1. Introduction to Pentesting

Ref:📕CompTIA PenTest+ PT0-002 Cert Guide (Certification Guide) 2nd Edition

Press the Start button to begin the practice test.

PenTest+ (PT0-002) Chapter 01. Introduction to Ethical Hacking and Penetration Testing

1 / 39

Which of the following is NOT a requirement for a typical penetration testing environment?

A. Access to online music platforms

B. Virtualized computing environment

C. Health monitoring

D. Duplicate tools

2 / 39

According to the CompTIA PenTest+ (PT0-002) study material, which of the following is NOT a requirement for a typical penetration testing environment?

A. Closed network to ensure controlled access

B. Use of a single operating system for testing

C. Health monitoring systems

D. Practice targets known to be vulnerable

3 / 39

Why is it important to follow a methodology for penetration testing?

A. To ensure best results

B. To avoid going off scope

C. To provide documentation of a specialized procedure

D. All of the above

4 / 39

Which of the following best describes the key defining factor between ethical hacking and nonethical hacking?

A. Ethical hackers only work with vendors, while nonethical hackers do not.

B. Ethical hackers do not use the same tools as nonethical hackers.

C. Ethical hackers have permission to test and do not have malicious intent, whereas nonethical hackers do not.

D. Ethical hackers are always associated with a nonprofit organization.

5 / 39

What does an application-based penetration test focus on?

A. Evaluating the security posture of the network infrastructure

B. Determining weaknesses in the wireless deployment

C. Testing for security weaknesses in enterprise applications

D. Focusing on cloud service providers’ security and compliance responsibilities

6 / 39

What is the importance of having multiple operating systems in a penetration testing lab environment?

A. To ensure multiple copies of the tool being used for testing.

B. To validate test findings from various system perspectives.

C. To meet hardware resources requirements.

D. To practice on multiple targets known to be vulnerable.

7 / 39

Which of the following elements differentiates ethical hacking from non-ethical hacking?

A. Ethical hackers perform tests that might be destructive

B. Ethical hackers use different tools to non-ethical hackers

C. Ethical hackers have the permission to perform tests

D. Ethical hackers don’t disclose vulnerabilities to the vendors

8 / 39

What type of penetration testing typically involves the use of tools for sniffing or manipulating traffic, flooding network devices, and bypassing firewalls and IPSs?

A. Wireless testing

B. Network infrastructure-based testing

C. Web applications and services testing

D. Database vulnerability testing

9 / 39

What motivates Hacktivists to carry out cyber attacks?

A. Monetizing the stolen data

B. Advancing their own beliefs and making a point

C. Defending their own operational domains

D. Seeking revenge or financial gain

10 / 39

What is the purpose of the MITRE ATT&CK framework in penetration testing methodologies?

A. It is a guide focused on web application testing.

B. It provides guidelines on planning and conducting information security testing.

C. It is a resource for learning about an adversary’s tactics, techniques, and procedures (TTPs).

D. It lays out repeatable and consistent security testing.

11 / 39

What does the testing of the network infrastructure as part of a penetration test usually include?

A. Only the switches and routers

B. Only AAA servers and IPSs

C. Only the physical servers

D. Switches, routers, firewalls, AAA servers, and IPSs

12 / 39

Why is it important to use a known methodology during a penetration test?

A. To ensure that the test is completed within a specific timeline

B. To show that the methods used are tested and reliable

C. To use less resources during the test

D. To include as many different types of penetration tests as possible

13 / 39

Which of the following is not typically a target for penetration testing?

A. Wireless infrastructure

B. Web servers

C. Mobile applications

D. Email client user interface

14 / 39

According to the Penetration Testing Execution Standard (PTES), what phases are involved?

A. Incident assessment, intelligence gathering, threat analysis, penetration, maintaining access, remediation

B. Pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, reporting

C. The scan, list, control and exploit phases

D. Vulnerability scanning, vulnerability assessment, risk mitigation, system exploitation, penetration prevention

15 / 39

What are some of the considerations when performing penetration testing in the cloud?

A. The type of cloud model being used

B. Disaster recovery and service-level agreements

C. Understanding what actions are permitted during testing

D. All of the above

16 / 39

Which of the following best describes the difference between an ethical hacker and a nonethical hacker?

A. The nonethical hacker does not report their findings to the vendor or customer

B. The ethical hacker does not use the same tools to find vulnerabilities and exploit targets

C. The nonethical hacker discloses vulnerabilities publicly without working with a vendor

D. All of the above

17 / 39

What is the main purpose of NIST Special Publication (SP) 800-115?

A. To provide guidelines on planning and conducting information security testing

B. To provide a comprehensive guide focused on web application testing

C. To provide a collection of different matrices of tactics, techniques, and subtechniques used by adversaries

D. To provide a manual about repeatable and consistent security testing

18 / 39

Which of the following best describes the purpose of a penetration testing lab environment?

A. To break customer networks with untested tools

B. To perform live testing on production environments

C. To test and understand how tools perform before unleashing them on a customer network

D. To break down different Linux distributions

19 / 39

Which of the following penetration testing methodologies is focused on web application testing and provides detailed attack vectors for several attack types, including SQL injection and cross-site scripting?

A. MITRE ATT&CK

B. Open Source Security Testing Methodology Manual (OSSTMM)

C. OWASP Web Security Testing Guide (WSTG)

D. NIST Special Publication 800-115

20 / 39

Why is it important to follow a methodology during penetration testing?

A. To ensure that the tools used are always the same

B. To prevent scope creep and show proven methods

C. To make the networks and systems less complex

D. To spend more time on the penetration test

21 / 39

Why is it necessary to conduct penetration testing on a regular basis?

A. To ensure the antivirus system is operational

B. To verify the amount of data that needs protection

C. To assess changes in the attack surface due to constant changes in networks and systems

D. To ensure the VPN is effectively encrypted

22 / 39

What is a key component of a typical penetration testing lab environment?

A. Open access to the Internet

B. Non-virtualized computing environment

C. Operation on a single operating system

D. A closed network to control access

23 / 39

Which resource provides guidelines specifically on planning and conducting information security testing?

A. MITRE ATT&CK

B. OWASP Web Security Testing Guide (WSTG)

C. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-115

D. Open Source Security Testing Methodology Manual (OSSTMM)

24 / 39

Which type of threat actor is typically motivated by revenge or money and originates from inside an organization?

A. Organized crime

B. Hacktivists

C. State-sponsored attackers

D. Insider threats

25 / 39

What are the requirements of a typical penetration testing environment?

A. Controlled access, virtualized computing environment, health monitoring, sufficient hardware resources

B. Realistic environment, duplicate tools, multiple operating systems

C. Only a realistic environment and multiple operating systems

D. All of the above

26 / 39

Which of the following best describes a Partially known environment test (previously known as graybox tests) in penetration testing?

A. Testers start with a significant amount of information about the organization and its infrastructure.

B. Testers are typically provided only a very limited amount of information.

C. The test perspective is from an external attacker with no prior knowledge of the target’s organization and infrastructure.

D. This is a hybrid approach where the testers may be provided credentials but not full documentation of the network infrastructure.

27 / 39

Which type of threat actor is known to be motivated by money, and can use any and all latest attack techniques to exploit and monetize sensitive information?

A. Hacktivists

B. Insider Threats

C. State-sponsored attackers

D. Organized crime

28 / 39

What is a characteristic of a Known-environment penetration test?

A. The tester starts with minimal information about the target

B. The network support personnel of the target may not be informed about when the test is taking place

C. The tester is not provided with any credentials or details about the network infrastructure

D. The tester starts out with substantial details about the organization and its infrastructure

29 / 39

What is an important consideration when setting up a penetration testing lab environment according to the text?

A. Only needing one type of operating system

B. The testing environment needs to be as different as possible from the real environment

C. The use of duplicate tools to validate findings

D. Not needing to practice with the tools used

30 / 39

Which is one of the common environmental considerations for penetration tests?

A. Strength of the company’s human resources

B. Network infrastructure tests

C. Company’s financial health

D. Company’s business model

31 / 39

What is the key characteristic of an unknown-environment penetration test?

A. The tester is provided with a significant amount of information about the organization and its infrastructure.

B. The tester starts the test from the perspective of an internal attacker.

C. The tester is provided only a very limited amount of information and conducts the test from the perspective of an external attacker.

D. The tester starts on the inside of the network and has access to a client machine.

32 / 39

What are some of the requirements for a typical penetration testing environment?

A. Open network and identical development and production environments

B. Closed network, virtualized computing environment, and health monitoring

C. Open network, multiple operating systems, and duplicate tools

D. Closed network, multiple operating systems, and practice targets

33 / 39

Which of the following best describes the characteristics and motivations of the threat actor category known as organized crime?

A. They are motivated by ideology and often publicly expose sensitive data to further their beliefs.

B. They are usually government-sponsored groups that carry out cyber espionage.

C. They are typically well-funded groups that use various attack techniques for profit.

D. They are individuals within an organization who may inadvertently or intentionally cause security breaches.

34 / 39

Which of the following is NOT listed as a requirement for a typical penetration testing environment?

A. Strict firewall rules

B. Virtualized computing environment

C. Multiple operating systems

D. Realistic environment

35 / 39

Which of the following is an important reason for being able to recover your lab environment when doing penetration testing?

A. The attacks in testing can put bogus data into the database

B. You would not require backups if the lab environment is recoverable

C. The customer may require a virtual environment for testing

D. To check the resilience of the system

36 / 39

What is the MITRE ATT&CK framework?

A. A guide focused on web application testing

B. A document providing guidelines on planning and conducting information security testing

C. A collection of different matrices of tactics, techniques, and subtechniques used by adversaries during an attack

D. A document that lays out repeatable and consistent security testing

37 / 39

What are the seven distinct phases involved in the Penetration Testing Execution Standard (PTES)?

A. Pre-engagement interactions, Intelligence gathering, Threat modeling, Vulnerability analysis, Gaining access and privilege escalation, Enumerating further, Reporting

B. Pre-engagement interactions, Intelligence gathering, Threat modeling, Vulnerability analysis, Exploitation, Post-exploitation, Reporting

C. Information gathering, Network mapping, Vulnerability identification, Penetration, Gaining access and privilege escalation, Enumerating further, Compromising remote users/sites

D. Information gathering, Network mapping, Threat modeling, Vulnerability analysis, Exploitation, Post-exploitation, Reporting

38 / 39

Which type of threat actor is described as motivated by disrupture and theft of information at a national level?

A. Insider threats

B. Organized crime

C. Hacktivists

D. State-sponsored attackers

39 / 39

Which requirement of a typical penetration testing lab environment aims at enabling easy deployment and recovery of devices?

A. Closed network

B. Virtualized computing environment

C. Realistic environment

D. Health monitoring

Your score is

Boost Your Skills with Free Anki Flashcards

Click the download button to get the CompTIA Pentest+ Anki deck.

Start your journey into ethical hacking with our CompTIA PenTest+ Chapter 01 practice questions.

This chapter provides insights into the fundamentals of ethical hacking, penetration testing methodologies, and essential tools.
Mastering these concepts is crucial for success in the PenTest+ exam.

Supplement your learning with our free Anki decks.
For official exam details, visit CompTIA’s website.

Ready to deepen your skills?
Proceed to Chapter 02: Planning and Scoping a Penetration Testing Assessment for more advanced topics.

1. Introduction to Pentesting

Press the Start button to begin the practice test.

Boost Your Skills with Free Anki Flashcards

Explore our other free practice tests:

Related Posts

The Affordable, Hands-On Josh Madakor IT Course that gets Results!

The Affordable, Hands-On Cyber Security that gets Results!

JOIN OUR

NEWSLETTER