I85PREP
⌘ K
CompTIA PenTest+ study materials
CompTIA PenTest+ study resources

CompTIA PenTest+ practice questions

One question at a time. Build your CompTIA PenTest+ understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Engagement management

A client asks a penetration tester to assess a web application but wants testing to occur only during a two-week window before a product launch. Which engagement document primarily defines this constraint?

  1. The statement of work
  2. The rules of engagement Correct answer.
  3. The nondisclosure agreement
  4. The master service agreement

Explanation

The rules of engagement document records the operational boundaries of testing, including allowed time windows, target scope, and escalation contacts. It translates contractual intent into day-to-day testing limits that the tester must follow.

Question 2Engagement management

Before starting an authorized penetration test, the tester confirms that the client has signed a document granting legal permission to perform the assessment. Which document is this?

  1. The penetration testing agreement or authorization letter Correct answer.
  2. The incident response plan
  3. The service level agreement
  4. The business continuity plan

Explanation

Written authorization is essential to establish legal permission and protect the tester from liability. It typically takes the form of a signed penetration testing agreement or authorization letter that identifies the targets and the testing party.

Question 3Engagement management

A penetration tester discovers that a target server contains customer records during an assessment. The client has asked that no real customer data be accessed. What is the most appropriate action?

  1. Copy a sample of records for evidence and continue testing
  2. Encrypt the records and continue testing
  3. Stop accessing the data and report the observation to the client contact Correct answer.
  4. Delete the exposed records to protect customers

Explanation

The tester must respect the agreed data-handling rules and avoid accessing real personal data when the client prohibits it. The finding should be reported through the agreed channel so the client can address the exposure without the tester copying or altering data.

Question 4Engagement management

During a test, a penetration tester accidentally causes a production service to become unavailable. What should the tester do first according to typical engagement management practice?

  1. Notify the designated client contact using the agreed escalation process Correct answer.
  2. Document the outage and report it at the end of the engagement
  3. Wait to see whether the service recovers on its own
  4. Continue testing other targets to avoid wasting time

Explanation

The rules of engagement normally specify an escalation path and contact for emergencies. Prompt notification lets the client restore service quickly and reduces harm, while the tester records details for later reporting.

Question 5Engagement management

A client provides a list of IP addresses and asks the tester to assess only those systems. Which term best describes this list?

  1. Threat model
  2. Risk appetite
  3. Attack surface
  4. Scope Correct answer.

Explanation

Scope defines the specific systems, networks, and assets that the client has authorized for testing. Systems outside the list must not be tested even if they are reachable from in-scope hosts.

Question 6Engagement management

A tester is engaged to assess an internal network and discovers a misconfigured server that exposes a database to the internet. This server is outside the agreed scope. What is the best course of action?

  1. Ignore the observation entirely because it is outside scope
  2. Test the exposed database because it is a serious risk
  3. Ask a colleague to test the server without informing the client
  4. Document the observation and report it to the client without testing the out-of-scope server Correct answer.

Explanation

Out-of-scope systems must not be tested, but material observations can still be reported as information. Reporting the exposure without interacting with the server respects the scope while helping the client.

Question 7Engagement management

Which element of a penetration testing report is most useful for helping the client prioritize remediation work?

  1. The tester's resume and certifications
  2. The raw command history from the engagement
  3. Risk ratings assigned to each finding Correct answer.
  4. A list of every tool used during testing

Explanation

Risk ratings translate technical findings into business impact so the client can sequence remediation. They should be supported by evidence and clear descriptions of each vulnerability.

Question 8Engagement management

A penetration testing report includes an executive summary. What is the primary purpose of this section?

  1. To list the tools and versions used during testing
  2. To document the tester's hourly activities
  3. To communicate overall risk posture and key findings to business leadership Correct answer.
  4. To provide exact reproduction steps for each vulnerability

Explanation

The executive summary is written for decision-makers and focuses on business risk, overall posture, and the most important findings. Technical reproduction details belong in the detailed findings sections.

Question 9Engagement management

A client wants to ensure that a penetration test does not disrupt a critical transaction system during business hours. Which approach best supports this requirement?

  1. Schedule testing outside business hours and agree on a rollback or stop condition Correct answer.
  2. Skip testing the transaction system entirely
  3. Disable monitoring during testing to avoid alerts
  4. Test during peak hours to observe realistic load

Explanation

Timing restrictions and predefined stop conditions reduce the chance that testing disrupts critical services. These controls should be documented in the rules of engagement before testing starts.

Question 10Engagement management

Which metric is most appropriate for measuring the success of a penetration testing engagement?

  1. The number of tools installed on the tester's workstation
  2. The number of validated vulnerabilities with remediation guidance Correct answer.
  3. The number of hours spent testing
  4. The number of pages in the final report

Explanation

Engagement success is best measured by actionable outcomes such as validated findings and clear remediation guidance. Volume-based metrics like hours or report length do not reflect the value delivered.

Question 11Engagement management

A client asks a penetration tester to sign an agreement that prohibits disclosing any findings to third parties. Which document type is this?

  1. Statement of work
  2. Rules of engagement
  3. Nondisclosure agreement Correct answer.
  4. Penetration test report

Explanation

A nondisclosure agreement restricts disclosure of confidential information, including engagement findings, to unauthorized parties. It protects the client's sensitive information and is often signed before testing begins.

Question 12Engagement management

A tester is preparing to conduct a penetration test for a client in a regulated industry. The client requests that all test data be encrypted at rest and deleted after the engagement. Where should these requirements be documented?

  1. Only in the final report
  2. In the tester's personal notes
  3. In the rules of engagement and data-handling section of the agreement Correct answer.
  4. In the public vulnerability disclosure policy

Explanation

Data-handling requirements such as encryption and deletion should be agreed in writing before testing. Documenting them in the rules of engagement or agreement ensures both parties understand their obligations.

Question 13Engagement management

During scoping, a client states that the tester may use social engineering against employees but must not target executives. Which engagement artifact should capture this restriction?

  1. Vulnerability scan report
  2. Executive summary
  3. Rules of engagement Correct answer.
  4. Asset inventory

Explanation

The rules of engagement captures specific constraints on techniques and targets, including exclusions. It guides the tester's conduct and provides a reference if questions arise during testing.

Question 14Engagement management

A penetration tester is asked to assess a cloud environment. The client provides read-only credentials for the cloud console. What should the tester confirm before using the credentials?

  1. That the credentials and permitted actions are documented in the authorized scope Correct answer.
  2. That the credentials can be shared with third parties
  3. That the credentials belong to an executive account
  4. That the credentials never expire

Explanation

Any credentials and permissions supplied by the client should be reflected in the authorized scope so the tester stays within agreed limits. Confirming this prevents accidental actions beyond the intended access level.

Question 15Engagement management

A penetration tester completes testing and delivers a report. The client asks for a debrief meeting. What is the primary benefit of this meeting?

  1. It replaces the need for a written report
  2. It allows the tester to clarify findings and answer remediation questions directly Correct answer.
  3. It authorizes additional testing without new paperwork
  4. It transfers legal liability to the client

Explanation

A debrief lets the tester walk through findings, clarify technical details, and discuss remediation priorities with stakeholders. It complements, rather than replaces, the written report.

Question 16Engagement management

Which statement best describes the purpose of a statement of work in a penetration testing engagement?

  1. It lists every vulnerability the tester expects to find
  2. It describes the client's internal security policies
  3. It replaces the need for written authorization
  4. It defines deliverables, timeline, and scope of services to be provided Correct answer.

Explanation

A statement of work formalizes what services will be delivered, when, and within what scope. It supports planning and accountability but does not replace authorization or predict specific findings.

Question 17Engagement management

A tester finds that a client's web application allows access to another customer's account data. The client has asked to be notified immediately of any data exposure. What should the tester do?

  1. Post the finding to a public bug bounty forum
  2. Continue enumerating other customers' data to measure impact
  3. Stop testing that path and notify the client contact immediately Correct answer.
  4. Wait until the final report to disclose the issue

Explanation

When a client requests immediate notification of data exposure, the tester should stop interacting with the vulnerable path and escalate promptly. This limits exposure and respects the client's data-handling requirements.

Question 18Engagement management

A penetration tester is planning an engagement and needs to identify the client's tolerance for service disruption. Which question is most relevant during scoping?

  1. Which systems are business-critical and what downtime is acceptable? Correct answer.
  2. Which report template will be used?
  3. Which operating systems does the tester prefer?
  4. How many testers will be assigned to the engagement?

Explanation

Scoping should establish which systems are critical and how much disruption, if any, the client can tolerate. This informs scheduling, technique selection, and stop conditions in the rules of engagement.

Question 19Engagement management

Which practice best protects client data collected during a penetration test?

  1. Emailing evidence to all project stakeholders
  2. Retaining evidence indefinitely for future engagements
  3. Keeping evidence on a shared public drive
  4. Storing evidence in an encrypted location with access limited to authorized team members Correct answer.

Explanation

Evidence should be protected with encryption and access controls so only authorized personnel can view it. Retention should follow the agreed data-handling terms, including deletion when required.

Question 20Engagement management

A client wants to know how the tester will handle a situation where testing reveals evidence of an active intrusion by a real attacker. Which engagement element should address this?

  1. The tester's preferred exploitation framework
  2. The final report's appendix
  3. The escalation and incident communication procedure in the rules of engagement Correct answer.
  4. The client's marketing plan

Explanation

The rules of engagement should define how the tester reports suspected real-world incidents and whom to contact. This ensures the client can activate its incident response process without delay.

Question 21Engagement management

A penetration tester is asked to test a client's application but the client cannot provide a signed authorization before the testing window. What is the most appropriate response?

  1. Decline to begin testing until written authorization is provided Correct answer.
  2. Begin testing only against non-production systems
  3. Begin testing and rely on the verbal request
  4. Begin testing and obtain authorization afterward

Explanation

Testing without written authorization exposes the tester and the client to legal and contractual risk. The engagement should not begin until proper authorization is documented.

Question 22Engagement management

Which item is typically included in the rules of engagement for a penetration test?

  1. The client's annual revenue figures
  2. The full source code of the target application
  3. The tester's personal billing rate
  4. Approved testing hours and emergency contact details Correct answer.

Explanation

The rules of engagement documents operational details such as testing windows, contacts, and escalation paths. These details help the tester act safely and communicate effectively during the engagement.

Question 23Engagement management

A client asks the tester to include remediation recommendations in the report. Which type of recommendation is most useful?

  1. A statement that the client should improve security
  2. A copy of the tester's internal methodology
  3. Specific, prioritized guidance tied to each finding Correct answer.
  4. A generic list of security products to purchase

Explanation

Recommendations should be specific to the findings and prioritized by risk so the client can act effectively. Generic advice or product lists do not help the client address the actual vulnerabilities.

Question 24Engagement management

A penetration tester is reviewing a contract and notices that the scope includes a third-party service provider's systems. What should the tester confirm before testing those systems?

  1. That the third party has no security controls
  2. That the third party has authorized testing of its systems Correct answer.
  3. That the third party uses the same operating system
  4. That the third party is a competitor of the client

Explanation

Testing systems owned by a third party requires authorization from that party, not just from the client. Without it, the tester risks legal exposure and damage to the client's business relationships.

Question 25Engagement management

Which approach best ensures that a penetration test stays aligned with the client's business objectives?

  1. Testing every possible vulnerability regardless of business context
  2. Avoiding communication with the client during testing
  3. Reviewing the objectives during scoping and confirming them before testing begins Correct answer.
  4. Focusing only on the easiest vulnerabilities to find

Explanation

Aligning testing with business objectives starts with scoping discussions that identify what the client most needs to learn. Confirming those objectives keeps effort focused on relevant risks.

Question 26Engagement management

A penetration tester is reviewing the rules of engagement before an engagement and notices that the client has defined the testing window as 22:00 to 04:00 local time, but the tester's automated scanning tool is configured to use UTC timestamps. Which engagement management action should the tester take before starting the assessment?

  1. Convert the agreed testing window into the tool's time zone and document the converted schedule in the rules of engagement so both parties confirm the same hours. Correct answer.
  2. Begin scanning immediately and rely on the tool's default schedule, since the rules of engagement only govern manual testing activities.
  3. Ask the client to extend the testing window to 24 hours so that time zone differences no longer affect the schedule.
  4. Run the scan during business hours and note the deviation in the final report so the client can decide whether the timing was acceptable.

Explanation

The rules of engagement define the authorized testing window, and the tester must ensure the tooling enforces exactly that window in a consistent time reference. Time zone mismatches are a common cause of out-of-window testing, which can breach the agreement and disrupt production. Converting the window, documenting it, and confirming it with the client keeps the engagement within authorized bounds.

Question 27Reconnaissance and enumeration

During a passive reconnaissance phase, a penetration tester reviews public DNS records for a target domain. Which record type would most directly reveal the mail servers handling email for that domain?

  1. CNAME
  2. A
  3. MX Correct answer.
  4. TXT

Explanation

MX records map a domain to the mail exchange hosts responsible for accepting email, so enumerating them exposes mail infrastructure and its priorities. A records map names to IPv4 addresses, CNAMEs create aliases, and TXT records hold arbitrary text such as SPF or verification strings.

Question 28Reconnaissance and enumeration

A tester wants to discover hosts on a subnet without completing the TCP three-way handshake. Which Nmap scan technique sends a SYN and interprets the response without establishing a full connection?

  1. TCP SYN scan (-sS) Correct answer.
  2. Ping sweep (-sn)
  3. UDP scan (-sU)
  4. TCP connect scan (-sT)

Explanation

The TCP SYN scan sends a SYN packet and classifies the port from the SYN/ACK or RST reply, then tears down before the handshake completes, which is faster and stealthier than a full connect. A connect scan completes the handshake through the operating system, while UDP and ping sweeps do not probe TCP ports this way.

Question 29Reconnaissance and enumeration

Which tool is specifically designed to perform active and passive information gathering against a target domain, aggregating DNS, WHOIS, and host data from multiple sources?

  1. dnsrecon Correct answer.
  2. John the Ripper
  3. Burp Suite
  4. Wireshark

Explanation

dnsrecon is a reconnaissance tool that enumerates DNS records, performs zone transfers, and gathers related host and WHOIS data for a domain. Wireshark captures traffic, Burp Suite proxies web traffic, and John the Ripper cracks password hashes, none of which aggregate DNS reconnaissance.

Question 30Reconnaissance and enumeration

A tester queries a public certificate transparency log and finds subdomains such as vpn and dev for the target organization. Which reconnaissance category does this activity represent?

  1. Active service scanning
  2. Exploitation of a discovered vulnerability
  3. Post-exploitation lateral movement
  4. Passive open-source intelligence gathering Correct answer.

Explanation

Certificate transparency logs are public third-party data sources, so mining them is passive OSINT that does not touch the target's systems directly. Active scanning would send traffic to the target, exploitation and lateral movement occur after reconnaissance.

Question 31Reconnaissance and enumeration

An attacker sets up a server that answers DNS queries for a domain the tester's organization owns but has not yet configured. What is this technique called?

  1. Domain shadowing Correct answer.
  2. Typosquatting
  3. DNS cache poisoning
  4. Nameserver takeover

Explanation

Domain shadowing occurs when an attacker registers subdomains under a legitimate domain by gaining control of its DNS management, then uses those subdomains for malicious activity. Cache poisoning corrupts resolver caches, typosquatting registers look-alike domains, and a nameserver takeover hijacks the authoritative servers themselves.

Question 32Reconnaissance and enumeration

A tester runs a DNS zone transfer attempt against an authoritative nameserver and receives a full listing of records. What is the primary security implication of this result?

  1. The organization lacks an SPF record
  2. The nameserver permits unauthenticated AXFR, exposing internal hostnames Correct answer.
  3. The server is running an outdated kernel
  4. The domain uses DNSSEC signing

Explanation

A successful AXFR means the nameserver allows zone transfers from unauthorized clients, leaking the complete record set including internal hostnames and IP ranges. This is a misconfiguration independent of kernel version, DNSSEC, or email policy.

Question 33Reconnaissance and enumeration

A penetration tester wants to enumerate SMB shares and operating system details on a Windows host discovered during scanning. Which tool is best suited for this task?

  1. enum4linux Correct answer.
  2. sqlmap
  3. Nikto
  4. Hydra

Explanation

enum4linux queries SMB and NetBIOS services to enumerate shares, users, groups, and OS information on Windows and Samba hosts. Nikto scans web servers, sqlmap tests SQL injection, and Hydra performs online password attacks.

Question 34Reconnaissance and enumeration

During enumeration, a tester discovers that a web server returns different HTTP response lengths for valid and invalid usernames on a login endpoint. What does this finding most likely indicate?

  1. The server is vulnerable to SQL injection
  2. The application enforces account lockout
  3. The server is using HTTP/2
  4. The endpoint is susceptible to username enumeration Correct answer.

Explanation

Inconsistent response sizes or timing between valid and invalid usernames allow an attacker to distinguish real accounts, which is username enumeration. SQL injection, protocol version, and lockout policy are separate concerns not implied by response-length differences alone.

Question 35Reconnaissance and enumeration

A tester uses theHarvester to gather email addresses associated with a target domain. Which data sources does this tool primarily query?

  1. Internal Active Directory
  2. Encrypted TLS traffic
  3. Firewall logs
  4. Search engines and public sources Correct answer.

Explanation

theHarvester collects email addresses, hostnames, and employee names from public sources such as search engines, PGP key servers, and certificate data. It does not access internal directories, firewall logs, or encrypted traffic.

Question 36Reconnaissance and enumeration

While performing a service version scan, a tester observes that Nmap reports a service as 'tcpwrapped' on several ports. What does this result most likely mean?

  1. The port is filtered by a firewall
  2. A TCP wrapper or access control closed the connection after the handshake Correct answer.
  3. The service is encrypted with TLS
  4. The host is offline

Explanation

A 'tcpwrapped' result indicates the TCP connection completed but was immediately closed, often by TCP wrappers or access controls, preventing banner grabbing. It does not mean the service is encrypted, filtered, or that the host is offline.

Question 37Reconnaissance and enumeration

A tester wants to identify all hosts responding on a large IPv4 range quickly before port scanning. Which Nmap option performs host discovery without port scanning?

  1. -sn Correct answer.
  2. -A
  3. -O
  4. -sV

Explanation

The -sn option performs host discovery only, using ICMP and other probes without scanning ports. The -sV option detects service versions, -O performs OS detection, and -A enables aggressive features including both.

Question 38Reconnaissance and enumeration

A tester observes that a target responds to TCP SYN probes with an RST/ACK on most ports but receives no response on port 445. How should the tester interpret port 445?

  1. Open
  2. Filtered Correct answer.
  3. Open|filtered
  4. Closed

Explanation

In a SYN scan, an RST/ACK indicates a closed port, while no response typically means a firewall or filter is dropping packets, so the port is classified as filtered. An open port would answer with SYN/ACK, and open|filtered applies mainly to UDP scans.

Question 39Reconnaissance and enumeration

An organization publishes a WHOIS record that lists a generic registrar privacy address instead of the owner's contact details. Which conclusion should the tester draw?

  1. WHOIS privacy protection is masking registrant information Correct answer.
  2. The domain is hosted on a cloud provider
  3. The registrar is the target organization
  4. The domain is unregistered

Explanation

Registrar privacy services replace registrant contact details with proxy information, so WHOIS returns masked data. This does not mean the domain is unregistered, hosted in the cloud, or owned by the registrar.

Question 40Reconnaissance and enumeration

A tester performs a UDP scan and receives an ICMP port unreachable message for a probed port. What does this indicate about the port?

  1. The port is filtered
  2. The port is closed Correct answer.
  3. The port is open
  4. The host is unreachable

Explanation

For UDP scans, an ICMP port unreachable response means no service is listening on that UDP port, so it is classified as closed. Silence often means open|filtered, and host unreachable would indicate routing or filtering problems.

Question 41Reconnaissance and enumeration

Which technique uses a search engine to discover sensitive files such as exposed configuration files on a target site?

  1. Kerberoasting
  2. ARP spoofing
  3. Pass-the-hash
  4. Google dorking Correct answer.

Explanation

Google dorking uses advanced search operators to locate exposed files, login pages, and other sensitive content indexed by search engines. Kerberoasting, pass-the-hash, and ARP spoofing are credential and network attacks unrelated to search-based reconnaissance.

Question 42Reconnaissance and enumeration

A tester discovers an exposed .git directory on a web server during enumeration. What is the most significant risk of this finding?

  1. Disclosure of source code and potentially embedded secrets Correct answer.
  2. DNS cache poisoning
  3. Cross-site request forgery against administrators
  4. Denial of service through resource exhaustion

Explanation

An exposed .git directory allows retrieval of repository metadata and source code, which may contain credentials, API keys, and logic flaws. It is a disclosure issue rather than a denial-of-service, CSRF, or DNS attack.

Question 43Reconnaissance and enumeration

A tester wants to enumerate valid usernames against an SMTP server using the VRFY command. Which response most strongly suggests a username exists?

  1. 550 No such user
  2. 421 Service not available
  3. 503 Bad sequence of commands
  4. 250 OK or a 252 response Correct answer.

Explanation

A 250 or 252 reply to VRFY indicates the server recognizes or cannot verify the user, which suggests the account may exist. A 550 reply typically means the user does not exist, while 421 and 503 are service and sequencing errors.

Question 44Reconnaissance and enumeration

Which Nmap script category is used to run scripts that gather additional information about discovered services without exploiting them?

  1. intrusive
  2. exploit
  3. dos
  4. discovery Correct answer.

Explanation

The discovery script category gathers additional host and service information such as banners and configuration details without attacking the target. Intrusive, dos, and exploit categories perform disruptive or exploitative actions.

Question 45Reconnaissance and enumeration

A penetration tester captures network traffic on a switched LAN and wants to see traffic between other hosts. Which technique enables this observation?

  1. ARP spoofing Correct answer.
  2. DNS zone transfer
  3. Banner grabbing
  4. Port knocking

Explanation

ARP spoofing poisons the ARP cache of hosts so traffic destined for the gateway flows through the tester, enabling interception on a switched network. Zone transfers, port knocking, and banner grabbing do not redirect inter-host traffic.

Question 46Reconnaissance and enumeration

A tester uses a tool to send crafted DNS queries and observes that the target resolver forwards queries to an arbitrary external server. Which vulnerability class does this represent?

  1. DNS open resolver abuse Correct answer.
  2. Buffer overflow
  3. Cross-site scripting
  4. SQL injection

Explanation

A resolver that answers recursive queries from any client is an open resolver and can be abused for amplification and reflection attacks. The other options are application-layer vulnerabilities unrelated to recursive DNS behavior.

Question 47Reconnaissance and enumeration

During enumeration, a tester finds that a target exposes an LDAP service permitting anonymous binds. What information can be gathered from this configuration?

  1. Encrypted password hashes for all accounts
  2. Directory entries such as users and groups Correct answer.
  3. TLS private keys
  4. Firewall rule sets

Explanation

Anonymous LDAP binds allow unauthenticated reads of directory entries, exposing user accounts, groups, and organizational structure. They do not reveal password hashes, firewall rules, or private keys.

Question 48Reconnaissance and enumeration

A tester wants to determine the operating system of a remote host by analyzing subtle differences in TCP/IP stack behavior. Which Nmap feature supports this?

  1. Script scan (-sC)
  2. Ping sweep (-sn)
  3. OS detection (-O) Correct answer.
  4. UDP scan (-sU)

Explanation

The -O option performs OS fingerprinting by examining TCP/IP stack responses such as initial sequence numbers and TCP options. Ping sweeps only find hosts, UDP scans probe UDP ports, and script scans run NSE scripts.

Question 49Reconnaissance and enumeration

A tester discovers a subdomain takeover candidate where a CNAME points to a deprovisioned cloud service. Which condition confirms the takeover is feasible?

  1. The CNAME points to an internal IP
  2. The cloud provider returns a claimable resource error for the dangling CNAME Correct answer.
  3. The target uses HTTPS
  4. The domain has an SPF record

Explanation

A dangling CNAME is exploitable when the referenced cloud resource no longer exists and the provider allows another party to claim that name, often signaled by a provider-specific unclaimed-resource response. HTTPS usage, SPF records, and internal IPs do not establish takeover feasibility.

Question 50Reconnaissance and enumeration

Which reconnaissance activity is considered passive because it does not send packets directly to the target's infrastructure?

  1. Brute-forcing credentials on a login page
  2. Running a SYN scan against the target
  3. Reviewing Shodan results for the target's IP range Correct answer.
  4. Banner grabbing on discovered services

Explanation

Reviewing third-party datasets such as Shodan relies on previously collected internet scan data, so no traffic reaches the target directly. SYN scanning, banner grabbing, and credential brute forcing all interact with the target's systems.