Question 1

When analyzing a vulnerability scan report that flags an outdated jQuery library on a customer-facing web portal, a penetration tester confirms the library version. However, manual testing reveals that the specific functions within the library that contain known vulnerabilities are not being called by the application's code. How should this finding be categorized?

Accepted Answer

A false negative, because the scanner missed the real risk., A false positive, because the vulnerable code path is not reachable., A true positive, because the vulnerable library is present., A configuration-based vulnerability requiring a server patch.

Question 2

A security assessment of a cloud infrastructure reveals several high-risk IAM permissions that could be exploited for privilege escalation. A penetration tester is tasked with demonstrating this risk. Which of the following permissions would allow an attacker to create a new version of an existing managed policy with elevated privileges? (Select Two)

Accepted Answer

iam:TagPolicy, iam:GetPolicy, iam:SetDefaultPolicyVersion, iam:ListPolicyVersions, iam:CreatePolicyVersion

Question 3

To exploit a directory traversal vulnerability on a hardened Linux web server that filters common traversal sequences like `../`, which of the following payloads would be the most likely to succeed?

Accepted Answer

..\..\..\etc\passwd, C:\boot.ini, ....//....//....//etc/passwd, /etc/passwd

Question 4

To gain the most comprehensive view of system vulnerabilities from an insider's perspective, including missing security patches, weak local password policies, and insecure service configurations, which type of scan is most effective?

Accepted Answer

Authenticated scan, Unauthenticated scan, Port scan, DAST scan

Question 5

When performing a vulnerability scan with OpenVAS against a network segmented by firewalls, the scanner is unable to reach several target subnets. The network administrator confirms that firewall rules are in place to restrict traffic between the scanner's segment and the target segments. The rules of engagement permit scanning the entire scope. What is the most appropriate solution to enable comprehensive scanning across the segmented network?

Accepted Answer

Use Nmap with the `-Pn` and `--max-retries 5` flags to bypass the firewall., Request the network administrator to create an 'any/any' rule from the scanner's IP address., Configure the OpenVAS scan to use a SOCKS proxy located in the target subnet., Deploy multiple remote OpenVAS sensors, one in each target network segment.

Question 6

A penetration tester has acquired a large list of credentials from a well-known public data breach. The engagement's objective is to determine if employees at the target organization have reused these compromised credentials on corporate systems. Which attack technique should the tester employ?

Accepted Answer

Credential stuffing, Rainbow table attack, Dictionary attack, Password spraying

Question 7

A penetration tester, assessing a hospital's patient portal, discovers a potential logic flaw that could allow access to medical records. However, the exact impact is unclear without further testing that could potentially expose protected health information (PHI). The tester is unsure if this behavior is a vulnerability or an undocumented feature. What is the most prudent course of action?

Accepted Answer

Disregard the finding to avoid any legal or ethical complications related to PHI., Report the finding as a critical vulnerability based on the potential worst-case scenario., Immediately attempt to exfiltrate a sample of PHI to confirm the impact for the report., Document the potential finding and seek clarification from the client's designated technical contact.

Question 8

A financial institution is contracting a third party for a penetration test of its new online banking portal. The client's primary concerns are avoiding service interruptions for customers and preventing the compromise of any real customer data. Which two clauses in the Rules of Engagement would be most critical to include to directly address these concerns? (Select Two)

Accepted Answer

A detailed schedule of daily debriefing meetings., The testing team must provide a list of all tools they intend to use., Specific limitations on automated scanning and brute-force attack intensity., A requirement for the testers to hold specific industry certifications., Testing must be conducted against a dedicated, isolated UAT environment.

Question 9

When drafting the executive summary of a penetration test report for a diverse audience including C-level executives, which element is most critical to include?

Accepted Answer

Detailed step-by-step exploit chains for critical vulnerabilities., A high-level overview of the security posture, quantified business risks, and strategic recommendations., The specific commands and scripts used during the engagement., A complete list of all Common Vulnerabilities and Exposures (CVEs) discovered.

Question 10

When performing initial reconnaissance, what is the fundamental advantage of using a tool like Shodan over directly using Nmap against a target's known IP ranges?

Accepted Answer

Shodan can execute vulnerability-specific scripts against discovered hosts automatically., Shodan provides more detailed service version information than Nmap's -sV flag., Shodan queries a pre-existing database, providing information without directly touching the target network., Shodan is faster for scanning small, internal IP ranges.

Question 11

Following a successful red team engagement that simulated an advanced persistent threat (APT) within a logistics company's network, the lead tester is drafting the final report. To construct a compelling attack narrative that effectively communicates the sequence of events and provides actionable intelligence for both technical staff and executive leadership, which two components should be prioritized? (Select Two)

Accepted Answer

A raw data dump from all network packet captures taken during the engagement., A comprehensive list of all commands executed on each compromised system for forensic analysis., A comparative analysis of the security tools that failed to detect or prevent the simulated attack., A chronological timeline of the attack path, mapping observed techniques to the MITRE ATT&CK framework., An executive summary that translates the technical exploit chain into quantifiable business risks and potential impact.

Question 12

An analyst has obtained a low-privilege shell on a Linux server and wants to find potential paths for privilege escalation. Which command is most effective for recursively searching the entire filesystem for files with the SUID permission set?

Accepted Answer

ls -lR / | find "-rwsr-xr-x", grep -r "-rwsr-xr-x" /, find / -perm -u=s -type f 2>/dev/null, find / -user root -type f 2>/dev/null

Question 13

An AI-powered image recognition system used for medical diagnostics is found to misclassify a benign tumor as malignant when a few, human-imperceptible pixels in the image are altered. This manipulation exploits the model's learned features without corrupting its training data or user-facing prompts. What is the most accurate term for this attack?

Accepted Answer

Adversarial attack, Model skewing, Data poisoning, Prompt injection

Question 14

When recommending remediation for widespread local administrator password reuse that enabled lateral movement, which suggestion offers the most effective and strategic long-term solution?

Accepted Answer

Increasing the password complexity requirements and rotation frequency for all accounts., Disabling all local administrator accounts and relying solely on domain administrator accounts., Implementing a unique, randomized password for each local administrator account using a LAPS-like solution., Mandating an immediate, enterprise-wide password reset for all local administrator accounts.

Question 15

After compromising a Windows server with strict application whitelisting policies, an attacker needs to establish a persistent foothold that avoids dropping new executable files to the disk. The goal is to trigger a malicious script block whenever a specific administrative account logs on. Which of the following methods allows the attacker to achieve this by creating a permanent event consumer tied to the native system management infrastructure?

Accepted Answer

Modifying a legitimate service's ImagePath to point to a malicious payload., Implementing DLL search order hijacking for a commonly used system utility., Creating a WMI event subscription with an event filter and consumer., Adding a new entry to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key.

Question 16

A security consultant has successfully established an on-path position and now intends to redirect a target's web traffic to a malicious server by manipulating name resolution requests. Which of the following tools are specifically designed to facilitate this type of DNS spoofing attack? (Select Two)

Accepted Answer

Bettercap, Ettercap, Nmap, John the Ripper, Wireshark

Question 17

During a web application assessment, a Python script using the `requests` library for directory enumeration is being consistently blocked by a WAF. The pentester suspects the WAF is keying on the script's default user-agent string. Which of the following code modifications is the MOST effective way to address this specific issue?

Accepted Answer

Set the `verify` parameter to `False` to ignore SSL certificate warnings., Pass a `headers` dictionary with a randomized 'User-Agent' value to the request., Add a timeout parameter: `requests.get(url, timeout=5)`, Implement a session object: `s = requests.Session()`

Question 18

Constructing the most effective Shodan query to locate a client's German-based systems with exposed RDP on the default port requires which syntax?

Accepted Answer

port:3389 country:"DE" org:"Client Name", rdp default_port country:DE, service:rdp location:germany, product:"Remote Desktop" geo:DE

Question 19

When presenting the outcomes of a penetration test to an organization's executive leadership, which of the following communication techniques are MOST effective for articulating risk and driving remediation efforts? (Select Two)

Accepted Answer

Submitting the raw output from automated scanning tools as an appendix., Providing a detailed, step-by-step walkthrough of the exploit chain for each finding., Listing all discovered CVEs and their corresponding CVSS base scores., Relating technical vulnerabilities to potential financial, reputational, or operational losses., Using a risk matrix that visually maps vulnerability likelihood against business impact.

Question 20

An e-commerce platform assessment requires a tool to rapidly find common web server misconfigurations and outdated software. Which tool is BEST suited for this focused task, avoiding a full network scan?

Accepted Answer

Nmap with the --script=vuln flag, OpenVAS, Nessus, Nikto

CompTIA PenTest+ Practice Exams (2025) for DevelopersData ScientistsData AnalystsData EngineersAnyoneDevelopers

Master the CompTIA PenTest+ Exam

Practice Exam Domains Covered - Latest 2025 certification alignment

2025 Practice Exam Details

Cutting Edge Exam Prep with AI Enhanced Learning

AI Enhanced Learning With Premium Certification Practice Exams

Real-time AI Learning:

Unparalleled Understanding:

Advanced Learning with AI:

Exam Prep Powered by our Certification Practice System

Fast-Track Your Preparation Path

Realistic Exam Experience and Comprehensive Preparation

Fully Crafted and Supported by Experts in the USA

Proven Quality and Trust for Real Success

In-depth Explanations for Complete Mastery

Chosen and Trusted by Professionals Worldwide

Edward Martinez

Daniel Garcia

Ella Sanders

Ava Thompson

Jiwon Thomas

Brandon Hill

Marvin Watson

Ali Karim

Peter Chen

Sophia Padilla

Edward Martinez

Daniel Garcia

Ella Sanders

Ava Thompson

Jiwon Thomas

Brandon Hill

Marvin Watson

Ali Karim

Peter Chen

Sophia Padilla

Edward Martinez

Daniel Garcia

Ella Sanders

Ava Thompson

Jiwon Thomas

Brandon Hill

CompTIA PenTest+ Certification Preparation Path

Focus on Passing on the First Attempt

Practice with Realistic Exams for Real Success

Build a Deep and Solid Foundation

Invest in Your Future

Why Choose Our CompTIA Practice Exams?

Built on Trust, Quality, and Proven Success

Expertise Backed by Professionals

Customer Focused, Always

CompTIA PenTest+ Certification PreparationChoose Your Path to Success

Starter Practice Exam1 Exam

Pro Practice Pack3 Exam Bundle

Ultimate Practice Pack6 Exam Bundle

Prepare for Success with CompTIA PenTest+ Exam Practice

CompTIA PenTest+ Certification Preparation

The Goal of our Certification Preparation

Who Should Pursue this Certification Preparation?

ConsiderationsWhen Choosing Practice Exams

Beware of Outdated Content

Quality Matters in Exam Prep

Avoid Non-Expert Materials

Anytime, Anywhere Access

Unlimited Attempts

Cross-Device Sync

Frequently Asked Questions

How closely do your practice questions resemble the actual exam?▼

How up-to-date are your practice exams?▼

How long do I have access to the practice exams?▼

Are your practice exams available on mobile devices?▼

Do you provide explanations for the answers?▼

Take the Next Step Towards CompTIA Certification Prep

CompTIA PenTest+ Practice Exams (2025) for
Developers
Data Scientists
Data Analysts
Data Engineers
Anyone
Developers

CompTIA PenTest+ Certification Preparation
Choose Your Path to Success

Starter Practice Exam
1 Exam

Pro Practice Pack
3 Exam Bundle

Ultimate Practice Pack
6 Exam Bundle

Considerations
When Choosing Practice Exams