PENTEST+ Cheat Sheet 2026

The 30 highest-yield PENTEST+ facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What is 'Kerberoasting' used for in Active Directory environments? → Requesting service tickets for SPNs and extracting their hashes for offline cracking
2. Which document formally authorizes a penetration tester to perform security assessments and protects them from legal liability? → Rules of engagement
3. An attacker exploits a race condition between a privilege check and file operation in a SUID program. What classic vulnerability type does this represent? → Time-of-check to time-of-use (TOCTOU)
4. Which of the following is a key reason to include third-party service providers in the scoping discussion of a penetration test? → Testing systems owned by third parties may require separate authorization
5. Which tool is commonly used for maintaining persistent access and post-exploitation activities after initial compromise? → Metasploit Meterpreter
6. What is the purpose of a 'severity rating' assigned to each finding in a pentest report? → To help the client prioritize remediation efforts based on risk to the organization
7. Which scoping activity helps identify systems that should be excluded from testing to prevent business disruption? → Fragility assessment
8. When testing REST APIs during a pentest, which technique helps identify endpoints that are not documented but may be accessible? → Fuzzing with wordlists of common API paths
9. What is 'pivoting' in the context of penetration testing? → Using a compromised host as a relay to reach other network segments
10. Which Nmap scan type sends SYN packets but never completes the TCP handshake, making it less likely to be logged by the target application? → SYN stealth scan (-sS)
11. What does token impersonation allow an attacker to do in a Windows post-exploitation scenario? → Assume the identity and privileges of another logged-in user
12. Which metric best measures the success of a phishing simulation campaign during a pentest engagement? → Click-through rate and credential submission rate
13. What tool is commonly used for information gathering during a penetration test? → Nmap and Netcat
14. A PHP application includes files based on a `page` parameter: `include($_GET['page'] . '.php')`. How could a tester exploit Local File Inclusion (LFI)? → Using path traversal sequences like `../../../etc/passwd%00`
15. Which vulnerability is exploited when an attacker injects an external entity into an XML document to read local files from the server? → XXE Injection
16. How should a PenTest+ professional manager address underperformance within their team? → Provide timely, specific feedback with support and a clear improvement plan
17. What is the MOST effective way for new PenTest+ professionals to build competency in their field? → Combining formal education, mentored practice, and ongoing professional development
18. Which HTTP security header specifically prevents a web page from being embedded in an iframe to mitigate clickjacking attacks? → X-Frame-Options
19. What is the role of reconnaissance in penetration testing? → Gathering information to identify attack vectors
20. During wireless testing, a tester captures a 4-way WPA2 handshake and runs it through hashcat with a wordlist. What is being attacked? → The Pre-Shared Key (PSK) via offline dictionary attack
21. What is 'tailgating' (piggybacking) in physical security penetration testing? → Following an authorized person through a secured door without presenting credentials
22. What is 'shoulder surfing' as a physical security attack? → Observing someone's screen or keyboard to capture PINs, passwords, or sensitive data
23. Which tool is commonly used to exploit network vulnerabilities? → Metasploit
24. Why is reporting important in penetration testing? → To provide actionable recommendations for improving security
25. What does a 'get-out-of-jail-free letter' represent in the context of a penetration testing engagement? → Written authorization proving the tester has permission to conduct the assessment
26. What should be done after identifying vulnerabilities in a penetration test? → Report and assess risk for further testing
27. A tester discovers that a web application renders user input inside a Jinja2 template. Submitting `{{7*7}}` returns `49`. What vulnerability is present? → Server-Side Template Injection (SSTI)
28. What is a zero-day attack? → An attack targeting an unpatched, unknown vulnerability
29. Which concept describes the process of correlating data from multiple OSINT sources to build a comprehensive profile of a target? → Intelligence fusion
30. A tester discovers evidence of an active breach by a third party during a scheduled pentest. What is the MOST appropriate immediate action? → Document the breach evidence and immediately notify the client