1500 Questions | CompTIA PenTest+ Certification 2026

Detailed Exam Domain Coverage

To earn your CompTIA PenTest+ certification, you must demonstrate a deep understanding of the entire penetration testing lifecycle. This course is meticulously designed to cover every objective within the official exam domains:

• Domain 1: Planning and Reconnaissance (15%): Master the art of scoping engagements, legal requirements, and utilizing passive/active reconnaissance to map target environments.

• Domain 2: Scanning and Vulnerability Identification (15%): Learn to use industry-standard tools for vulnerability analysis and prioritize findings based on potential impact.

• Domain 3: Exploitation of Vulnerabilities (15%): Gain expertise in executing attacks against network, wireless, application, and RF-based vulnerabilities.

• Domain 4: Post-Exploitation (15%): Understand how to maintain persistence, perform lateral movement, and determine the business impact of a breach.

• Domain 5: Defense Bypass (10%): Identify and circumvent security controls like firewalls, IDS/IPS, and sandboxes using specialized techniques.

• Domain 6: Post-Penetration Test (35%): Focus on the most weighted part of the exam—reporting, communication of findings, and recommending effective remediation strategies.

Course Description

I designed this practice test suite to provide a realistic simulation of the CompTIA PenTest+ exam environment. With a vast bank of original questions, I aim to help you move beyond rote memorization and develop the critical thinking skills required to identify weaknesses and suggest professional-grade mitigations.

Navigating the transition from security analyst to penetration tester is challenging. That is why I have included detailed breakdowns for every question. I don't just tell you which answer is right; I explain the logic behind the correct choice and why the distractors don't fit the specific scenario provided. This ensures you are prepared for the "best-answer" style questions CompTIA is known for.

Sample Practice Questions

• Question 1: During a penetration test, I am tasked with performing a stealthy scan to identify live hosts on a /24 subnet without completing a three-way handshake. Which Nmap command should I use?

  • A. nmap -sT 192.168.1.0/24

  • B. nmap -sU 192.168.1.0/24

  • C. nmap -sS 192.168.1.0/24

  • D. nmap -sV 192.168.1.0/24

  • E. nmap -O 192.168.1.0/24

  • F. nmap -Pn 192.168.1.0/24

  • Correct Answer: C

  • Explanation:

    • C (Correct): The -sS flag performs a SYN Stealth scan. It sends a SYN packet and waits for a SYN/ACK, but never sends the final ACK to complete the handshake, making it less likely to be logged.

    • A (Incorrect): -sT is a TCP Connect scan which completes the full three-way handshake and is much noisier.

    • B (Incorrect): -sU is used for scanning UDP ports, not for stealthy TCP host discovery.

    • D (Incorrect): -sV is used for service version detection, which occurs after host discovery.

    • E (Incorrect): -O is used for OS fingerprinting and does not determine the "stealthiness" of the initial scan.

    • F (Incorrect): -Pn skips the host discovery (ping) phase and treats all hosts as online; it doesn't define the scan type itself.

• Question 2: While reviewing a web application, I find that I can input <script>alert('XSS')</script> into a comment field, and it executes in the browser of anyone viewing the page. What type of vulnerability is this?

  • A. Reflected XSS

  • B. DOM-based XSS

  • C. Stored XSS

  • D. Cross-Site Request Forgery (CSRF)

  • E. SQL Injection

  • F. Insecure Direct Object Reference (IDOR)

  • Correct Answer: C

  • Explanation:

    • C (Correct): Because the script is saved in the comment field (on the server/database) and served to other users later, it is a Stored (or Persistent) XSS attack.

    • A (Incorrect): Reflected XSS occurs when the script is "reflected" off a web server in a URL or search result, not saved permanently.

    • B (Incorrect): DOM-based XSS happens entirely on the client-side within the Document Object Model.

    • D (Incorrect): CSRF involves tricking a user into performing an unwanted action on a different site where they are authenticated.

    • E (Incorrect): SQL Injection targets the database logic, not the execution of scripts in a browser.

    • F (Incorrect): IDOR occurs when a user can access unauthorized resources by changing a parameter (like a UserID).

• Question 3: I am in the post-exploitation phase and need to ensure my access survives a system reboot. Which of the following is a common technique for achieving persistence on a Windows target?

  • A. Running ipconfig /all

  • B. Modifying the Registry "Run" keys

  • C. Using whoami to check privileges

  • D. Clearing the Windows Event Logs

  • E. Performing a pass-the-hash attack

  • F. Mapping a network drive

  • Correct Answer: B

  • Explanation:

    • B (Correct): Adding a malicious executable to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key ensures the program starts automatically whenever a user logs in.

    • A (Incorrect): ipconfig is a reconnaissance/info-gathering command, not a persistence mechanism.

    • C (Incorrect): whoami is used for situational awareness regarding current permissions.

    • D (Incorrect): Clearing logs is part of "covering tracks," but it does not help maintain access after a reboot.

    • E (Incorrect): Pass-the-hash is a lateral movement technique, not a persistence method.

    • F (Incorrect): Mapping a drive is for data exfiltration or access, but doesn't guarantee the shell returns after a restart.

• Welcome to the Exams Practice Tests Academy to help you prepare for your CompTIA PenTest+ Practice Tests.

• You can retake the exams as many times as you want.

• This is a huge original question bank.

• You get support from instructors if you have questions.

• Each question has a detailed explanation.

• Mobile-compatible with the Udemy app.

• 30-days money-back guarantee if you're not satisfied.

I hope that by now you're convinced! And there are a lot more questions inside the course.