Framework
- B. Maltego
- C. Metasploit
- D. theHarvester
Answer : A
Question 10
A penetration tester gains access to a Linux computer system. The tester then attempts to enumerate user accounts, including the directories and user default shell. Which of the following commands should the tester use to enumerate user accounts?
- A. cat /etc/shadow
- B. ls /var/usr
- C. ls /home
- D. cat /etc/passwd
Answer : D
Question 11
A client warns the assessment team that an ICS application is maintained by the manufacturer. Any tampering of the host could void the enterprise support terms of use. Which of the following techniques would be most effective to validate whether the application encrypts communications in transit?
- A. Utilizing port mirroring on a firewall appliance
- B. Installing packet capture software on the server
- C. Reconfiguring the application to use a proxy
- D. Requesting that certificate pinning be disabled
Answer : A
Question 12
While performing a penetration testing exercise, a tester executes the following command:
PS c:\tools> c:\hacks\PsExec.exe \\server01.comptia.org -accepteula cmd.exe
Which of the following best explains what the tester is trying to do?
- A. Test connectivity using PSExec on the server01 using CMD.exe.
- B. Perform a lateral movement attack using PsExec.
- C. Send the PsExec binary file to the server01 using CMD.exe.
- D. Enable CMD.exe on the server01 through PsExec.
Answer : B
Question 13
During an assessment, a penetration tester obtains a low-privilege shell and then runs the following command: findstr /SIM /C:"pass” *.txt *.cfg *.xml
Which of the following is the penetration tester trying to enumerate?
- A. Configuration files
- B. Permissions
- C. Virtual hosts
- D. Secrets
Answer : D
Question 14
A penetration tester finished a security scan and uncovered numerous vulnerabilities on several hosts. Based on the targets' EPSS and CVSS scores, which of the following targets is the most likely to get attacked?
- A. Target 1: EPSS Score = 0.6 and CVSS Score = 4
- B. Target 2: EPSS Score = 0.3 and CVSS Score = 2
- C. Target 3: EPSS Score = 0.6 and CVSS Score = 1
- D. Target 4: EPSS Score = 0.4 and CVSS Score = 4.5
Answer : A
Question 15
During a discussion of a penetration test final report, the consultant shows the following payload used to attack a system:
?/<sCRitP>aLeRt("pwned")</ScriPt>
Based on the code, which of the following options represents the attack executed by the tester and the associated countermeasure?
- A. Arbitrary code execution; the affected computer should be placed on a perimeter network
- B. SQL injection attack; should be detected and prevented by a web application firewall
- C. Cross-site request forgery; should be detected and prevented by a firewall
- D. XSS obfuscated; should be prevented by input sanitization
Answer : D