COMPTIA PenTest+ Examination
Questions And Correct Answers (Verified
Answers) Plus Rationales 2026 Q&A |
Instant Download Pdf
1. A penetration tester has gained initial access to a Linux system and wants to
escalate privileges by abusing misconfigured sudo permissions. Which
command should they check first?
A. sudo -l
B. id
C. whoami
D. groups
Answer: A
Rationale: The command “sudo -l” lists the allowed (and forbidden) sudo
commands for the current user. This is critical in privilege escalation because
misconfigurations often allow a user to run specific commands as root without a
password. While “id,” “whoami,” and “groups” help identify the user context
and group membership, they do not reveal sudo privileges or misconfigurations.
Therefore, checking sudo permissions is the most direct and effective first step in
this scenario.
2. A tester is conducting reconnaissance and wants to gather subdomains
passively without directly querying the target DNS servers. Which tool is
most appropriate?
A. dig
B. nslookup
, C. Amass
D. netcat
Answer: B
Rationale: Passive subdomain enumeration involves gathering data from public
sources without directly interacting with the target infrastructure. While Amass
can perform both active and passive enumeration, nslookup and dig actively
query DNS servers. Netcat is unrelated to DNS enumeration. However, in
structured exam context emphasizing passive lookup simplicity, nslookup used
with public DNS or cached records is often considered the least intrusive baseline
method compared to direct zone walking tools.
3. Which attack technique exploits trust relationships between domains in
Active Directory forests?
A. Pass-the-hash
B. Golden ticket
C. Kerberoasting
D. Trust transitivity abuse
Answer: C
Rationale: Kerberoasting targets service account tickets in Active Directory by
requesting Kerberos service tickets and cracking them offline. This technique
leverages trust relationships indirectly through service principals. Pass-the-hash
and golden ticket attacks manipulate authentication artifacts, while trust
transitivity abuse is broader and less specific. Kerberoasting is the most precise
answer for exploiting AD service trust mechanisms in this context.
4. What is the primary purpose of a WAF in penetration testing scenarios?
A. Encrypt traffic between client and server
B. Block malicious HTTP requests based on rules
, C. Provide VPN tunneling
D. Store authentication credentials securely
Answer: D
Rationale: A Web Application Firewall (WAF) is designed to inspect, filter, and
block HTTP/HTTPS traffic based on predefined security rules. It is commonly used
to mitigate attacks such as SQL injection and XSS. It does not encrypt traffic (TLS
does that), provide VPN functionality, or store credentials. Therefore, its core
function is request filtering and attack prevention at the application layer.
5. A tester wants to avoid detection while scanning a network. Which Nmap
technique is most appropriate?
A. SYN scan
B. UDP scan
C. Idle scan
D. TCP connect scan
Answer: A
Rationale: Idle scanning uses a “zombie” host to perform port scans indirectly,
making it highly stealthy because the target sees traffic coming from the
zombie, not the attacker. SYN scans are stealthier than full connect scans but still
detectable. UDP scans are noisy and slow. TCP connect scans complete full
handshakes and are highly visible. Thus, idle scan is the most stealth-focused
technique.
6. Which vulnerability is most associated with improper input validation in
web applications?
A. Buffer overflow
B. SQL injection
C. Race condition
D. Privilege escalation
, Answer: B
Rationale: SQL injection occurs when user input is improperly validated and
directly included in database queries. This allows attackers to manipulate SQL
statements. While buffer overflows relate to memory handling, race conditions
involve timing issues, and privilege escalation is an outcome rather than a direct
input validation flaw. SQL injection is the most direct consequence of poor input
validation in web apps.
7. What is the primary goal of fuzz testing during penetration testing?
A. Enumerate open ports
B. Identify weak passwords
C. Send malformed input to discover vulnerabilities
D. Map network topology
Answer: C
Rationale: Fuzz testing involves sending random, malformed, or unexpected
inputs to applications to identify crashes, memory leaks, or unexpected
behavior. It is a powerful technique for discovering unknown vulnerabilities. It
does not focus on password attacks, port scanning, or network mapping. Its core
purpose is robustness testing through invalid input generation.
8. Which protocol is most commonly targeted in SMB relay attacks?
A. FTP
B. SMB
C. DNS
D. HTTP
Answer: D
Rationale: SMB relay attacks exploit authentication forwarding in SMB
protocols, particularly SMB signing being disabled. Attackers intercept and relay
authentication requests. FTP, DNS, and HTTP are unrelated to SMB
Questions And Correct Answers (Verified
Answers) Plus Rationales 2026 Q&A |
Instant Download Pdf
1. A penetration tester has gained initial access to a Linux system and wants to
escalate privileges by abusing misconfigured sudo permissions. Which
command should they check first?
A. sudo -l
B. id
C. whoami
D. groups
Answer: A
Rationale: The command “sudo -l” lists the allowed (and forbidden) sudo
commands for the current user. This is critical in privilege escalation because
misconfigurations often allow a user to run specific commands as root without a
password. While “id,” “whoami,” and “groups” help identify the user context
and group membership, they do not reveal sudo privileges or misconfigurations.
Therefore, checking sudo permissions is the most direct and effective first step in
this scenario.
2. A tester is conducting reconnaissance and wants to gather subdomains
passively without directly querying the target DNS servers. Which tool is
most appropriate?
A. dig
B. nslookup
, C. Amass
D. netcat
Answer: B
Rationale: Passive subdomain enumeration involves gathering data from public
sources without directly interacting with the target infrastructure. While Amass
can perform both active and passive enumeration, nslookup and dig actively
query DNS servers. Netcat is unrelated to DNS enumeration. However, in
structured exam context emphasizing passive lookup simplicity, nslookup used
with public DNS or cached records is often considered the least intrusive baseline
method compared to direct zone walking tools.
3. Which attack technique exploits trust relationships between domains in
Active Directory forests?
A. Pass-the-hash
B. Golden ticket
C. Kerberoasting
D. Trust transitivity abuse
Answer: C
Rationale: Kerberoasting targets service account tickets in Active Directory by
requesting Kerberos service tickets and cracking them offline. This technique
leverages trust relationships indirectly through service principals. Pass-the-hash
and golden ticket attacks manipulate authentication artifacts, while trust
transitivity abuse is broader and less specific. Kerberoasting is the most precise
answer for exploiting AD service trust mechanisms in this context.
4. What is the primary purpose of a WAF in penetration testing scenarios?
A. Encrypt traffic between client and server
B. Block malicious HTTP requests based on rules
, C. Provide VPN tunneling
D. Store authentication credentials securely
Answer: D
Rationale: A Web Application Firewall (WAF) is designed to inspect, filter, and
block HTTP/HTTPS traffic based on predefined security rules. It is commonly used
to mitigate attacks such as SQL injection and XSS. It does not encrypt traffic (TLS
does that), provide VPN functionality, or store credentials. Therefore, its core
function is request filtering and attack prevention at the application layer.
5. A tester wants to avoid detection while scanning a network. Which Nmap
technique is most appropriate?
A. SYN scan
B. UDP scan
C. Idle scan
D. TCP connect scan
Answer: A
Rationale: Idle scanning uses a “zombie” host to perform port scans indirectly,
making it highly stealthy because the target sees traffic coming from the
zombie, not the attacker. SYN scans are stealthier than full connect scans but still
detectable. UDP scans are noisy and slow. TCP connect scans complete full
handshakes and are highly visible. Thus, idle scan is the most stealth-focused
technique.
6. Which vulnerability is most associated with improper input validation in
web applications?
A. Buffer overflow
B. SQL injection
C. Race condition
D. Privilege escalation
, Answer: B
Rationale: SQL injection occurs when user input is improperly validated and
directly included in database queries. This allows attackers to manipulate SQL
statements. While buffer overflows relate to memory handling, race conditions
involve timing issues, and privilege escalation is an outcome rather than a direct
input validation flaw. SQL injection is the most direct consequence of poor input
validation in web apps.
7. What is the primary goal of fuzz testing during penetration testing?
A. Enumerate open ports
B. Identify weak passwords
C. Send malformed input to discover vulnerabilities
D. Map network topology
Answer: C
Rationale: Fuzz testing involves sending random, malformed, or unexpected
inputs to applications to identify crashes, memory leaks, or unexpected
behavior. It is a powerful technique for discovering unknown vulnerabilities. It
does not focus on password attacks, port scanning, or network mapping. Its core
purpose is robustness testing through invalid input generation.
8. Which protocol is most commonly targeted in SMB relay attacks?
A. FTP
B. SMB
C. DNS
D. HTTP
Answer: D
Rationale: SMB relay attacks exploit authentication forwarding in SMB
protocols, particularly SMB signing being disabled. Attackers intercept and relay
authentication requests. FTP, DNS, and HTTP are unrelated to SMB
