How should I use these Tools and Code Analysis practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Tools and Code Analysis questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Tools and Code Analysis domain.

PT0-002 · topic practice

Tools and Code Analysis practice questions

Practise CompTIA PenTest+ PT0-002 Tools and Code Analysis practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Tools and Code Analysis

Practice 10 questions Browse domain →

What the exam tests

What to know about Tools and Code Analysis

Tools and Code Analysis questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Tools and Code Analysis exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Tools and Code Analysis questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Review the full subnetting walkthrough →

During a penetration test, you are asked to identify all live hosts on a subnet. Which Nmap scan type is most likely to evade firewalls and determine if a host is up without completing the TCP handshake?

Trap 1: Ping sweep (-sn)

Ping sweep does not scan ports; it uses ICMP/ARP to find hosts.

Trap 2: TCP connect scan (-sT)

Completes full TCP handshake; less stealthy.

Trap 3: UDP scan (-sU)

Used for UDP ports, not for stealth host discovery.

Study all Tools and Code Analysis common traps →

A
Ping sweep (-sn)
Why wrong: Ping sweep does not scan ports; it uses ICMP/ARP to find hosts.
B
SYN scan (-sS)
Correct: half-open scan that doesn't complete handshake.
C
TCP connect scan (-sT)
Why wrong: Completes full TCP handshake; less stealthy.
D
UDP scan (-sU)
Why wrong: Used for UDP ports, not for stealth host discovery.

Tools and Code Analysis practice questions

What to know about Tools and Code Analysis

Common Tools and Code Analysis exam traps

Tools and Code Analysis questions

During a penetration test, you are asked to identify all live hosts on a subnet. Which Nmap scan type is most likely to evade firewalls and determine if a host is up without completing the TCP handshake?

A penetration tester wants to exploit a vulnerable service on a target using a known module. Which framework provides a large database of exploit modules, payloads, and post-exploitation tools?

During a web application test, a penetration tester needs to modify an HTTP request in real-time, send it repeatedly with different parameter values, and analyze the responses. Which Burp Suite tool is best suited for this task?

After gaining initial access to a Windows domain controller, a tester wants to extract password hashes from the SAM database and domain account hashes. Which Impacket tool is designed for this purpose?

A penetration tester has captured a WPA2 handshake. Which tool from the Aircrack-ng suite is used to crack the pre-shared key?

During a code review of a PHP web application, you encounter the following code: $result = mysql_query("SELECT * FROM users WHERE username='" . $_GET['user'] . "'");. Which vulnerability does this represent?

A tester needs to brute-force SSH credentials on a target. Which tool is most appropriate for this task?

In a Python script for a penetration test, you need to craft a custom TCP packet with specific flags. Which library is best suited for low-level packet manipulation?

Which tool is used for security auditing of AWS environments and can enumerate misconfigurations in IAM, S3, and other services?

During a reverse engineering task on a .NET binary, which tool would allow you to decompile the code into readable C# source code?

A tester wants to perform an evil twin attack to capture WPA handshakes. Which tool from the Aircrack-ng suite is used to deauthenticate clients from a legitimate AP to force reconnection to the rogue AP?

Which PowerShell script is commonly used for post-exploitation enumeration of Active Directory, such as querying user accounts and group memberships?

A penetration tester is analyzing a network capture with Wireshark. Which TWO of the following are common uses of Wireshark in a pentest?

During a cloud security assessment of AWS, a tester wants to identify misconfigurations using automated tools. Which THREE tools are specifically designed for AWS security auditing?

A tester is reviewing source code for security vulnerabilities. Which TWO of the following are examples of insecure coding practices that often lead to critical vulnerabilities?

A penetration tester wants to identify all live hosts and open ports on a network segment. Which Nmap scan type is most efficient for this purpose?

During a web application test, a penetration tester needs to intercept and modify HTTP requests before forwarding them to the server. Which tool is best suited for this task?

A penetration tester is performing a password cracking task against a dump of NTLM hashes obtained from a Windows domain controller. Which tool would be the most efficient for this task?

A tester wants to perform a Kerberoasting attack against an Active Directory environment. Which Impacket tool would be most appropriate?

During a wireless penetration test, a tester captures WPA2 handshakes but finds they are unable to crack the password using a dictionary attack. Which technique could improve the likelihood of cracking the password?

Track your progress over time

Start a Tools and Code Analysis only practice session

Related PT0-002 topic practice pages

Information Gathering and Vulnerability Scanning practice questions

Planning and Scoping practice questions

Reporting and Communication practice questions

Attacks and Exploits practice questions

Tools and Code Analysis practice questions

PT0-002 fundamentals practice questions

PT0-002 scenario practice questions

PT0-002 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid