1500 Questions | CompTIA PenTest+ Certification 2026

Domain 2: Scanning and Vulnerability Identification (15%): Learn to use industry-standard tools for vulnerability analysis and prioritize findings based on potential impact.

Domain 3: Exploitation of Vulnerabilities (15%): Gain expertise in executing attacks against network, wireless, application, and RF-based vulnerabilities.

Domain 4: Post-Exploitation (15%): Understand how to maintain persistence, perform lateral movement, and determine the business impact of a breach.

Domain 5: Defense Bypass (10%): Identify and circumvent security controls like firewalls, IDS/IPS, and sandboxes using specialized techniques.

Domain 6: Post-Penetration Test (35%): Focus on the most weighted part of the exam—reporting, communication of findings, and recommending effective remediation strategies.

B. nmap -sU 192.168.1.0/24

C. nmap -sS 192.168.1.0/24

D. nmap -sV 192.168.1.0/24

E. nmap -O 192.168.1.0/24

F. nmap -Pn 192.168.1.0/24

Correct Answer: C

Explanation:

A (Incorrect): -sT is a TCP Connect scan which completes the full three-way handshake and is much noisier.

B (Incorrect): -sU is used for scanning UDP ports, not for stealthy TCP host discovery.

D (Incorrect): -sV is used for service version detection, which occurs after host discovery.

E (Incorrect): -O is used for OS fingerprinting and does not determine the "stealthiness" of the initial scan.

F (Incorrect): -Pn skips the host discovery (ping) phase and treats all hosts as online; it doesn't define the scan type itself.

Question 2: While reviewing a web application, I find that I can input <script>alert('XSS')</script> into a comment field, and it executes in the browser of anyone viewing the page. What type of vulnerability is this?

B. DOM-based XSS

C. Stored XSS

D. Cross-Site Request Forgery (CSRF)

E. SQL Injection

F. Insecure Direct Object Reference (IDOR)

Correct Answer: C

Explanation:

A (Incorrect): Reflected XSS occurs when the script is "reflected" off a web server in a URL or search result, not saved permanently.

B (Incorrect): DOM-based XSS happens entirely on the client-side within the Document Object Model.

D (Incorrect): CSRF involves tricking a user into performing an unwanted action on a different site where they are authenticated.

E (Incorrect): SQL Injection targets the database logic, not the execution of scripts in a browser.

F (Incorrect): IDOR occurs when a user can access unauthorized resources by changing a parameter (like a UserID).

Question 3: I am in the post-exploitation phase and need to ensure my access survives a system reboot. Which of the following is a common technique for achieving persistence on a Windows target?

B. Modifying the Registry "Run" keys

C. Using whoami to check privileges

D. Clearing the Windows Event Logs

E. Performing a pass-the-hash attack

F. Mapping a network drive

Correct Answer: B

Explanation:

A (Incorrect): ipconfig is a reconnaissance/info-gathering command, not a persistence mechanism.

C (Incorrect): whoami is used for situational awareness regarding current permissions.

D (Incorrect): Clearing logs is part of "covering tracks," but it does not help maintain access after a reboot.

E (Incorrect): Pass-the-hash is a lateral movement technique, not a persistence method.

F (Incorrect): Mapping a drive is for data exfiltration or access, but doesn't guarantee the shell returns after a restart.

You can retake the exams as many times as you want.

This is a huge original question bank.

You get support from instructors if you have questions.

Each question has a detailed explanation.

Mobile-compatible with the Udemy app.

30-days money-back guarantee if you're not satisfied.