Free CompTIA PenTest+ practice questions

Sample question 1. During authorized subdomain enumeration, every candidate name from a wordlist appears to resolve, and all of them return the same address. What is the MOST likely explanation, and how should the tester handle the results?

1. The zone has a wildcard record; resolve a random name that cannot exist and discard results matching that answer.
2. The client hosts every one of those subdomains on one shared server, so each should be scoped and tested as a separate site.
3. The tester’s own DNS resolver is faulty, so enumeration of this domain should be abandoned.
4. An intrusion prevention system is actively blocking the scan, so the tester should slow the query rate.

Sample question 2. A tester plans an authenticated dynamic scan of a production HR application using a real test account. The application has pages that delete employee records, send emails to staff and log the user out. The client wants broad coverage without disrupting the business. How should the tester configure the scan?

1. Run the scanner’s default crawl and audit policy so every page is exercised
2. Run it unauthenticated only, so that no dangerous function can be reached
3. Exclude logout and destructive actions, and prefer a staging copy if one exists
4. Run the full default scan overnight, when few HR staff are using the system

Sample question 3. An internal test is ending. During it, the team created two test accounts, uploaded a small helper tool to three servers and added a scheduled task on one host. Which close-out action is MOST appropriate?

1. Remove every account, file and task the team created, verify removal, and list anything that could not be removed in the report.
2. Leave the items in place so the client’s administrators can study them and learn how they were used.
3. Ask the client to reimage the affected servers, since that is the only reliable way to remove test artifacts.
4. Disable the two test accounts but keep the tool and task, since those cannot be used without an account.