COMPTIA PENTEST+ EXAM – EXAM-STYLE QUESTIONS AND ANSWERS | VERIFIED
AND WELL DETAILED ANSWERS | PLUS RATIONALES | GUARANTEED PASS |
2026/27 LATEST UPDATE | EXAM PREP | STUDY GUIDE | PRACTICE TEST
Section One: Questions 1 – 50
1. A penetration tester has gained initial access to a target network and is
attempting to move laterally. The tester discovers that the local Administrator
account on several workstations has the same password. Which of the following
techniques would be the MOST effective and efficient for using this information
to gain access to other systems?
A. Pass-the-hash attack
B. Brute-force attack
C. Password spraying
D. Credential harvesting
Correct Answer: A. Pass-the-hash attack
Rationale: The correct answer is Pass-the-hash. In this scenario, the tester has gained
the password hash for the local Administrator account. A pass-the-hash attack allows
the tester to use the captured hash to authenticate to other systems without needing
to crack the plaintext password, making it extremely efficient in environments with
shared local admin credentials. Brute-force (B) and password spraying (C) are
guessing attacks that do not utilize a captured hash and are less efficient. Credential
harvesting (D) is a method for gathering credentials, not using an already obtained
one for lateral movement.
,2. A penetration tester is reviewing the logs of a web application firewall (WAF)
after a simulated attack. The tester notices that a series of requests sent to the
login page have unusual User-Agent strings that contain variations of the text
"sqlmap". Which of the following accurately describes what the tester is
observing?
A. An automated vulnerability scanning attempt.
B. A successful SQL injection exploitation.
C. A manual penetration testing attempt using a proxy.
D. An operating system fingerprinting attempt.
Correct Answer: A. An automated vulnerability scanning attempt
Rationale: The presence of "sqlmap" in the User-Agent string is a strong indicator of
an automated tool, specifically the SQL injection tool sqlmap. This is a classic
signature of an automated vulnerability scanning or exploitation attempt. A
successful SQL injection (B) would likely be evident in other log entries (e.g., database
error messages, unusual queries), not just the User-Agent. A manual test (C) would
typically use a browser or a proxy like Burp Suite, which often has standard User-
Agents. OS fingerprinting (D) usually involves analyzing responses to network probes,
not web application logs.
3. A penetration tester has been hired to evaluate the physical security of a
facility. The tester's objective is to gain unauthorized access to the server room.
Which of the following attack vectors represents the MOST effective application
of social engineering for this objective?
,A. Attempting to pick the lock on the server room door.
B. Using a USB rubber ducky to drop a payload on a receptionist's computer.
C. Tailgating an employee through a secure access door.
D. Calling the help desk and impersonating a manager to request a new server
room key card.
Correct Answer: D. Calling the help desk and impersonating a manager to request a
new server room key card
Rationale: This is a pure social engineering attack, leveraging impersonation and
authority to manipulate an individual into performing an action that compromises
security. It directly targets the human element to obtain a tangible access credential.
Lock picking (A) is a physical attack, not social engineering. Using a USB rubber
ducky (B) is a hardware-based attack. Tailgating (C) involves physical proximity and
following an authorized person, but it is less "effective" as a standalone social
engineering tactic if the door is secure and requires individual card access, making
the phone-based impersonation a more direct and reliable method for obtaining
access.
4. A penetration tester is conducting an internal network assessment and
identifies a single Windows host responding to a ping sweep with a TTL value of
128. What is the MOST likely operating system of this host?
A. Linux
B. Windows
C. Cisco IOS
D. macOS
, Correct Answer: B. Windows
Rationale: The Time-to-Live (TTL) value in an ICMP echo reply can provide a strong
indication of the target's operating system. A default TTL of 128 is characteristic of
Windows operating systems. Linux (A) typically uses a default TTL of 64. Cisco IOS (C)
usually has a TTL of 255. macOS (D) commonly uses a TTL of 64, similar to Linux.
5. During a network penetration test, a tester identifies an open port 22 on a
target server. What is the MOST important information to gather as part of the
initial enumeration of this service?
A. The server's MAC address.
B. The specific version of SSH running on the server.
C. The total number of users logged into the server.
D. The server's current CPU utilization.
Correct Answer: B. The specific version of SSH running on the server
Rationale: Version identification is a critical step in enumeration. Knowing the
specific SSH version allows the tester to search for known vulnerabilities, exploits, and
configuration weaknesses specific to that release. The MAC address (A) is a layer-2
address and is less relevant for exploiting an SSH service. User count (C) and CPU
utilization (D) are dynamic system details that, while useful for other purposes, are
not the most critical information for identifying potential vulnerabilities in the service
itself.
AND WELL DETAILED ANSWERS | PLUS RATIONALES | GUARANTEED PASS |
2026/27 LATEST UPDATE | EXAM PREP | STUDY GUIDE | PRACTICE TEST
Section One: Questions 1 – 50
1. A penetration tester has gained initial access to a target network and is
attempting to move laterally. The tester discovers that the local Administrator
account on several workstations has the same password. Which of the following
techniques would be the MOST effective and efficient for using this information
to gain access to other systems?
A. Pass-the-hash attack
B. Brute-force attack
C. Password spraying
D. Credential harvesting
Correct Answer: A. Pass-the-hash attack
Rationale: The correct answer is Pass-the-hash. In this scenario, the tester has gained
the password hash for the local Administrator account. A pass-the-hash attack allows
the tester to use the captured hash to authenticate to other systems without needing
to crack the plaintext password, making it extremely efficient in environments with
shared local admin credentials. Brute-force (B) and password spraying (C) are
guessing attacks that do not utilize a captured hash and are less efficient. Credential
harvesting (D) is a method for gathering credentials, not using an already obtained
one for lateral movement.
,2. A penetration tester is reviewing the logs of a web application firewall (WAF)
after a simulated attack. The tester notices that a series of requests sent to the
login page have unusual User-Agent strings that contain variations of the text
"sqlmap". Which of the following accurately describes what the tester is
observing?
A. An automated vulnerability scanning attempt.
B. A successful SQL injection exploitation.
C. A manual penetration testing attempt using a proxy.
D. An operating system fingerprinting attempt.
Correct Answer: A. An automated vulnerability scanning attempt
Rationale: The presence of "sqlmap" in the User-Agent string is a strong indicator of
an automated tool, specifically the SQL injection tool sqlmap. This is a classic
signature of an automated vulnerability scanning or exploitation attempt. A
successful SQL injection (B) would likely be evident in other log entries (e.g., database
error messages, unusual queries), not just the User-Agent. A manual test (C) would
typically use a browser or a proxy like Burp Suite, which often has standard User-
Agents. OS fingerprinting (D) usually involves analyzing responses to network probes,
not web application logs.
3. A penetration tester has been hired to evaluate the physical security of a
facility. The tester's objective is to gain unauthorized access to the server room.
Which of the following attack vectors represents the MOST effective application
of social engineering for this objective?
,A. Attempting to pick the lock on the server room door.
B. Using a USB rubber ducky to drop a payload on a receptionist's computer.
C. Tailgating an employee through a secure access door.
D. Calling the help desk and impersonating a manager to request a new server
room key card.
Correct Answer: D. Calling the help desk and impersonating a manager to request a
new server room key card
Rationale: This is a pure social engineering attack, leveraging impersonation and
authority to manipulate an individual into performing an action that compromises
security. It directly targets the human element to obtain a tangible access credential.
Lock picking (A) is a physical attack, not social engineering. Using a USB rubber
ducky (B) is a hardware-based attack. Tailgating (C) involves physical proximity and
following an authorized person, but it is less "effective" as a standalone social
engineering tactic if the door is secure and requires individual card access, making
the phone-based impersonation a more direct and reliable method for obtaining
access.
4. A penetration tester is conducting an internal network assessment and
identifies a single Windows host responding to a ping sweep with a TTL value of
128. What is the MOST likely operating system of this host?
A. Linux
B. Windows
C. Cisco IOS
D. macOS
, Correct Answer: B. Windows
Rationale: The Time-to-Live (TTL) value in an ICMP echo reply can provide a strong
indication of the target's operating system. A default TTL of 128 is characteristic of
Windows operating systems. Linux (A) typically uses a default TTL of 64. Cisco IOS (C)
usually has a TTL of 255. macOS (D) commonly uses a TTL of 64, similar to Linux.
5. During a network penetration test, a tester identifies an open port 22 on a
target server. What is the MOST important information to gather as part of the
initial enumeration of this service?
A. The server's MAC address.
B. The specific version of SSH running on the server.
C. The total number of users logged into the server.
D. The server's current CPU utilization.
Correct Answer: B. The specific version of SSH running on the server
Rationale: Version identification is a critical step in enumeration. Knowing the
specific SSH version allows the tester to search for known vulnerabilities, exploits, and
configuration weaknesses specific to that release. The MAC address (A) is a layer-2
address and is less relevant for exploiting an SSH service. User count (C) and CPU
utilization (D) are dynamic system details that, while useful for other purposes, are
not the most critical information for identifying potential vulnerabilities in the service
itself.
