Skip to content

PenTest+ (PT0-003) Full-Length Mock Exam (Unofficial)

A single, full-length timed mock for the CompTIA PenTest+ (PT0-003) exam, built to rehearse the concepts in this pentest-plus/ hub under realistic conditions. It has 85 multiple-choice questions (Part A) interleaved across the five domains and 5 performance-based (PBQ) style scenarios (Part B) — 90 items total, mirroring the real exam's shape. Every item is original and written for this hub; the answer key is at the end.

Unofficial — NOT real CompTIA exam questions. These are pedagogical study aids written for this hub to rehearse documented PenTest+ concepts. They are not drawn from, affiliated with, or endorsed by CompTIA and reproduce no actual exam item. They do not duplicate the items in practice-questions.md — treat that bank and this mock as separate rehearsals.

Authorised-use note. Every technique referenced here is for understanding and defence. Penetration testing is legal only with explicit written authorisation, a defined scope, and agreed Rules of Engagement (RoE). Questions stay at the level of methodology, concepts, and tool purpose — no weaponised specifics. See ../../ceh/00-overview/legal-and-ethics.md.

Exam rules — sit this in one timed block

Reproduce the real exam's constraints as closely as you can:

Item This mock Real PT0-003
Questions 85 MCQ (Part A) + 5 PBQ (Part B) = 90 items Maximum 90 — multiple-choice + performance-based (PBQ)
Time 165 minutes, one uninterrupted sitting 165 minutes
Pace ~1.8 min/item; the PBQs cost more — bank time on the MCQs Same — flag long PBQs and return
Pass mark 85% raw — this repo's readiness gate, not a CompTIA figure 750 on a 100–900 scaled score
  • Scaled score, not a percentage. CompTIA states a PT0-003 passing score of 750 on a 100–900 scale (CompTIA's page, checked 2026-09-29); a scaled score does not convert to a fixed percentage correct. The 85% line below is this repo's own readiness gate, not CompTIA's.
  • One block, closed book. No notes, no cheat sheet, no pausing the clock — that is the point of a mock. Review afterwards with the cheat sheet and glossary open.
  • Watch qualifier words — best, most likely, first, next — and confirm scope in every scenario item; staying in scope is often part of the correct answer.

All tool output, IP addresses, and hostnames in this mock are invented for the exercise. Addresses use the documentation ranges reserved by RFC 5737 (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24); hostnames are fictional.

How to score

  1. Take the whole paper in one 165-minute block, writing your letter for each item.
  2. Mark Part A against the answer key, one point per correct MCQ (85 possible).
  3. Score each Part B PBQ against its model answer. Each PBQ lists a bounded set of sub-marks; award one point per correct sub-answer, then convert to a whole-item score (see each PBQ). For a simple run, score a PBQ as correct only if every sub-answer is right.
  4. Fill in the score sheet below by domain, then read the explanation for every item you missed and re-read the linked domain page.
  5. Readiness gate (this repo's rule, not CompTIA's): ≥ 85% overall on this timed mock, and no domain sitting far below the rest. Below that, log the weak domains and retest spaced.

Score sheet

Part A (85 MCQ), by domain — count your correct answers:

Domain Questions Items Correct %
1 — Engagement Management Q7, 15, 21, 30, 38, 44, 50, 58, 64, 78, 81 11 ___ ___
2 — Reconnaissance & Enumeration Q3, 9, 13, 18, 23, 27, 32, 37, 41, 46, 52, 55, 60, 66, 69, 74, 80, 84 18 ___ ___
3 — Vulnerability Discovery & Analysis Q4, 10, 16, 24, 29, 35, 40, 47, 54, 61, 67, 71, 77, 83 14 ___ ___
4 — Attacks & Exploits Q2, 5, 8, 11, 14, 17, 19, 22, 25, 28, 31, 34, 36, 39, 42, 45, 48, 51, 53, 56, 62, 65, 68, 70, 73, 76, 79, 82, 85 29 ___ ___
5 — Post-exploitation & Lateral Movement Q1, 6, 12, 20, 26, 33, 43, 49, 57, 59, 63, 72, 75 13 ___ ___
Part A total 85 ___ ___

Part B (5 PBQ) — score each out of the sub-marks it lists:

PBQ Topic Sub-marks Correct
PBQ 1 Next enumeration step per service 4 ___
PBQ 2 Findings → CVSS band + remediation 4 ___
PBQ 3 Order the engagement / attack chain 2 ___
PBQ 4 Select the RoE items 6 ___
PBQ 5 Technique → ATT&CK tactic + control 4 ___
Part B total 20 ___

Overall readiness percentage = (Part A correct + Part B sub-marks correct) / 105. The 85% gate is this repo's how-to-prepare rule.

Part A — Multiple choice (Q1–Q85)

Questions are interleaved across all five domains, as on the real exam. Choose the single best answer.

Q1. A tester lists the post-exploitation phases for a client briefing. Which order matches the conceptual chain PenTest+ describes? - A. Enumeration → privilege escalation → persistence → lateral movement / pivoting → collection / exfiltration → covering tracks - B. Privilege escalation → enumeration → lateral movement → persistence → covering tracks → exfiltration - C. Lateral movement → enumeration → persistence → privilege escalation → covering tracks → exfiltration - D. Persistence → enumeration → privilege escalation → exfiltration → lateral movement → covering tracks

Q2. On a switched LAN a tester poisons the mapping between IP and MAC addresses to sit between two hosts and observe their traffic. This describes ARP spoofing / Man-in-the-Middle, and it works because: - A. TLS is enabled on the segment - B. The hosts use static ARP entries - C. The switch encrypts every frame - D. ARP replies are stateless and trusted without authentication

Q3. A credentialed authorised scan of host web01.example.test (198.51.100.24) returns:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9 (protocol 2.0)

Which is the most appropriate next enumeration action for this service, within scope? - A. Note the SSH service and version for later analysis and check the host's supported authentication methods and key configuration - B. Launch a denial-of-service flood against port 22 - C. Ignore it — SSH is never relevant - D. Immediately encrypt the host's files

Q4. A client asks the difference between a vulnerability assessment and a penetration test. The best answer is that a vulnerability assessment: - A. Always exploits every finding to prove impact - B. Can only be run against web applications - C. Is identical to a penetration test - D. Enumerates weaknesses for breadth and usually does not exploit them, whereas a penetration test proves impact by exploiting selected findings

Q5. A finding notes that a public service can be knocked offline by exhausting its request capacity. The most appropriate remediation guidance for this denial-of-service exposure is: - A. Publish the service on more ports - B. Disable all logging - C. Rate limiting, upstream traffic scrubbing, and redundancy - D. Remove multi-factor authentication

Q6. During post-exploitation a tester reuses a stolen Kerberos ticket to access a server without knowing the password. This is Pass-the-Ticket; the defences that most directly limit it are: - A. Longer banner strings - B. Opening additional firewall ports - C. Disabling account lockout - D. Short ticket lifetimes, PAM-brokered access, and monitoring ticket use from anomalous endpoints

Q7. A tester needs to describe the engagement using a recognised methodology. Which mapping is correct? - A. MITRE ATT&CK is a strictly linear seven-phase engagement process - B. PTES is a seven-phase process; NIST SP 800-115 is plan / discover / attack / report; MITRE ATT&CK is a knowledge base of tactics and techniques, not a linear process - C. PTES is a four-phase model and NIST SP 800-115 is a seven-phase model - D. OSSTMM is only for web-application testing

Q8. A tester captures authentication from one host and forwards it to a third system to authenticate there. To defend against this relay attack on Windows name resolution, a defender should: - A. Add more DNS servers only - B. Increase the monitor brightness - C. Disable legacy LLMNR/NBT-NS, enforce SMB signing, and use channel binding - D. Turn off the SIEM

Q9. Which tool's purpose is to gather emails, subdomains, and hostnames about a domain from public sources? - A. theHarvester - B. Hashcat - C. Metasploit Framework - D. Aircrack-ng

Q10. A finding is enriched with an EPSS value. EPSS tells you: - A. The probability that the vulnerability will be exploited in the wild in the near term - B. The vendor of the scanner - C. The CVSS base vector only - D. Whether the asset is internet-facing

Q11. A SIEM shows dozens of accounts each failing a single login with the same password within a few minutes, all from one source. This pattern is the detection signature of: - A. A zone transfer - B. Kerberoasting - C. A denial-of-service attack - D. Password spraying

Q12. A tester explains why a host's local logs are not a trustworthy record after compromise. The defensive control that best preserves the record against covering-tracks activity is: - A. Shipping logs off-host in near real time to a central, write-restricted / tamper-evident store - B. Deleting logs nightly - C. Disabling time synchronisation - D. Storing logs only on the same host

Q13. A misconfigured DNS server permits an AXFR zone transfer to any client. Why does this matter to a tester? - A. It encrypts all DNS traffic - B. It blocks reconnaissance entirely - C. It can dump the entire zone, exposing internal hostnames and infrastructure at once - D. It only affects wireless clients

Q14. In the OWASP Top 10 (2021), category A03 Injection includes which pair of concepts? - A. SQL injection and Cross-Site Scripting (XSS) - B. Evil-twin and deauthentication - C. Pass-the-Hash and Pass-the-Ticket - D. Tailgating and baiting

Q15. A client asks which document defines this specific engagement's deliverables, scope, timeline, and price versus the umbrella terms governing the whole relationship. The correct pairing is: - A. The SOW defines the specific engagement; the MSA is the overarching agreement it sits under - B. The RoE is the umbrella; the MSA is the specific job - C. The authorisation letter is the umbrella; the NDA is the specific job - D. The NDA defines the specific job; the SOW is the umbrella

Q16. A vulnerability appears on the CISA KEV catalog. This tells the tester that the vulnerability is: - A. Theoretical with no known exploit - B. Only relevant to cloud storage - C. Already patched everywhere - D. Confirmed exploited in the wild

Q17. An application can be coerced into making requests to attacker-chosen URLs, including internal endpoints. This is A10 Server-Side Request Forgery (SSRF); the durable defence is: - A. Increasing the session timeout - B. Renaming the database tables - C. Faster TLS handshakes - D. Allow-listing outbound destinations and blocking internal ranges and metadata endpoints

Q18. A tester discovers several previously unknown subdomains without sending any packets to the target, by reading issued TLS certificates. The source used is: - A. Certificate transparency (CT) logs — a passive discovery source - B. A brute-force password attack - C. A denial-of-service tool - D. An SMB null session

Q19. A web app lets a user change the numeric account_id in a request and view another customer's records. This is Broken Access Control; the durable fix is: - A. A faster CPU - B. Hiding the URL bar - C. Client-side JavaScript validation only - D. Enforcing authorisation server-side on every request and object reference

Q20. A tester moves from one standard user's access to another user's account at the same privilege level. This is best described as: - A. Persistence - B. Vertical privilege escalation - C. Horizontal privilege escalation - D. Pivoting

Q21. A junior employee tells a tester "go ahead and test the finance server, it's fine." The correct action is: - A. Not test it; authorisation must come in writing from someone with authority over the asset, scoped and time-bounded - B. Proceed but skip the report - C. Test it — a client employee gave permission - D. Test it only at night

Q22. A finding flags sensitive data transmitted and stored without adequate encryption (A02 Cryptographic Failures). The remediation guidance is: - A. Use TLS in transit and strong, salted hashing / encryption at rest - B. Publish the data publicly - C. Turn off the firewall - D. Disable logging

Q23. Which tool's purpose is an internet-device search engine that indexes internet-facing hosts, services, and banners? - A. Shodan - B. Responder - C. Burp Suite - D. John the Ripper

Q24. In a findings write-up the tester references both a CVE and a CWE for one issue. The distinction is: - A. CVE is the weakness class; CWE is the specific instance - B. They are identical - C. CVE is a scanner and CWE is a tool - D. CVE identifies a specific vulnerability instance; CWE names the underlying class of weakness

Q25. A crafted email targets the CFO specifically, using their name and role to request an urgent wire transfer. Targeting a high-value individual like this is best called: - A. Credential stuffing - B. A deauthentication attack - C. Whaling - D. Baiting

Q26. A defender wants to shrink how much a single foothold can enumerate about Active Directory and the network. The primary control, and its detection signal, are: - A. Disabling MFA; read web logs only - B. Louder alarms; count open ports - C. Least privilege to limit what a foothold can read; alert on broad AD/LDAP queries and share-enumeration sweeps from one host - D. More disk space; watch CPU temperature

Q27. An authorised scan of 203.0.113.40 returns the block below. What is the correct reading of the port states?

PORT     STATE    SERVICE
80/tcp   open     http
139/tcp  closed   netbios-ssn
8443/tcp filtered https-alt
  • A. All three ports accept connections
  • B. 139 is filtered and 80 is closed
  • C. 8443 is confirmed open and serving
  • D. 80 is reachable/serving, 139 actively refuses, and 8443 is blocked/dropped (likely by a firewall) so its state is uncertain

Q28. A social-engineering finding recommends defending against pretexting and vishing (voice calls using a fabricated scenario). The most fitting control is: - A. Faster DNS resolution - B. Identity-verification procedures and callback policies for sensitive requests - C. Longer TLS ciphers - D. A web application firewall

Q29. A team compares two application-testing styles: one inspects source code without running it, the other tests the running application from the outside. These are, respectively: - A. Both static analysis - B. DAST and SAST - C. SAST (static) and DAST (dynamic) - D. Both dynamic analysis

Q30. A scope document says the tester receives a standard domain user account and partial network information, but no source code or architecture. This knowledge level is: - A. No-box - B. Grey-box - C. White-box - D. Black-box

Q31. A wireless finding notes clients being forced to disconnect and reconnect. This deauthentication attack works because 802.11 management frames are unauthenticated; the targeted defence is: - A. Disabling the SIEM - B. 802.11w protected management frames - C. Longer DNS TTLs - D. A stronger web password policy

Q32. A scan infers a host's operating system from its default TTL, TCP window size, and how it handles crafted flags. This technique is: - A. A zone transfer - B. Credential stuffing - C. Banner grabbing - D. OS fingerprinting

Q33. A defender values a PAM bastion's session recordings stored off-host because they: - A. Encrypt the wireless network - B. Provide a high-fidelity, independent forensic record that endpoint-level log tampering cannot reach - C. Remove the need for segmentation - D. Replace the need for backups

Q34. A finding reports a WPA2 pre-shared-key network whose handshake can be captured and cracked offline. The strongest remediation options are: - A. WPA3 or 802.1X/EAP enterprise authentication with long passphrases - B. Broadcasting on more channels - C. Turning off encryption - D. Hiding the SSID only

Q35. A validated finding carries a CVSS base score of 9.4. Using the CVSS v3.x severity bands, its qualitative severity is: - A. High - B. Low - C. Critical - D. Medium

Q36. A cloud finding reports an IAM role granting far more permissions than the workload needs. The remediation is: - A. Least-privilege IAM with short-lived credentials and key rotation - B. Disabling CloudTrail-style logging - C. Sharing the access keys widely - D. Making the storage bucket public

Q37. Which tool's purpose is to visualise relationships between entities (people, domains, emails, infrastructure) gathered during OSINT? - A. Hashcat - B. Aircrack-ng - C. Maltego - D. sqlmap

Q38. An engagement is scoping a cardholder-data environment. Which regulatory driver most directly mandates periodic penetration testing of that environment? - A. PCI DSS - B. None apply to card data - C. Only GDPR - D. HIPAA

Q39. In a cloud environment, which detection signal most directly indicates abuse of the instance metadata service (often reached via SSRF)? - A. Unexpected requests to the internal metadata endpoint from the application - B. A slower screen saver - C. A rise in wireless deauthentication frames - D. More printer jobs

Q40. A tester enriches a CVE with analysis and a CVSS score. Which resource, run by NIST, provides that enrichment? - A. Shodan - B. The National Vulnerability Database (NVD) - C. OWASP ZAP - D. The CISA KEV catalog

Q41. During DNS enumeration a tester finds several TXT records. These most commonly relate to which security function? - A. Physical access control - B. Wireless encryption - C. Disk encryption - D. Email authentication — SPF, DKIM, and DMARC

Q42. A finding reports IoT devices shipped with default, hardcoded credentials. The primary remediation is: - A. Remove all monitoring - B. Publish the device passwords - C. Disable network segmentation - D. Change default credentials, segment the devices, and apply firmware updates

Q43. A defender introduces just-in-time (JIT) access for administrators. This most directly counters which post-exploitation advantage? - A. Standing, always-on privileged access an attacker can abuse at any time - B. Weak TLS ciphers - C. Verbose banner strings - D. Slow DNS resolution

Q44. A client asks what a retest accomplishes after they remediate findings. The best answer is that the tester: - A. Starts an entirely new unrelated engagement - B. Deletes the original report - C. Only re-reads the executive summary - D. Re-tests the reported issues to confirm the fixes worked and introduced no new problems, then updates each finding's status

Q45. In an OT/ICS environment, why does a careful tester prefer passive monitoring and segmentation over an intrusive active scan? - A. Active scanning could disrupt a safety-critical or availability-sensitive process - B. Confidentiality is the only concern in OT - C. Passive methods are always illegal - D. OT devices patch instantly

Q46. A tester connects to a service and reads the version string it announces on connection to map it to known vulnerabilities. This technique is: - A. Pivoting - B. Banner grabbing - C. A zone transfer - D. A denial-of-service attack

Q47. CVSS v3.x defines three metric groups. Which set is correct? - A. Passive, Active, and Hybrid - B. Base, Temporal (Threat), and Environmental - C. Low, Medium, and High - D. Static, Dynamic, and Interactive

Q48. Which tool is named on PenTest+ for the purpose of demonstrating SQL-injection issues (concept and awareness, not procedure)? - A. Wireshark - B. Aircrack-ng - C. sqlmap - D. Nmap

Q49. A defender wants to ensure that cracking one machine's local administrator password does not unlock every other machine. The control is: - A. A single shared local-admin password everywhere - B. Disabling logging - C. Removing MFA - D. Unique, per-host local-admin passwords (e.g. a managed local-admin password solution)

Q50. Which agreement's specific purpose is to protect the confidential findings and client data uncovered during testing? - A. SLA - B. NDA - C. SOW - D. MSA

Q51. Which tool suite's purpose is wireless-network security auditing? - A. theHarvester - B. Burp Suite - C. John the Ripper - D. Aircrack-ng

Q52. A whois lookup on an in-scope domain returns registrar, registrant contacts, and name servers. WHOIS and the Regional Internet Registries (RIRs) primarily provide: - A. Domain and IP registration data - B. Wireless handshakes - C. Password hashes - D. Live packet captures

Q53. Which tool is named on PenTest+ for the purpose of name-resolution poisoning awareness (capturing authentication when legacy LLMNR/NBT-NS is abused)? - A. Responder - B. Nessus - C. Maltego - D. Hydra

Q54. A team relies solely on an automated scanner and misses a business-logic authorisation flaw. The lesson PenTest+ teaches is: - A. Automated scanning gives breadth but manual discovery is needed for logic, authentication, and access-control flaws scanners miss - B. Scanners find every possible issue - C. Manual testing is never useful - D. Logic flaws do not matter

Q55. A cloud reconnaissance activity most commonly surfaces which high-yield exposure? - A. Printer toner levels - B. Screen-saver settings - C. Publicly readable object storage buckets and exposed management/metadata endpoints - D. Keyboard layouts

Q56. Which tool's purpose is capturing and inspecting network traffic (a packet analyser)? - A. Wireshark - B. GoPhish - C. Hashcat - D. sqlmap

Q57. A single account authenticates to many systems in quick succession, including privileged logons from a non-admin workstation. This is the detection signature of: - A. A CVSS recalculation - B. Banner grabbing - C. Lateral movement - D. A zone transfer

Q58. When prioritising findings for the report, the tester should: - A. Weigh severity together with exploitability and business context, so a Medium on an internet-facing crown-jewel system can outrank a Critical on an isolated test box - B. List findings alphabetically - C. Only report Critical findings - D. Rank strictly by raw CVSS base score with no context

Q59. Which tool's purpose is mapping Active Directory attack paths and relationships during post-exploitation analysis? - A. BloodHound - B. Kismet - C. Nikto - D. Recon-ng

Q60. A tester must query hosts, services, and directory objects across a Windows/Active Directory estate. Which scripting language is the natural fit for that environment? - A. HTML - B. Only SQL - C. PowerShell - D. Only Bash

Q61. A defender re-runs a scan with valid credentials and the false-positive count drops sharply. This is because a credentialed scan: - A. Ignores the target entirely - B. Only tests wireless - C. Cannot see local configuration - D. Logs in to see installed patches and actual configuration, so it judges real state rather than guessing from banners

Q62. A finding flags a known-vulnerable third-party library in the application (A06 Vulnerable and Outdated Components). The remediation is: - A. Publishing the source publicly - B. Software Composition Analysis (SCA) and patching/updating the dependency - C. Removing all logging - D. Disabling the firewall

Q63. Before exfiltration, a defender may catch an attacker in the staging step. Which behaviour is the tell? - A. A routine DNS query - B. A single successful web login - C. A screen-saver activation - D. Mass file reads and creation of large local archives

Q64. Mid-engagement, a tester uncovers evidence of a real, pre-existing breach unrelated to the test. The correct action is: - A. Continue testing and ignore it - B. Pause, notify the agreed point of contact, and help de-escalate per the stop conditions in the RoE - C. Delete the evidence - D. Post it on social media

Q65. A physical-security finding notes an unauthorised device plugged into an open network port. The primary technical control is: - A. Disabling the SIEM - B. A stronger web password policy - C. More DNS servers - D. 802.1X port authentication / Network Access Control (NAC)

Q66. An authorised internal scan shows 192.0.2.15 with the line below. What does the open port most directly imply for the next step?

3389/tcp open  ms-wbt-server
  • A. A mail server — enumerate SMTP
  • B. A DNS server — query zone records next
  • C. A Remote Desktop (RDP) service is reachable — note it as a remote-access surface to assess (in scope), watching for exposure and weak authentication
  • D. A wireless access point — capture the handshake

Q67. A scanner with an out-of-date feed misses a genuinely present, exploitable vulnerability. This error is a: - A. False positive - B. False negative - C. True negative - D. True positive

Q68. A user plugs in a USB drive found in the car park, and it runs unwanted code. This baiting attack exploits curiosity; the primary controls are: - A. A faster CPU - B. Disabling encryption - C. Device control / USB restrictions plus user-awareness training - D. More open ports

Q69. Before deeper probing, a tester determines which addresses on a segment are live. Which pair are host-discovery techniques? - A. Baiting and tailgating - B. ICMP echo (ping) sweeps and ARP discovery on the local segment - C. Kerberoasting and PtH - D. SQL injection and XSS

Q70. A finding recommends managing the security posture of company mobile endpoints. The control class is: - A. Mobile Device Management (MDM) with app vetting and encryption - B. A web application firewall - C. Removing all authentication - D. A wireless jammer

Q71. A quieter assessment style observes existing traffic or reviews configuration without sending probes. This is: - A. A brute-force attack - B. A denial-of-service attack - C. Passive analysis - D. Active scanning

Q72. To limit lateral movement, a defender enforces MFA on privileged and remote access. This helps because: - A. It disables Active Directory - B. It removes the need for any passwords - C. A stolen or reused credential alone is no longer sufficient to authenticate to the next system - D. It encrypts the wireless network

Q73. A finding reports insecure defaults and verbose error pages (A05 Security Misconfiguration). The remediation is: - A. Removing the login page - B. Turning off TLS - C. Hardening baselines and least privilege, with unnecessary features disabled - D. Publishing debug output publicly

Q74. A blue team runs Shodan, certificate-transparency, and dig queries against its own domains to find exposure first. This defensive practice is called: - A. Session hijacking - B. A denial-of-service test - C. Self-OSINT / external attack-surface management - D. Credential stuffing

Q75. A defender routes all administrative access through a brokered bastion / session proxy. The security value is that it: - A. Replaces the need for backups - B. Speeds up logons only - C. Removes the need for patching - D. Creates a monitored choke point where every privileged hop is recorded and credentials are not left reusable on endpoints

Q76. Which is the corresponding defensive tool a defender relies on to flag token abuse, credential access, and anomalous privilege grants on a host? - A. Endpoint Detection and Response (EDR) - B. theHarvester - C. sqlmap - D. Aircrack-ng

Q77. Two validated findings compete for remediation priority: a Critical (CVSS 9.1) with no known exploit on an isolated host, and a High (CVSS 7.5) on the CISA KEV list on an internet-facing server. The better remediation order is: - A. Neither — ignore both - B. Order by CVE number - C. The Critical first, always, because its number is higher - D. The High first, because confirmed in-the-wild exploitation plus exposure make it the more urgent real risk

Q78. An engagement's scope may touch a third-party cloud provider's infrastructure. Before testing there, the tester must: - A. Assume the client's authorisation covers it - B. Verify and obtain the provider's testing authorisation/policy, because the client's letter does not authorise touching someone else's systems - C. Skip all documentation - D. Test first and ask later

Q79. A tester captures a password hash and cracks it offline on their own hardware. This is effective because: - A. The user has MFA - B. The hash is stored in plaintext - C. The network is encrypted - D. The stolen hash faces no account-lockout or rate limit once offline

Q80. Classify this technique: a tester queries public certificate-transparency logs to discover subdomains, sending nothing to the target. It is: - A. Post-exploitation - B. Active reconnaissance - C. Exploitation - D. Passive reconnaissance

Q81. For whom is the executive summary of a penetration-test report primarily written? - A. The scanner vendor - B. Only the tester - C. Non-technical leadership who need overall risk posture and business impact, in plain language - D. The attacker

Q82. A finding reports weak login and session management (A07 Identification and Authentication Failures). The remediation is: - A. Storing passwords in plaintext - B. Removing account lockout - C. Turning off HTTPS - D. MFA, strong random session IDs, and secure cookie flags

Q83. A scanner is aimed at fragile legacy and embedded hosts. The correct engagement consideration is: - A. Tune scan intensity and timing to the RoE, using safe-check options, because aggressive scans can disrupt fragile systems - B. Always scan at maximum intensity regardless of impact - C. Scan production payroll systems anyway - D. Skip authorisation

Q84. Which tool's purpose is a modular framework for automating and organising web-based OSINT gathering? - A. Nikto - B. Recon-ng - C. Wireshark - D. Hashcat

Q85. During an in-scope web test the tester confirms a SQL-injection point. In the report's remediation section, the definitive fix to recommend is: - A. Renaming the tables - B. Hiding error messages only - C. Parameterised queries / prepared statements (a WAF is only a stop-gap layer) - D. A faster database server

Part B — Performance-based scenarios (PBQ 1–5)

Each PBQ has a clear task and a bounded answer set. Write your answers, then score against the PBQ answer key.

PBQ 1 — Next enumeration step per service (4 sub-marks)

An authorised, in-scope credentialed scan of appsrv.example.test (198.51.100.50) returns:

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        (DNS)
80/tcp   open  http          nginx 1.25
445/tcp  open  microsoft-ds  (SMB)
3306/tcp open  mysql         MySQL 8.0

Task. Match each open service (1–4) to the single most appropriate next enumeration action from the list A–D. Every service and action is used exactly once. Stay conceptual and in scope — no exploitation.

Services: 1. 53/tcp DNS 2. 80/tcp HTTP (nginx) 3. 445/tcp SMB 4. 3306/tcp MySQL

Actions: - A. Enumerate shares and check for null-session / over-permissive access - B. Crawl/spider the site and map directories, parameters, and technologies - C. Interrogate DNS records (A, MX, NS, TXT) and test whether a zone transfer is allowed - D. Identify the database version/instance and note it for credentialed configuration review

PBQ 2 — Findings to CVSS band and remediation (4 sub-marks)

Using the CVSS v3.x severity bands (None 0.0; Low 0.1–3.9; Medium 4.0–6.9; High 7.0–8.9; Critical 9.0–10.0), assign each finding's band, then pick its best remediation from the list. (Each finding earns one sub-mark for correct band and remediation together.)

# Finding Base score
1 Unauthenticated remote code execution on an internet-facing server 9.8
2 Reflected Cross-Site Scripting in a search box 6.1
3 Verbose banner discloses exact software version 3.1
4 SQL injection in a login form 8.6

Remediation options: - A. Context-aware output encoding plus a Content Security Policy - B. Suppress or genericise the banner - C. Parameterised queries / prepared statements - D. Emergency patch / isolate the host and apply the vendor fix now

PBQ 3 — Order the phases (2 sub-marks)

Task 3a (1 mark). Put the engagement lifecycle stages in the correct order:

  • Reporting & retest
  • Pre-engagement (scope, RoE, agreements)
  • Exploitation (gain a foothold)
  • Reconnaissance
  • Post-exploitation
  • Vulnerability discovery & analysis

Task 3b (1 mark). Put the post-exploitation chain steps in the correct order:

  • Lateral movement / pivoting
  • Enumeration of the compromised host & network
  • Covering tracks
  • Privilege escalation
  • Collection / exfiltration
  • Persistence

PBQ 4 — Select the Rules-of-Engagement items (6 sub-marks)

Task. From the list below, select every item that belongs in a Rules-of-Engagement (RoE) document. There are six correct items; award one sub-mark per correctly included item (and treat wrongly included items as lost marks when self-scoring).

  1. In-scope targets and explicit exclusions
  2. Authorised techniques and constraints (e.g. whether social engineering or DoS testing is allowed)
  3. Testing timing windows
  4. Points of contact and the escalation path
  5. Stop conditions (when to halt immediately)
  6. Evidence-handling and confidentiality terms
  7. The tester's personal opinion of the client's staff
  8. A list of unrelated industry news headlines
  9. The exact exploit code to run against production
  10. The client's marketing calendar

PBQ 5 — Technique to ATT&CK tactic and defensive control (4 sub-marks)

Task. For each described technique, name the MITRE ATT&CK tactic it serves and select the best defensive control from the attack-to-defense matrix list. One sub-mark per row for the correct tactic and control together.

Techniques: 1. Reusing a stolen NTLM hash to authenticate to another host without cracking it (Pass-the-Hash) 2. Requesting service tickets for service-principal names, then cracking them offline (Kerberoasting) 3. Tricking a user into revealing a password or running malware to gain first access (phishing) 4. Editing and deleting local logs and timestamps to hide the intrusion

Tactics (use each once): Lateral Movement · Credential Access · Initial Access · Defense Evasion

Defensive controls: - A. User-awareness training, email filtering, MFA everywhere; privileged targets need the gateway + MFA (no target password to phish) - B. Vault + automatic rotation gives long, random, frequently changed service-account passwords; group Managed Service Accounts - C. Off-host, tamper-evident / SIEM logging that an endpoint attacker cannot reach; alert on log gaps - D. Unique, rotated per-host credentials and no standing local admin (PAM + EPM); disable NTLM where possible

Answer key

Score Part A one point per correct letter; score Part B against the model answers that follow.

Part A answer key (Q1–Q85)

Q1 — A. The conceptual post-exploitation chain is enumeration → privilege escalation → persistence → lateral movement/pivoting → collection/exfiltration → covering tracks. (Domain 5 — post-exploitation)

Q2 — D. ARP is stateless and unauthenticated, so spoofed replies let an attacker sit in the middle; Dynamic ARP Inspection and encryption defend against it. (Domain 4 — attacks & exploits)

Q3 — A. Recognising SSH and noting its version/config for later analysis is the right, in-scope next step; flooding or encrypting the host is out of scope and destructive. (Domain 2 — recon & enumeration)

Q4 — D. A vulnerability assessment enumerates weaknesses for breadth and usually does not exploit; a penetration test proves impact by exploiting selected findings. (Domain 3 — vuln discovery & analysis)

Q5 — C. Denial-of-service exposure is mitigated by rate limiting, upstream scrubbing, and redundancy. (Domain 4 — attacks & exploits)

Q6 — D. Pass-the-Ticket replays a stolen Kerberos ticket; short ticket lifetimes, PAM, and anomalous-endpoint monitoring limit it. (Domain 5 — post-exploitation)

Q7 — B. PTES is seven phases; NIST SP 800-115 is plan/discover/attack/report; MITRE ATT&CK is a knowledge base of tactics/techniques, not a linear process. (Domain 1 — engagement management)

Q8 — C. Relay/name-resolution abuse is countered by disabling legacy LLMNR/NBT-NS, enforcing SMB signing, and channel binding. (Domain 4 — attacks & exploits)

Q9 — A. theHarvester gathers emails, subdomains, and hostnames from public sources. (Domain 2 — recon & enumeration)

Q10 — A. EPSS estimates the probability a vulnerability will be exploited in the wild in the near term. (Domain 3 — vuln discovery & analysis)

Q11 — D. Many accounts, one password, low per-account failures from one source is the password-spraying signature. (Domain 4 — attacks & exploits)

Q12 — A. Shipping logs off-host in near real time to a write-restricted/tamper-evident store preserves the record against covering-tracks activity. (Domain 5 — post-exploitation)

Q13 — C. A misconfigured AXFR zone transfer can dump the whole zone, exposing internal hostnames and infrastructure at once. (Domain 2 — recon & enumeration)

Q14 — A. OWASP A03 Injection includes SQL injection and Cross-Site Scripting. (Domain 4 — attacks & exploits)

Q15 — A. The SOW defines the specific engagement; the MSA is the overarching agreement it sits under. (Domain 1 — engagement management)

Q16 — D. The CISA KEV catalog lists vulnerabilities confirmed exploited in the wild — a strong "fix now" signal. (Domain 3 — vuln discovery & analysis)

Q17 — D. SSRF (A10) is defended by allow-listing outbound destinations and blocking internal ranges and metadata endpoints. (Domain 4 — attacks & exploits)

Q18 — A. Certificate transparency logs reveal issued certificates and their hostnames without touching the target — a passive discovery source. (Domain 2 — recon & enumeration)

Q19 — D. Broken Access Control (changing an ID to reach another account) is fixed by enforcing authorisation server-side on every request/object. (Domain 4 — attacks & exploits)

Q20 — C. Reaching another account at the same privilege level is horizontal privilege escalation; going user→admin/root is vertical. (Domain 5 — post-exploitation)

Q21 — A. Authorisation must come in writing from someone with authority over the asset, scoped and time-bounded; a junior employee's "it's fine" is a trap. (Domain 1 — engagement management)

Q22 — A. Cryptographic Failures (A02) are remediated with TLS in transit and strong salted hashing/encryption at rest. (Domain 4 — attacks & exploits)

Q23 — A. Shodan is an internet-device search engine indexing internet-facing hosts, services, and banners. (Domain 2 — recon & enumeration)

Q24 — D. A CVE is a specific vulnerability instance; a CWE names the underlying class of weakness. (Domain 3 — vuln discovery & analysis)

Q25 — C. Targeting a high-value individual such as the CFO is whaling (a form of spear-phishing). (Domain 4 — attacks & exploits)

Q26 — C. Least privilege limits what a foothold can enumerate; broad AD/LDAP queries and share-enumeration sweeps from one host are the detection signal. (Domain 5 — post-exploitation)

Q27 — D. open = reachable/serving (80), closed = actively refused (139), filtered = dropped and uncertain, typically a firewall (8443). (Domain 2 — recon & enumeration)

Q28 — B. Pretexting and vishing are countered by identity-verification procedures and callback policies for sensitive requests. (Domain 4 — attacks & exploits)

Q29 — C. SAST inspects code without running it; DAST tests the running application from the outside. (Domain 3 — vuln discovery & analysis)

Q30 — B. A standard account plus partial information but no source/architecture is grey-box. (Domain 1 — engagement management)

Q31 — B. Deauthentication abuses unauthenticated management frames; 802.11w protected management frames are the targeted defence. (Domain 4 — attacks & exploits)

Q32 — D. Inferring the OS from TTL, TCP window size, and flag handling is OS fingerprinting. (Domain 2 — recon & enumeration)

Q33 — B. Off-host PAM session recordings are an independent, high-fidelity forensic record that endpoint log tampering cannot reach. (Domain 5 — post-exploitation)

Q34 — A. WPA3 or 802.1X/EAP enterprise authentication with long passphrases defends against handshake capture and offline cracking. (Domain 4 — attacks & exploits)

Q35 — C. A base score of 9.4 falls in the Critical band (9.0–10.0). (Domain 3 — vuln discovery & analysis)

Q36 — A. Over-permissive IAM is remediated with least-privilege roles, short-lived credentials, and key rotation. (Domain 4 — attacks & exploits)

Q37 — C. Maltego visualises relationships between entities in OSINT data (link analysis). (Domain 2 — recon & enumeration)

Q38 — A. PCI DSS mandates periodic penetration testing of cardholder-data environments. (Domain 1 — engagement management)

Q39 — A. Unexpected requests to the internal metadata endpoint from the application indicate metadata-service abuse (often via SSRF). (Domain 4 — attacks & exploits)

Q40 — B. The National Vulnerability Database (NVD), run by NIST, enriches CVE entries with analysis and CVSS scores. (Domain 3 — vuln discovery & analysis)

Q41 — D. DNS TXT records commonly carry the email-authentication records SPF, DKIM, and DMARC. (Domain 2 — recon & enumeration)

Q42 — D. IoT default/hardcoded credentials are remediated by changing defaults, segmenting the devices, and updating firmware. (Domain 4 — attacks & exploits)

Q43 — A. Just-in-time access removes standing, always-on privilege an attacker could abuse at any time. (Domain 5 — post-exploitation)

Q44 — D. A retest confirms the fixes worked and introduced no new problems, then updates each finding's status. (Domain 1 — engagement management)

Q45 — A. In OT/ICS an active scan could disrupt a safety- or availability-critical process, so passive monitoring and segmentation are preferred. (Domain 4 — attacks & exploits)

Q46 — B. Reading the version string a service announces on connection is banner grabbing. (Domain 2 — recon & enumeration)

Q47 — B. CVSS metric groups are Base, Temporal (Threat in newer versions), and Environmental. (Domain 3 — vuln discovery & analysis)

Q48 — C. sqlmap is named for the purpose of demonstrating SQL-injection issues. (Domain 4 — attacks & exploits)

Q49 — D. Unique per-host local-admin passwords (a managed local-admin password solution) stop one cracked password unlocking every machine. (Domain 5 — post-exploitation)

Q50 — B. The NDA protects confidential findings and client data uncovered during testing. (Domain 1 — engagement management)

Q51 — D. The Aircrack-ng suite is for wireless-network security auditing. (Domain 4 — attacks & exploits)

Q52 — A. WHOIS and the RIRs provide domain and IP registration data (registrar, contacts, name servers). (Domain 2 — recon & enumeration)

Q53 — A. Responder is named on PenTest+ for name-resolution poisoning awareness. (Domain 4 — attacks & exploits)

Q54 — A. Automated scanning gives breadth, but manual discovery finds the logic, authentication, and access-control flaws scanners miss. (Domain 3 — vuln discovery & analysis)

Q55 — C. Cloud recon commonly surfaces publicly readable storage buckets and exposed management/metadata endpoints. (Domain 2 — recon & enumeration)

Q56 — A. Wireshark captures and inspects network traffic (a packet analyser). (Domain 4 — attacks & exploits)

Q57 — C. One account authenticating to many systems quickly, with privileged logons from a non-admin workstation, signals lateral movement. (Domain 5 — post-exploitation)

Q58 — A. Prioritise by severity plus exploitability and business context, so a Medium on an exposed crown-jewel can outrank a Critical on an isolated box. (Domain 1 — engagement management)

Q59 — A. BloodHound maps Active Directory attack paths and relationships during post-exploitation. (Domain 5 — post-exploitation)

Q60 — C. PowerShell is the natural fit for querying Windows/Active Directory hosts, services, and directory objects. (Domain 2 — recon & enumeration)

Q61 — D. A credentialed scan logs in to see installed patches and real configuration, so it judges actual state rather than guessing from banners, reducing false positives. (Domain 3 — vuln discovery & analysis)

Q62 — B. Vulnerable/outdated components (A06) are remediated with Software Composition Analysis and patching the dependency. (Domain 4 — attacks & exploits)

Q63 — D. Mass file reads and large local archives are staging behaviour that precedes exfiltration. (Domain 5 — post-exploitation)

Q64 — B. On finding a real pre-existing breach, pause, notify the point of contact, and de-escalate per the RoE stop conditions. (Domain 1 — engagement management)

Q65 — D. A rogue device on an open port is countered by 802.1X port authentication / Network Access Control. (Domain 4 — attacks & exploits)

Q66 — C. An open 3389/ms-wbt-server is Remote Desktop — an in-scope remote-access surface to assess for exposure and weak authentication. (Domain 2 — recon & enumeration)

Q67 — B. A real, exploitable vulnerability missed by a stale-feed scanner is a false negative — the more dangerous error. (Domain 3 — vuln discovery & analysis)

Q68 — C. Baiting (dropped media) is countered by device control / USB restrictions plus user-awareness training. (Domain 4 — attacks & exploits)

Q69 — B. ICMP echo (ping) sweeps and ARP discovery on the local segment are host-discovery techniques. (Domain 2 — recon & enumeration)

Q70 — A. Mobile posture is managed with Mobile Device Management (MDM), app vetting, and encryption. (Domain 4 — attacks & exploits)

Q71 — C. Observing existing traffic or reviewing configuration without probing is passive analysis. (Domain 3 — vuln discovery & analysis)

Q72 — C. MFA on privileged/remote access means a stolen or reused credential alone cannot authenticate to the next system, limiting lateral movement. (Domain 5 — post-exploitation)

Q73 — C. Security Misconfiguration (A05) is remediated with hardening baselines, least privilege, and disabling unnecessary features. (Domain 4 — attacks & exploits)

Q74 — C. Running Shodan, CT-log, and dig queries against your own domains is self-OSINT / external attack-surface management. (Domain 2 — recon & enumeration)

Q75 — D. A brokered bastion/session proxy is a monitored choke point where every privileged hop is recorded and credentials are not left reusable on endpoints. (Domain 5 — post-exploitation)

Q76 — A. Endpoint Detection and Response (EDR) is the defensive tool that flags token abuse, credential access, and anomalous privilege grants. (Domain 4 — attacks & exploits)

Q77 — D. The High on the CISA KEV list and internet-facing outranks the Critical with no known exploit on an isolated host — confirmed exploitation plus exposure drive urgency. (Domain 3 — vuln discovery & analysis)

Q78 — B. Third-party infrastructure needs the provider's own testing authorisation; the client's letter does not authorise touching someone else's systems. (Domain 1 — engagement management)

Q79 — D. Offline hash cracking works because a stolen hash faces no account lockout or rate limit once off the target. (Domain 4 — attacks & exploits)

Q80 — D. Querying public certificate-transparency logs without sending anything to the target is passive reconnaissance. (Domain 2 — recon & enumeration)

Q81 — C. The executive summary is written for non-technical leadership: overall risk posture and business impact, in plain language. (Domain 1 — engagement management)

Q82 — D. Identification and Authentication Failures (A07) are remediated with MFA, strong random session IDs, and secure cookie flags. (Domain 4 — attacks & exploits)

Q83 — A. Tune scan intensity and timing to the RoE and use safe-check options; aggressive scans can disrupt fragile systems. (Domain 3 — vuln discovery & analysis)

Q84 — B. Recon-ng is a modular framework for automating and organising web-based OSINT. (Domain 2 — recon & enumeration)

Q85 — C. The definitive fix for SQL injection is parameterised queries / prepared statements; a WAF is only a stop-gap defence-in-depth layer. (Domain 4 — attacks & exploits)

Part B (PBQ) answer key

PBQ 1 — Next enumeration step per service

  • 1 (DNS) → C — interrogate DNS records and test for a zone transfer.
  • 2 (HTTP) → B — crawl/spider the site and map its structure and technologies.
  • 3 (SMB) → A — enumerate shares and check for null-session/over-permissive access.
  • 4 (MySQL) → D — identify the database version/instance for credentialed configuration review.

Each service names a distinct enumeration target from Domain 2's target-type table. (Domain 2 — recon & enumeration)

PBQ 2 — Findings to CVSS band and remediation

  • 1 → Critical (9.8), D — emergency patch/isolate the internet-facing RCE host now.
  • 2 → Medium (6.1), A — output encoding plus Content Security Policy for reflected XSS.
  • 3 → Low (3.1), B — suppress/genericise the banner.
  • 4 → High (8.6), C — parameterised queries / prepared statements for SQL injection.

Bands follow the CVSS v3.x ranges; remediations follow the OWASP/Domain 4 durable fixes. (Domains 3 & 4 — vuln discovery & analysis, attacks & exploits)

PBQ 3 — Order the phases

  • 3a (engagement lifecycle): Pre-engagement → Reconnaissance → Vulnerability discovery & analysis → Exploitation → Post-exploitation → Reporting & retest.
  • 3b (post-exploitation chain): Enumeration of the compromised host & network → Privilege escalation → Persistence → Lateral movement / pivoting → Collection / exfiltration → Covering tracks.

(Domain 1 lifecycle: engagement management; Domain 5 chain: post-exploitation)

PBQ 4 — Select the Rules-of-Engagement items

Correct items: 1, 2, 3, 4, 5, 6. Items 7, 8, 9, and 10 do not belong in an RoE — the RoE covers in-scope targets and exclusions, authorised techniques and constraints, timing windows, contacts and escalation, stop conditions, and evidence-handling/confidentiality terms. (Domain 1 — engagement management)

PBQ 5 — Technique to ATT&CK tactic and defensive control

  • 1 Pass-the-Hash → Lateral Movement; control D — unique, rotated per-host credentials and no standing local admin (PAM + EPM); disable NTLM where possible. (ATT&CK T1550.002.)
  • 2 Kerberoasting → Credential Access; control B — vault + automatic rotation and group Managed Service Accounts for strong, frequently changed service-account passwords. (ATT&CK T1558.003.)
  • 3 Phishing → Initial Access; control A — awareness training, email filtering, MFA everywhere; privileged access needs the gateway + MFA. (ATT&CK T1566.)
  • 4 Log tampering → Defense Evasion; control C — off-host, tamper-evident/SIEM logging an endpoint attacker cannot reach; alert on log gaps. (ATT&CK T1070.)

See the attack-to-defense matrix and MITRE ATT&CK for the full mappings. (Domains 4 & 5 — attacks & exploits, post-exploitation)

Where to go next

Sources