Welcome to the Penetration Testing MCQs Page

Dive deep into the fascinating world of Penetration Testing with our comprehensive set of Multiple-Choice Questions (MCQs). This page is dedicated to exploring the fundamental concepts and intricacies of Penetration Testing, a crucial aspect of CompTIA PenTest+ Certification Exam PT0 002. In this section, you will encounter a diverse range of MCQs that cover various aspects of Penetration Testing, from the basic principles to advanced topics. Each question is thoughtfully crafted to challenge your knowledge and deepen your understanding of this critical subcategory within CompTIA PenTest+ Certification Exam PT0 002.

Check out the MCQs below to embark on an enriching journey through Penetration Testing. Test your knowledge, expand your horizons, and solidify your grasp on this vital area of CompTIA PenTest+ Certification Exam PT0 002.

Note: Each MCQ comes with multiple answer choices. Select the most appropriate option and test your understanding of Penetration Testing. You can click on an option to test your knowledge before viewing the solution for a MCQ. Happy learning!

Penetration Testing MCQs | Page 5 of 10

Explore more Topics under CompTIA PenTest+ Certification Exam PT0 002

01

Planning and Scoping Penetration Tests 🔒

02

Information Gathering 🔒

03

Vulnerability Scanning 🔒

04

Analyzing Vulnerability Scans

05

Exploiting and Pivoting 🔒

06

Exploiting Network Vulnerabilities 🔒

07

Exploiting Physical and Social Vulnerabilities

08

Exploiting Application Vulnerabilities 🔒

09

Attacking Hosts,Cloud Technologies and Specialized Systems 🔒

10

Reporting and Communication

11

Scripting for Penetration Testing 🔒

Q41.

Which of the following tools is used for gathering information about domain ownership from public records?

Nmap

theHarvester

Nessus

Maltego

Discuss

Answer: (b).theHarvester Explanation:theHarvester is used for gathering information about domain ownership from public records.

Q42.

What does Nslookup help identify?

Network vulnerabilities

IP addresses associated with an organization

SQL injection vulnerabilities

Metadata within Office documents

Discuss

Answer: (b).IP addresses associated with an organization Explanation:Nslookup helps identify the IP addresses associated with an organization.

Q43.

What is the purpose of FOCA (Fingerprinting Organizations with Collected Archives)?

Scanning IP addresses across the Internet

Finding vulnerabilities in Internet of Things (IoT) devices

Visualizing data gathered from OSINT efforts

Finding metadata within Office documents, PDFs, and other file formats

Discuss

Answer: (d).Finding metadata within Office documents, PDFs, and other file formats Explanation:FOCA is used to find metadata within Office documents, PDFs, and other common file formats.

Q44.

Which tool is a web-based tool that probes IP addresses across the Internet and provides penetration testers with access to that information through a search engine?

Maltego

Censys

Shodan

Nikto

Discuss

Answer: (b).Censys Explanation:Censys is a web-based tool that probes IP addresses across the Internet and provides access to that information through a search engine.

Q45.

What is the role of Nessus in a penetration test?

Automating SQL injection attacks against web applications

Performing network vulnerability scans

Visualizing data gathered from OSINT efforts

Scanning IP addresses across the Internet

Discuss

Answer: (b).Performing network vulnerability scans Explanation:Nessus is a commercial vulnerability scanning tool used to perform network vulnerability scans in a penetration test.

Q46.

What is the primary focus of the Social Engineer Toolkit (SET) in penetration testing?

Enumerating files and directories on a web server

Automating social engineering attacks, including spear phishing and credential collection

Scanning through code repositories for accidentally published secrets

Performing static software analysis on Ruby on Rails applications

Discuss

Answer: (b).Automating social engineering attacks, including spear phishing and credential collection Explanation:The Social Engineer Toolkit (SET) is focused on automating social engineering attacks, including spear phishing and credential collection.

Q47.

Which tool provides an automated toolkit for using social engineering to take over a victim’s web browser?

Hashcat

CeWL

The Social Engineer Toolkit (SET)

Browser Exploitation Framework (BeEF)

Discuss

Answer: (d).Browser Exploitation Framework (BeEF) Explanation:The Browser Exploitation Framework (BeEF) provides an automated toolkit for using social engineering to take over a victim’s web browser.

Q48.

What is the role of Mimikatz in penetration testing?

Brute-forcing files and directories on a web server

Reverse-engineering hashed passwords stored in files

Retrieving sensitive credential information from memory on Windows systems

Scanning through code repositories for accidentally published secrets

Discuss

Answer: (c).Retrieving sensitive credential information from memory on Windows systems Explanation:Mimikatz retrieves sensitive credential information from memory on Windows systems.

Q49.

Which tool is a password-cracking tool used to reverse-engineer hashed passwords stored in files?

CeWL

John the Ripper

TruffleHog

Brakeman

Discuss

Answer: (b).John the Ripper Explanation:John the Ripper is a password-cracking tool used to reverse-engineer hashed passwords stored in files.

Q50.

What is the purpose of Immunity Debugger in penetration testing?

Scanning through code repositories for accidentally published secrets

Static software analysis of Ruby on Rails applications

Debugging and supporting penetration testing and malware reverse engineering

Brute-forcing files and directories on a web server

Discuss

Answer: (c).Debugging and supporting penetration testing and malware reverse engineering Explanation:Immunity Debugger is designed to support penetration testing and the reverse engineering of malware by providing debugging capabilities.

Page 5 of 10

Planning and Scoping Penetration Tests 🔒

Information Gathering 🔒

Vulnerability Scanning 🔒

Exploiting and Pivoting 🔒

Exploiting Network Vulnerabilities 🔒

Exploiting Application Vulnerabilities 🔒

Attacking Hosts,Cloud Technologies and Specialized Systems 🔒

Scripting for Penetration Testing 🔒

Welcome to the Penetration Testing MCQs Page

Penetration Testing MCQs | Page 5 of 10

Explore more Topics under CompTIA PenTest+ Certification Exam PT0 002

Analyzing Vulnerability Scans

Exploiting Physical and Social Vulnerabilities

Reporting and Communication

Suggested Topics

Computer Architecture

Data Science

Management Information Systems

Internet of Things (IoT)

C Programming

Formal Languages and Automata Theory

Object Oriented Programming

CSS

Wireless and Mobile Communications