PenTest Plus Exam Prep Free practice test →

Free PenTest Plus Practice Questions

10 free, exam-style PenTest Plus (PenTest Plus) practice questions with answers and explanations. No signup required. Work through them below, then take the full free PenTest Plus practice test to study every exam domain.

Question 1

During an internal penetration test of an Active Directory environment, a tester uses BloodHound and identifies several service accounts with Service Principal Names (SPNs) registered. The tester requests Kerberos TGS tickets for these accounts without sending any traffic to the service hosts themselves. Which attack is the tester performing?

  1. AS-REP Roasting
  2. Golden Ticket
  3. Kerberoasting
  4. Pass-the-Ticket
Show answer & explanation

Correct answer: C - Kerberoasting

Question 2

A penetration tester runs the following command against a target network: nmap -sS -p- -T4 10.10.10.0/24 -oX results.xml Which of the following BEST describes what this command does?

  1. Performs a full TCP connect scan of the top 1,000 ports and saves output in grepable format
  2. Performs a SYN scan of all 65,535 ports with aggressive timing and saves output in XML format
  3. Performs a UDP scan of all ports with default timing and saves output in XML format
  4. Performs a SYN scan of common ports with insane timing and saves output in normal format
Show answer & explanation

Correct answer: B - Performs a SYN scan of all 65,535 ports with aggressive timing and saves output in XML format

Question 3

A penetration tester submits a single quotation mark (') into a web application's search field and notices the page loads significantly slower than normal but returns no error messages or visible changes in the response content. The tester then submits a payload that causes a 10-second delay using a WAITFOR DELAY statement, which succeeds. Which type of SQL injection has the tester confirmed?

  1. UNION-based SQL injection
  2. Error-based SQL injection
  3. Time-based blind SQL injection
  4. Out-of-band SQL injection
Show answer & explanation

Correct answer: C - Time-based blind SQL injection

Question 4

A penetration tester discovers a Server-Side Request Forgery (SSRF) vulnerability in a web application hosted on an AWS EC2 instance. The tester crafts a request that causes the server to query http://169.254.169.254/latest/meta-data/. What is the tester attempting to retrieve?

  1. IAM role credentials attached to the instance
  2. The EC2 instance's stored S3 backup encryption keys
  3. The AWS root account password hash
  4. CloudTrail audit logs for the account
Show answer & explanation

Correct answer: A - IAM role credentials attached to the instance

Question 5

After running an authenticated vulnerability scan against a web server, the scanner reports a critical remote code execution vulnerability. The penetration tester manually attempts to exploit the finding using the exact CVE referenced but confirms that the server has already been patched. Which term BEST describes this scanner result?

  1. True positive
  2. True negative
  3. False negative
  4. False positive
Show answer & explanation

Correct answer: D - False positive

Question 6

A penetration tester has gained initial access to a Linux host inside a corporate network. The host's firewall blocks all inbound connections but allows outbound HTTP traffic. Which method should the tester use to establish an interactive shell?

  1. Start a bind shell listener on the compromised host
  2. Use a reverse shell that connects back to the tester's external listener
  3. Open an SSH server on the compromised host and connect from the attack machine
  4. Deploy a netcat listener on an unused port above 1024 on the target
Show answer & explanation

Correct answer: B - Use a reverse shell that connects back to the tester's external listener

Question 7

During the reconnaissance phase, a penetration tester queries certificate transparency logs, reviews the target's job postings on LinkedIn, and searches cached pages using the Wayback Machine. The tester has NOT sent any packets directly to the target's infrastructure. Which type of reconnaissance is being performed?

  1. Passive reconnaissance
  2. Active reconnaissance
  3. Vulnerability scanning
  4. Enumeration
Show answer & explanation

Correct answer: A - Passive reconnaissance

Question 8

After completing a penetration test, a tester documents a step-by-step account of how an initial phishing email led to credential capture, lateral movement through SMB relay, and ultimately domain administrator access by exploiting a misconfigured certificate template. In which section of the final report does this documentation belong?

  1. Executive summary
  2. Methodology
  3. Detailed findings
  4. Attack narrative
Show answer & explanation

Correct answer: D - Attack narrative

Question 9

A penetration tester gains standard user access on a Windows 10 workstation and runs the command: wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" The output reveals a service with the path C:\Program Files\Internal App\update service\svc.exe running as SYSTEM. What should the tester attempt next?

  1. Modify the Windows registry Run key to add a payload that executes at user login
  2. Inject a malicious DLL into the svc.exe process while it is actively running in memory
  3. Extract stored credentials from the LSASS process memory using Mimikatz
  4. Place a malicious executable at C:\Program.exe to exploit the unquoted path
Show answer & explanation

Correct answer: D - Place a malicious executable at C:\Program.exe to exploit the unquoted path

Question 10

A penetration tester compromises a dual-homed server that has one interface on the DMZ (10.0.1.0/24) and another on an internal network segment (192.168.50.0/24) not reachable from the tester's attack machine. The tester needs to run Nmap scans against hosts on the internal segment. Which approach is MOST appropriate?

  1. Perform an ARP scan from the tester's machine targeting the 192.168.50.0/24 range directly
  2. Use Responder on the compromised server to passively capture internal NTLM hashes
  3. Configure an SSH SOCKS proxy through the compromised host and route scans via Proxychains
  4. Install a standalone Nmap binary directly on the compromised server and scan from there
Show answer & explanation

Correct answer: C - Configure an SSH SOCKS proxy through the compromised host and route scans via Proxychains

Ready for the real thing?

Practice hundreds more PenTest Plus questions with instant scoring, weak-area drills, and full exam simulations.

Start the free practice test See pricing