I85PREP
⌘ K
PenTest+ study materials
PenTest+ study resources

PenTest+ practice questions

One question at a time. Build your PenTest+ understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Engagement management

Which document defines the specific activities, deliverables, and timeline for a penetration testing engagement?

  1. Rules of engagement
  2. Statement of work Correct answer.
  3. Master service agreement
  4. Non-disclosure agreement

Explanation

The statement of work defines the specific tasks, deliverables, and schedule for the engagement. It operates alongside the rules of engagement, which set testing constraints, and the NDA, which governs confidentiality.

Question 2Engagement management

What is the primary purpose of the rules of engagement document?

  1. To define authorized actions and constraints during testing Correct answer.
  2. To list the tester's professional certifications
  3. To establish the contractual fee schedule
  4. To record vulnerabilities discovered during testing

Explanation

Rules of engagement define what the tester may and may not do, including target boundaries, permitted techniques, and timing windows. They protect both parties by making authorized activity explicit before testing starts.

Question 3Engagement management

Which agreement is designed to protect sensitive information shared between the client and the tester?

  1. Service level agreement
  2. Acceptable use policy
  3. Statement of work
  4. Non-disclosure agreement Correct answer.

Explanation

A non-disclosure agreement binds parties to keep shared sensitive information confidential. It typically survives the engagement and covers data learned before, during, and after testing.

Question 4Engagement management

Before testing begins, which artifact provides documented proof that the tester is authorized to perform the activities?

  1. Test plan
  2. Status report
  3. Risk register
  4. Signed authorization letter Correct answer.

Explanation

A signed authorization letter documents that the client has granted permission for the testing. It is often paired with the rules of engagement so the tester can demonstrate legitimacy if questioned.

Question 5Engagement management

Which item is a core component of pre-engagement scoping?

  1. Identifying in-scope targets and exclusions Correct answer.
  2. Conducting the lessons-learned meeting
  3. Drafting the final report
  4. Remediating discovered vulnerabilities

Explanation

Scoping establishes exactly which systems, addresses, and applications may be tested and which are excluded. Clear targets and exclusions prevent accidental testing of unauthorized assets.

Question 6Engagement management

What should be established to handle emergencies or critical findings during an engagement?

  1. A billing schedule
  2. An escalation path with client contacts Correct answer.
  3. A password vault for the client
  4. A list of all open ports

Explanation

An escalation path identifies who to contact, in what order, and how quickly when critical findings or emergencies arise. It ensures time-sensitive issues reach decision makers promptly.

Question 7Engagement management

Which US regulation governs the protection of protected health information?

  1. HIPAA Correct answer.
  2. PCI DSS
  3. SOX
  4. GLBA

Explanation

HIPAA is the US law governing the privacy and security of protected health information held by covered entities. Testers handling such data must observe its safeguards.

Question 8Engagement management

A get-out-of-jail-free letter primarily serves which purpose?

  1. It transfers ownership of findings to the client
  2. It proves the tester has authorization if confronted by law enforcement Correct answer.
  3. It waives the tester's liability for all damage
  4. It defines the testing methodology to be used

Explanation

This letter documents that the client authorized the testing, so the tester can demonstrate legitimacy if law enforcement or a third party intervenes. It complements, but does not replace, the rules of engagement.

Question 9Engagement management

While testing, a penetration tester discovers a critical vulnerability on a system outside the agreed scope. What is the most appropriate action?

  1. Scan the entire network to find related issues
  2. Stop testing that system and notify the client point of contact Correct answer.
  3. Exploit the vulnerability to confirm it is real
  4. Ignore it because it is out of scope

Explanation

Out-of-scope systems must not be tested without written authorization, so the tester should stop and escalate through the agreed contact. The finding can then be reported so the client can decide how to proceed.

Question 10Engagement management

A client wants to test a production system during peak business hours. What should the tester do first?

  1. Refuse to test the system entirely
  2. Test the system without informing the client
  3. Document the risk and agree on safeguards in the rules of engagement Correct answer.
  4. Wait until the engagement ends

Explanation

Testing production during peak hours raises availability and business risk, so the risk should be documented and controls agreed in advance. Safeguards such as throttling, time windows, or rollback plans reduce the chance of disruption.

Question 11Engagement management

Which scoping practice best reduces the chance of impacting third-party systems?

  1. Using default credentials on all hosts
  2. Documenting precise target ranges Correct answer.
  3. Broadcasting scans to the entire internet
  4. Skipping written authorization

Explanation

Precise target ranges and exclusions keep testing confined to assets the client owns or controls. This prevents scans or exploits from touching systems belonging to third parties.

Question 12Engagement management

A client says to test everything and provides no asset inventory. What is the best course of action?

  1. Assume all systems are in scope and proceed
  2. Test only the client's public website
  3. Work with the client to define specific targets and constraints in writing Correct answer.
  4. Begin scanning the entire internet address space

Explanation

An undefined scope must be narrowed with the client and documented before testing to keep activities authorized and safe. Written targets and constraints prevent accidental testing of unrelated or out-of-scope systems.

Question 13Engagement management

How should captured credentials be handled during an engagement?

  1. Post them in the shared team chat for convenience
  2. Store them encrypted and limit access to authorized testers Correct answer.
  3. Leave them in plaintext on the testing laptop
  4. Share them with the whole team via email

Explanation

Captured credentials are highly sensitive and must be protected with encryption and need-to-know access. This keeps the engagement from introducing new exposure of its own.

Question 14Engagement management

At the end of an engagement, what is the appropriate way to handle client data collected during testing?

  1. Keep it indefinitely for future engagements
  2. Sell it to a third party for profit
  3. Return or destroy it according to the contract Correct answer.
  4. Publish it as sample data for research

Explanation

Contracts and data-handling terms specify whether collected data is returned, destroyed, or retained, along with any retention period. Following those terms protects confidentiality and satisfies legal obligations.

Question 15Engagement management

A tester needs to assess a cloud-hosted application owned by the client. What must be confirmed before testing?

  1. That the tester has provider admin credentials
  2. Provider authorization and client ownership Correct answer.
  3. That the application uses HTTPS
  4. That the tester has a personal cloud account

Explanation

Cloud providers often restrict or require notification of security testing, so the client's authority and the provider's testing policy must be confirmed. Testing without that confirmation can violate the provider's terms and the client's obligations.

Question 16Engagement management

Which document typically establishes the overall legal relationship, terms, and liabilities between organizations?

  1. Statement of work
  2. Test plan
  3. Rules of engagement
  4. Master service agreement Correct answer.

Explanation

A master service agreement sets the overarching contractual terms, including liability and dispute provisions, that govern all work orders. Individual statements of work then define each engagement's specifics.

Question 17Engagement management

A client asks the tester to assess a system owned by a subsidiary located in another country. What is the most important consideration?

  1. The language spoken by local staff
  2. The time zone difference for scheduling
  3. The currency used for billing
  4. Jurisdiction and legal authorization in that country Correct answer.

Explanation

Testing across borders requires confirming that the client can authorize the activity and that local law permits it. Jurisdiction affects both legality and what evidence may be collected.

Question 18Engagement management

During testing, a tester encounters what appears to be regulated personal data. What is the best action?

  1. Minimize access and report per the RoE Correct answer.
  2. Share samples with colleagues on social media
  3. Download the entire dataset for offline analysis
  4. Delete it immediately to avoid liability

Explanation

Handling regulated data requires minimizing what is accessed or copied and following the rules of engagement for reporting. Protecting confidentiality and documenting the encounter keeps the engagement lawful.

Question 19Engagement management

What is the primary purpose of a risk register during a penetration testing engagement?

  1. To record the number of packets sent
  2. To list the tester's hourly rates
  3. To store the client's employee passwords
  4. To track risks and mitigation status Correct answer.

Explanation

A risk register captures identified risks, their severity, owners, and mitigation status so they can be managed throughout the engagement. It gives the team a shared, auditable view of what could go wrong.

Question 20Engagement management

Status reports provided to the client during an engagement should primarily include what?

  1. Only the vulnerabilities that have been remediated
  2. The tester's personal travel itinerary
  3. Detailed exploit code for every finding
  4. Progress, key findings, and any blockers Correct answer.

Explanation

Regular status reports keep the client informed of progress, emerging findings, and anything impeding the work. This supports timely decisions and preserves the agreed communication cadence.

Question 21Engagement management

A tester is engaged to assess an industrial control system that supports physical operations. Which consideration is most important?

  1. Testing only during production peak hours
  2. Maximizing scan intensity to finish quickly
  3. Avoiding actions that could disrupt availability Correct answer.
  4. Using aggressive exploitation tools by default

Explanation

ICS environments support physical processes where disruption can cause safety or operational harm, so availability must be protected. Tests should be coordinated with operations staff and limited to safe techniques.

Question 22Engagement management

During an engagement, a tester is asked to test a system they suspect is used for illegal activity. What is the most appropriate action?

  1. Verify authorization and consult legal Correct answer.
  2. Proceed quietly because a contract has been signed
  3. Report the suspicion publicly on social media
  4. Ignore the concern and continue testing

Explanation

Suspected illegal activity warrants confirming authorization and seeking legal guidance before continuing. Documenting the concern preserves the tester's professional and legal position.

Question 23Engagement management

Midway through an engagement, the client asks the tester to add a new subnet to the scope verbally. What is the best response?

  1. Immediately scan the new subnet
  2. Get written change approval first Correct answer.
  3. Add it to the report without testing
  4. Refuse and end the engagement

Explanation

Scope changes must be documented and approved in writing so authorization remains verifiable. Verbal additions create ambiguity about permission and should be formalized before testing.

Question 24Engagement management

Which practice best reduces the risk of accidental exfiltration of sensitive data during testing?

  1. Follow data handling rules and redact values Correct answer.
  2. Storing collected data on a publicly accessible share
  3. Emailing captured data to a personal account
  4. Disabling all logging on the tester's workstation

Explanation

Defined data-handling rules, including redaction or hashing of sensitive values, limit what leaves the client environment. Logging and controlled storage further support accountability.

Question 25Engagement management

A client asks the tester to perform an action that would violate a compliance standard the client must uphold. What is the most appropriate response?

  1. Perform the action because the client asked for it
  2. Perform the action and blame the client later
  3. Perform the action but hide it from the report
  4. Decline, explain the conflict, and document it Correct answer.

Explanation

Testers should not perform actions that would place the client out of compliance, even when requested. Declining, explaining the conflict, and documenting the request protects both parties and preserves professional integrity.

Question 26Engagement management

A penetration tester will run automated scans against a client's internet-facing systems while the client's security operations center is actively monitoring for attacks. Which rules-of-engagement item best allows the SOC to distinguish the tester's traffic from a genuine intrusion?

  1. The source IP addresses the tester will use Correct answer.
  2. A signed nondisclosure agreement covering the tester's findings and deliverables
  3. The tester's preferred scanning tool and its default template
  4. A list of the specific CVEs that the scan is expected to surface

Explanation

Rules of engagement should document the source addresses the tester will originate traffic from, so the client's defenders can allowlist or whitelist those addresses and avoid blocking or escalating authorized activity. Sharing source IPs also supports deconfliction contacts and time windows. An NDA, a CVE list, or tool preferences do not let a SOC identify which packets come from the tester.

Question 27Reconnaissance and enumeration

Which activity is an example of passive reconnaissance?

  1. Running a ping sweep across a subnet
  2. Querying Shodan for indexed host data Correct answer.
  3. Requesting a zone transfer from a name server
  4. Grabbing a banner from an open port

Explanation

Passive reconnaissance collects information from third-party or publicly available sources without sending traffic directly to the target. Shodan indexes data from internet-wide scans, so querying it does not touch the target. Zone transfers, ping sweeps, and banner grabs all interact with the target network.

Question 28Reconnaissance and enumeration

Which tool is used to retrieve domain registration details such as registrar, creation date, and name servers?

  1. dig
  2. nmap
  3. whois Correct answer.
  4. traceroute

Explanation

whois queries registrar and registration databases for ownership and administrative details about a domain. dig resolves DNS records, nmap scans ports and services, and traceroute maps network paths.

Question 29Reconnaissance and enumeration

Which DNS record type requests a full zone transfer from a name server?

  1. PTR
  2. AXFR Correct answer.
  3. MX
  4. A

Explanation

AXFR is the DNS zone transfer record type used to request a full copy of a zone. If a name server allows transfers to arbitrary clients, the response can reveal all records in the zone. A, MX, and PTR serve ordinary lookup purposes.

Question 30Reconnaissance and enumeration

Which Nmap option performs host discovery without scanning ports?

  1. -sS
  2. -O
  3. -sn Correct answer.
  4. -sV

Explanation

The -sn option performs a ping scan that discovers live hosts without probing ports. The -sS option runs a SYN port scan, -sV probes service versions, and -O attempts operating system detection.

Question 31Reconnaissance and enumeration

Which tool is designed to collect email addresses, hostnames, and employee names from public sources?

  1. theHarvester Correct answer.
  2. Nikto
  3. Nmap
  4. Hydra

Explanation

theHarvester aggregates open-source intelligence from search engines, certificate sources, and similar public data to find emails, hosts, and names. Nmap performs port scanning, Nikto checks web server issues, and Hydra brute-forces credentials.

Question 32Reconnaissance and enumeration

A tester retrieves robots.txt and finds several Disallow entries. What information does this most directly reveal?

  1. Password hashes for local accounts
  2. The server operating system
  3. Open TCP ports on the server
  4. Paths hidden from crawlers Correct answer.

Explanation

robots.txt tells search-engine crawlers which paths not to index, and those entries often point to administrative, backup, or staging areas. It does not list open ports, password hashes, or operating system details.

Question 33Reconnaissance and enumeration

Which technique captures a service banner to identify software and version?

  1. Connect to the port and read the response Correct answer.
  2. Perform a zone transfer from the name server
  3. Send an ICMP echo request to the host
  4. Query DNS TXT records for the domain

Explanation

Banner grabbing connects to a service and reads its greeting, which often names the software and version. ICMP echo only tests reachability, TXT records hold text data such as SPF policy, and zone transfers enumerate DNS records.

Question 34Reconnaissance and enumeration

Which DNS record type resolves an IP address to a hostname?

  1. TXT
  2. PTR Correct answer.
  3. A
  4. MX

Explanation

PTR records are used in reverse DNS zones to map IP addresses back to hostnames. A records map names to IPv4 addresses, MX records identify mail exchangers, and TXT records hold arbitrary text data.

Question 35Reconnaissance and enumeration

Which command attempts a DNS zone transfer for example.com from ns1.example.com?

  1. dig -x 192.0.2.10 @ns1.example.com
  2. nslookup -type=MX example.com ns1.example.com
  3. dig axfr example.com @ns1.example.com Correct answer.
  4. dig example.com MX @ns1.example.com

Explanation

The dig command uses the axfr type with @server to request a zone transfer from a specific name server. The other commands query MX records or perform a reverse lookup, which do not request a full zone transfer.

Question 36Reconnaissance and enumeration

Which TCP scan type sends a SYN and never completes the three-way handshake?

  1. TCP connect scan
  2. UDP scan
  3. TCP SYN scan Correct answer.
  4. ICMP ping sweep

Explanation

A SYN scan is a half-open scan: it sends a SYN, reads the SYN-ACK or RST, and never sends the final ACK. A connect scan completes the handshake, a UDP scan does not use TCP handshakes, and a ping sweep uses ICMP.

Question 37Reconnaissance and enumeration

During a UDP scan, which response most clearly indicates that a port is closed?

  1. An ICMP port-unreachable message Correct answer.
  2. A TCP RST packet from the target
  3. An ICMP echo reply from the target
  4. A TCP SYN-ACK from the target

Explanation

A closed UDP port typically replies with ICMP type 3 code 3, port unreachable. An open UDP port often gives no response or a service-specific reply. TCP RST and SYN-ACK packets relate to TCP behavior, while an echo reply only shows the host is reachable.

Question 38Reconnaissance and enumeration

Which Nmap option treats every target as online and skips host discovery?

  1. -sS
  2. -O
  3. -Pn Correct answer.
  4. -sV

Explanation

The -Pn option disables host discovery and scans every supplied target as if it were online. The -sS option performs a SYN scan, -sV probes service versions, and -O attempts OS detection.

Question 39Reconnaissance and enumeration

Which tool queries SNMP MIB objects to enumerate device information?

  1. smbclient
  2. dig
  3. snmpwalk Correct answer.
  4. ldapsearch

Explanation

snmpwalk walks the SNMP object tree and retrieves MIB values such as system descriptions, interfaces, and installed software. smbclient accesses SMB shares, ldapsearch queries directory services, and dig queries DNS.

Question 40Reconnaissance and enumeration

Which tool is commonly used to enumerate users, shares, and groups from SMB and NetBIOS services on Windows hosts?

  1. hping3
  2. enum4linux Correct answer.
  3. whois
  4. theHarvester

Explanation

enum4linux automates SMB and NetBIOS enumeration, including user, group, and share discovery on Windows systems. theHarvester gathers public OSINT, whois retrieves registration data, and hping3 crafts packets for testing.

Question 41Reconnaissance and enumeration

Which SMTP command asks the server to verify whether a specific mailbox exists?

  1. EXPN
  2. HELO
  3. VRFY Correct answer.
  4. DATA

Explanation

VRFY asks the SMTP server to verify a mailbox or username, and a permissive server may confirm valid accounts. EXPN expands mailing lists, HELO identifies the client, and DATA begins the message body.

Question 42Reconnaissance and enumeration

Which tool enumerates NetBIOS name service information such as computer names and workgroups?

  1. snmpwalk
  2. nbtscan Correct answer.
  3. ldapsearch
  4. dig

Explanation

nbtscan queries the NetBIOS name service on UDP port 137 to list computer names, workgroups, and related details. dig handles DNS, snmpwalk handles SNMP, and ldapsearch handles LDAP.

Question 43Reconnaissance and enumeration

Which public source can passively reveal subdomains by searching issued TLS certificates?

  1. traceroute
  2. crt.sh Correct answer.
  3. whois
  4. Shodan

Explanation

crt.sh searches certificate transparency logs, which record hostnames from issued TLS certificates and can expose internal or forgotten subdomains. Shodan indexes service banners, whois returns registration data, and traceroute maps paths.

Question 44Reconnaissance and enumeration

Which tool is designed to perform DNS reconnaissance that includes brute-force subdomain discovery?

  1. fierce Correct answer.
  2. Nmap
  3. Netcat
  4. theHarvester

Explanation

fierce performs DNS reconnaissance and can brute-force subdomain names and identify related hosts. theHarvester mainly collects public OSINT, Nmap scans ports and services, and Netcat makes generic network connections.

Question 45Reconnaissance and enumeration

Which Nmap option sends scans from multiple spoofed source addresses to obscure the real source?

  1. -sI
  2. -f
  3. -D Correct answer.
  4. -sA

Explanation

The -D option adds decoy source addresses so that scan traffic appears to come from multiple hosts. The -sI option performs an idle scan, -sA performs an ACK scan, and -f fragments packets.

Question 46Reconnaissance and enumeration

Which Nmap timing template is the slowest and least likely to overwhelm a link or trigger rate-based alerts?

  1. -T3
  2. -T2
  3. -T0 Correct answer.
  4. -T4

Explanation

The -T0 timing template is paranoid mode, which serializes probes and introduces long delays. Higher timing templates increase speed and are more likely to stress a link or draw attention from rate-based monitoring.

Question 47Reconnaissance and enumeration

Which Nmap scan uses a separate idle host's IP ID sequence to infer open ports without sending packets from the tester's address?

  1. -sN
  2. -sU
  3. -sI Correct answer.
  4. -sA

Explanation

The -sI option performs an idle scan by using a zombie host's IP ID sequence to infer port state, which helps hide the tester's address. The -sA option is an ACK scan, -sN is a NULL scan, and -sU is a UDP scan.

Question 48Reconnaissance and enumeration

Which Nmap scan is used primarily to determine whether a firewall is stateful or stateless by sending ACK packets?

  1. -sT
  2. -sS
  3. -sU
  4. -sA Correct answer.

Explanation

An ACK scan sends packets with the ACK flag set and interprets responses to infer whether filtering is stateful or stateless. A SYN scan looks for open TCP ports, a connect scan completes handshakes, and a UDP scan targets UDP services.

Question 49Reconnaissance and enumeration

Which TCP scan sends a packet with no flags set and may pass through some stateless packet filters?

  1. -sS
  2. -sT
  3. -sN Correct answer.
  4. -sA

Explanation

A NULL scan sets no TCP flags; closed ports generally reply with RST, while open ports usually do not respond. Some stateless filters do not block such unusual packets, although modern firewalls often detect them.

Question 50Reconnaissance and enumeration

Which technique can enumerate names in a DNSSEC-signed zone that uses NSEC records?

  1. Certificate transparency
  2. NSEC walking Correct answer.
  3. Reverse PTR sweep
  4. Zone transfer

Explanation

NSEC records chain existing names in order, so an attacker can walk the chain to discover names in the zone. NSEC3 was introduced partly to mitigate this enumeration risk. Zone transfers require server permission, PTR sweeps only query reverse records, and certificate transparency covers TLS certificates.