Welcome to the Penetration Testing MCQs Page

Dive deep into the fascinating world of Penetration Testing with our comprehensive set of Multiple-Choice Questions (MCQs). This page is dedicated to exploring the fundamental concepts and intricacies of Penetration Testing, a crucial aspect of CompTIA PenTest+ Certification Exam PT0 002. In this section, you will encounter a diverse range of MCQs that cover various aspects of Penetration Testing, from the basic principles to advanced topics. Each question is thoughtfully crafted to challenge your knowledge and deepen your understanding of this critical subcategory within CompTIA PenTest+ Certification Exam PT0 002.

Check out the MCQs below to embark on an enriching journey through Penetration Testing. Test your knowledge, expand your horizons, and solidify your grasp on this vital area of CompTIA PenTest+ Certification Exam PT0 002.

Note: Each MCQ comes with multiple answer choices. Select the most appropriate option and test your understanding of Penetration Testing. You can click on an option to test your knowledge before viewing the solution for a MCQ. Happy learning!

Penetration Testing MCQs | Page 9 of 10

Explore more Topics under CompTIA PenTest+ Certification Exam PT0 002

01

Planning and Scoping Penetration Tests 🔒

02

Information Gathering 🔒

03

Vulnerability Scanning 🔒

04

Analyzing Vulnerability Scans

05

Exploiting and Pivoting 🔒

06

Exploiting Network Vulnerabilities 🔒

07

Exploiting Physical and Social Vulnerabilities

08

Exploiting Application Vulnerabilities 🔒

09

Attacking Hosts,Cloud Technologies and Specialized Systems 🔒

10

Reporting and Communication

11

Scripting for Penetration Testing 🔒

Q81.

Which one of the following security assessment tools is not commonly used during the Information Gathering and Vulnerability Scanning phase of a penetration test?

Nmap

Nessus

Metasploit

Nslookup

Discuss

Answer: (c).Metasploit Explanation:Nmap is a port scanning tool used to enumerate open network ports on a system. Nessus is a vulnerability scanner designed to detect security issues on a system. Nslookup is a DNS information-gathering utility. All three of these tools may be used to gather information and detect vulnerabilities. Metasploit is an exploitation framework used to execute and attack and would be better suited for the Attacking and Exploiting phase of a penetration test.

Q82.

During what phase of the Cyber Kill Chain does an attacker steal information, use computing resources, or alter information without permission?

Weaponization

Installation

Actions on Objectives

Command and Control

Discuss

Answer: (c).Actions on Objectives Explanation:The attacker carries out their original intentions to violate the confidentiality, integrity, and/or availability of information or systems during the Actions on Objectives stage of the Cyber Kill Chain.

Q83.

Grace is investigating a security incident where the attackers left USB drives containing infected files in the parking lot of an office building. What stage in the Cyber Kill Chain describes this action?

Weaponization

Installation

Delivery

Command and Control

Discuss

Answer: (c).Delivery Explanation:Distributing infected media (or leaving it in a location where it is likely to be found) is an example of the Delivery phase of the Cyber Kill Chain. The process moves from Delivery into Installation if a user executes the malware on the device.

Q84.

Which one of the following is not an open-source intelligence gathering tool?

WHOIS

Nslookup

Nessus

FOCA

Discuss

Answer: (c).Nessus Explanation:Whois and Nslookup are tools used to gather information about domains and IP addresses. FOCA is used to harvest information from files. All three of those tools are OSINT tools. Nessus is a commercial vulnerability scanner.

Q85.

Which one of the following tools is an exploitation framework commonly used by penetration testers?

Metasploit

Wireshark

Aircrack-ng

SET

Discuss

Answer: (a).Metasploit Explanation:Metasploit is the most popular exploitation framework used by penetration testers. Wireshark is a protocol analyzer. Aircrack-ng is a wireless network security testing tool. The Social Engineer Toolkit (SET) is a framework for conducting social engineering attacks.

Q86.

Which one of the following tools is not a password-cracking utility?

OWASP ZAP

Cain and Abel

Hashcat

Jack the Ripper

Discuss

Answer: (a).OWASP ZAP Explanation:Cain and Abel, Hashcat, and Jack the Ripper are all password-cracking utilities. OWASP ZAP is a web proxy tool.

Q87.

Which one of the following vulnerability scanners is specifically designed to test the security of web applications against a wide variety of attacks?

OpenVAS

Nessus

SQLmap

Nikto

Discuss

Answer: (d).Nikto Explanation:Nikto is an open-source web application security assessment tool. SQLmap does test web applications, but it only tests for SQL injection vulnerabilities. OpenVAS and Nessus are general-purpose vulnerability scanners. Although they can detect web application security issues, they are not specifically designed for that purpose.

Q88.

Which one of the following debugging tools does not support Windows systems?

GDB

OllyDbg

WinDbg

IDA

Discuss

Answer: (a).GDB Explanation:OllyDBG, WinDBG, and IDA are all debugging tools that support Windows environments. GDB is a Linux-specific debugging tool.

Q89.

What is the final stage of the Cyber Kill Chain?

Weaponization

Installation

Actions on Objectives

Command and Control

Discuss

Answer: (c).Actions on Objectives Explanation:During the Actions on Objectives stage, the attacker carries out the activities that were the purpose of the attack. As such, it is the final stage in the chain.

Q90.

Which one of the following activities assumes that an organization has already been compromised?

Penetration testing

Threat hunting

Vulnerability scanning

Software testing

Discuss

Answer: (b).Threat hunting Explanation:Threat hunting assumes that an organization has already been compromised and searches for signs of successful attacks.

Page 9 of 10

Planning and Scoping Penetration Tests 🔒

Information Gathering 🔒

Vulnerability Scanning 🔒

Exploiting and Pivoting 🔒

Exploiting Network Vulnerabilities 🔒

Exploiting Application Vulnerabilities 🔒

Attacking Hosts,Cloud Technologies and Specialized Systems 🔒

Scripting for Penetration Testing 🔒

Welcome to the Penetration Testing MCQs Page

Penetration Testing MCQs | Page 9 of 10

Explore more Topics under CompTIA PenTest+ Certification Exam PT0 002

Analyzing Vulnerability Scans

Exploiting Physical and Social Vulnerabilities

Reporting and Communication

Suggested Topics

Compiler Design

C# programming

Artificial Intelligence

Data Structures and Algorithms

Java Spring Framework

Computer Graphics

Digital Communication

Object Oriented Programming Using C++

Cyber Security