CompTIA PenTest+ Exam Test Bank 2 with a
review of 435 latest real exam questions and
Correct Answers/ CompTIA PenTest+ Exam
Prep Test bank 2 (Latest 2026-2027)
A penetration tester has established a foothold inside a network and wants to
conduct reconnaissance inside while remaining anonymous. What could they use
to best accomplish this?
A. SOCKS
B. masscan
C. Ostinato
D. Snow
A. SOCKS
What is the primary function of a SOCKS proxy in network security?
A. To scan the entire internet rapidly and efficiently.
B. To generate and send crafted network packets.
C. To mediate communications between a client and server, providing anonymity.
D. To hide data within the whitespace of text files.
C. To mediate communications between a client and server, providing anonymity.
Why might masscan not be suitable for reconnaissance within internal networks?
A. It provides anonymity for the user.
B. It is designed for rapid scanning of the internet and can be extremely noisy,
potentially disrupting the network.
C. It is primarily used for data hiding in text files.
D. It mediates communications between clients and servers.
B. It is designed for rapid scanning of the internet and can be extremely noisy,
potentially disrupting the network.
1
,What is the main use of Ostinato in network testing?
A. To provide a proxy service that anonymizes internal network traffic.
B. To perform quiet, stealthy scans within a network.
C. To craft and send customized network packets, similar to tools like Scapy and
hping3.
D. To conceal data payloads within ASCII text files.
C. To craft and send customized network packets, similar to tools like Scapy and
hping3.
How does the Snow tool contribute to data security?
A. By scanning networks rapidly to identify vulnerabilities.
B. By crafting packets to simulate network traffic.
C. By mediating and anonymizing communications over a network.
D. By concealing a data payload within the whitespace of ASCII text files, using
steganography.
D. By concealing a data payload within the whitespace of ASCII text files, using
steganography.
A penetration tester has landed a shell on a Linux box and wants to find out more
about the users' login and idle time. Which built-in bash command should they
use?
A. cat /etc/passwd
B. finger
C. uname -a
D. env
B. finger
What information can the finger command provide about system users?
A. List of all users on the system.
B. Environmental variables for the current user session.
C. Home directories, login times, and idle times of users.
D. Operating system name and version.
C. Home directories, login times, and idle times of users.
2
,How can the cat /etc/passwd command be used during a security assessment?
A. To display system environmental variables.
B. To list all users on the system and their basic information.
C. To check the idle time of users logged into the system.
D. To determine the operating system version.
B. To list all users on the system and their basic information.
Which command provides detailed information about the operating system on a
Linux machine?
A. finger
B. env
C. uname -a
D. cat /etc/passwd
C. uname -a
What does the env command display when executed in a Linux environment?
A. Information about the system's hardware.
B. A list of all environment variables currently set.
C. The home directories and login times of users.
D. The list of users stored in /etc/passwd.
B. A list of all environment variables currently set.
When might a penetration tester use Nmap's smb- NSE scripts?
A. When they need to list environmental variables of a target system.
B. When assessing a Linux system for user login and idle times.
C. When interrogating a target system's Samba service for vulnerabilities.
D. When checking for the operating system details of a remote host.
C. When interrogating a target system's Samba service for vulnerabilities.
How can the finger command be supplemented with Nmap scans in a security
assessment?
A. By using Nmap's -O or -sV scans to further fingerprint the operating system and
3
, assess service vulnerabilities after identifying user activity with finger.
B. By using Nmap to list all environmental variables after using finger.
C. By using finger to change system environmental variables before running an
Nmap scan.
D. By using finger in conjunction with Nmap to modify user account details.
A. By using Nmap's -O or -sV scans to further fingerprint the operating system and
assess service vulnerabilities after identifying user activity with finger.
What additional information can be obtained about a Linux system using the
uname -a command and Metasploit's post exploitation modules?
A. Environmental variables and user account passwords.
B. Details about user login times and idle times.
C. Comprehensive system information including OS name, version, and other
system details, which can be extended with Metasploit's post/linux/enum_system
module for deeper system analysis.
D. Data on environmental variables and their settings.
C. Comprehensive system information including OS name, version, and other
system details, which can be extended with Metasploit's post/linux/enum_system
module for deeper system analysis.
A security tester is looking for custom scripts against uncommon services which
they can't find in MetaSploit. Which of the following could they look at to possibly
find what they need?
A. ExploitDB
B. Mobile Security Testing Guide (MSTG)
C. Open Web Application Security Project (OWASP)
D. OSSTMM
A. ExploitDB
What is the primary use of the Exploit Database in the context of security testing?
A. To provide a structured approach to penetration testing.
B. To offer a comprehensive collection of public exploits and vulnerable software
in a searchable format.
4
review of 435 latest real exam questions and
Correct Answers/ CompTIA PenTest+ Exam
Prep Test bank 2 (Latest 2026-2027)
A penetration tester has established a foothold inside a network and wants to
conduct reconnaissance inside while remaining anonymous. What could they use
to best accomplish this?
A. SOCKS
B. masscan
C. Ostinato
D. Snow
A. SOCKS
What is the primary function of a SOCKS proxy in network security?
A. To scan the entire internet rapidly and efficiently.
B. To generate and send crafted network packets.
C. To mediate communications between a client and server, providing anonymity.
D. To hide data within the whitespace of text files.
C. To mediate communications between a client and server, providing anonymity.
Why might masscan not be suitable for reconnaissance within internal networks?
A. It provides anonymity for the user.
B. It is designed for rapid scanning of the internet and can be extremely noisy,
potentially disrupting the network.
C. It is primarily used for data hiding in text files.
D. It mediates communications between clients and servers.
B. It is designed for rapid scanning of the internet and can be extremely noisy,
potentially disrupting the network.
1
,What is the main use of Ostinato in network testing?
A. To provide a proxy service that anonymizes internal network traffic.
B. To perform quiet, stealthy scans within a network.
C. To craft and send customized network packets, similar to tools like Scapy and
hping3.
D. To conceal data payloads within ASCII text files.
C. To craft and send customized network packets, similar to tools like Scapy and
hping3.
How does the Snow tool contribute to data security?
A. By scanning networks rapidly to identify vulnerabilities.
B. By crafting packets to simulate network traffic.
C. By mediating and anonymizing communications over a network.
D. By concealing a data payload within the whitespace of ASCII text files, using
steganography.
D. By concealing a data payload within the whitespace of ASCII text files, using
steganography.
A penetration tester has landed a shell on a Linux box and wants to find out more
about the users' login and idle time. Which built-in bash command should they
use?
A. cat /etc/passwd
B. finger
C. uname -a
D. env
B. finger
What information can the finger command provide about system users?
A. List of all users on the system.
B. Environmental variables for the current user session.
C. Home directories, login times, and idle times of users.
D. Operating system name and version.
C. Home directories, login times, and idle times of users.
2
,How can the cat /etc/passwd command be used during a security assessment?
A. To display system environmental variables.
B. To list all users on the system and their basic information.
C. To check the idle time of users logged into the system.
D. To determine the operating system version.
B. To list all users on the system and their basic information.
Which command provides detailed information about the operating system on a
Linux machine?
A. finger
B. env
C. uname -a
D. cat /etc/passwd
C. uname -a
What does the env command display when executed in a Linux environment?
A. Information about the system's hardware.
B. A list of all environment variables currently set.
C. The home directories and login times of users.
D. The list of users stored in /etc/passwd.
B. A list of all environment variables currently set.
When might a penetration tester use Nmap's smb- NSE scripts?
A. When they need to list environmental variables of a target system.
B. When assessing a Linux system for user login and idle times.
C. When interrogating a target system's Samba service for vulnerabilities.
D. When checking for the operating system details of a remote host.
C. When interrogating a target system's Samba service for vulnerabilities.
How can the finger command be supplemented with Nmap scans in a security
assessment?
A. By using Nmap's -O or -sV scans to further fingerprint the operating system and
3
, assess service vulnerabilities after identifying user activity with finger.
B. By using Nmap to list all environmental variables after using finger.
C. By using finger to change system environmental variables before running an
Nmap scan.
D. By using finger in conjunction with Nmap to modify user account details.
A. By using Nmap's -O or -sV scans to further fingerprint the operating system and
assess service vulnerabilities after identifying user activity with finger.
What additional information can be obtained about a Linux system using the
uname -a command and Metasploit's post exploitation modules?
A. Environmental variables and user account passwords.
B. Details about user login times and idle times.
C. Comprehensive system information including OS name, version, and other
system details, which can be extended with Metasploit's post/linux/enum_system
module for deeper system analysis.
D. Data on environmental variables and their settings.
C. Comprehensive system information including OS name, version, and other
system details, which can be extended with Metasploit's post/linux/enum_system
module for deeper system analysis.
A security tester is looking for custom scripts against uncommon services which
they can't find in MetaSploit. Which of the following could they look at to possibly
find what they need?
A. ExploitDB
B. Mobile Security Testing Guide (MSTG)
C. Open Web Application Security Project (OWASP)
D. OSSTMM
A. ExploitDB
What is the primary use of the Exploit Database in the context of security testing?
A. To provide a structured approach to penetration testing.
B. To offer a comprehensive collection of public exploits and vulnerable software
in a searchable format.
4
