CompTIA PenTest+ Exam Prep 2026 Comprehensive
Penetration Testing Certification Review Practice
Questions with Detailed Explanations
DOMAIN 1: ENGAGEMENT MANAGEMENT (13%) — Questions 1-13
Question 1
A penetration tester is preparing for an engagement with a financial services client.
The rules of engagement specify that testing is limited to the client's public-facing
web applications and APIs, with a strict prohibition against touching production
databases. During testing, the tester discovers a SQL injection vulnerability that
could potentially expose customer financial data. What is the MOST appropriate
course of action?
A) Exploit the SQL injection to demonstrate the full impact of the vulnerability
B) Stop testing immediately and report the finding to the client's security team
C) Document the vulnerability and continue testing within the scope boundaries
D) Exploit the vulnerability on a staging environment if available, and document
the finding
Answer: C
Rationale: The rules of engagement define the scope of the penetration test, and
testers must operate within these boundaries. While discovering a critical SQL
injection is significant, exploiting it against production systems would violate the
rules of engagement and could cause data loss or corruption. The tester should
document the vulnerability with evidence (such as error messages or time-based
injection responses) that demonstrates the risk without actually extracting or
damaging data, then continue testing within scope.
Question 2
During the scoping phase of a penetration test, the client requests that the
assessment cover 200 IP addresses, 15 web applications, and include a wireless
,assessment. The timeline is four weeks with a team of two testers. Which of the
following is the MOST appropriate response?
A) Accept the scope and timeline as requested by the client
B) Negotiate a reduced scope or extended timeline based on resource constraints
C) Proceed with the assessment but prioritize only the web applications
D) Decline the engagement due to insufficient resources
Answer: B
Rationale: Scoping is a critical part of engagement management where testers
must align expectations with available resources. A four-week timeline with two
testers for 200 IPs, 15 web applications, and wireless testing is likely insufficient
for a thorough assessment. The professional approach is to negotiate a reduced
scope, extended timeline, or additional resources while clearly articulating the risks
of incomplete testing to the client.
Question 3
Which of the following documents is MOST critical for establishing the legal
authority to conduct a penetration test?
A) Non-disclosure agreement (NDA)
B) Rules of engagement (RoE)
C) Authorization letter signed by an authorized representative
D) Statement of work (SOW)
Answer: C
Rationale: A signed authorization letter from an authorized representative of the
target organization is the most critical document for establishing legal authority to
conduct penetration testing. Without proper authorization, the tester could be
prosecuted under computer fraud laws (such as the CFAA in the US). The RoE,
NDA, and SOW are important documents, but they do not provide the legal
authority to test—only a signed authorization from the client does that.
Question 4
A penetration tester completes an assessment and is preparing the final report.
Which of the following is the MOST appropriate structure for the report?
,A) A single technical document with all findings and exploit code
B) An executive summary for leadership and a separate technical report for
remediation teams
C) A verbal presentation only, to avoid creating a permanent record of
vulnerabilities
D) A public-facing blog post detailing the findings
Answer: B
Rationale: Penetration test reports should include both executive summaries for
leadership audiences and detailed technical findings for remediation teams. The
executive summary should be concise, focusing on business risk and high-level
findings, while the technical report should include detailed vulnerability
descriptions, proof of concept, and remediation recommendations. Creating
separate reports ensures that each audience receives the information they need
without overwhelming non-technical stakeholders.
Question 5
A client requests that a penetration tester sign a non-disclosure agreement (NDA)
that prohibits discussing any findings with anyone outside the client's organization.
The tester discovers a critical vulnerability that affects a widely used third-party
library. What is the MOST appropriate action?
A) Ignore the NDA and disclose the vulnerability to the library maintainers
B) Report the vulnerability to the client and recommend they coordinate disclosure
with the vendor
C) Keep the finding confidential as required by the NDA
D) Publish the finding anonymously on a security forum
Answer: B
Rationale: While NDAs protect client confidentiality, responsible disclosure of
critical vulnerabilities that affect third-party software is an ethical obligation. The
tester should report the finding to the client and recommend that the client
coordinate responsible disclosure with the vendor. This approach respects the NDA
while fulfilling the ethical duty to protect the broader security community.
, Question 6
During the planning phase, a penetration tester needs to identify which systems are
in scope for the assessment. Which of the following sources would provide the
MOST reliable and current information?
A) Public DNS records
B) The client's asset inventory and network documentation
C) Results from an automated port scan
D) Information from social media and job postings
Answer: B
Rationale: The client's asset inventory and network documentation provide the
most reliable and current information about which systems are in scope. Public
DNS records, port scans, and OSINT sources can provide supplemental
information but may be incomplete or outdated. Relying solely on external sources
could result in missing critical assets or testing out-of-scope systems.
Question 7
A penetration tester is conducting a post-engagement review with the client. The
client is disappointed that the tester did not find any "critical" vulnerabilities.
Which of the following is the BEST way to communicate the value of the
assessment?
A) Apologize and offer to retest at a discount
B) Explain that the absence of critical findings indicates the client's security
controls are effective
C) Highlight the identified medium- and low-severity findings and their potential
impact if chained together
D) Suggest the client hire a different testing team for a second opinion
Answer: C
Rationale: Effective communication with stakeholders includes articulating risk
and the value of findings, even when no critical vulnerabilities are found. Medium-
and low-severity findings can often be chained together to create significant
impact, and explaining this demonstrates the depth of the assessment. While the
absence of critical findings can indicate good security controls, focusing only on
that may undersell the value of the work.
Penetration Testing Certification Review Practice
Questions with Detailed Explanations
DOMAIN 1: ENGAGEMENT MANAGEMENT (13%) — Questions 1-13
Question 1
A penetration tester is preparing for an engagement with a financial services client.
The rules of engagement specify that testing is limited to the client's public-facing
web applications and APIs, with a strict prohibition against touching production
databases. During testing, the tester discovers a SQL injection vulnerability that
could potentially expose customer financial data. What is the MOST appropriate
course of action?
A) Exploit the SQL injection to demonstrate the full impact of the vulnerability
B) Stop testing immediately and report the finding to the client's security team
C) Document the vulnerability and continue testing within the scope boundaries
D) Exploit the vulnerability on a staging environment if available, and document
the finding
Answer: C
Rationale: The rules of engagement define the scope of the penetration test, and
testers must operate within these boundaries. While discovering a critical SQL
injection is significant, exploiting it against production systems would violate the
rules of engagement and could cause data loss or corruption. The tester should
document the vulnerability with evidence (such as error messages or time-based
injection responses) that demonstrates the risk without actually extracting or
damaging data, then continue testing within scope.
Question 2
During the scoping phase of a penetration test, the client requests that the
assessment cover 200 IP addresses, 15 web applications, and include a wireless
,assessment. The timeline is four weeks with a team of two testers. Which of the
following is the MOST appropriate response?
A) Accept the scope and timeline as requested by the client
B) Negotiate a reduced scope or extended timeline based on resource constraints
C) Proceed with the assessment but prioritize only the web applications
D) Decline the engagement due to insufficient resources
Answer: B
Rationale: Scoping is a critical part of engagement management where testers
must align expectations with available resources. A four-week timeline with two
testers for 200 IPs, 15 web applications, and wireless testing is likely insufficient
for a thorough assessment. The professional approach is to negotiate a reduced
scope, extended timeline, or additional resources while clearly articulating the risks
of incomplete testing to the client.
Question 3
Which of the following documents is MOST critical for establishing the legal
authority to conduct a penetration test?
A) Non-disclosure agreement (NDA)
B) Rules of engagement (RoE)
C) Authorization letter signed by an authorized representative
D) Statement of work (SOW)
Answer: C
Rationale: A signed authorization letter from an authorized representative of the
target organization is the most critical document for establishing legal authority to
conduct penetration testing. Without proper authorization, the tester could be
prosecuted under computer fraud laws (such as the CFAA in the US). The RoE,
NDA, and SOW are important documents, but they do not provide the legal
authority to test—only a signed authorization from the client does that.
Question 4
A penetration tester completes an assessment and is preparing the final report.
Which of the following is the MOST appropriate structure for the report?
,A) A single technical document with all findings and exploit code
B) An executive summary for leadership and a separate technical report for
remediation teams
C) A verbal presentation only, to avoid creating a permanent record of
vulnerabilities
D) A public-facing blog post detailing the findings
Answer: B
Rationale: Penetration test reports should include both executive summaries for
leadership audiences and detailed technical findings for remediation teams. The
executive summary should be concise, focusing on business risk and high-level
findings, while the technical report should include detailed vulnerability
descriptions, proof of concept, and remediation recommendations. Creating
separate reports ensures that each audience receives the information they need
without overwhelming non-technical stakeholders.
Question 5
A client requests that a penetration tester sign a non-disclosure agreement (NDA)
that prohibits discussing any findings with anyone outside the client's organization.
The tester discovers a critical vulnerability that affects a widely used third-party
library. What is the MOST appropriate action?
A) Ignore the NDA and disclose the vulnerability to the library maintainers
B) Report the vulnerability to the client and recommend they coordinate disclosure
with the vendor
C) Keep the finding confidential as required by the NDA
D) Publish the finding anonymously on a security forum
Answer: B
Rationale: While NDAs protect client confidentiality, responsible disclosure of
critical vulnerabilities that affect third-party software is an ethical obligation. The
tester should report the finding to the client and recommend that the client
coordinate responsible disclosure with the vendor. This approach respects the NDA
while fulfilling the ethical duty to protect the broader security community.
, Question 6
During the planning phase, a penetration tester needs to identify which systems are
in scope for the assessment. Which of the following sources would provide the
MOST reliable and current information?
A) Public DNS records
B) The client's asset inventory and network documentation
C) Results from an automated port scan
D) Information from social media and job postings
Answer: B
Rationale: The client's asset inventory and network documentation provide the
most reliable and current information about which systems are in scope. Public
DNS records, port scans, and OSINT sources can provide supplemental
information but may be incomplete or outdated. Relying solely on external sources
could result in missing critical assets or testing out-of-scope systems.
Question 7
A penetration tester is conducting a post-engagement review with the client. The
client is disappointed that the tester did not find any "critical" vulnerabilities.
Which of the following is the BEST way to communicate the value of the
assessment?
A) Apologize and offer to retest at a discount
B) Explain that the absence of critical findings indicates the client's security
controls are effective
C) Highlight the identified medium- and low-severity findings and their potential
impact if chained together
D) Suggest the client hire a different testing team for a second opinion
Answer: C
Rationale: Effective communication with stakeholders includes articulating risk
and the value of findings, even when no critical vulnerabilities are found. Medium-
and low-severity findings can often be chained together to create significant
impact, and explaining this demonstrates the depth of the assessment. While the
absence of critical findings can indicate good security controls, focusing only on
that may undersell the value of the work.
