CompTIA PenTest+ PT0-002 practice test

A penetration tester is performing passive reconnaissance on a target organization. Which of the following activities would be considered passive reconnaissance?

Trap 1: Scanning open ports on the target web server

Port scanning sends packets to the target, making it an active reconnaissance technique.

Trap 2: Sending a crafted ICMP echo request to the target

ICMP echo requests are direct interactions with the target, classifying this as active reconnaissance.

Trap 3: Attempting a SQL injection on a login form

SQL injection is an active attack that sends malicious input to the target application.

A
Scanning open ports on the target web server
Why wrong: Port scanning sends packets to the target, making it an active reconnaissance technique.
B
Using a search engine to find exposed documents
Correct. Search engines index publicly accessible data; this activity does not send traffic to the target.
C
Sending a crafted ICMP echo request to the target
Why wrong: ICMP echo requests are direct interactions with the target, classifying this as active reconnaissance.
D
Attempting a SQL injection on a login form
Why wrong: SQL injection is an active attack that sends malicious input to the target application.

Question 2easymultiple choice

A penetration tester is conducting passive reconnaissance on a target organization. Which technique can be used to discover subdomains of the target's domain without sending any packets to the target's network?

Trap 1: Performing a DNS brute-force attack against the target's domain

DNS brute force sends queries to DNS servers, which may be logged by the target.

Trap 2: Sending ICMP echo requests to potential subdomain IP addresses

ICMP requests are active and may be detected by intrusion detection systems.

Trap 3: Querying WHOIS databases for domain registration information

WHOIS provides registration info, not subdomains.

A
Performing a DNS brute-force attack against the target's domain
Why wrong: DNS brute force sends queries to DNS servers, which may be logged by the target.
B
Using the 'site:' operator in a search engine query
Search engines index subdomains; querying 'site:example.com' reveals them passively.
C
Sending ICMP echo requests to potential subdomain IP addresses
Why wrong: ICMP requests are active and may be detected by intrusion detection systems.
D
Querying WHOIS databases for domain registration information
Why wrong: WHOIS provides registration info, not subdomains.

Study the full Python automation breakdown →

Question 3mediummultiple choice

A penetration tester is analyzing a Python script that uses the 'requests' library to send HTTP POST requests to a target URL with different payloads. The script also implements a retry mechanism with exponential backoff. What is the most likely purpose of this script?

Trap 1: Directory brute-forcing

Directory brute-forcing typically uses GET requests and looks for valid paths, not POST requests with different payloads targeting a single URL.

Trap 2: SQL injection testing

SQL injection testing often sends various payloads but rarely implements exponential backoff, as retrying without a delay is more common to test multiple vectors quickly.

Trap 3: Session hijacking

Session hijacking typically involves stealing or predicting session tokens, not sending multiple POST payloads with retry logic.

A
Directory brute-forcing
Why wrong: Directory brute-forcing typically uses GET requests and looks for valid paths, not POST requests with different payloads targeting a single URL.
B
Password spraying
The script sends POST requests (likely to a login endpoint) with different payloads (passwords) and uses retry with backoff to evade rate limiting, which is characteristic of password spraying.
C
SQL injection testing
Why wrong: SQL injection testing often sends various payloads but rarely implements exponential backoff, as retrying without a delay is more common to test multiple vectors quickly.
D
Session hijacking
Why wrong: Session hijacking typically involves stealing or predicting session tokens, not sending multiple POST payloads with retry logic.

Read the full NAT/PAT explanation →

Question 4mediummultiple choice

A penetration tester is analyzing a PowerShell script that contains the following code: Get-WmiObject -Class Win32_Service | Where-Object {$_.PathName -like "* *"} | Select-Object Name, PathName, State What is the primary purpose of this script?

Trap 1: Enumerate all installed services to find vulnerable applications

The script filters for paths with spaces, not all services, so it is specifically targeting unquoted path vulnerabilities rather than general enumeration.

Trap 2: Identify services that run with elevated privileges

The script does not check the user account under which the service runs (e.g., LocalSystem vs. NetworkService). It only looks at the path name pattern.

Trap 3: Check for services with weak file permissions

The script does not examine file permissions on the binary or its directories; it only selects services based on the path containing a space.

A
Enumerate all installed services to find vulnerable applications
Why wrong: The script filters for paths with spaces, not all services, so it is specifically targeting unquoted path vulnerabilities rather than general enumeration.
B
Identify services that run with elevated privileges
Why wrong: The script does not check the user account under which the service runs (e.g., LocalSystem vs. NetworkService). It only looks at the path name pattern.
C
List services that have unquoted paths in their binary path
The wildcard pattern '* *' catches paths with spaces, which is the hallmark of an unquoted service path vulnerability. The script identifies such services for further analysis.
D
Check for services with weak file permissions
Why wrong: The script does not examine file permissions on the binary or its directories; it only selects services based on the path containing a space.

Question 5mediummultiple choice

A client review of a penetration test report reveals confusion about why a particular vulnerability exists. The client's security engineer wants to understand the root cause and the exact steps to reproduce the issue. Which section of the report should the tester point the engineer to?

Trap 1: Executive Summary

The Executive Summary contains high-level information for management, not detailed technical explanations.

Trap 2: Methodology

The Methodology section describes the testing process and tools used, not details on specific findings.

Trap 3: Risk Rating Appendix

The Risk Rating Appendix assigns severity scores but does not provide root cause or reproduction steps.

A
Executive Summary
Why wrong: The Executive Summary contains high-level information for management, not detailed technical explanations.
B
Technical Findings
This section includes in-depth vulnerability descriptions, root cause analysis, reproduction steps, and remediation guidance.
C
Methodology
Why wrong: The Methodology section describes the testing process and tools used, not details on specific findings.
D
Risk Rating Appendix
Why wrong: The Risk Rating Appendix assigns severity scores but does not provide root cause or reproduction steps.

Question 6mediummultiple choice

A penetration tester has completed the test and is writing the findings section. For a critical vulnerability, the tester wants to provide a clear and actionable remediation recommendation. Which of the following is the best practice for writing this recommendation?

Trap 1: State 'Upgrade the software to the latest version'

This is too vague; it does not specify the version number or any steps to perform the upgrade, leaving room for error.

Trap 2: Recommend applying vendor-supplied patches but do not include…

Without specific version numbers, the client might apply the wrong patch or miss critical updates.

Trap 3: Suggest hiring a third-party consultant to fix the issue

While sometimes necessary, this recommendation does not provide immediate actionable steps and may be seen as avoiding responsibility.

A
State 'Upgrade the software to the latest version'
Why wrong: This is too vague; it does not specify the version number or any steps to perform the upgrade, leaving room for error.
B
Provide a step-by-step guide including commands, patches, and configuration changes
This gives the client a clear path to remediation, reducing the chance of misinterpretation and ensuring the vulnerability is properly addressed.
C
Recommend applying vendor-supplied patches but do not include specific versions
Why wrong: Without specific version numbers, the client might apply the wrong patch or miss critical updates.
D
Suggest hiring a third-party consultant to fix the issue
Why wrong: While sometimes necessary, this recommendation does not provide immediate actionable steps and may be seen as avoiding responsibility.