Sample TCM Security PNPT Practice Questions
Q: Which activity is passive reconnaissance?
A: Searching certificate transparency logs for a target's subdomains. Certificate transparency logs (for example crt.sh) are public records, so the target never sees your queries. Scanning, zone transfer attempts, and banner grabbing all send traffic to target systems.
Q: Which Nmap flag runs a TCP SYN (half-open) scan?
A: -sS. -sS sends SYN packets and does not complete the handshake. -sT does a full connect, -sU scans UDP, and -sV detects service versions.
Q: In Metasploit, which command sets the target host for a module?
A: set RHOSTS. RHOSTS is the remote host (the target). LHOST is the local address the payload connects back to.
Q: Which file on a domain controller stores the AD database, including password hashes?
A: NTDS.dit. NTDS.dit holds every domain account's data. The local SAM only stores local account hashes.
Q: What is Burp Suite's default proxy listener address?
A: 127.0.0.1:8080. Browsers are pointed at 127.0.0.1:8080 so Burp can intercept and modify requests.
Q: What does the PNPT exam require beyond finding vulnerabilities?
A: A professional written report and a live debrief with an assessor. TCM Security describes the exam as a full engagement, ending with a report and a live report debrief, and notes that it is not a CTF.
Q: What is theHarvester mainly used for?
A: Collecting emails, subdomains, and hostnames from public sources. theHarvester queries search engines, certificate logs, and other public sources to build lists of emails, hosts, and subdomains during the OSINT phase.
Q: Why would a tester look up a company's domain on Hunter.io?
A: To learn the company's email address format and find employee addresses. Knowing the pattern (such as [email protected]) lets a tester build valid username lists for later password spraying or phishing, if those are in scope.
Q: A tester finds the addresses [email protected] and [email protected]. Which username format does the company use?
A: First initial followed by last name. jsmith is J. Smith and mdoe is M. Doe, so the format is first initial plus last name. Identifying the format turns a LinkedIn employee list into a usable username list.
Q: What does the Google dork site:example.com filetype:pdf do?
A: Returns only PDF files indexed under example.com. The site: operator limits results to one domain and filetype: limits them to one extension. Public documents often leak usernames, software versions, and internal paths.