CompTIA PenTest+ practice questions.

A penetration tester is reviewing the Statement of Work. The client wants Active Directory testing but not testing of the cloud production environment. The cloud environment shares some authentication with on-premises AD. What is the appropriate scoping action?

A tester is doing passive reconnaissance and wants to inventory the target's exposed cloud assets without sending packets directly to the target. Which combination is most appropriate?

A tester has captured a Service Principal Name (SPN) ticket in an Active Directory environment. They want to crack the ticket offline to recover the service account's plaintext password. Which attack is this?

An AWS EC2 instance is reachable via SSRF from a vulnerable web application. The tester wants to retrieve the IAM credentials the EC2 instance uses. Which endpoint should the SSRF target?

A tester discovers a critical SQL injection during an engagement. The vulnerability is in a production system and clearly exploitable to extract customer PII. What is the appropriate immediate action?

A web application accepts a `id` query parameter that is concatenated into a SQL query without parameterization. The tester wants to confirm vulnerability and determine the back-end database type. Which approach is the canonical first step?