Attacks & Exploits
52 practice questions with explanations — 15 free to try
PassNova has 52 CompTIA PenTest+ practice questions on Attacks & Exploits, each with a clear explanation. A 15-question taster is free with no sign-up; the full bank is part of PassNova Premium. Updated for 2026.
Attacks & Exploits: example questions & answers
3 worked examples with answers and explanations below. Try 15 CompTIA PenTest+ questions free in the browser; the full 52-question Attacks & Exploits bank is part of PassNova Premium.
A web application accepts the input ' OR '1'='1 in a login field and grants access. Which vulnerability does this demonstrate?
- ASQL injection✓
- BCross-site request forgery (CSRF)
- CBuffer overflow
- DCross-site scripting (XSS)
Answer: The payload manipulates the SQL query logic so the WHERE clause always evaluates true, bypassing authentication, which is a classic SQL injection.
A tester captures NTLMv2 hashes from a Windows network using Responder, then uses them to authenticate to another host without cracking them. What is this technique called?
- AGolden ticket
- BKerberoasting
- CPass-the-hash✓
- DPass-the-ticket
Answer: Pass-the-hash reuses a captured password hash directly to authenticate to other systems via NTLM, avoiding the need to crack the plaintext password.
Which attack requests Kerberos service tickets for accounts with Service Principal Names (SPNs) and cracks them offline to recover service account passwords?
- AARP spoofing
- BDNS poisoning
- CSmurf attack
- DKerberoasting✓
Answer: Kerberoasting requests TGS tickets for SPN-associated service accounts; because the ticket is encrypted with the service account's password hash, it can be cracked offline to recover the password.