20+ practice questions focused on Attacks and Exploits — one of the most tested topics on the CompTIA PenTest+ PT0-002 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Attacks and Exploits PracticeA penetration tester is conducting an internal network assessment and wants to capture NTLMv2 hashes from Windows hosts without sending any authentication traffic. Which tool and attack technique should the tester use?
Explanation: Responder poisons LLMNR/NBT-NS/mDNS to trick hosts into sending NTLM hashes to the attacker, capturing them without the attacker needing to authenticate.
During a web application test, the tester discovers a parameter that reflects user input in the response without sanitization. Which type of vulnerability is most likely present?
Explanation: Reflected XSS occurs when user input is immediately reflected in the response without proper encoding or sanitization.
A tester wants to exploit a Windows service running with SYSTEM privileges that has an unquoted service path containing spaces. Which technique should be used to escalate privileges?
Explanation: An unquoted service path allows placing an executable with the same name as a folder in the path, which Windows will execute with SYSTEM privileges.
A penetration tester is performing a password attack on a Windows domain and has captured NTLM hashes. Which tool can be used to perform a pass-the-hash attack to gain remote code execution on a target system?
Explanation: pth-winexe is a tool specifically designed for pass-the-hash attacks to execute commands on remote Windows systems.
During a web application test, the tester uses sqlmap and identifies a time-based blind SQL injection. Which technique is sqlmap using to extract data?
Explanation: Time-based blind SQL injection uses conditional delays to infer the truth of queries based on response time.
+15 more Attacks and Exploits questions available
Practice all Attacks and Exploits questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Attacks and Exploits. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Attacks and Exploits questions on the PT0-002 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Attacks and Exploits is tested as part of the CompTIA PenTest+ PT0-002 blueprint. Practicing with targeted Attacks and Exploits questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free PT0-002 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Attacks and Exploits is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Attacks and Exploits practice session with instant scoring and detailed explanations.
Start Attacks and Exploits Practice →