Sample questions
Pt Methodology PhasesDifficulty 1
In a standard penetration test methodology, what is the main purpose of the reconnaissance (information gathering) phase?
- aTo immediately attempt to log into every discovered system using default credentials, treating that as an acceptable substitute for first understanding what the environment actually looks like.
- bTo collect publicly available, passively observable information about the target before any active probing begins.✓
- cTo write the final report that will be delivered to the client at the end of the engagement.
- dTo negotiate the contract and pricing terms of the engagement with the client's legal team.
Explanation:Reconnaissance is the information-gathering phase: understanding the target's footprint (domains, technologies, organizational structure) mostly through passive or low-impact means, before any active testing begins.
Pt Methodology PhasesDifficulty 2
What is the key difference between passive and active reconnaissance, at the process level?
- aPassive recon gathers information without directly touching the target's systems, while active recon involves direct interaction that the target could potentially notice.✓
- bThere is no real difference; both terms describe the exact same set of process steps.
- cPassive recon is always illegal, while active recon is always authorized by definition.
- dActive recon only happens after the engagement has already ended and the report is delivered.
Explanation:Passive reconnaissance relies on sources like public records, search engines, or third-party data that do not touch the target directly. Active reconnaissance involves direct interaction with the target's systems, which carries a higher (though still low relative to later phases) chance of being observed.
Pt Methodology PhasesDifficulty 2
After reconnaissance, a pentest methodology typically moves to an enumeration phase. What does enumeration primarily aim to establish?
- aThe exact identity of every employee who will read the final report.
- bThe final list of remediation deadlines that will appear in the delivered report, which is only assembled once every other phase of the engagement has already concluded.
- cThe legal contract terms that authorize the engagement to take place.
- dA concrete inventory of live hosts, open services, and their versions, based on the broader footprint recon identified.✓
Explanation:Enumeration narrows the broad footprint from recon into a concrete, actionable inventory: which hosts are actually alive, which services they run, and what versions are exposed. This inventory is what later phases build on.
Pt Methodology PhasesDifficulty 2
A junior tester wants to skip enumeration entirely and jump straight from a raw port scan to attempting exploitation. What is the main risk of doing this?
- aThere is no risk at all; enumeration is only a formality that has no bearing on later phases.
- bWithout confirming service versions and context, the tester risks targeting the wrong assumption about what is actually running, wasting time or causing unintended impact.✓
- cIt automatically violates the rules of engagement regardless of what the scope document says.
- dIt guarantees exploitation will succeed faster, since fewer steps are involved overall.
Explanation:Enumeration confirms what is actually running (versions, configurations, purpose of a service) before deciding what to test. Skipping it means acting on assumptions from a raw scan, which increases the chance of wasted effort or unintended disruption.
Pt Methodology PhasesDifficulty 2
In methodology terms, what does the exploitation phase of a pentest aim to establish, without going into any technique-level detail?
- aWhether a suspected weakness can actually be leveraged to gain some real level of unauthorized access, confirming it is not just a theoretical finding.✓
- bThat every employee has memorized the organization's password policy.
- cThat the client's legal department has approved the wording of the final report, a step that happens well after any technical testing activity has finished.
- dThat the reconnaissance phase collected the maximum possible amount of public data.
Explanation:The exploitation phase exists to move a finding from 'theoretically weak' to 'demonstrably exploitable' — confirming real-world impact rather than technique. This is a validation step, not a place to describe how any specific attack is carried out.
Pt Methodology PhasesDifficulty 2
What is the general purpose of the post-exploitation phase in a pentest methodology?
- aTo permanently disable the compromised system so it can never be used again.
- bTo draft the invoice that will be sent to the client's finance department.
- cTo repeat the exact same reconnaissance steps a second time for redundancy.
- dTo assess the real-world impact of a foothold — what sensitive data or systems it could realistically reach.✓
Explanation:Post-exploitation is about understanding consequence: once some access is confirmed, what does that access actually expose in business terms (data sensitivity, further reachable systems), which feeds directly into risk-based reporting.