CompTIA PenTest+ Exam Test Bank 3 with a
review of 435 latest real exam questions and
Correct Answers/ CompTIA PenTest+ Exam
Prep Test bank 3 (Latest 2026-2027)
A new penetration tester is creating a summary of their first upcoming process and
wants to follow the standard process. What step takes place after planning?
A. Scanning
B. Recon
C. Gaining access
D. Analysis
B. Recon
What is the primary focus of the reconnaissance phase in a penetration testing
process?
A. To disable security measures and gain access to the network
B. To gather as much information about the target as possible using OSINT and
other methods
C. To perform actual attacks on the system
D. To finalize the testing report
B. To gather as much information about the target as possible using OSINT and
other methods
Which phase in penetration testing involves identifying live hosts, listening ports,
and running services?
A. Planning
B. Reconnaissance
C. Scanning
D. Gaining access
1
,C. Scanning
During which phase of penetration testing does the team actively attempt to exploit
vulnerabilities to gain unauthorized access to systems?
A. Reconnaissance
B. Scanning
C. Gaining access
D. Analysis
C. Gaining access
What is the final step in the penetration testing process where findings are
reviewed and a risk rating summary is provided?
A. Reconnaissance
B. Scanning
C. Gaining access
D. Analysis
D. Analysis
Which tool category is most associated with the reconnaissance phase of
penetration testing?
A. Firewalls
B. Open-Source Information Gathering Tools (OSINT)
C. Exploit frameworks
D. Encryption software
B. Open-Source Information Gathering Tools (OSINT)
A penetration tester is conducting a physical test on-premise and is attempting to
exploit human errors. What type of risk is the pen tester trying to exploit?
A. Risk
B. Threat
C. Social Engineering
D. Risk Management
C. Social Engineering
2
,What is Social Engineering in the context of cybersecurity?
A. A process for managing software updates
B. The technical exploitation of network vulnerabilities
C. The manipulation of individuals to bypass security controls
D. A method of physically securing server rooms
C. The manipulation of individuals to bypass security controls
How is 'risk' defined in cybersecurity?
A. The potential for a threat to exploit a vulnerability and cause harm
B. The software used to protect against malware
C. A policy for handling data breaches
D. The physical measures taken to protect hardware
A. The potential for a threat to exploit a vulnerability and cause harm
Which of the following best describes a 'threat' in the context of cybersecurity?
A. The process of analyzing and responding to security weaknesses
B. A potential cause of an incident that may result in harm to a system or
organization
C. The calculation of potential losses from a security breach
D. The hardware used to enhance digital security
B. A potential cause of an incident that may result in harm to a system or
organization
What is the goal of risk management in cybersecurity?
A. To completely eliminate all risks
B. To identify, assess, analyze, and respond to risks
C. To ensure compliance with international standards only
D. To monitor employee behavior and prevent data leaks
B. To identify, assess, analyze, and respond to risks
Which type of risk exploitation involves tricking employees into revealing
confidential information?
3
, A. Social Engineering
B. Phishing attacks
C. Network intrusion
D. Application layer attacks
A. Social Engineering
A security professional is researching the latest vulnerabilities that have been
released. Where is a good resource they can go to in order to look at these?
A. Common Vulnerability Scoring System (CVSS)
B. Common Vulnerabilities and Exposures (CVE)
C. National Vulnerability Database (NVD)
D. Information Systems Security Assessment Framework (ISSAF)
C. National Vulnerability Database (NVD)
What resource provides detailed descriptions and other data about publicly known
vulnerabilities?
A. Common Vulnerability Scoring System (CVSS)
B. Common Vulnerabilities and Exposures (CVE)
C. National Vulnerability Database (NVD)
D. Information Systems Security Assessment Framework (ISSAF)
C. National Vulnerability Database (NVD)
Which system assigns a unique identifier to each publicly known vulnerability?
A. Common Vulnerability Scoring System (CVSS)
B. National Vulnerability Database (NVD)
C. Common Vulnerabilities and Exposures (CVE)
D. Information Systems Security Assessment Framework (ISSAF)
C. Common Vulnerabilities and Exposures (CVE)
What does the Common Vulnerability Scoring System (CVSS) provide for each
vulnerability?
A. A unique identifier
B. A severity rating
4
review of 435 latest real exam questions and
Correct Answers/ CompTIA PenTest+ Exam
Prep Test bank 3 (Latest 2026-2027)
A new penetration tester is creating a summary of their first upcoming process and
wants to follow the standard process. What step takes place after planning?
A. Scanning
B. Recon
C. Gaining access
D. Analysis
B. Recon
What is the primary focus of the reconnaissance phase in a penetration testing
process?
A. To disable security measures and gain access to the network
B. To gather as much information about the target as possible using OSINT and
other methods
C. To perform actual attacks on the system
D. To finalize the testing report
B. To gather as much information about the target as possible using OSINT and
other methods
Which phase in penetration testing involves identifying live hosts, listening ports,
and running services?
A. Planning
B. Reconnaissance
C. Scanning
D. Gaining access
1
,C. Scanning
During which phase of penetration testing does the team actively attempt to exploit
vulnerabilities to gain unauthorized access to systems?
A. Reconnaissance
B. Scanning
C. Gaining access
D. Analysis
C. Gaining access
What is the final step in the penetration testing process where findings are
reviewed and a risk rating summary is provided?
A. Reconnaissance
B. Scanning
C. Gaining access
D. Analysis
D. Analysis
Which tool category is most associated with the reconnaissance phase of
penetration testing?
A. Firewalls
B. Open-Source Information Gathering Tools (OSINT)
C. Exploit frameworks
D. Encryption software
B. Open-Source Information Gathering Tools (OSINT)
A penetration tester is conducting a physical test on-premise and is attempting to
exploit human errors. What type of risk is the pen tester trying to exploit?
A. Risk
B. Threat
C. Social Engineering
D. Risk Management
C. Social Engineering
2
,What is Social Engineering in the context of cybersecurity?
A. A process for managing software updates
B. The technical exploitation of network vulnerabilities
C. The manipulation of individuals to bypass security controls
D. A method of physically securing server rooms
C. The manipulation of individuals to bypass security controls
How is 'risk' defined in cybersecurity?
A. The potential for a threat to exploit a vulnerability and cause harm
B. The software used to protect against malware
C. A policy for handling data breaches
D. The physical measures taken to protect hardware
A. The potential for a threat to exploit a vulnerability and cause harm
Which of the following best describes a 'threat' in the context of cybersecurity?
A. The process of analyzing and responding to security weaknesses
B. A potential cause of an incident that may result in harm to a system or
organization
C. The calculation of potential losses from a security breach
D. The hardware used to enhance digital security
B. A potential cause of an incident that may result in harm to a system or
organization
What is the goal of risk management in cybersecurity?
A. To completely eliminate all risks
B. To identify, assess, analyze, and respond to risks
C. To ensure compliance with international standards only
D. To monitor employee behavior and prevent data leaks
B. To identify, assess, analyze, and respond to risks
Which type of risk exploitation involves tricking employees into revealing
confidential information?
3
, A. Social Engineering
B. Phishing attacks
C. Network intrusion
D. Application layer attacks
A. Social Engineering
A security professional is researching the latest vulnerabilities that have been
released. Where is a good resource they can go to in order to look at these?
A. Common Vulnerability Scoring System (CVSS)
B. Common Vulnerabilities and Exposures (CVE)
C. National Vulnerability Database (NVD)
D. Information Systems Security Assessment Framework (ISSAF)
C. National Vulnerability Database (NVD)
What resource provides detailed descriptions and other data about publicly known
vulnerabilities?
A. Common Vulnerability Scoring System (CVSS)
B. Common Vulnerabilities and Exposures (CVE)
C. National Vulnerability Database (NVD)
D. Information Systems Security Assessment Framework (ISSAF)
C. National Vulnerability Database (NVD)
Which system assigns a unique identifier to each publicly known vulnerability?
A. Common Vulnerability Scoring System (CVSS)
B. National Vulnerability Database (NVD)
C. Common Vulnerabilities and Exposures (CVE)
D. Information Systems Security Assessment Framework (ISSAF)
C. Common Vulnerabilities and Exposures (CVE)
What does the Common Vulnerability Scoring System (CVSS) provide for each
vulnerability?
A. A unique identifier
B. A severity rating
4
