CompTIA PenTest+ Practice Questions: Attacks and Exploits

6 free, exam-style CompTIA PenTest+ (PT0-003) practice questions covering Attacks and Exploits. Each question shows the correct answer and a clear explanation. Ready for the real thing? Take the full timed quiz below.

🚀 Take the full CompTIA PenTest+ quiz 📘 CompTIA PenTest+ study guide

Q1. Which vulnerability allows an attacker to make a database run unintended queries?

A.SQL injection✓ Correct
B.Open relay only
C.DNS round robin
D.Port security

Explanation: SQL injection occurs when untrusted input is included in database queries without proper parameterization or validation. Learn more.

Q2. Which attack captures and relays authentication attempts without knowing the password?

A.NTLM relay✓ Correct
B.DNS zone transfer
C.ARP cache timeout
D.DHCP reservation

Explanation: Relay attacks forward authentication messages to another service to gain access without cracking the credential. Learn more.

Q3. What is the purpose of a reverse shell?

A.Make a compromised host initiate a connection back to the tester✓ Correct
B.Create a DNS MX record
C.Encrypt backup tapes
D.Patch a kernel

Explanation: A reverse shell causes the target to connect outward to the listener, which can bypass some inbound filtering. Learn more.

Q4. Which password attack uses known breached username and password pairs against another service?

A.Credential stuffing✓ Correct
B.Rainbow table creation only
C.ARP spoofing
D.Kerberoasting only

Explanation: Credential stuffing tests reused credentials from breaches against other services. Learn more.

Q5. Which Kerberos attack targets service tickets for offline password cracking?

A.Kerberoasting✓ Correct
B.Bluejacking
C.Smurf attack
D.DNS tunneling

Explanation: Kerberoasting requests service tickets and attempts to crack the service account password offline. Learn more.

Q6. Which exploit development protection makes memory addresses harder to predict?

A.ASLR✓ Correct
B.SMTP
C.SNMP
D.NTP

Explanation: Address Space Layout Randomization randomizes memory locations to make exploitation harder. Learn more.