CompTIA Certification
63 practice questions with correct answers and detailed explanations. Use this guide to review concepts before taking the practice exam.
The CompTIA PenTest+ (PT0-002) certification validates professional expertise in CompTIA technologies. This study guide covers all 63 practice questions from our PT0-002 practice test, complete with correct answers and explanations to help you understand each concept thoroughly.
Review each question and explanation below, then test yourself with the full interactive practice exam to measure your readiness.
During a penetration test, you discover a web application that uses client-side validation only. What is the primary risk associated with this finding?
Client-side validation provides no security since it runs in the user's browser and can be easily bypassed. Server-side validation is essential to protect against malicious input.
Which of the following best describes the purpose of a golden ticket attack in Active Directory environments?
A golden ticket is a forged Kerberos TGT that allows an attacker to impersonate any user and maintain persistent access to domain resources, even after credential changes.
What is the primary advantage of using a proxy server during a penetration test?
A proxy server allows penetration testers to intercept, inspect, and modify requests and responses, enabling thorough testing of application security controls.
During reconnaissance, you identify that a target organization uses a Content Delivery Network (CDN). How does this affect your attack surface mapping?
CDNs mask origin servers, so penetration testers must use DNS enumeration, HTTP header analysis, and other techniques to identify actual infrastructure for proper scope mapping.
What is the primary purpose of implementing rate limiting controls in web applications?
Rate limiting restricts the number of requests allowed in a specific time period, effectively defending against brute force attacks, credential stuffing, and DDoS attempts.
During a white-box penetration test, you review the source code and discover hardcoded API keys in the application. What should be your immediate action?
Hardcoded credentials are critical vulnerabilities that should be reported immediately. The proper remediation is to use secure credential storage mechanisms like environment variables or vault systems.
Which attack technique involves capturing and replaying network traffic to bypass authentication mechanisms?
A session replay attack captures legitimate session tokens or authentication data and replays them to impersonate authenticated users without knowing their credentials.
What is the primary difference between a vulnerability assessment and a penetration test?
Vulnerability assessments identify and catalog security flaws, while penetration tests go further by attempting to exploit those flaws to show real-world impact and chain attacks together.
You are testing a REST API and discover it uses JWT tokens without proper validation of the signature. What is the primary risk of this vulnerability?
Without signature validation, attackers can modify JWT token payloads (such as user ID or roles) and the application will accept the forged token as legitimate.
During the exploitation phase, you gain access to a system running outdated BIOS/firmware. What does this represent in your engagement report?
Outdated BIOS/firmware can contain exploitable vulnerabilities that provide low-level system access, persistence mechanisms, and bypass security controls like secure boot.
What is the primary purpose of implementing CORS (Cross-Origin Resource Sharing) headers correctly?
CORS headers specify which origins are allowed to access resources, preventing malicious websites from making unauthorized requests on behalf of users.
During a network penetration test, you discover a service running on an unusual port. What is the most effective approach to identify and test this service?
Banner grabbing reveals service type and version, allowing you to research specific vulnerabilities and conduct targeted testing rather than making assumptions.
What is the primary security risk associated with allowing file uploads without proper validation and storage controls?
Unrestricted file uploads allow attackers to upload executable code, web shells, or malware that can be executed by the server or served to other users.
During post-exploitation, you obtain a Windows NTLM hash. What technique can you use to crack this hash without performing a dictionary attack?
Rainbow tables are precomputed databases of hashes mapped to plaintext values, allowing fast hash cracking without dictionary attacks.
What is the primary benefit of using a dedicated testing environment or sandbox during penetration testing?
Sandboxed environments allow safe testing of exploits, malware, and potentially destructive techniques without risk to production systems or accidental data damage.
Which vulnerability allows attackers to access data beyond intended boundaries, such as reading arbitrary files from a server?
Path traversal uses specially crafted file paths (like ../) to access files and directories outside the intended application directory.
During a test, you discover that the application stores passwords using an unsalted hashing algorithm. What is the specific risk this presents?
Unsalted hashes produce identical outputs for identical inputs, allowing attackers to identify common passwords and use precomputed tables (rainbow tables) efficiently.
What is the primary purpose of using parameterized queries or prepared statements in database interactions?
Parameterized queries treat user input as data rather than executable code, preventing SQL injection by ensuring input cannot be interpreted as SQL commands.
During reconnaissance, you identify that a target organization uses a web application firewall (WAF). How should this discovery influence your testing methodology?
WAF presence requires adjusted methodology including testing bypass techniques, identifying evasion methods, and potentially accessing internal networks to bypass the WAF.
What is the primary risk of using default credentials on network devices and applications?
Default credentials are widely known and documented, allowing attackers trivial access to systems that retain factory settings after deployment.
During testing of a web application, you identify that user input is reflected in the response without proper encoding. What type of vulnerability is this?
Reflected XSS occurs when user input is immediately returned to the user in the response without encoding, allowing attackers to inject malicious scripts via manipulated URLs.
What is the primary security purpose of implementing certificate pinning in mobile applications?
Certificate pinning hardcodes or pins the expected certificate within the application, preventing attackers from intercepting connections using fraudulent certificates.
During a black-box penetration test, you discover the application returns different error messages for valid versus invalid usernames during login attempts. What vulnerability does this represent?
Differential error messages reveal which usernames exist in the system, allowing attackers to enumerate valid accounts and focus brute force attacks on real users.
What is the primary advantage of implementing proper access controls and the principle of least privilege during system configuration?
Least privilege limits the damage from compromised accounts or exploits by restricting what an attacker can access even after gaining initial access.
During a test of a third-party API integration, you discover the API key is transmitted over HTTP instead of HTTPS. What is the primary risk of this configuration?
Unencrypted HTTP transmission allows man-in-the-middle attackers to capture sensitive credentials in transit, compromising the entire API integration.
What is the primary purpose of implementing a Web Application Firewall (WAF) in a security architecture?
A WAF provides a protective layer that inspects web traffic and blocks known attack patterns, providing defense-in-depth against web-based exploits.
During a penetration test, you discover a web application that reflects user input without any sanitization. Which type of vulnerability is this most likely to be?
Reflected user input without sanitization is the primary indicator of XSS vulnerabilities, where attackers can inject malicious scripts that execute in users' browsers.
What is the primary purpose of a rules of engagement document in a penetration test?
Rules of engagement establish the legal and operational boundaries of the penetration test, including what systems can be tested, when, and what techniques are permitted.
You are performing reconnaissance on a target organization. Which of the following is a passive information gathering technique?
Passive reconnaissance gathers information without directly interacting with the target. Job postings, DNS records, and public documents provide intelligence without triggering detection mechanisms.
A penetration tester finds that a Windows server is running an outdated version of SMB with null session enabled. What is the greatest risk this presents?
Null sessions on SMB allow unauthenticated users to connect and enumerate network information, shares, and user accounts—a significant information disclosure risk. While RCE may be possible with additional exploits, enumeration is the direct risk.
During post-exploitation, you gain access to a Linux system and discover a setuid binary owned by root. What does this indicate?
A setuid binary executes with the privileges of its owner; if owned by root, it runs as root regardless of the executing user. This can be a privilege escalation vector if the binary is vulnerable.
Which of the following best describes the difference between vulnerability scanning and penetration testing?
Vulnerability scanners automatically detect known vulnerabilities and misconfigurations, while penetration testing actively exploits those vulnerabilities to determine actual impact and risk to the organization.
You perform a lateral movement attack and successfully escalate privileges using a plaintext password found in a configuration file. Under what circumstance would this be a valid test activity?
Exploitation activities must always align with the signed rules of engagement and scope. Even discovered credentials should only be used for authorized testing purposes defined in the engagement documentation.
A web application uses JWT tokens for authentication. An attacker modifies the token's payload and changes the signature algorithm from RS256 to HS256. What vulnerability is being exploited?
Algorithm confusion attacks exploit improper JWT validation where the server accepts multiple algorithms. Changing from asymmetric (RS256) to symmetric (HS256) can allow attackers to forge valid signatures if the implementation doesn't enforce algorithm types.
During a network penetration test, you identify that Domain Name System (DNS) queries are not encrypted. Which protocol could you recommend to encrypt DNS traffic?
DoH and DoT are the primary standards for encrypting DNS queries. DoH uses HTTPS while DoT uses TLS, both preventing eavesdropping on DNS traffic. DNSSEC validates authenticity but doesn't encrypt queries.
What is the primary goal of threat modeling during the planning phase of a penetration test?
Threat modeling helps identify high-value assets and likely attack paths, allowing the penetration tester to focus on realistic scenarios that an actual attacker would pursue.
You discover a web application parameter that filters input to prevent SQL injection. However, you notice the application is vulnerable to NoSQL injection through the same parameter. What is the most likely cause?
SQL injection filters typically look for SQL keywords and syntax. NoSQL injection uses different operators and syntax (like $ne, $regex), so legacy SQL-focused validation won't catch these attacks.
During privilege escalation testing on a Windows system, you find a service running with SYSTEM privileges that loads a DLL from a world-writable directory. What attack would be most effective?
If a SYSTEM-level service loads a DLL from a world-writable location, an attacker can place a malicious DLL there first. When the service starts, it will load and execute the attacker's code with SYSTEM privileges.
What is the primary purpose of maintaining a testing journal during a penetration engagement?
A testing journal creates a comprehensive audit trail of all actions, findings, and evidence collected during the assessment. This is essential for report accuracy, demonstrating due diligence, and supporting conclusions.
You are testing an API endpoint that uses OAuth 2.0 for authentication. You discover the refresh token is stored in browser localStorage instead of a secure HTTP-only cookie. What vulnerability does this create?
Storing sensitive tokens in localStorage makes them accessible to JavaScript, including malicious scripts injected via XSS. HTTP-only cookies prevent script access, protecting tokens from XSS-based theft.
During active reconnaissance, you perform a SYN scan on a target and receive RST responses from closed ports and no responses from filtered ports. Based on this behavior, what can you infer?
RST responses indicate open/closed ports (the server is responding), while no response (filtered) suggests a firewall is silently dropping packets. This pattern is typical of stateful firewall behavior.
What is the primary difference between authenticated and unauthenticated vulnerability scanning in a penetration test?
Authenticated scanning provides deeper visibility by logging in with valid credentials, revealing configuration issues, patch levels, and vulnerabilities that aren't visible to anonymous users.
You discover that a target application is vulnerable to XML External Entity (XXE) injection. Which of the following is the most critical risk associated with this vulnerability?
XXE vulnerabilities allow attackers to read local files, access internal services via SSRF, and conduct denial-of-service attacks through billion laughs (entity expansion) attacks, making them a critical security risk.
During client communication, a stakeholder asks why you're testing for vulnerabilities that 'obviously shouldn't exist.' What is the best response?
Organizations often assume obvious vulnerabilities don't exist, yet default credentials, unpatched systems, and basic misconfigurations are among the most commonly exploited issues in real attacks.
What is the primary function of a Web Application Firewall (WAF) in the context of web application security?
A WAF acts as a protective layer between clients and web servers, analyzing HTTP requests for known attack patterns and blocking malicious payloads before they can exploit application vulnerabilities.
You find that a Linux server allows SSH password authentication with weak passwords. During your testing, you successfully brute-force an administrative account. What additional security control would best prevent this attack?
MFA and SSH key-based authentication eliminate the risk of brute-force attacks against passwords. Keys are cryptographically stronger and MFA adds an additional layer that can't be brute-forced.
During a test of a mobile application, you discover that sensitive data is being cached in the application's memory and not cleared after the user logs out. Why is this a security concern?
Sensitive data left in memory can be recovered through memory dumps, malware, or physical device access long after the application is closed, violating data protection principles.
What is the best practice for reporting findings that overlap between multiple penetration testers on a large engagement?
Centralized tracking prevents duplicate reporting, ensures all systems are covered, and facilitates team communication for complex findings that span multiple systems or attack chains.
A penetration tester discovers a vulnerability in the target organization's code repository that could impact all deployed applications. Should this finding be included in the penetration test report?
If code repositories are within scope and contain exploitable vulnerabilities affecting deployed systems, they should be reported as they represent significant risk to the organization's security.
Which of the following is the primary advantage of using Burp Suite or similar web proxy tools during web application penetration testing?
Web proxies enable testers to intercept and manipulate HTTP traffic, revealing how applications handle malformed input and allowing manual testing for complex vulnerabilities that automated scanners miss.
During exploitation, you gain a shell on a compromised system. The operating system uses Address Space Layout Randomization (ASLR). Why would this complicate further exploitation attempts?
ASLR randomizes the base addresses of executable code and data segments with each execution. Exploits using hardcoded memory addresses will fail, requiring more sophisticated techniques like information disclosure to bypass ASLR.
What is the primary purpose of conducting a social engineering test as part of a penetration engagement?
Social engineering tests evaluate how well employees follow security policies, recognize threats, and respond to suspicious communications. Results guide awareness training and process improvements.
You are testing a cloud-based infrastructure and discover overly permissive IAM roles that allow services to access resources beyond their operational needs. What principle does this violate?
Overly permissive IAM roles violate the Principle of Least Privilege, which states that users and services should have only the minimum permissions required to perform their duties, limiting potential damage from compromised accounts.
During a penetration test, you discover that a web application fails to properly validate file uploads and allows execution of arbitrary code. Which of the following best describes this vulnerability?
Unrestricted file upload vulnerabilities allow attackers to upload and execute arbitrary files, including code. This directly matches the scenario of bypassed upload validation and code execution.
What is the primary purpose of performing a wireless network assessment during a penetration test?
Wireless assessments focus on identifying security weaknesses in wireless infrastructure, including rogue access points, weak encryption, and authentication flaws.
You are conducting a black-box penetration test and need to identify web application technologies in use. Which technique would be most appropriate for fingerprinting web technologies without making obvious requests that trigger IDS alerts?
Passive analysis of HTTP headers, HTML comments, and other metadata allows technology identification with minimal noise and fewer alerts compared to active scanning techniques.
During post-exploitation, you gain access to a Linux system and find a database backup file encrypted with a weak cipher. Which approach would be most efficient for attempting to recover the plaintext?
Analyzing the cipher for known weaknesses (such as ECB mode vulnerabilities, weak key schedules, or implementation flaws) is far more efficient than brute force and demonstrates professional penetration testing methodology.
What is the primary benefit of establishing a command and control (C2) infrastructure during a penetration test?
A C2 infrastructure allows penetration testers to simulate advanced persistent threat (APT) behavior by maintaining access and executing post-exploitation commands while avoiding detection.
You discover that a target system uses certificate pinning in its mobile application. Which of the following best describes the impact this has on your penetration test?
Certificate pinning validates that the server's certificate matches a pre-pinned list, preventing standard MITM attacks. Testers must employ bypass techniques such as jailbreaking, hooking, or patching the application.
During a social engineering assessment, you successfully obtain credentials from an employee through phishing. What should be your next step to maintain professional ethics and scope compliance?
Professional penetration testing requires validating the finding and documenting it while respecting scope limitations. Using credentials only within authorized boundaries demonstrates ethical practice and prevents unintended damage.
Which of the following scenarios best represents the need for DNS enumeration during reconnaissance?
DNS enumeration reveals subdomains, mail servers, nameservers, and other records that expand the target's attack surface and provide valuable information for vulnerability identification.
You are testing a web application that implements rate limiting on login attempts. Which technique would best help identify if the rate limiting can be bypassed?
Rate limiting bypasses often depend on how limits are applied—by IP, session, or account. Testing with varied headers and IPs helps identify if the implementation has weaknesses in tracking request origin.
When documenting vulnerabilities in a penetration test report, which information is most critical for remediation efforts?
Effective remediation requires understanding how the vulnerability was exploited, its business impact, proof that it exists, and actionable steps to fix it. This information enables the organization to prioritize and resolve issues effectively.
You've reviewed all 63 questions. Take the interactive practice exam to simulate the real test environment.
▶ Start Practice Exam — Free