PenTest+ Vulnerability Discovery practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About
Try 20 questions free →

PenTest+ Vulnerability Discovery and Analysis: 148 practice questions

PenTest+ 148 questions 12 shown free

12 of the 148 Vulnerability Discovery and Analysis questions in the Certsqill PenTest+ bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for PenTest+? Take the free 5-min readiness check →

1. The finding is not confirmed: What is the strongest supported conclusion?

Medium
A staging scanner flags an old web-library version. Supplied records show the vendor package includes a documented security backport, and the application uses that installed package. No exploit behavior was observed. What is the strongest supported conclusion?
  1. The vulnerability is confirmed because exploitation was not attempted.
    Non-exploitation neither confirms nor disproves vulnerability.
  2. Remove the package immediately regardless of vendor support or application dependency.
    Disruptive removal is not justified before validating the supported package and its security status.
  3. The finding is not confirmed; validate the backport before prioritizing remediation. ✓
    The upstream version match does not establish applicability when the vendor may have backported the fix.
  4. The host is definitely vulnerable because scanners cannot recognize backports.
    A scanner limitation does not prove that the installed build is vulnerable.
The trap
Confuses lack of testing with confirmation. Treats a detection limitation as proof. Prescribes remediation before applicability validation.

Validate the vendor backport before treating the version finding as confirmed.

2. Trace the setting in the test build and observe validation: Which next step best validates the finding while p

Hard
A SAST review of a mobile application identifies a branch that disables certificate validation under a debug configuration. The designated test device has the corresponding test build, and validation may use only a controlled endpoint. Which next step best validates the finding while preserving scope?
  1. Treat every release as vulnerable because the debug branch exists in source.
    Build profiles can compile different behavior, so a source path does not prove all releases are affected.
  2. Trace the setting in the test build and observe validation against the controlled endpoint. ✓
    This connects the source condition to the designated build and observes runtime behavior within scope.
  3. Review the source configuration.
    Static review alone does not establish whether the relevant behavior exists or executes in the test build.
  4. Replace the device trust store and exercise the application against several endpoints.
    Changing trust material and using multiple endpoints expands the test unnecessarily and does not first establish that the debug branch is active.
The trap
Stops at static evidence. Alters the environment and broadens testing prematurely. Generalizes a configuration-dependent path.

Trace the setting into the test build and observe validation against the controlled endpoint.

3. Tailgating caused by missing independent-entry enforcement: Which root cause is stated by this observation?

Medium
During an authorized walkthrough of an isolated training facility, an evaluator observes an employee badge at a secured door and follows immediately behind without presenting an independent badge. No impersonation or conversation occurs. Which root cause is stated by this observation?
  1. Tailgating caused by missing independent-entry enforcement. ✓
    Following an authorized person through a controlled entry without separate authorization is the stated tailgating condition.
  2. Unauthorized network access through the secured door.
    Physical entry alone does not establish access to network resources or systems.
  3. Badge cloning caused by weak RFID authentication.
    No copied credential was presented, and the observation does not test badge-technology resistance.
  4. Social impersonation using a false employee identity.
    The observation contains no claimed identity, deception, or impersonation behavior.
The trap
Infers cloning without credential evidence. Conflates facility entry with network authorization. Adds deception absent from the observation.

Following an authorized person through a controlled door without independent entry is tailgating.

4. Use Nessus with successful host authentication: Which tool best matches the requirement for an authenticated v

Medium
During an authorized office assessment, perimeter probes to a synthetic server are blocked, creating a possible false negative. The owner provides valid credentials and confirms successful login with permissions to inspect the host's installed software and configuration. Which tool best matches the requirement for an authenticated vulnerability assessment?
  1. Capture perimeter traffic with Wireshark.
    Packet capture observes traffic but does not inspect authenticated host software or configuration.
  2. Run Nikto against the blocked web listener for server checks.
    Nikto focuses on web-server checks and remains limited by the blocked listener.
  3. Repeat Nmap SYN probes from the blocked perimeter.
    Repeating the constrained external scan does not provide authenticated local inspection.
  4. Use Nessus with successful host authentication. ✓
    Nessus can perform an authenticated vulnerability assessment when the supplied credentials and permissions work.
The trap
Confuses traffic observation with host assessment. Repeats the source of the suspected false negative. Uses an external web checker for host configuration inspection.

Use Nessus with successful host authentication for inspection behind perimeter filtering.

5. A role with permission to access the protected functions: Which TWO missing prerequisites best explain the inc

Medium
In the fictional retail lab, a DAST scan reached a running application endpoint, but the supplied record shows that login failed and no authenticated pages were crawled. The assessment specifically requires coverage of protected functions, and the endpoint's availability is already confirmed.

Exhibit: The scanner received an unsuccessful login response and produced no authenticated crawl results.

Which TWO missing prerequisites best explain the incomplete assessment? Select TWO.

Select two. More than one option is correct — every correct one is ticked below.

  1. A role with permission to access the protected functions being tested. ✓
    Even a valid login is insufficient if its role cannot reach the protected functions in scope.
  2. A successful authorized login for the application. ✓
    A working authorized login is required to reach authenticated application content.
  3. A complete source repository with its compiler and build configuration.
    These support static source analysis, not authenticated dynamic crawling.
  4. A complete inventory of server-side package dependencies and versions.
    A dependency inventory supports software-composition analysis rather than authenticated runtime crawling.
  5. A passive DNS record set covering every lab hostname.
    Passive DNS can support reconnaissance but cannot provide authenticated application coverage.
The trap
Confuses SAST inputs with DAST prerequisites. Substitutes reconnaissance for runtime access. Confuses SCA with DAST.

The reachable endpoint is already confirmed; missing working authentication and suitable protected-function permissions explain the coverage gap.

6. Require verified visitor registration and badge: Which TWO recommendations directly address the observed physi

Hard
During a fictional software-delivery-lab site survey, the assessor observed contractors entering through a controlled vestibule while visitors received temporary badges without escort verification. The engagement permits observing access processes but prohibits bypass attempts. Which TWO recommendations directly address the observed physical-control weakness? Select TWO.

Select two. More than one option is correct — every correct one is ticked below.

  1. Require verified visitor registration and badge accountability ✓
    Registration and temporary-badge tracking directly address the observed visitor-control weakness.
  2. Perform an unannounced tailgating attempt to demonstrate impact
    The engagement permits observation but prohibits bypass attempts.
  3. Install cameras as the vestibule's primary access barrier
    Cameras can detect or deter activity but do not physically prevent entry.
  4. Scan the visitor badge database for external vulnerabilities
    A network scan does not directly correct vestibule access or visitor-process weaknesses.
  5. Require independent badge authentication at the vestibule ✓
    Independent authentication reduces reliance on following another person through controlled entry.
The trap
Substitutes cyber scanning for physical control improvement. Confuses detection with prevention. Exceeds the stated assessment boundary.

Independent vestibule authentication and accountable visitor procedures directly address the observed weakness.

7. Repeat with valid credentials: How should the assessor interpret this observation?

Easy
In an approved wireless test network, the scanner identified fictional access point `LAB-AP7`, but its credentialed probe returned `authentication failed`; no client or protected-service results were collected. How should the assessor interpret this observation?
  1. Call it secure.
    A failed credentialed probe does not establish that the access point or its protected services are secure.
  2. Label it a false positive.
    No vulnerability finding was disproven; the observation shows that intended validation did not complete.
  3. Report a confirmed critical vulnerability immediately.
    The evidence shows incomplete coverage, not a confirmed vulnerability or established critical business impact.
  4. Repeat with valid credentials. ✓
    Authentication failure leaves credentialed coverage incomplete, so authorized validation should be repeated with functioning credentials.
The trap
Mistakes missing coverage for evidence of absence. Confuses incomplete testing with false-positive confirmation. Assigns severity without vulnerability evidence.

Authentication failure creates incomplete coverage; repeat bounded validation with functioning authorized credentials.

8. IAST with approved instrumentation during application: Which assessment approach best fits this requirement?

Medium
In a synthetic cloud tenant, developers can run the fictional service `orders-test`, and the engagement permits adding approved application instrumentation. The assessor needs findings tied to code paths while requests execute. Which assessment approach best fits this requirement?
  1. SCA against the service dependency manifest
    SCA identifies component exposure and does not provide runtime code-path observations.
  2. DAST against the service's externally reachable endpoints
    DAST exercises external behavior but does not inherently provide the requested instrumented code-path visibility.
  3. IAST with approved instrumentation during application execution ✓
    IAST instruments a running application and correlates observed requests with internal code execution.
  4. SAST against the service repository before deployment
    SAST analyzes static artifacts and does not observe code paths while the service handles requests.
The trap
External behavior alone lacks internal instrumentation. Static analysis does not observe runtime execution. Component analysis is not application instrumentation.

IAST instruments the running application and relates exercised requests to internal code paths.

9. The evidence does not establish that badge cloning: What is the strongest supported conclusion?

Easy
In a fictional nonproduction service, the badge uses challenge-response authentication. A controlled review found no static identifier replay and produced no evidence that a copied badge could authenticate. What is the strongest supported conclusion?
  1. The evidence does not establish that badge cloning or replay is feasible ✓
    Challenge-response design and absent authentication evidence prevent concluding that a copied badge would work.
  2. All RFID badges are inherently immune to cloning attacks
    Badge security depends on credential technology and authentication design; RFID alone does not establish immunity.
  3. The badge system is secure against every physical attack
    The review addressed limited authentication evidence and cannot establish protection against every physical attack.
  4. The copied badge successfully bypassed the service authentication
    No successful copied-badge authentication was observed, so this conclusion contradicts the supplied evidence.
The trap
Generalizes one technology category into universal protection. Claims success despite explicitly absent supporting evidence. A narrow test cannot prove universal security.

The review cannot establish cloning feasibility; badge security depends on authentication technology and observed evidence.

10. Map allowed functions and log 403: What is the next bounded validation step?

Easy
In a staging web application, an approved low-privilege account authenticated successfully, but requests to an administrative endpoint returned HTTP 403. The engagement permits non-destructive role-boundary checks. What is the next bounded validation step?
  1. Exploit the endpoint to test hidden access.
    Exploitation is unnecessary for the permitted non-destructive role-boundary check and could exceed the staging boundary.
  2. Map allowed functions and log 403. ✓
    Enumerating only the account’s permitted functions while recording the denied administrative boundary validates authorization without escalation.
  3. Declare all privilege escalation impossible.
    One HTTP 403 response does not prove that every privilege boundary or alternate path is secure.
  4. Spray passwords against administrator accounts.
    Password spraying is unrelated to the stated authorization check and introduces unnecessary authentication risk.
The trap
Treats privilege escalation as necessary confirmation. Substitutes credential attack activity for authorization testing. Generalizes from one denied request.

Map the account’s permitted surface and document the denied boundary without escalation or destructive testing.

11. Exposure from a vulnerable third-party dependency: What root cause is stated by the evidence?

Medium
A mobile test device uses a build whose dependency manifest specifies `fictional-json 2.4.1`; the SCA report maps that component to a published vulnerability. No custom source defect has been demonstrated. What root cause is stated by the evidence?
  1. A confirmed active compromise of the test device
    A vulnerable dependency indicates exposure, not evidence that the device has been compromised.
  2. A runtime-only container configuration error
    The observation concerns a mobile dependency manifest and does not establish a container runtime configuration issue.
  3. Exposure from a vulnerable third-party dependency ✓
    The evidence identifies a vulnerable component version in the dependency manifest, which is an SCA finding.
  4. A custom source-code weakness in the application
    The supplied evidence identifies a dependency component, not a demonstrated flaw in custom application source.
The trap
Confuses component exposure with custom-code analysis. Vulnerability presence is not compromise evidence. Changes the affected artifact and assessment type.

The manifest identifies exposure through a vulnerable third-party component, not a proven custom-code flaw or compromise.

12. Use inert labeled USB media: Which option best matches the requirement?

Easy
In an isolated training network, the client authorizes a USB-drop simulation using inert files, documented placement, and process observation only. The exercise must not execute malware or alter endpoints. Which option best matches the requirement?
  1. Place a credential-harvesting document on removable media.
    Credential harvesting conflicts with harmless artifacts and could collect sensitive information.
  2. Use a BadUSB device for keystroke injection.
    Keystroke injection actively changes endpoint behavior and exceeds observation-only testing.
  3. Use inert labeled USB media. ✓
    Harmless labeled media supports placement and handling observation without executing code or changing endpoint state.
  4. Deliver a Metasploit payload from removable media.
    A payload conflicts with the requirement for inert artifacts and no malware execution.
The trap
Replaces simulation with payload delivery. Treats active device emulation as harmless observation. Adds unnecessary sensitive-data collection.

Inert, labeled USB media supports process observation without executing code or collecting credentials.

136 more Vulnerability Discovery and Analysis questions

The remaining 136 questions in this domain are part of the full PenTest+ bank — 870 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your PenTest+ readiness — free

Other PenTest+ domains

Part of the Certsqill PenTest+ question bank · Vulnerability Discovery and Analysis · Every answer, right and wrong, comes with its own explanation.