WGU D484 - CompTIA PenTest+ (PT0-002) NEWEST
EXAM QUESTIONS AND 100% CORRECT ANSWERS
(A+) 2025
Why is lack of code signing not highlighted in the OWASP Top Ten?
A. Because it primarily affects hardware compatibility rather than security.
B. Because it is considered a lower risk compared to direct web application
vulnerabilities.
C. Because it improves application performance.
D. Because it is related to user interface design.
B. Because it is considered a lower risk compared to direct web application
vulnerabilities.
A penetration tester has joined a consulting company that performs tests for several
varying clients. The company has stressed about staying within the scope of the
project. What is the worst thing the tester could face if they go outside their scope?
A. Contract negation
B. Fees
C. Fines
D. Criminal charges
D. Criminal charges
A penetration tester is conducting a PCI DSS compliance report for a large
company that does ten million transactions a year. What level should they comply
with?
A. 1
B. 2
C. 3
D. 4
A. 1
What is required for a Level 1 merchant in terms of compliance assessment?
,A. Internal audit only
B. Self-assessment questionnaire
C. Over six million transactions a year and must have an external audit by an
approved Qualified Security Assessor (QSA)
D. No compliance documentation required
C. Over six million transactions a year and must have an external audit by an
approved Qualified Security Assessor (QSA)
Which PCI DSS level applies to a merchant processing between 20,000 and 1
million transactions annually?
A. Level 1
B. Level 2
C. Level 3
D. Level 4
C. Level 3
Which of the following statements is true for a Level 2 merchant under PCI DSS?
A. They must submit a self-assessment questionnaire only.
B. They can choose not to comply with PCI DSS.
C. They must complete a Report on Compliance (RoC).
D. They are not required to document compliance.
C. They must complete a Report on Compliance (RoC).
Which level of PCI DSS compliance is appropriate for a merchant processing
under 20,000 transactions annually?
A. Level 1
B. Level 2
C. Level 3
D. Level 4
D. Level 4
, A penetration tester is currently reviewing the adherence to organizational policies
and procedures. Which controls help to monitor this?
A. Administrative
B. Physical
C. Technical
D. Logical
A. Administrative
Which type of control is primarily concerned with the implementation of security
measures through policies and guidelines related to human resources management?
A. Administrative
B. Physical
C. Technical
D. Logical
A. Administrative
What type of security control involves the use of Access Control Lists (ACL) to
manage permissions and access rights to network resources?
A. Administrative
B. Physical
C. Technical
D. Logical
C. Technical
Which control would include the use of biometric systems to restrict access to a
highly sensitive area within a company?
A. Administrative
B. Physical
C. Technical
D. Logical
B. Physical
EXAM QUESTIONS AND 100% CORRECT ANSWERS
(A+) 2025
Why is lack of code signing not highlighted in the OWASP Top Ten?
A. Because it primarily affects hardware compatibility rather than security.
B. Because it is considered a lower risk compared to direct web application
vulnerabilities.
C. Because it improves application performance.
D. Because it is related to user interface design.
B. Because it is considered a lower risk compared to direct web application
vulnerabilities.
A penetration tester has joined a consulting company that performs tests for several
varying clients. The company has stressed about staying within the scope of the
project. What is the worst thing the tester could face if they go outside their scope?
A. Contract negation
B. Fees
C. Fines
D. Criminal charges
D. Criminal charges
A penetration tester is conducting a PCI DSS compliance report for a large
company that does ten million transactions a year. What level should they comply
with?
A. 1
B. 2
C. 3
D. 4
A. 1
What is required for a Level 1 merchant in terms of compliance assessment?
,A. Internal audit only
B. Self-assessment questionnaire
C. Over six million transactions a year and must have an external audit by an
approved Qualified Security Assessor (QSA)
D. No compliance documentation required
C. Over six million transactions a year and must have an external audit by an
approved Qualified Security Assessor (QSA)
Which PCI DSS level applies to a merchant processing between 20,000 and 1
million transactions annually?
A. Level 1
B. Level 2
C. Level 3
D. Level 4
C. Level 3
Which of the following statements is true for a Level 2 merchant under PCI DSS?
A. They must submit a self-assessment questionnaire only.
B. They can choose not to comply with PCI DSS.
C. They must complete a Report on Compliance (RoC).
D. They are not required to document compliance.
C. They must complete a Report on Compliance (RoC).
Which level of PCI DSS compliance is appropriate for a merchant processing
under 20,000 transactions annually?
A. Level 1
B. Level 2
C. Level 3
D. Level 4
D. Level 4
, A penetration tester is currently reviewing the adherence to organizational policies
and procedures. Which controls help to monitor this?
A. Administrative
B. Physical
C. Technical
D. Logical
A. Administrative
Which type of control is primarily concerned with the implementation of security
measures through policies and guidelines related to human resources management?
A. Administrative
B. Physical
C. Technical
D. Logical
A. Administrative
What type of security control involves the use of Access Control Lists (ACL) to
manage permissions and access rights to network resources?
A. Administrative
B. Physical
C. Technical
D. Logical
C. Technical
Which control would include the use of biometric systems to restrict access to a
highly sensitive area within a company?
A. Administrative
B. Physical
C. Technical
D. Logical
B. Physical
