PenTest+ Post-exploitation and Lateral practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About
Try 20 questions free →

PenTest+ Post-exploitation and Lateral Movement: 122 practice questions

PenTest+ 122 questions 12 shown free

12 of the 122 Post-exploitation and Lateral Movement questions in the Certsqill PenTest+ bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for PenTest+? Take the free 5-min readiness check →

1. The route supports pivoting to another reachable resource: What is the strongest supported conclusion?

Easy
In a software delivery lab, evidence shows a low-privilege account on runner.training.local can reach build.training.local through an approved route. No new rights were granted, no persistence mechanism was observed, and the same account remains restricted. What is the strongest supported conclusion?
  1. Data exfiltration was confirmed.
    Reachability does not show that data was collected or transferred to any destination.
  2. The route supports pivoting to another reachable resource. ✓
    Pivoting uses an accessible host or route to reach another resource without requiring privilege escalation.
  3. Privilege escalation occurred.
    The account retained the same restricted rights, so increased privilege was not demonstrated.
  4. Persistence was established across restart or credential changes.
    No mechanism showing survival across restart or credential events was observed.
The trap
Infers data movement from network-path availability. Confuses access to another host with greater local privilege. Mistakes current connectivity for persistence.

The evidence supports pivoting or lateral reachability, not escalation, persistence, or confirmed exfiltration.

2. Remove LabValidation and preserve logs: What should the assessor do next?

Easy
During a client-provided evidence review, the assessor confirms that the only scheduled task created for testing is LabValidation. The client requires audit logs to remain intact, and the agreed cleanup window is open. What should the assessor do next?
  1. Disable the entire Task Scheduler service.
    Disabling the service could disrupt legitimate workloads and is broader than removing the test task.
  2. Delete all scheduled tasks.
    Broad deletion could remove legitimate client tasks and exceeds the required cleanup.
  3. Remove LabValidation and preserve logs. ✓
    The assessor should remove the testing artifact while preserving audit evidence.
  4. Delete audit logs recording the task creation event.
    Audit logs are evidence and must remain intact under the stated requirement.
The trap
Removes artifacts beyond the assessor's own change. Uses an unnecessarily disruptive cleanup action. Confuses artifact cleanup with destruction of security records.

Remove only the assessor-created task and preserve the audit logs.

3. Scheduled task: Which root cause best explains the artifact?

Hard
During an authorized assessment of fictional host app-stg, the evidence identifies a Windows Task Scheduler entry configured to launch a validation script at system startup. No outbound connection, extra account, or privilege change was observed. Which root cause best explains the artifact?
  1. Scheduled task ✓
    The identified Task Scheduler entry directly explains execution triggered at system startup.
  2. Startup-folder entry with a user logon trigger
    A startup-folder entry explains execution at user logon, not the explicitly identified Task Scheduler entry at system startup.
  3. Startup service
    A service can provide startup execution, but the evidence specifically identifies a Task Scheduler entry rather than a service.
  4. Registry autorun
    A registry autorun can trigger startup execution, but it does not explain the identified scheduled-task artifact.
The trap
Chooses another persistence mechanism despite direct artifact identification. Confuses similar persistence mechanisms. Matches a nearby trigger but not the observed mechanism.

The identified Task Scheduler entry explains the startup-triggered execution.

4. Use tar, then gzip, then adb pull: Which command sequence best matches the requirement?

Hard
In an authorized mobile-device assessment, multiple approved synthetic files are already present on device m-test-07. They must be combined into one archive, compressed locally on that device, and only the resulting archive may be transferred to the analyst workstation. Confidentiality is not required. Which command sequence best matches the requirement?
  1. Use adb pull.
    adb pull transfers files but does not archive or compress the multiple source files.
  2. Use gzip, then adb pull.
    gzip compresses data but does not combine multiple files into the required archive.
  3. Use tar, then gzip, then adb pull. ✓
    tar combines the approved files, gzip compresses the archive locally on the device, and adb pull transfers only that resulting archive.
  4. Use tar, then adb pull.
    tar creates one archive and adb pull transfers it, but the sequence omits the required compression.
The trap
Provides transfer without preparation. Omits compression. Confuses compression with archival.

Create the archive with tar, compress it with gzip, then transfer it with adb pull.

5. A valid authorized account: What prerequisite is missing?

Medium
During an approved internal assessment, a tester can route through jump-stg to a fictitious server but receives an authorization failure. The route is confirmed; no service credentials were supplied.

Exhibit:route: jump-stg -> 10.40.5.20 TCP/5985: reachable WinRM response: access denied credential set: noneWhat prerequisite is missing?
  1. A valid authorized account ✓
    Routing reaches the service, but authentication and permissions still require valid authorized credentials.
  2. A different destination address
    The supplied destination responds on the expected port, so changing addresses does not address access denial.
  3. A second proxy protocol
    A second proxy is unnecessary when the target service is already reachable through the confirmed route.
  4. Another network route
    The exhibit confirms a working route and reachable service, so an additional path is not the missing prerequisite.
The trap
Misreads authorization failure as addressing failure Repeats a prerequisite already demonstrated Confuses path access with identity

The route works; valid authorized credentials are required before the reachable WinRM service can authenticate.

6. Restore the agreed firewall baseline: What control should be recommended?

Medium
During an authorized office assessment, the team added a temporary inbound firewall rule to fictitious host office-stg. The agreed test window has ended, and the rule is not part of the baseline. What control should be recommended?
  1. Hash the temporary rule.
    Hashing can support integrity comparison but does not restore the firewall’s intended access control.
  2. Restore the agreed firewall baseline. ✓
    Removing the temporary rule and verifying the agreed baseline addresses the residual exposure without deleting audit evidence.
  3. Create a second inbound rule.
    Adding another rule could broaden exposure and does not restore the agreed configuration.
  4. Delete the firewall audit logs.
    Audit logs should be preserved; deleting them removes evidence without correcting the exposed rule.
The trap
Confuses cleanup with evidence destruction Treats integrity evidence as remediation Adds configuration instead of correcting it

Restore and verify the agreed firewall baseline, while preserving audit records and documenting residual artifacts.

7. The service may provide persistence: What conclusion is best supported?

Medium
In a retail test environment, a service on fictitious host store-stg starts automatically and launches a script from a writable application directory. No command-and-control traffic or account creation was observed. What conclusion is best supported?
  1. Reverse connection occurred.
    No outbound command-and-control traffic was observed, so a reverse connection is unsupported.
  2. The service is a confirmed malicious implant.
    Automatic startup and a writable path warrant investigation but do not prove malicious intent by themselves.
  3. Lateral movement occurred.
    The evidence does not show access to another host or resource, which is required to conclude lateral movement.
  4. The service may provide persistence. ✓
    Automatic service startup can maintain execution across restarts, while the evidence does not establish maliciousness.
The trap
Invents network behavior absent from the observation Infers movement without a second resource Treats a suspicious artifact as conclusive proof

Automatic service startup supports possible persistence, but does not prove malicious intent or movement.

8. Compress, then encrypt: Which operation sequence is appropriate?

Medium
In a software-delivery lab, the team must prepare an approved synthetic archive for transfer while reducing its size and protecting its contents. Which operation sequence is appropriate?
  1. Encrypt only.
    Encryption protects content but does not satisfy the explicit requirement to reduce transfer size.
  2. Embed the archive in an image.
    Steganography conceals data within cover media but does not inherently compress or encrypt its contents.
  3. Compress only.
    Compression reduces size but leaves the archive’s contents unprotected from disclosure.
  4. Compress, then encrypt. ✓
    Compression reduces size, and encryption subsequently protects the archive’s contents during approved handling.
The trap
Confuses concealment with protection Confuses confidentiality with compression Confuses size reduction with confidentiality

Compression addresses size, and encryption separately addresses confidentiality for the approved synthetic archive.

9. WinRM reachable: What conclusion is strongest?

Hard
In an approved wireless test network, a tester examined fictitious host win-stg after a permitted connection attempt.

Exhibit:TCP/5985: open WinRM service response: HTTP 401 Unauthorized TCP/135: no response WMI execution result: not obtainedWhat conclusion is strongest?
  1. No remote service exists.
    The open port and WinRM response directly contradict the conclusion that remote management is absent.
  2. WMI remote execution succeeded.
    TCP/135 provided no response and no WMI result was obtained, so successful WMI execution is unsupported.
  3. WinRM reachable; auth unproven. ✓
    The open WinRM port and 401 response support reachability while showing that authentication was not established.
  4. A lateral path is proven.
    Reachability and an authentication challenge do not prove successful authentication, execution, or access to another resource.
The trap
Ignores direct service evidence Overstates evidence from service exposure Treats an unperformed action as successful

The evidence supports WinRM reachability and an authentication challenge, not successful execution or lateral movement.

10. Test revoked sign-in: What should the team do next?

Easy
In a synthetic cloud tenant, the assessment team revoked a test credential after validation. Only bounded checks using synthetic identities are permitted, and the client requires evidence that revocation took effect. What should the team do next?
  1. Test revoked sign-in; review its audit event. ✓
    A bounded synthetic sign-in attempt and its audit event directly verify that revocation took effect.
  2. Test the revoked credential against a production identity provider for confirmation.
    Production testing exceeds the synthetic-tenant boundary and is unnecessary for this validation.
  3. Delete the tenant audit logs after the credential test to remove temporary evidence.
    Deleting logs destroys evidence and does not validate the credential's authentication status.
  4. Rotate an unrelated tenant key and review its resulting audit record.
    An unrelated key does not test whether the revoked credential can still authenticate.
The trap
Performs unrelated remediation Expands testing beyond the approved environment Confuses cleanup with verification

Attempt a permitted synthetic sign-in and review its audit event.

11. A registry autorun entry triggering at login: Which root cause is most supported?

Medium
During an authorized review of nonproduction host svc-stg, the team found a value under the current user’s Run registry key that launches a script at login. No scheduled task, service change, or outbound connection was observed. Which root cause is most supported?
  1. A service-based pivot to another host.
    The observation shows local login execution, not service execution or access to another host.
  2. A scheduled task mechanism.
    No scheduled task was observed; the supplied artifact is a registry Run-key value.
  3. A reverse shell maintaining an outbound session.
    No outbound connection was observed, so the evidence does not support a reverse shell.
  4. A registry autorun entry triggering at login. ✓
    A Run-key value that launches code at login is a registry autorun mechanism and may provide persistence.
The trap
Substitutes another persistence mechanism. Combines unrelated execution and movement concepts. Infers network behavior without network evidence.

The login-triggered Run-key value identifies a registry autorun artifact and possible persistence mechanism.

12. Embed it with steghide: Which tool or method best fits?

Medium
During an approved internal assessment, the team must place an approved synthetic canary inside an image so observers cannot readily see that data is present. The requirement is concealment within cover media, not merely protecting readable contents. Which tool or method best fits?
  1. Encrypt the canary with OpenSSL before placing it in the image.
    Encryption protects contents but does not inherently conceal that data exists in the image.
  2. Use Base64 encoding.
    Base64 represents data as text and does not conceal it within an image.
  3. Embed it with steghide. ✓
    Steghide embeds data within cover media, matching the concealment requirement.
  4. Use gzip compression to reduce its size.
    Compression changes representation and size but does not hide data within cover media.
The trap
Mistakes encoding for concealment. Confuses reduced size with hidden presence. Confuses content protection with concealment.

Steghide provides steganographic concealment within image cover media.

110 more Post-exploitation and Lateral Movement questions

The remaining 110 questions in this domain are part of the full PenTest+ bank — 870 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your PenTest+ readiness — free

Other PenTest+ domains

Part of the Certsqill PenTest+ question bank · Post-exploitation and Lateral Movement · Every answer, right and wrong, comes with its own explanation.