PenTest+ Engagement Management: 113 practice questions

12 of the 113 Engagement Management questions in the Certsqill PenTest+ bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for PenTest+? Take the free 5-min readiness check →

1. Stop and escalate: What should the tester do next?

1. Continue because the training network is isolated.

   Network isolation does not expand the authorized target list or remove the documented escalation requirement.
2. Request an informal scope expansion and continue.

   An informal change does not alter the written boundary, and continuing would compound the breach.
3. Stop and escalate. ✓

   The request reached an excluded host and returned records, confirming a scope breach that requires stopping and escalating.
4. Record the event as an unverified scan artifact.

   An HTTP 200 response containing records confirms more than an unverified connection or scan artifact.

Stop, preserve the evidence, and follow the defined scope-breach escalation path.

2. Validate the approved read: What is the next bounded validation step?

1. Query every attribute with an administrative account.

   Administrative, broad attribute retrieval exceeds the read-only and least-necessary scope.
2. Validate the approved read. ✓

   A focused read-only LDAP check within lab.example validates the observation without touching excluded tenants or accounts.
3. Enumerate all reachable directory tenants.

   Tenant-wide enumeration would cross the explicit sibling-tenant exclusion.
4. Test authentication against production accounts.

   Authentication testing against production accounts is outside the stated target and read-only limits.

Use the narrowest read-only LDAP query within the approved namespace.

3. The shared PSK prevents reliable individual identity: Select TWO supported statements.

Select two. More than one option is correct — every correct one is ticked below.

1. The wireless network has no encryption configured at all.

   WPA2-PSK indicates configured wireless encryption; the evidence concerns shared authentication and client separation.
2. The shared PSK prevents reliable individual identity and accountability. ✓

   A single shared secret prevents distinct user identities and accountability at the wireless-authentication layer.
3. Every device using the wireless network was compromised during the assessment.

   The evidence demonstrates shared access and communication, not compromise or control of every device.
4. Direct client communication shows that isolation between the user groups is insufficient. ✓

   Direct client-to-client communication across the groups supports inadequate client isolation as a contributing cause.
5. A firmware defect in the access points caused the cross-group exposure.

   No firmware evidence is provided, so firmware cannot be identified as the supported root cause.

The evidence supports shared-credential identity reuse and inadequate client isolation.

4. Use ATT&CK Navigator: Which tool best matches this requirement?

1. Use ATT&CK Navigator. ✓

   ATT&CK Navigator is designed to organize and present tactic and technique mappings without exploiting the tenant or changing its configuration.
2. Discover services with Nmap.

   Nmap is a network-discovery and service-scanning tool, not an ATT&CK tactic-and-technique mapping tool.
3. Exploit the tenant with Metasploit.

   Metasploit is an exploitation framework and does not directly map observed behavior to ATT&CK tactics and techniques.
4. Inspect the behavior through OWASP ZAP.

   ZAP is a web-application proxy and testing tool; it does not provide the required ATT&CK mapping workflow.

ATT&CK Navigator directly supports organizing observed behavior by ATT&CK tactics and techniques.

5. Confirm driver support for bound parameters: What prerequisite should be confirmed before implementing the fix

1. Retain concatenation behind a firewall.

   A firewall does not correct the application’s unsafe query-construction logic or prevent injection through an allowed request.
2. Use a longer random identifier format.

   Changing identifier format does not prevent SQL interpretation when the value remains concatenated into the query.
3. Patch the database.

   Database patching may be useful but does not establish an application mechanism for separating values from SQL structure.
4. Confirm driver support for bound parameters. ✓

   The driver and API must support binding values separately from the SQL statement so input is not concatenated into query text.

Confirm that the database driver and API support bound parameters.

6. Require peer review: Which control directly addresses the situation?

1. Ask the application owner to approve the severity rating.

   Client approval does not replace qualified independent review of the tester’s evidence and reasoning.
2. Require peer review. ✓

   Independent peer review verifies the evidence, reproduction, severity, and limitations before delivery.
3. Run an automated scanner against staging and attach its output.

   Scanner output may provide additional evidence but does not independently review the authorization finding or report rationale.
4. Have the original tester expand the reproduction steps.

   More detail from the same tester does not provide the required independent verification.

Independent peer review directly verifies the finding before delivery.

7. Stop testing and obtain an approved window extension: What should the tester do?

1. Stop testing and obtain an approved window extension. ✓

   Testing must stop outside the authorized window until the agreed extension or a new approved window is documented.
2. Continue after logging the timestamp.

   Logging the event does not authorize activity outside the approved testing window.
3. Resume after the next routine status update.

   A status update is not an approved change to the execution window.
4. Ask the device owner for an informal confirmation, then continue testing.

   Informal confirmation from the device owner does not replace the engagement’s documented extension process.

Stop outside the approved window and obtain a documented extension before resuming.

8. Scope, methods, tools, dates, assumptions, and limitations: Which content best fits that section?

1. Scope, methods, tools, dates, assumptions, and limitations. ✓

   These details describe the assessment process, boundaries, and constraints needed to interpret the results.
2. Test dates, scope, and findings.

   Dates and scope may belong in methodology, but findings are results rather than a description of the testing approach and limitations.
3. Finding owners, due dates, acceptance decisions, and retest outcomes.

   These items support remediation tracking and follow-up rather than explaining the original test method and coverage limits.
4. Business impact, risk ratings, and remediation priorities.

   These are primarily findings and recommendations content, not the core record of how testing was performed.

Methodology documents scope, timing, methods, tools, assumptions, and limitations.

9. Authorized reconnaissance and enumeration are complete: Which conclusion is best supported by the exhibit?

1. Exploitation must begin because authorization, reconnaissance, and enumeration are complete.

   The record documents authorization and completed activities, but it does not require beginning exploitation or establish that all execution preconditions are satisfied.
2. Authorized reconnaissance and enumeration are complete; exploitation was not performed. ✓

   The exhibit records signed rules, completed reconnaissance and enumeration, and explicitly states that no exploitation commands were executed.
3. Only passive reconnaissance completed.

   Service enumeration is also recorded as completed, so this understates the observed activity.
4. The directory service is secure because exploitation was not performed.

   Unperformed exploitation cannot establish that the service is secure or free of vulnerabilities.

Reconnaissance and enumeration were completed, but exploitation was not performed.

10. Use a harmless marker to verify attribute-context encoding: What is the next bounded validation step?

1. Inspect only the rendered page after browser processing.

   Rendered output alone may hide the raw response behavior and does not verify context-appropriate server-side encoding.
2. Use a harmless marker to verify attribute-context encoding. ✓

   A controlled marker can confirm whether output is encoded correctly for the specific HTML attribute context without unnecessary impact.
3. Deploy persistent script code and capture wireless users’ session tokens.

   This exceeds bounded validation, creates unnecessary impact, and seeks sensitive session data without a demonstrated need.
4. Rely on browser filtering.

   Browser filtering is not a reliable substitute for verifying server-side encoding appropriate to the output context.

Use a harmless marker to verify encoding for the HTML attribute context.

11. Insufficient stakeholder alignment on test assumptions: What is the stated root cause?

1. An unreliable vulnerability scanner produced inconsistent results

   The evidence attributes disagreement to human assumptions and role definitions, not scanner reliability or detection accuracy.
2. The staging API is inherently unsuitable for security testing

   The signed scope explicitly authorizes staging API testing, so environment suitability is not the demonstrated problem.
3. Insufficient stakeholder alignment on test assumptions and roles ✓

   The conflicting role assumptions show stakeholders did not align on test conditions and expected access boundaries.
4. Production data was improperly included in the assessment

   The scenario identifies inconsistent role assumptions, without evidence that production data entered the authorized test.

Unaligned assumptions about roles and test conditions caused the inconsistent results.

12. Rules of Engagement: Which artifact is the best match?

1. Statement of Work and deliverables schedule

   A Statement of Work defines work and deliverables, but execution constraints belong in the Rules of Engagement.
2. Master Services Agreement governing the business relationship

   An MSA establishes overarching contractual terms, not the detailed operational controls for a particular assessment.
3. Rules of Engagement ✓

   Rules of Engagement define execution windows, methods, escalation paths, exclusions, and stop conditions for authorized testing.
4. NDA

   An NDA governs confidentiality, not operational windows, escalation procedures, or technical stop conditions during testing.

Rules of Engagement capture operational windows, escalation, methods, exclusions, and stop conditions.

Other PenTest+ domains

• Attacks and Exploits — 304 questions →
• Reconnaissance and Enumeration — 183 questions →
• Vulnerability Discovery and Analysis — 148 questions →
• Post-exploitation and Lateral Movement — 122 questions →
• All 870 PenTest+ questions →
• PenTest+ certification: requirements, cost and exam format →