COMPTIA PENTEST+ EXAM TEST BANK 2
WITH ACTUAL CORRECT QUESTIONS AND
VERIFIED DETAILED ANSWERS|
FREQUENTLY TESTING VERSION | ALREADY
GRADED A+|NEWEST|EXPERT VERIFIED FOR
GUARANTEED PASS 2026-2027
A penetration tester has established a foothold inside a network and wants to conduct
reconnaissance inside while remaining anonymous. What could they use to best
accomplish this?
A. SOCKS
B. masscan
C. Ostinato
D. Snow
A. SOCKS
What is the primary function of a SOCKS proxy in network security?
A. To scan the entire internet rapidly and efficiently.
B. To generate and send crafted network packets.
C. To mediate communications between a client and server, providing anonymity.
D. To hide data within the whitespace of text files.
C. To mediate communications between a client and server, providing anonymity.
Why might masscan not be suitable for reconnaissance within internal networks?
A. It provides anonymity for the user.
B. It is designed for rapid scanning of the internet and can be extremely noisy,
potentially disrupting the network.
C. It is primarily used for data hiding in text files.
D. It mediates communications between clients and servers.
B. It is designed for rapid scanning of the internet and can be extremely noisy,
potentially disrupting the network.
1|Page
,What is the main use of Ostinato in network testing?
A. To provide a proxy service that anonymizes internal network traffic.
B. To perform quiet, stealthy scans within a network.
C. To craft and send customized network packets, similar to tools like Scapy and
hping3.
D. To conceal data payloads within ASCII text files.
C. To craft and send customized network packets, similar to tools like Scapy and
hping3.
How does the Snow tool contribute to data security?
A. By scanning networks rapidly to identify vulnerabilities.
B. By crafting packets to simulate network traffic.
C. By mediating and anonymizing communications over a network.
D. By concealing a data payload within the whitespace of ASCII text files, using
steganography.
D. By concealing a data payload within the whitespace of ASCII text files, using
steganography.
A penetration tester has landed a shell on a Linux box and wants to find out more about
the users' login and idle time. Which built-in bash command should they use?
A. cat /etc/passwd
B. finger
C. uname -a
D. env
B. finger
What information can the finger command provide about system users?
A. List of all users on the system.
B. Environmental variables for the current user session.
C. Home directories, login times, and idle times of users.
D. Operating system name and version.
C. Home directories, login times, and idle times of users.
How can the cat /etc/passwd command be used during a security assessment?
A. To display system environmental variables.
B. To list all users on the system and their basic information.
2|Page
,C. To check the idle time of users logged into the system.
D. To determine the operating system version.
B. To list all users on the system and their basic information.
Which command provides detailed information about the operating system on a Linux
machine?
A. finger
B. env
C. uname -a
D. cat /etc/passwd
C. uname -a
What does the env command display when executed in a Linux environment?
A. Information about the system's hardware.
B. A list of all environment variables currently set.
C. The home directories and login times of users.
D. The list of users stored in /etc/passwd.
B. A list of all environment variables currently set.
When might a penetration tester use Nmap's smb- NSE scripts?
A. When they need to list environmental variables of a target system.
B. When assessing a Linux system for user login and idle times.
C. When interrogating a target system's Samba service for vulnerabilities.
D. When checking for the operating system details of a remote host.
C. When interrogating a target system's Samba service for vulnerabilities.
How can the finger command be supplemented with Nmap scans in a security
assessment?
A. By using Nmap's -O or -sV scans to further fingerprint the operating system and
assess service vulnerabilities after identifying user activity with finger.
B. By using Nmap to list all environmental variables after using finger.
C. By using finger to change system environmental variables before running an Nmap
scan.
D. By using finger in conjunction with Nmap to modify user account details.
A. By using Nmap's -O or -sV scans to further fingerprint the operating system and
assess service vulnerabilities after identifying user activity with finger.
3|Page
, What additional information can be obtained about a Linux system using the uname -a
command and Metasploit's post exploitation modules?
A. Environmental variables and user account passwords.
B. Details about user login times and idle times.
C. Comprehensive system information including OS name, version, and other system
details, which can be extended with Metasploit's post/linux/enum_system module for
deeper system analysis.
D. Data on environmental variables and their settings.
C. Comprehensive system information including OS name, version, and other system
details, which can be extended with Metasploit's post/linux/enum_system module for
deeper system analysis.
A security tester is looking for custom scripts against uncommon services which they
can't find in MetaSploit. Which of the following could they look at to possibly find what
they need?
A. ExploitDB
B. Mobile Security Testing Guide (MSTG)
C. Open Web Application Security Project (OWASP)
D. OSSTMM
A. ExploitDB
What is the primary use of the Exploit Database in the context of security testing?
A. To provide a structured approach to penetration testing.
B. To offer a comprehensive collection of public exploits and vulnerable software in a
searchable format.
C. To guide the security testing of mobile applications.
D. To increase awareness of web security through educational projects.
B. To offer a comprehensive collection of public exploits and vulnerable software in a
searchable format.
What does the Mobile Security Testing Guide (MSTG) offer to security professionals?
A. A database of web application vulnerabilities.
B. A methodology for structured penetration testing.
C. A framework for assessing the security of mobile applications, including security
recommendations and testing specifications.
D. A collection of exploits for mobile and web applications.
4|Page
WITH ACTUAL CORRECT QUESTIONS AND
VERIFIED DETAILED ANSWERS|
FREQUENTLY TESTING VERSION | ALREADY
GRADED A+|NEWEST|EXPERT VERIFIED FOR
GUARANTEED PASS 2026-2027
A penetration tester has established a foothold inside a network and wants to conduct
reconnaissance inside while remaining anonymous. What could they use to best
accomplish this?
A. SOCKS
B. masscan
C. Ostinato
D. Snow
A. SOCKS
What is the primary function of a SOCKS proxy in network security?
A. To scan the entire internet rapidly and efficiently.
B. To generate and send crafted network packets.
C. To mediate communications between a client and server, providing anonymity.
D. To hide data within the whitespace of text files.
C. To mediate communications between a client and server, providing anonymity.
Why might masscan not be suitable for reconnaissance within internal networks?
A. It provides anonymity for the user.
B. It is designed for rapid scanning of the internet and can be extremely noisy,
potentially disrupting the network.
C. It is primarily used for data hiding in text files.
D. It mediates communications between clients and servers.
B. It is designed for rapid scanning of the internet and can be extremely noisy,
potentially disrupting the network.
1|Page
,What is the main use of Ostinato in network testing?
A. To provide a proxy service that anonymizes internal network traffic.
B. To perform quiet, stealthy scans within a network.
C. To craft and send customized network packets, similar to tools like Scapy and
hping3.
D. To conceal data payloads within ASCII text files.
C. To craft and send customized network packets, similar to tools like Scapy and
hping3.
How does the Snow tool contribute to data security?
A. By scanning networks rapidly to identify vulnerabilities.
B. By crafting packets to simulate network traffic.
C. By mediating and anonymizing communications over a network.
D. By concealing a data payload within the whitespace of ASCII text files, using
steganography.
D. By concealing a data payload within the whitespace of ASCII text files, using
steganography.
A penetration tester has landed a shell on a Linux box and wants to find out more about
the users' login and idle time. Which built-in bash command should they use?
A. cat /etc/passwd
B. finger
C. uname -a
D. env
B. finger
What information can the finger command provide about system users?
A. List of all users on the system.
B. Environmental variables for the current user session.
C. Home directories, login times, and idle times of users.
D. Operating system name and version.
C. Home directories, login times, and idle times of users.
How can the cat /etc/passwd command be used during a security assessment?
A. To display system environmental variables.
B. To list all users on the system and their basic information.
2|Page
,C. To check the idle time of users logged into the system.
D. To determine the operating system version.
B. To list all users on the system and their basic information.
Which command provides detailed information about the operating system on a Linux
machine?
A. finger
B. env
C. uname -a
D. cat /etc/passwd
C. uname -a
What does the env command display when executed in a Linux environment?
A. Information about the system's hardware.
B. A list of all environment variables currently set.
C. The home directories and login times of users.
D. The list of users stored in /etc/passwd.
B. A list of all environment variables currently set.
When might a penetration tester use Nmap's smb- NSE scripts?
A. When they need to list environmental variables of a target system.
B. When assessing a Linux system for user login and idle times.
C. When interrogating a target system's Samba service for vulnerabilities.
D. When checking for the operating system details of a remote host.
C. When interrogating a target system's Samba service for vulnerabilities.
How can the finger command be supplemented with Nmap scans in a security
assessment?
A. By using Nmap's -O or -sV scans to further fingerprint the operating system and
assess service vulnerabilities after identifying user activity with finger.
B. By using Nmap to list all environmental variables after using finger.
C. By using finger to change system environmental variables before running an Nmap
scan.
D. By using finger in conjunction with Nmap to modify user account details.
A. By using Nmap's -O or -sV scans to further fingerprint the operating system and
assess service vulnerabilities after identifying user activity with finger.
3|Page
, What additional information can be obtained about a Linux system using the uname -a
command and Metasploit's post exploitation modules?
A. Environmental variables and user account passwords.
B. Details about user login times and idle times.
C. Comprehensive system information including OS name, version, and other system
details, which can be extended with Metasploit's post/linux/enum_system module for
deeper system analysis.
D. Data on environmental variables and their settings.
C. Comprehensive system information including OS name, version, and other system
details, which can be extended with Metasploit's post/linux/enum_system module for
deeper system analysis.
A security tester is looking for custom scripts against uncommon services which they
can't find in MetaSploit. Which of the following could they look at to possibly find what
they need?
A. ExploitDB
B. Mobile Security Testing Guide (MSTG)
C. Open Web Application Security Project (OWASP)
D. OSSTMM
A. ExploitDB
What is the primary use of the Exploit Database in the context of security testing?
A. To provide a structured approach to penetration testing.
B. To offer a comprehensive collection of public exploits and vulnerable software in a
searchable format.
C. To guide the security testing of mobile applications.
D. To increase awareness of web security through educational projects.
B. To offer a comprehensive collection of public exploits and vulnerable software in a
searchable format.
What does the Mobile Security Testing Guide (MSTG) offer to security professionals?
A. A database of web application vulnerabilities.
B. A methodology for structured penetration testing.
C. A framework for assessing the security of mobile applications, including security
recommendations and testing specifications.
D. A collection of exploits for mobile and web applications.
4|Page
