CompTIA PenTest+ (PT0-003) - Blueprint Practice Exam 1

1. A browser executes attacker-controlled content stored in a comment whenever another user opens the page. Which vulnerability is shown?
2. A client asks which of two findings to fix first: a minor internal banner leak or an externally reachable authentication bypass on a sensitive application. What is the strongest prioritization basis?
3. A client authorizes testing of one production hostname, but it resolves to infrastructure shared with other tenants. What must the tester clarify before intrusive testing?
4. A client wants a penetration test report safe for executives and engineers to share internally. What should the reporting plan specify?
5. A cloud assessment identifies a public object-storage endpoint in a client repository. What should precede any attempt to retrieve content?
6. A cloud configuration permits a workload identity to assume a more privileged role under overly broad trust conditions. What should be analyzed?
7. A lab application accepts an uploaded file and serves it from an executable script directory. Which control combination is most appropriate?
8. A lab demonstration confirms that an application accepts a serialized object and invokes unintended server-side behavior during deserialization. Which control best addresses this risk?
9. A password reset link can be reused after a successful reset. Which design improvement directly fixes the demonstrated weakness?
10. A scoped web application returns a verbose error naming a database engine and internal path. What should the tester record?
11. A service responds on TCP port 8443 with an HTTPS certificate and HTTP headers. What is the best interpretation?
12. A suspected SQL injection appears in a production search field. The engagement prohibits data modification. What is the best validation approach?
13. A test deploys a temporary scheduled task solely to demonstrate persistence. What is required during cleanup?
14. A tester can read a cloud storage container because its policy permits anonymous access. What proof best respects a rule to minimize sensitive-data collection?
15. A tester demonstrates directory traversal using a test marker file outside the permitted document root. Which remediation most directly addresses the root cause?
16. A tester discovers a vulnerable server outside the written scope. What is the best action?
17. A tester finds an email address in a public job posting and a matching naming pattern on the company's website. What does that evidence support?
18. A tester gains the limited access allowed by a lab engagement. What should happen before collecting additional files?
19. A tester has one low-impact finding and an unvalidated hypothesis for a more serious chain. How should the report distinguish them?
20. A tester performs DNS lookups and receives several CNAME aliases pointing to a third-party service. What does this imply for planning?
21. A tester reviews public certificate-transparency records to identify possible subdomains without sending probes to the client's servers. What type of activity is this?
22. A tester suspects an authentication rate-limit gap. The engagement authorizes a small, fixed number of attempts against designated test accounts. What is the appropriate validation?
23. A web API trusts a role value supplied in the client's request and grants administrator actions when it is changed. What is the primary fix?
24. A web scanner labels a reflected parameter as cross-site scripting. What additional evidence best validates the result?
25. A wireless test identifies an imitation access point using the corporate SSID to lure clients. What attack pattern is this?
26. After cleanup, the client asks whether the demonstrated attack still works following remediation. What should the tester do?
27. An application builds an operating-system command by concatenating a supplied filename. A safe approved proof shows that input changes the command's structure. What is the weakness?
28. An application fetches a user-provided URL on its server. In a scoped lab replica, the tester causes it to request a restricted internal endpoint. Which vulnerability does this demonstrate?
29. An approved low-privilege shell reveals that its service account can write a script later executed by a privileged service. What risk is most directly suggested?
30. An assessment permits pivoting only through one designated test host into one specified subnet. What should the tester enforce?
31. An authenticated browser sends a sensitive change request without a CSRF defense. A tester demonstrates that another site can trigger that request using the victim's session. Which weakness is shown?
32. An authorized assessment shows that a shared local administrator password works across many workstations. What risk does this create?
33. An authorized internal assessment needs to identify active hosts and exposed services on a defined subnet. What should guide scanning intensity?
34. An automated scan fails to identify an authorization flaw that allows one user to view another user's invoice. What testing approach addresses this gap?
35. An external scanner identifies a vulnerable version, but the installed vendor build contains a backported security fix. What should determine whether the finding remains valid?
36. An internal test obtains a credential from an exposed configuration file. What should the final handover include?
37. During an authorized wireless survey, a tester sees multiple access points using the client's SSID. What is the most useful next step?
38. In an authorized test, changing an invoice ID returns another user's invoice without a permission check. Which weakness is demonstrated?
39. Rules of engagement require stopping if service availability degrades. A permitted test causes rising error rates. What should the tester do?
40. The engagement includes social-engineering simulations. Which requirement is essential before execution?

Comments — 0