PenTest+ Attacks and Exploits: 304 practice questions

12 of the 304 Attacks and Exploits questions in the Certsqill PenTest+ bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for PenTest+? Take the free 5-min readiness check →

1. CVSS shows technical severity: Which conclusion best interprets the evidence?

1. The finding automatically outranks every issue with a lower score.

   Risk prioritization cannot be determined by CVSS alone; contextual exposure and business consequences also matter.
2. No public route makes the issue harmless.

   Isolation may reduce exposure but does not eliminate internal reachability, compromise paths, or technical severity.
3. The score proves active exploitation of the database host.

   A CVSS score does not provide evidence that exploitation is occurring.
4. CVSS shows technical severity; context determines risk. ✓

   CVSS describes technical severity, while practical priority also depends on reachability, controls, asset importance, exploit conditions, and impact.

CVSS indicates technical severity; context determines practical risk and priority.

2. Classify it as vishing and verify reporting: What is the next bounded validation step?

1. Collect credentials through a simulated login page.

   Credential collection is outside the stated measurement and is unnecessary for validating reporting behavior.
2. Test the same scenario through SMS.

   SMS would test smishing, a different delivery channel, rather than validate the observed voice scenario.
3. Call it spearphishing because named participants were targeted.

   Targeting may be specific, but the defining channel in this observation is voice, not email or messaging.
4. Classify it as vishing and verify reporting. ✓

   A phishing attempt delivered by voice is vishing. Reporting can be checked within the approved cohort without collecting credentials.

Classify the voice attempt as vishing and verify reporting within the approved cohort.

3. Validate inventory: What conclusion is currently supported?

1. The network is vulnerable to WPS PIN attacks because the BSSID differs.

   The observation provides no evidence about WPS configuration or PIN weakness.
2. The access point is confirmed as an evil twin.

   A different BSSID is suspicious, but it does not alone prove impersonation.
3. Validate inventory, certificates, and authentication behavior. ✓

   The unusual BSSID warrants corroboration through expected inventory and additional wireless evidence before assigning root cause.
4. The matching SSID proves authorized roaming.

   An SSID does not establish ownership, authorization, certificate validity, or intended roaming configuration.

Corroborate the unusual BSSID with inventory, certificates, and authentication behavior.

4. Require IMDSv2 session tokens for metadata requests: Which AWS mechanism best matches that requirement?

1. Scan the container image with Trivy for vulnerable packages.

   Trivy analyzes image contents; it does not require metadata session tokens or change instance metadata behavior.
2. Require IMDSv2 session tokens for metadata requests. ✓

   Requiring IMDSv2 tokens helps mitigate certain SSRF paths that cannot obtain the required session token.
3. Add an IAM trust policy allowing the workload role to assume itself.

   Trust policies govern who may assume roles and do not require IMDSv2 tokens for metadata requests.
4. Apply Kubernetes NetworkPolicy to the workload namespace.

   NetworkPolicy governs selected pod traffic and does not configure AWS instance metadata authentication requirements.

IMDSv2 token requirements directly address the stated metadata request control, though they do not remove all workload risks.

5. 5: What integer does it print?

1. 6

   Six incorrectly counts every input value, including nine, which fails the less-than-seven condition.
2. 4

   Four is incorrect because five values are less than seven, including both occurrences of three.
3. 5 ✓

   The qualifying values are 4, 3, 6, 3, and 1, so the selected list length is five.
4. 3

   Three incorrectly counts distinct qualifying values or duplicates inconsistently; list filtering preserves both threes.

Five list elements satisfy the less-than-seven condition, so Python prints 5.

6. Use parameterized queries and least-privileged database: Which control best addresses the potential SQL inject

1. Add a WAF rule matching the observed database error.

   A WAF rule can provide defense in depth, but it does not remove unsafe query construction in application code.
2. Increase database privileges so failed searches complete successfully.

   Additional privileges increase potential impact and do not prevent attacker-controlled input from altering SQL structure.
3. Suppress detailed database errors.

   Generic error handling reduces information disclosure but does not correct unsafe query construction.
4. Use parameterized queries and least-privileged database access. ✓

   Parameterized queries separate data from SQL syntax, while least privilege limits impact if another defect remains.

Use parameterized queries and least privilege; a database error alone does not confirm injection.

7. The service directory presents a possible privileged: What conclusion is best supported?

1. The service directory presents a possible privileged binary-replacement condition requiring validation. ✓

   Modify access to the service's directory may permit replacement or manipulation of its executable before privileged execution, but the exact file permissions, service restart behavior, and replacement feasibility still require validation.
2. The finding is lateral movement because the service executes with LocalSystem privileges on the Windows host.

   This is a possible local privilege-escalation condition; no second host or external resource is identified.
3. This proves exploitation.

   The evidence shows permissions and execution context, not that an unauthorized binary was placed or executed.
4. No issue exists.

   The service directory is writable by standard users while the service executes with LocalSystem privileges, so a potential privileged service-binary replacement condition exists.

Writable service-directory permissions and privileged execution support a possible service-binary replacement risk, not confirmed exploitation or lateral movement.

8. Brute force concentrates many candidate guesses on one: Which TWO descriptions correctly distinguish password

Select two. More than one option is correct — every correct one is ticked below.

1. Credential stuffing tests reused username-password pairs from another breach.

   Credential stuffing reuses known pairs, whereas spraying and brute force generate or select guesses.
2. Offline hash cracking is the usual definition of password spraying.

   Password spraying commonly targets online authentication; offline hash guessing is a separate technique without online lockout behavior.
3. Brute force concentrates many candidate guesses on one account. ✓

   Brute force systematically tries numerous candidates against one account or a focused account set.
4. Password spraying distributes a few common guesses across many accounts. ✓

   Spraying limits repeated attempts against each account by distributing common-password guesses across many accounts.
5. Brute force uses one fixed password across many accounts.

   Using one or a few passwords across many accounts describes spraying, not concentrated candidate generation.

Spraying spreads a few guesses across accounts; brute force concentrates many guesses on an account.

9. The evidence does not establish plaintext recovery: What TWO conclusions are supported?

Select two. More than one option is correct — every correct one is ticked below.

1. The evidence does not establish plaintext recovery by cracking. ✓

   The capture explicitly records no password recovery, and relay forwards authentication rather than cracking it.
2. SMB signing prevents relay because NTLM is enabled.

   Disabled signing removes an important SMB integrity control; NTLM enablement does not prevent relay.
3. The evidence supports assessing NTLM relay exposure to SMB. ✓

   A live NTLM exchange plus an SMB target without signing supports relay exposure assessment.
4. The evidence proves the captured material can be cracked into plaintext.

   A live relay observation does not establish offline password recovery or plaintext cracking success.
5. The observation proves pass-the-ticket using Kerberos credentials.

   The record identifies NTLM authentication, not Kerberos tickets or ticket reuse.

The capture supports SMB NTLM relay assessment, while explicitly providing no evidence of password cracking or plaintext recovery.

10. Review the debug APK with MobSF for local-storage: Which TWO next steps are best?

Select two. More than one option is correct — every correct one is ticked below.

1. Instrument runtime behavior with Frida before examining the application package.

   Frida is a legitimate runtime-analysis tool, but the stated objective can first be addressed through static review and approved collection without requiring runtime instrumentation.
2. Use WiGLE to survey wireless networks.

   WiGLE supports wireless-network observations and cannot determine how an Android application stores local values.
3. Root the device before reviewing application storage.

   Rooting changes device controls and is unnecessary when the approved debug build and authorized ADB connection support bounded inspection.
4. Review the debug APK with MobSF for local-storage indicators. ✓

   MobSF supports static mobile-application analysis, including review of permissions, code, and indicators of local-storage handling.
5. Collect approved synthetic app data with ADB for local inspection. ✓

   With an authorized debugging connection and synthetic records, ADB can support bounded collection from the test application for local inspection.

Use MobSF for static review and ADB for bounded inspection of synthetic debug-build data.

11. The absent security update is the root cause: Which statement identifies the stated root cause?

1. EPSS 0.31 proves exploitation occurred.

   EPSS estimates near-term exploitation likelihood; it does not prove that exploitation occurred.
2. The absent security update is the root cause. ✓

   The evidence directly identifies the missing update as the cause of the component remaining vulnerable.
3. Internet reachability caused the update to be missing.

   Reachability affects exposure and risk, but it does not explain why the update is absent.
4. The CVE identifier created the weakness.

   A CVE identifies a published vulnerability; it does not create the underlying weakness.

The missing update is the stated root cause; EPSS estimates exploitation likelihood.

12. Gophish for a controlled email simulation: Which tool best matches the explicit requirement?

1. SET for a broader social-engineering exercise.

   SET can support social-engineering simulations, but Gophish more directly matches the specified email campaign, tracking, and landing-page workflow.
2. Gophish for a controlled email simulation. ✓

   Gophish is designed to orchestrate authorized phishing simulations with recipients, tracking, and landing pages without requiring credential collection.
3. Maltego

   Maltego supports relationship and reconnaissance analysis rather than controlled email-campaign orchestration.
4. BeEF for browser-focused assessment.

   BeEF assesses browser behavior and does not primarily provide the requested email campaign workflow.

Gophish directly supports controlled email simulations with tracking and harmless landing pages.

Other PenTest+ domains

• Reconnaissance and Enumeration — 183 questions →
• Vulnerability Discovery and Analysis — 148 questions →
• Post-exploitation and Lateral Movement — 122 questions →
• Engagement Management — 113 questions →
• All 870 PenTest+ questions →
• PenTest+ certification: requirements, cost and exam format →