CompTIA PenTest+ Practice Questions: Information Gathering and Vulnerability Identification Domain

Published: July 31, 2025 | 20 min read

Test your CompTIA PenTest+ knowledge with 10 practice questions from the Information Gathering and Vulnerability Identification domain. Includes detailed explanations and answers.

CompTIA PenTest+ Practice Questions

Master the Information Gathering and Vulnerability Identification Domain

Test your knowledge in the Information Gathering and Vulnerability Identification domain with these 10 practice questions. Each question is designed to help you prepare for the CompTIA PenTest+ certification exam with detailed explanations to reinforce your learning.

Question 1

Which of the following is a non-intrusive method for identifying vulnerabilities in a network?

A) Credentialed scanning

B) Social engineering

C) Network traffic analysis

D) Denial of Service attack

Show Answer & Explanation

Correct Answer: C

Explanation: Network traffic analysis is non-intrusive as it involves monitoring and analyzing traffic without affecting the network. Credentialed scanning (A) is intrusive, social engineering (B) targets human factors, and a Denial of Service attack (D) is disruptive.

Question 2

During a penetration test, which technique would be most effective for gathering information about a company's internal network structure without direct access?

A) Phishing emails

B) Social media profiling

C) DNS zone transfer

D) ARP scanning

Show Answer & Explanation

Correct Answer: C

Explanation: A DNS zone transfer can potentially reveal detailed information about a company's internal network structure, such as internal hostnames and IP addresses, if misconfigured. Phishing emails (A) and social media profiling (B) are more human-centric and do not directly reveal network structure. ARP scanning (D) requires internal network access and is not applicable for external information gathering.

Question 3

Which of the following best describes the use of the tool 'theHarvester' in information gathering?

A) To scan for open ports on a target network

B) To gather email addresses and subdomains

C) To exploit web application vulnerabilities

D) To perform a denial of service attack

Show Answer & Explanation

Correct Answer: B

Explanation: TheHarvester (B) is a tool used in information gathering to collect email addresses, subdomains, and other related information from public sources. It is not used to scan for open ports (A), exploit web application vulnerabilities (C), or perform denial of service attacks (D).

Question 4

Which of the following tools is best suited for conducting a passive reconnaissance of a target network?

A) Wireshark

B) Nmap

C) Shodan

D) Metasploit

Show Answer & Explanation

Correct Answer: C

Explanation: Shodan is a search engine for Internet-connected devices and is used for passive reconnaissance because it allows you to gather information about devices and services exposed to the internet without actively probing the target network. Wireshark (A) is used for network traffic analysis, Nmap (B) is an active scanning tool, and Metasploit (D) is used for exploiting vulnerabilities.

Question 5

What is the role of a banner grabbing technique in the context of vulnerability identification?

A) To intercept and modify network packets

B) To identify the services running on open ports

C) To encrypt communication between client and server

D) To perform denial-of-service attacks

Show Answer & Explanation

Correct Answer: B

Explanation: Banner grabbing is used to identify services and versions running on open ports by capturing the initial communication banner from a service. This information can help in identifying potential vulnerabilities associated with those services. It does not intercept or modify network packets (A), encrypt communication (C), or perform denial-of-service attacks (D).

Question 6

What is the primary purpose of conducting a DNS zone transfer during a penetration test?

A) To capture network traffic

B) To gather subdomain information

C) To identify open ports

D) To exploit web applications

Show Answer & Explanation

Correct Answer: B

Explanation: A DNS zone transfer is used to gather detailed information about a domain, including subdomains and hostnames. Capturing network traffic (A) is related to packet analysis, not DNS. Identifying open ports (C) is done through port scanning, and exploiting web applications (D) involves identifying and using vulnerabilities in web apps.

Question 7

In the context of vulnerability identification, what is the significance of CVE (Common Vulnerabilities and Exposures) identifiers?

A) They provide detailed exploit code for vulnerabilities

B) They offer a standardized reference for known vulnerabilities

C) They are used to encrypt sensitive data

D) They identify the physical location of a server

Show Answer & Explanation

Correct Answer: B

Explanation: CVE identifiers provide a standardized reference for known vulnerabilities, allowing for consistent and reliable communication about vulnerabilities across various tools and platforms. They do not provide exploit code (A), encrypt data (C), or identify physical server locations (D).

Question 8

What is the primary reason for using OSINT (Open Source Intelligence) in the information gathering phase of a penetration test?

A) To execute denial-of-service attacks

B) To gather publicly available information

C) To perform vulnerability scanning

D) To encrypt communications

Show Answer & Explanation

Correct Answer: B

Explanation: OSINT is used to gather publicly available information about a target, which can be valuable in understanding the target's environment. It is not used to execute denial-of-service attacks (A), perform vulnerability scanning (C), or encrypt communications (D).

Question 9

Which method is most appropriate for identifying the physical location of a server based on its IP address?

A) Performing a geolocation lookup

B) Conducting a port scan

C) Using a vulnerability scanner

D) Executing a SQL injection attack

Show Answer & Explanation

Correct Answer: A

Explanation: Performing a geolocation lookup (A) is the correct method for identifying the physical location of a server based on its IP address. Port scanning (B) identifies open ports, vulnerability scanners (C) identify security weaknesses, and SQL injection attacks (D) are used to exploit database vulnerabilities, none of which provide geolocation information.

Question 10

During a penetration test, you discover an open FTP port on a server. What is the most appropriate next step to identify potential vulnerabilities?

A) Run a vulnerability scan on the FTP service

B) Attempt to brute force the FTP login

C) Capture network traffic to analyze FTP data

D) Check for anonymous login access

Show Answer & Explanation

Correct Answer: A

Explanation: Running a vulnerability scan on the FTP service (A) is the most appropriate next step to identify known vulnerabilities associated with the FTP service. Brute forcing (B) is an aggressive technique that should be used cautiously. Capturing network traffic (C) could be useful but doesn’t directly identify vulnerabilities. Checking for anonymous login (D) is a good step but should be part of a broader vulnerability assessment.

Ready to Accelerate Your CompTIA PenTest+ Preparation?

Join thousands of professionals who are advancing their careers through expert certification preparation with FlashGenius.

✅ Unlimited practice questions across all CompTIA PenTest+ domains
✅ Full-length exam simulations with real-time scoring
✅ AI-powered performance tracking and weak area identification
✅ Personalized study plans with adaptive learning
✅ Mobile-friendly platform for studying anywhere, anytime
✅ Expert explanations and study resources

Start Free Practice Now

Already have an account? Sign in here

About CompTIA PenTest+ Certification

The CompTIA PenTest+ certification validates your expertise in information gathering and vulnerability identification and other critical domains. Our comprehensive practice questions are carefully crafted to mirror the actual exam experience and help you identify knowledge gaps before test day.