Sample CompTIA PenTest+ PT0-002 Practice Questions
Q: Which document defines the boundaries, targets, and limitations of a penetration test?
A: Rules of Engagement (ROE) — The Rules of Engagement (ROE) specifically defines the scope, boundaries, allowed techniques, target systems, and limitations of a penetration test. The SOW covers general deliverables, the MSA covers the business relationship, and the NDA covers confidentiality.
Q: Which of the following is considered a passive reconnaissance technique?
A: Searching WHOIS records for domain registration information — WHOIS lookups are passive because they query public databases without directly interacting with the target's systems. Port scanning and vulnerability scanning are active techniques that send traffic to the target.
Q: Which OWASP Top 10 vulnerability involves inserting malicious SQL statements into application queries?
A: SQL Injection — SQL Injection occurs when an attacker inserts malicious SQL statements into input fields that are improperly validated, allowing them to manipulate database queries, extract data, or modify records.
Q: Which section of a penetration test report provides a non-technical summary for executives and management?
A: Executive summary — The executive summary provides a high-level, non-technical overview of the assessment's goals, key findings, risk levels, and strategic recommendations. It is designed for executives who may not have technical backgrounds.
Q: Which Burp Suite tool is used to intercept and modify HTTP requests between a browser and a web server?
A: Proxy — The Burp Suite Proxy intercepts HTTP/HTTPS traffic between the browser and the web server, allowing testers to view, modify, and forward requests. It is the core component for manual web application testing.
Q: A penetration tester is given full network diagrams, credentials, and source code before beginning a test. What type of test is this?
A: White box — A white box (or known environment) test provides the tester with complete information including network diagrams, credentials, and source code. Black box provides no information, and gray box provides partial information.
Q: During scoping, a client asks the penetration tester to avoid testing their production database server between 8 AM and 6 PM. Where should this restriction be documented?
A: Rules of Engagement — Time-based restrictions and constraints on testing are documented in the Rules of Engagement (ROE). This ensures the tester knows when and how they can test specific systems to avoid disrupting business operations.
Q: A company wants to test how well its SOC team detects and responds to attacks without informing the blue team. Which assessment type is MOST appropriate?
A: Red team engagement — A red team engagement simulates real-world adversarial attacks to test the organization's detection and response capabilities. The blue team (SOC) is typically not informed so their genuine response can be evaluated.
Q: Which of the following BEST describes a purple team exercise?
A: A collaborative exercise where attackers and defenders share tactics in real time — A purple team exercise combines red team (offensive) and blue team (defensive) efforts in a collaborative manner. Both teams share information in real time to improve detection capabilities and attack techniques simultaneously.
Q: Which legal document ensures that a penetration tester will not disclose sensitive client data discovered during testing?
A: Non-Disclosure Agreement (NDA) — A Non-Disclosure Agreement (NDA) is a legally binding document that ensures the penetration tester will maintain confidentiality of any sensitive information discovered during the engagement.