CompTIA PenTest+ flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Rules of engagement

A document defining authorized scope, targets, time windows, testing boundaries, escalation contacts, and prohibited actions; it is the authoritative reference for what the tester may and may not do.

Statement of work

The contractual document specifying deliverables, timeline, milestones, and cost of the engagement; it complements the rules of engagement and the master service agreement.

Authorization letter

A signed document naming the tester and client, describing the authorized scope and dates; it is carried during physical or on-site testing to prove testing is sanctioned.

Black-box testing

Testing performed with no prior knowledge of the target environment; the tester discovers architecture and assets from scratch, mimicking an external attacker with limited information.

White-box testing

Testing with full knowledge of the environment, including source code, architecture diagrams, and credentials; it typically finds more issues in less time than black-box testing.

PCI DSS testing requirement

Requires annual penetration testing of external and internal environments, plus segmentation testing to confirm cardholder data environments are isolated from out-of-scope networks.

Critical finding escalation

A communication rule requiring immediate notification of the client when a critical vulnerability or active incident is discovered, rather than waiting for the final report.

Passive reconnaissance

Collecting information about a target without directly interacting with its infrastructure, using sources such as WHOIS, DNS records, certificate transparency logs, and search engines.

DNS zone transfer

An AXFR request that, if the name server permits it, returns the full contents of a DNS zone including internal hostnames and IP addresses.

Certificate transparency logs

Public append-only logs of issued TLS certificates; querying them reveals subdomains and hostnames that may not appear in DNS or search engine results.

Nmap SYN scan

A half-open scan (-sS) that sends SYN packets and never completes the handshake; it requires root privileges and is faster and stealthier than a full connect scan.

Nmap version detection

The -sV option probes open ports to identify service names and versions; results feed vulnerability research and exploit selection.

SNMP enumeration

Querying UDP port 161 with tools such as snmpwalk using default or guessed community strings; readable MIBs can reveal interfaces, processes, and installed software.

Subdomain brute force

Testing a wordlist of candidate names against the target domain to discover hosts; wildcard DNS records produce false positives that must be filtered out.

OSINT framework

Tools such as theHarvester, Maltego, and Recon-ng that aggregate public sources including search engines, certificate logs, and DNS data into target profiles.

CVSS base score

A 0.0-10.0 severity score computed from attack vector, complexity, privileges required, user interaction, scope, and confidentiality, integrity, and availability impact.

CVSS rating ranges

Qualitative bands for CVSS v3.1 base scores: None 0.0, Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, and Critical 9.0-10.0.

False positive

A vulnerability reported by a scanner that does not actually exist on the target; confirmation requires manual validation before inclusion in the report.

Credentialed scan

A vulnerability scan that authenticates to hosts, allowing the scanner to inspect installed packages and configuration; results are more accurate than uncredentialed scans.

CVE versus CWE

CVE identifies a specific publicly disclosed vulnerability instance; CWE classifies the underlying weakness type, such as injection or buffer overflow.

SAST versus DAST

Static analysis reviews source code without execution; dynamic analysis tests a running application from the outside; each finds different classes of defects.

Vulnerability prioritization

Ranking findings by CVSS score combined with exploit availability, asset criticality, exposure, and compensating controls, rather than by raw score alone.

SQL injection authentication bypass

Supplying a payload such as ' OR '1'='1 in a login field so the constructed query evaluates true, granting access without valid credentials.

Stored cross-site scripting

A payload persisted server-side, such as in a comment or profile field, that executes in the browsers of users who later view the affected page.

Directory traversal

Using ../ sequences or encoded variants to escape the web root and read files such as /etc/passwd that should not be accessible.

Password spraying

Trying a small set of common passwords across many accounts to avoid account lockout thresholds while searching for weak credentials.

Pass-the-hash

Authenticating with a captured NTLM hash without cracking it to plaintext, exploiting protocols that accept the hash as proof of identity.

Linux privilege escalation

Escalating via SUID binaries, sudo misconfigurations, writable cron jobs or service files, and unpatched kernel vulnerabilities to gain root access.

Persistence mechanism

A technique such as scheduled tasks, cron entries, run keys, or SSH authorized_keys that maintains access across reboots and sessions after initial compromise.

SSH dynamic port forwarding

The -D option creates a local SOCKS proxy that tunnels traffic through a compromised host, enabling pivoting into otherwise unreachable internal networks.

DNS tunneling exfiltration

Encoding stolen data in DNS queries to an attacker-controlled domain, bypassing egress filters that permit DNS traffic while blocking other outbound channels.

Post-exploitation cleanup

Removing accounts, tools, scheduled tasks, and configuration changes created during testing, and documenting them so the client can verify restoration.