CertiFour agreements
An NDA keeps secrets. A master service agreement sets the ongoing terms. A statement of work names this test. A terms-of-service page is not permission to test.
Study guide · Flashcards & memory notes
PenTest+ Flashcards & Memory Notes
40 recall cards for the facts PenTest+ (PT0-003) keeps asking you to separate: agreements, reconnaissance, scan types, attack names, and cleanup.
How to use these cards: Say the answer out loud before you flip the card, and mark it honestly. Revisit the cards you missed tomorrow rather than rereading them right away. Progress is kept only while this page is open. For the full explanations behind each card, see the core notes.
Study mode
Choose a deck, flip each card, and mark what you already know.
You marked every card in this deck as known. Shuffle and run through it again, or choose another deck.
All flashcards
Select a question to reveal its answer.
Deck 1 · Engagement management
Agreements, scope, and the report leaders read.
1.1What must you have before you test a host?
Written permission that names the target. A hallway conversation is not authorization.
1.2What does an NDA protect?
Confidentiality of what you learn. It does not list the systems you may test.
1.3What does a statement of work define?
The targets, the work, and the deliverable for this engagement. A public terms-of-service page is not your scope.
1.4What is a rules-of-engagement exclusion?
A system or technique you must not touch. Interest does not put it in scope.
1.5Who secures customer data in the shared responsibility model?
The customer. The provider secures the platform it operates. The tester stays inside the agreement.
1.6What do you do if the test uncovers evidence of a crime?
Follow the reporting path in the agreement and the law. Do not ignore it, and do not post it.
1.7Which framework is a matrix of tactics and techniques?
MITRE ATT&CK. PTES is a test process. STRIDE is a threat-modeling mnemonic.
1.8What belongs in an executive summary?
The outcome, the business impact, and the decision leaders need. Packet detail stays with the findings.
Deck 2 · Reconnaissance
Public sources, enumeration, and the tools that collect them.
2.1How does passive reconnaissance differ from active reconnaissance?
Passive uses information that is already public. Active sends traffic to learn about the target.
2.2What is Shodan used for on this exam?
Searching hosts and services already visible on the internet. It is not an offline password cracker.
2.3What does theHarvester collect?
Public emails, names, and hosts. It does not map Active Directory attack paths.
2.4What do certificate transparency logs reveal?
Hostnames that received a certificate. They are not a vulnerability score.
2.5What is robots.txt during a test?
A list of paths the site asks crawlers to skip. Those paths can still exist. It is not an access-control list.
2.6What is operating-system fingerprinting?
An inference from how a live host responds. A job post that mentions Windows is a clue, not a fingerprint.
2.7What does Amass help you enumerate?
DNS names and related domains. It is not a wireless cracking suite.
2.8Which logic construct repeats a block of work?
A loop. A conditional chooses a branch. An arithmetic operator calculates a number.
Deck 3 · Vulnerability discovery
Scan types, false results, and physical checks.
3.1How does SAST differ from DAST?
SAST reads code or templates without running the app. DAST tests the running app from the outside.
3.2What is software composition analysis?
A check of third-party components and their known issues. It does not prove the running site has no logic bugs.
3.3How does an authenticated scan differ from an unauthenticated scan?
It logs in and can see local configuration. A clean unauthenticated scan can be a false negative.
3.4Which missed result is a false negative?
A real flaw the tool did not report. A false positive is a finding that is not real.
3.5Why are industrial-control assessments often manual or mirrored?
An aggressive probe can disrupt a fragile process. The agreement should name the method.
3.6What does TruffleHog look for?
Secrets such as keys and passwords in content you are allowed to search. It is not a wireless survey tool.
3.7What is tailgating?
Following an authorized person through a door. A USB drop leaves a device for someone to plug in.
3.8What is a true positive?
The tool reported a flaw and the flaw is real. Priority still depends on exposure and asset value.
Deck 4 · Attacks and exploits
Scores, identity attacks, web bugs, and wireless names.
4.1How do CVSS and EPSS differ?
CVSS is technical severity. EPSS estimates the chance of exploitation. A high score on an isolated lab host can wait.
4.2How do password spraying and credential stuffing differ?
Spraying tries a few passwords across many accounts. Stuffing tries username and password pairs from another breach.
4.3What is MFA fatigue?
Repeated approval prompts until a person accepts one. It is not a faster guess of the password.
4.4What is pass-the-hash?
Reusing a captured password hash to authenticate without recovering the password.
4.5How do SSRF and CSRF differ?
SSRF makes the server request a URL the attacker chose. CSRF makes the victim's browser send a request they did not intend.
4.6How do local and remote file inclusion differ?
Local inclusion uses a file on the server. Remote inclusion pulls a file from somewhere else.
4.7What is an evil twin?
A rogue wireless network using a name people already trust. Jamming only denies the radio.
4.8What is prompt injection?
Untrusted text that tries to override a model's instructions. It is not a VLAN hop.
Deck 5 · Post-exploitation
Persistence, pivoting, and giving the environment back.
5.1How do a bind shell and a reverse shell differ?
A bind shell listens on the target. A reverse shell makes the target connect outward.
5.2Name two persistence methods from the objectives.
A scheduled task and a new account. A one-time directory listing is not persistence.
5.3What is pivoting?
Using a host you can reach to access a network you otherwise cannot route to.
5.4What is a covert DNS channel?
Data hidden inside DNS lookups. Compressing a file is preparation, not by itself a channel.
5.5What must you remove at the end of the test?
Tester accounts, tools, and persistence you added. Leave the client's own accounts in place.
5.6Why preserve artifacts before cleanup?
The report may need the evidence. Destroying it first leaves a finding you cannot show.
5.7What is WinRM used for in lateral movement?
Remote management of a Windows host. It is not a wireless location database.
5.8What does spinning down infrastructure mean?
Turning off systems you created for the test so they do not keep running after the engagement.
Memory notes
Groupings that make the highest-yield PenTest+ facts easier to recall.
Four scan letters
SAST reads code. DAST tests the running app. IAST instruments that app. SCA checks other people's components. An unauthenticated scan can miss the local patch.
Password attempts
Spray a few passwords across many accounts. Stuff breached pairs into a new site. Brute-force one account. A dictionary is a word list. A mask is a pattern.
Two web pairs
SSRF uses the server. CSRF uses the victim's browser. Local file inclusion stays on the host. Remote file inclusion pulls a file in from elsewhere.
Shell direction
Bind listens on the target. Reverse calls out. Outbound still works when inbound ports are closed. Both are persistence until you remove them.
Cleanup order
Keep the evidence the report needs. Remove accounts, tools, and persistence. Turn off infrastructure you created. Then ask the client to accept the close.
Continue the PenTest+ study path
Test what you have learned with a timed practice exam.
Overview
Exam format, the 750 passing score, five domain weights, and the PT0-002 retirement date.
Core Notes
Reference notes for scope, reconnaissance, scans, attack names, and cleanup.
Flashcards & Memory Notes
40 recall cards in five decks, plus memory notes for agreements, scan types, and cleanup.
Practice Exams
200 original questions with custom exams, explanations, and an unofficial score on the 100-900 scale.
Related Tools
Useful companions while you study.
Password Generator
Generate strong random passwords with custom length, characters, symbols, and security options.
Base64 Converter
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
JSON/YAML Converter
Convert structured data between JSON and YAML with formatting and validation.
Time Calculator
Calculate elapsed time, add or subtract hours and minutes, and convert time to decimal hours.
Legal Disclaimer
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. CompTIA and PenTest+ are trademarks of CompTIA, Inc. Certicab is not affiliated with, endorsed by, or sponsored by CompTIA.