CompTIA PenTest+ (PT0-002) Practice Exam

Correct: A — the rules of engagement and signed scope/authorization. Scope, permitted targets, timing, and constraints are agreed and signed before testing starts; this written authorization (“permission to attack”) is what makes the work legal and defines its limits.

Why not the others: the report (B) comes at the end of the engagement; scan output (C) is a result produced during testing, not the authorizing document; an exploit payload (D) is a tool used in testing, not a scoping artifact.

Correct: B — passive reconnaissance (OSINT). Gathering open-source intelligence — public records, DNS data, social media, leaked credentials — without touching the target’s systems is passive reconnaissance, the stealthiest first information-gathering step.

Why not the others: an authenticated scan (A) actively probes the target; a brute-force attack (C) is an active exploit attempt; privilege escalation (D) happens post-exploitation, after access is gained.

Correct: C — Nmap. Nmap is the standard port-and-service scanner for host discovery, open-port enumeration, and service/version detection — the core active-reconnaissance tool in the PenTest+ toolset.

Why not the others: Wireshark (A) captures and analyses packets but does not scan for hosts/ports; Metasploit (B) is an exploitation framework; John the Ripper (D) is a password cracker. None is the primary discovery scanner.

Correct: D — SQL injection. Passing unsanitised input into a database query lets an attacker alter the query to read or modify data — the defining mechanism of SQL injection, a core application-attack objective.

Why not the others: XSS (A) injects script into pages viewed by other users, not into database queries; denial of service (B) disrupts availability; ARP spoofing (C) is a network-layer man-in-the-middle technique. None describes database-query manipulation.

Correct: A — privilege escalation. Moving from a low-privilege foothold to higher (here, root) rights by abusing a misconfiguration — such as a SUID binary — is vertical privilege escalation, a key post-exploitation activity.

Why not the others: passive reconnaissance (B) is pre-attack intelligence gathering; scoping (C) happens before testing begins; report writing (D) is the closing phase. None describes elevating rights on a compromised host.

Correct: B — social engineering (phishing). Manipulating people into divulging credentials or taking unsafe actions — here via a targeted phishing email — is social engineering, an explicit part of the attacks-and-exploits domain.

Why not the others: SQL injection (A) targets databases, not people; a buffer overflow (C) exploits memory handling in software; port scanning (D) is reconnaissance. Only phishing exploits human behaviour.

Correct: C — Metasploit Framework. Metasploit bundles exploits, payloads, encoders, and post-exploitation modules into one framework for delivering and managing a compromise — the canonical exploitation toolkit in the tools domain.

Why not the others: Nmap (A) is a scanner; Burp Suite (B) is a web-application proxy for testing web apps, not a general exploitation framework; tcpdump (D) is a packet capture tool. None is a full exploitation framework.

Correct: D — lateral movement. Using access or credentials from one compromised host to reach additional systems — for example via pass-the-hash — is lateral movement, a post-exploitation technique for expanding a foothold.

Why not the others: scoping (A) is the pre-engagement planning step; vulnerability scanning (B) is reconnaissance; report delivery (C) is the closing phase. Only lateral movement describes spreading across the network after initial compromise.

Correct: B — maintaining a documented chain of custody. Recording who handled each piece of evidence, when, and how preserves its integrity and admissibility — a reporting-and-communication requirement that also protects the tester and client.

Why not the others: deleting logs (A) destroys evidence; sharing findings publicly (C) breaches confidentiality; skipping timestamps (D) undermines the very integrity chain of custody exists to protect.

Correct: C — prioritise by risk with remediation guidance. Ranking findings by severity and business impact, each with clear remediation advice, is what lets a client fix the highest-risk issues first — the core purpose of the reporting domain.

Why not the others: discovery order (A) ignores severity; exploit code only (B) is not actionable for most stakeholders; omitting remediation (D) strips the report of its practical value.