How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the PT0-002 exam, each with detailed explanations and wrong-answer analysis.

How should I approach PT0-002 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to CompTIA PenTest+ PT0-002 questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise CompTIA PenTest+ PT0-002 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

PT0-002

exam code

CompTIA

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmulti select

Full question →

A tester has low-privilege shell access on a Linux server. Which two checks are most appropriate for local privilege escalation enumeration? (Choose 2.)

A
Review sudo privileges with sudo -l.
Misconfigured sudo rules are a common privilege escalation path.
B
Find SUID binaries and inspect unusual or writable executables.
SUID misconfiguration can allow privilege escalation.
C
Run a full SYN scan of the public IP range.
Why wrong: External port scanning does not enumerate local privilege escalation paths.
D
Send phishing emails to the finance department.
Why wrong: That is social engineering, not local Linux privilege escalation enumeration.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related PT0-002 topic practice pages

Planning and Scoping practice questions

Information Gathering and Vulnerability Scanning practice questions

Attacks and Exploits practice questions

Reporting and Communication practice questions

Tools and Code Analysis practice questions

PT0-002 fundamentals practice questions

PT0-002 scenario practice questions

PT0-002 troubleshooting practice questions

Practice scenarios

A tester has low-privilege shell access on a Linux server. Which two checks are most appropriate for local privilege escalation enumeration? (Choose 2.)

Which TWO of the following should be included in the methodology section of a penetration test report?

A penetration tester is performing passive reconnaissance against a target domain. Which of the following resources can be used to gather information about the target without directly sending packets to the target's network? (Select two.) (Choose 2.)

Before starting a penetration test, the tester receives permission to test only two public IP ranges and is told not to perform denial-of-service testing. Which two documents or artefacts are most important to confirm before testing begins? (Choose 2.)

When calculating the risk rating for a vulnerability found during a penetration test, which two factors are most fundamental to the risk calculation?

Which TWO of the following are indicators that a web application is vulnerable to XML External Entity (XXE) attacks? (Select TWO.)

Which TWO of the following are common techniques used during a pass-the-hash attack? (Select TWO.)

Which TWO of the following are common methods used to bypass network access controls during a penetration test? (Choose two.)

A penetration tester is assessing a wireless network's security. The tester wants to capture WPA2 handshakes for offline password cracking. Which two attacks can be used to force a client to re-authenticate and capture the handshake? (Choose TWO.)

A penetration tester is analyzing the results of a vulnerability scan. Which of the following findings indicate that a vulnerability is likely exploitable? (Choose two.)

Which TWO of the following are effective methods for bypassing AppLocker during a penetration test? (Choose two.)

A penetration tester is gathering information using passive reconnaissance techniques. Which of the following are considered passive reconnaissance methods? (Choose two.)

During a vulnerability scan of a Linux server, the tester notices that the NMAP scan reports port 22 as filtered. Which of the following could be causing this result? (Select TWO).

A penetration tester is performing information gathering for a web application. Which of the following are passive information gathering techniques? (Select THREE).

A penetration tester needs to perform initial reconnaissance on a target domain. Which of the following tools are specifically designed for domain enumeration? (Select TWO).

A penetration tester is scoping an engagement for a client that has both on-premises and cloud infrastructure. Which TWO documents should be reviewed to understand the client's cloud security posture?

Which THREE factors are critical to include in the rules of engagement for a penetration test?

A penetration tester is scoping a test for a client that uses a hybrid identity system. The client wants to ensure that the test does not affect production authentication. Which TWO actions should the tester recommend?

During the scoping phase of a penetration test, the tester and client must define the rules of engagement (ROE). Which THREE of the following should be included in the ROE? (Select THREE.)

A tester is planning a physical security assessment. Which TWO should be included in the scope? (Choose two.)