CompTIA PenTest+ Practice Test

1. Which phase of the penetration testing methodology involves gathering information about a target using public sources and passive techniques?

Exploitation

Reconnaissance

Reporting

Post-exploitation

2. What is the primary purpose of a Rules of Engagement (ROE) document in a penetration test?

To define scope, authorized techniques, and legal boundaries

To list all vulnerabilities found

To document the tester's credentials

To schedule testing windows

3. Which of the following is a passive reconnaissance technique?

Port scanning

DNS enumeration

WHOIS lookup

Banner grabbing

4. What does CVSS stand for in vulnerability assessment?

Common Vulnerability Scoring System

Critical Vulnerability Security Standard

Comprehensive Vulnerability Scan Service

Certified Vulnerability Security Specialist

5. Which tool is commonly used for network mapping and host discovery?

Wireshark

Nmap

Burp Suite

Metasploit

6. In the context of SQL injection, what does parameterized query help prevent?

Buffer overflow attacks

Cross-site scripting

Malicious SQL code execution

Denial of service attacks

7. What is the primary goal of privilege escalation in a penetration test?

To gain administrative or higher-level access

To document all users on the system

To create a backup of sensitive data

To disable antivirus software

8. Which methodology emphasizes starting with the least privileged user and working toward higher privileges?

White-box testing

Black-box testing

Gray-box testing

Blue-box testing

9. What is a common use of the Metasploit Framework in penetration testing?

Vulnerability scanning only

Payload generation and exploitation

Network packet analysis

Wireless network cracking

10. Which of the following best describes a zero-day vulnerability?

A vulnerability disclosed and patched within one day

An unknown vulnerability with no available patch

A vulnerability affecting only legacy systems

A vulnerability that requires administrator access

11. What is the primary purpose of a penetration test report?

To prove the tester's technical skills

To provide actionable findings and remediation guidance

To list all tools used during testing

To document the tester's hourly rate

12. In social engineering, which technique involves impersonating a trusted entity to extract information?

Phishing

Pretexting

Baiting

Tailgating

13. What does the term 'pivoting' refer to in penetration testing?

Rotating through different VPN servers

Using a compromised system to access other network resources

Changing testing methodologies mid-assessment

Redirecting network traffic

14. Which encryption standard is considered most secure for modern data protection?

DES

AES

MD5

SHA-1

15. What is the primary benefit of conducting a penetration test under a formal contract and NDA?

To reduce insurance costs

To establish legal protection and professional boundaries

To guarantee finding all vulnerabilities

To eliminate the need for follow-up testing