CompTIA PenTest+ Certification Detailed Exam Domain Coverage

This practice test course is mapped directly to the official CompTIA PenTest+ ce certification objectives. Every question is built to test your knowledge of the specific sub-topics you will encounter on exam day:

Planning and Scoping (14%)
- Key Topics: Defining testing goals, setting clear rules of engagement, managing expectations, and navigating legal, regulatory, and compliance considerations.
Information Gathering and Vulnerability Scanning (22%)
- Key Topics: Advanced DNS lookups, identifying technical contacts, OSINT techniques (including social media scraping, Shodan, and Recon-ng), thorough enumeration of hosts, services, domains, and users.
Attacks and Exploits (30%)
- Key Topics: Analyzing vulnerability scan results, executing target exploitation techniques (network, wireless, application, and RF), and performing post-exploitation actions like lateral movement and persistence.
Reporting and Communication (18%)
- Key Topics: Drafting comprehensive penetration testing reports, communicating critical findings to technical and non-technical stakeholders, and recommending actionable remediation strategies.
Tools and Code Analysis (16%)
- Key Topics: Utilizing network scanning and packet crafting tools, running specialized vulnerability scanners, using debuggers, working with exploitation frameworks, and analyzing script code (Python, Bash, PowerShell, Ruby).

Course Description

Passing the CompTIA PenTest+ ce certification requires more than just memorizing definitions; you need to understand how to apply penetration testing methodologies under real-world constraints. I designed this comprehensive practice question bank to bridge the gap between theory and the actual exam environment.

When I was preparing for my own advanced security certifications, I realized that the hardest part wasn't understanding the tools—it was analyzing the complex scenarios presented in the questions. That is why I have built these practice tests. They mimic the format, difficulty level, and subtle nuances of the actual CompTIA exam, ensuring you aren't caught off guard by tricky phrasing or multi-layered technical problems.

Every single question in this course comes with a thorough breakdown of the technical concepts involved. I don't just tell you which answer is correct; I explain exactly why the right choice fits the scenario and why the other five options are technically incorrect or sub-optimal for the situation. This approach helps you eliminate weak options quickly on the real exam, saving you valuable time. By working through these realistic scenarios, you will identify your specific weak points in areas like code analysis, script breakdown, and OSINT gathering, allowing you to focus your remaining study time where it matters most.

Practice Questions Preview

Question 1: Information Gathering and Vulnerability Scanning

An analyst needs to discover exposed, unauthenticated IoT devices and industrial control systems across an organization's public IP range during a passive reconnaissance phase. The analyst must avoid sending any direct network traffic or packets to the target infrastructure to prevent detection. Which tool or method is best suited for this task?

Options:
- A) Running an Nmap aggressive scan (nmap -A) against the target IP blocks.
- B) Querying the Shodan search engine database using target organizational filters.
- C) Utilizing Recon-ng to execute a DNS brute-force module against the target domain.
- D) Performing a standard DNS zone transfer request (AXFR) using the dig utility.
- E) Capturing live interface traffic using Wireshark from inside the local network segment.
- F) Executing a web application vulnerability scan using Nikto.
Correct Answer: B) Querying the Shodan search engine database using target organizational filters.
Explanation:
- Why Option B is correct: Shodan continuously crawls the entire internet and indexes banners returned by public-facing devices. Querying Shodan allows you to gather detailed data about exposed devices and open ports passively without ever interacting directly with the target infrastructure.
- Why Option A is incorrect: An Nmap aggressive scan sends thousands of packets directly to the target system, which constitutes active scanning and will easily trigger intrusion detection systems (IDS).
- Why Option C is incorrect: While Recon-ng is an OSINT tool, a DNS brute-force module actively sends queries to the target's authoritative DNS servers, violating the requirement for pure passive reconnaissance.
- Why Option D is incorrect: Performing a zone transfer involves sending a direct request to the target’s name servers. It is an active interaction and is almost always logged by modern systems.
- Why Option E is incorrect: Wireshark captures local network traffic. It will not show you the public-facing exposed infrastructure of a remote target unless you are already positioned inline on their external network.
- Why Option F is incorrect: Nikto is an active web scanner that sends hundreds of HTTP requests directly to a web server to look for vulnerabilities, making it highly noisy and easily detectable.

Question 2: Attacks and Exploits

During a penetration test of a Windows server environment, you successfully exploit a vulnerability and gain local administrator privileges on a target host. Your objective is to perform post-exploitation credential harvesting. To minimize the chance of triggering standard Endpoint Detection and Response (EDR) alerts, you want to avoid common tools like Mimikatz that directly open a handle to lsass.exe. Which native Windows method can be used to achieve this?

Options:
- A) Executing the native reg save command to export the SAM and SYSTEM registry hives.
- B) Using the net user command to force a password reset for the domain administrator account.
- C) Running the default Cobalt Strike Beacon psexec implementation across the subnet.
- D) Utilizing comsvcs.dll via rundll32.exe to create a minidump of the LSASS process memory.
- E) Using WMI to remotely pull cleartext passwords out of the active Active Directory NTDS.dit file.
- F) Replacing the Sticky Keys binary (sethc.exe) with cmd.exe to bypass the login screen.
Correct Answer: D) Utilizing comsvcs.dll via rundll32.exe to create a minidump of the LSASS process memory.
Explanation:
- Why Option D is correct: Utilizing the native, built-in Windows DLL comsvcs.dll via rundll32.exe allows an attacker to dump the memory of lsass.exe to a file using legitimate, signed operating system binaries (Living off the Land). This often bypasses basic EDR signatures that look for known malicious binaries like Mimikatz.
- Why Option A is incorrect: While exporting the SAM and SYSTEM hives is a valid technique, it only provides local account password hashes, not the active domain session credentials or Kerberos tickets held in LSASS memory.
- Why Option B is incorrect: Forcing a password reset is highly disruptive, immediately noticeable to users and administrators, and destroys the existing credentials rather than harvesting them.
- Why Option C is incorrect: Standard psexec creates a service on the remote system and is highly monitored by EDR tools; it is a lateral movement technique, not a stealthy local credential harvesting method.
- Why Option E is incorrect: WMI cannot directly extract cleartext passwords from a live NTDS.dit file on a random member server; the file is locked by the Active Directory process on Domain Controllers.
- Why Option F is incorrect: The Sticky Keys modification is a local persistence mechanism, not a method for harvesting existing active session credentials from memory.

Question 3: Tools and Code Analysis

You are conducting a static code analysis review of an internal automated script written in Python. During your review, you discover the following line of code: os.system("ping -c 1 " + user_input). Which specific vulnerability is present in this script, and which specialized tool should be used to automate the detection of such issues in Python codebases?

Options:
- A) SQL Injection; SQLmap
- B) OS Command Injection; Bandit
- C) Cross-Site Scripting (XSS); OWASP ZAP
- D) Buffer Overflow; GNU Debugger (GDB)
- E) Insecure Deserialization; YARA
- F) Local File Inclusion (LFI); Burp Suite
Correct Answer: B) OS Command Injection; Bandit
Explanation:
- Why Option B is correct: The script directly concatenates unvalidated user input into a system shell command (os.system). If a user inputs shell metacharacters (like ; or &&), they can execute arbitrary operating system commands. Bandit is the industry-standard static application security testing (SAST) tool explicitly designed to find security flaws like this in Python code.
- Why Option A is incorrect: SQL Injection occurs when user input interacts unsafely with a database query, not an operating system shell. SQLmap is an active exploitation tool, not a static code analyzer.
- Why Option C is incorrect: XSS involves injecting malicious scripts into web pages viewed by other users. OWASP ZAP is a Dynamic Application Security Testing (DAST) web proxy scanner, not a static source code analyzer.
- Why Option D is incorrect: Python automatically manages memory allocations, making classic buffer overflows extremely rare in native Python scripts. GDB is a dynamic runtime debugger, not a static scanner.
- Why Option E is incorrect: Insecure deserialization involves untrusted data parsing (like Python pickle). YARA is a tool used for pattern matching and malware signature identification, not for finding structural code flaws.
- Why Option F is incorrect: Local File Inclusion involves reading local files via input paths. Burp Suite is an active web proxy tool used for dynamic testing, not a tool for checking local source code files offline.

Welcome to the Mock Exam Practice Tests Academy to help you prepare for your CompTIA PenTest+ ce Certification course.
You can retake the exams as many times as you want
This is a huge original question bank
You get support from instructors if you have questions
Each question has a detailed explanation
Mobile-compatible with the Udemy app

I hope that by now you're convinced! And there are a lot more questions inside the course.