CompTIA PenTest+ Certification PT0-001: Practice Test #3 (Total Seminars) Flashcards
Code signing helps prevent against which of the following? (Choose two.)
A.Modification of system file
B.Compromising the signing certificate of the Certificate Authority
C.Successful execution of modified code
D.Execution of malicious software
C.Successful execution of modified code
D.Execution of malicious software
Explanation
Correct Answer: Successful execution of modified code and execution of malicious software are correct. Code that is signed by a vendor such as Microsoft will prevent modified code or malicious code from successfully executing during runtime.
Incorrect Answers: Modification of system files and Compromising the signing certificate of the Certificate Authority are incorrect because code signing enforces integrity, not access controls. Preventing the modification of a system file is a control enforced by the operating system and preventing an attacker from compromising the signing certificate of the Certificate Authority would be handled by an access control.
In regard to a pentest report, what is a testing narrative?
A.It shows how successful the pentest team was in conducting the assessment
B.It offers details as to the testing methodology that was executed and the outcome
C.It is require for PCI,HIPPA and FedRAMP pentests
D.It provides details for each tool used to conduct the testing
B.It offers details as to the testing methodology that was executed and the outcome
Explanation
Correct Answer: It offers details as to the testing methodology that was executed and the outcome is correct. The testing narrative provides chronological and causal data regarding the actions taken during testing to provide context for the findings within the scope of the methodology.
Incorrect Answers: It provides details for each tool used to conduct the testing is incorrect because each tool will not be elaborated on, especially if it is irrelevant to describe the technique used to exploit a target.
It shows how successful the pentest team was in conducting the assessment is incorrect because this could be a sign of gloating, and potentially add a negative tone to the report. The pentest team is successful when they execute testing activities that are within the bounds and constraints of the RoE and address all of the customer’s requirements/objectives from the assessment.
It’s required for PCI, HIPAA, and FedRAMP pentests is incorrect because PCI, HIPAA, and FedRAMP pentests have their own standards and guidelines for how a pentest report should be written, and a testing narrative may not be necessary.
During a pentest, your team finds a vulnerability in one of the customer’s PHP applications. The following command was used to exploit the vulnerability. What type of vulnerability did your team attempt to exploit?
curl http://www.example.com/info.php?name=test;cat%20/etc/passwd
A.Command injection attack
B.SQL Injection attack
C.Remote file include
D.Local file include
A.Command injection attack
Explanation
Correct Answer: Command injection attack is correct. This scenario shows an example of a command injection attack, where the id web parameter allowed the pentest team to insert the cat command into the URL to read the contents of the local /etc/passwd file.
Incorrect Answers: Remote file include is the incorrect because the attack uses an operating system command to read the local contents of the /etc/passwd file.
Local file include is incorrect because a command was used to read the contents of a local file, not an include function from the PHP application.
SQL injection attack is incorrect because a system command, not an SQL command, was used to carry out the injection attack.
The \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ dictionary is the standard for documenting publicly disclosed vulnerabilities. A.CWWE B.CVE C.NVD D.BID
B.CVE
Explanation
Correct Answer: CVE is correct. The Common Vulnerabilities and Exposures (CVE) dictionary is the standard for documenting publicly disclosed vulnerabilities.
Incorrect Answers: CWE is incorrect because the Common Weakness Enumeration (CWE) is used to track common vulnerabilities that may not be attributed to a product or service.
NVD is incorrect because the National Vulnerability Database (NVD) is the U.S. government repository of standards-based vulnerability management data and is maintained by the National Institute of Standards and Technology (NIST).
BID is incorrect because the Bugtraq ID (BID) is a reference ID given to a unique vulnerability and is tracked by SecurityFocus (https://www.securityfocus.com), but is not the standard for reporting public vulnerabilities.
During a web vulnerability scan, you discover the customer’s web server does not define the X-XSS-Protection header. Given the following scan results from Nikto, how could this type of vulnerability be exploited?
A.The client could be susceptible to a stored CSRF attack that could steal credentials from the users web browser
B.The server could be exploited using a command injection attack
C.The user would be susceptible to clickjacking attacks
D.Since the header is not defined the user could potentially be susceptible to a reflected XSS attack within the web browser
D.Since the header is not defined the user could potentially be susceptible to a reflected XSS attack within the web browser
Explanation
Correct Answer: Since the header is not defined, the user could potentially be susceptible to a reflected XSS attack within the web browser is correct. The X-XSS-Protection response header is used by various web browsers (such as Internet Explorer, Chrome, and Safari) to prevent malicious pages from loading when a reflected cross-site scripting (XSS) attack is detected.
Incorrect Answers: The server could be exploited using a command injection attack is incorrect because this is a client-side attack, not a server-side attack.
The client could be susceptible to a stored CSRF attack that could steal credentials from the user’s web browser is incorrect because the attack vector would be through cross-site scripting (XSS), not cross-site request forgery (CSRF).
The user would be susceptible to clickjacking attacks is incorrect because there is another web server header to help control those types of attacks, such as the X-Frame-Options header.
During web application testing you observe an HTTP 403 response from the web server when brute forcing web directories on the server. What is the likely cause of this response?
A.The web server encountered an internal error
B.You attempted to access a web page that requires authentication
C.The web page you requested does not exist
D.The web page was moved to another location
B.You attempted to access a web page that requires authentication
Explanation
Correct Answer: You attempted to access a web page that requires authentication is correct. An HTTP 403 message is attributed to a user not having permission to access a resource on the web server, typically due to the user failing to authenticate prior to requesting the resource.
Incorrect Answers: The web page you requested does not exist is incorrect because an HTTP 404 response is used to produce that type of message.
The web page was moved to another location is incorrect because an HTTP 302 response is used to produce that type of message.
The web server encountered an internal error is incorrect because an HTTP 500 response is used to produce that type of message.
Given the following nmap command syntax, what is the purpose of the -T flag?
nmap -n -sSV -T4 192.168.1.0/24
A.An aggressive template used by nmap to enhance the speed of the scan, and is not concerned with accuracy
B.A timing template used by nmap to conserve bandwidth and resource utilization on the target machine
C.A template used by nmap that is followed by a number, <0-5>, to determine how many seconds to execute the scan for (that is 0-5 seconds in total
D.A timing template used by nmap to be sneaky when conducting port scans against a remote target machine
A.An aggressive template used by nmap to enhance the speed of the scan, and is not concerned with accuracy
Explanation
Correct Answer: An aggressive timing template used by nmap to enhance the speed of the scan, and is not concerned with accuracy is correct. The nmap -T flag is a timing template that simplifies the process of telling the port scanner how efficient or effective you want the scan to be. Rather than the tester determine the timing values manually with other performance options, nmap will determine them based on the template used in the scan syntax. -T <0> or <1> is used to be sneaky and evade IDS, while -T <2> is used to conserve bandwidth, -T <3> is the default scan template used when no option is specified, -T <4> is the aggressive scan template, and -T <5> is the insane template. Both <4> and <5> should only be used when network bandwidth is not limited.
Incorrect Answers: The other choices are incorrect. When the -T flag is used, Nmap will determine the timing for you. The number <0-5> passed after the -T flag will determine the template to use, and does not represent the number of seconds to execute the scan for. -T <2> is used to conserve network bandwidth, and the -T <0-1> templates are used to be sneaky and evade IDS.
During a pentest, you are able to compromise the local administrator password for one of the Windows servers on the customer's internal domain. Which Sysinternals command can you use to execute a command shell against other Windows servers on the network to see if the customer is susceptible to password reuse? A.AccessChk B.BGInfo C.AccessEnum D.PsExec
D.PsExec
Explanation
Correct Answer: PsExec is correct. The PsExec utility (psexec.exe) can be used to execute processes (e.g., cmd.exe) on remote hosts over the network using your Windows credentials.
Incorrect Answers: AccessEnum is incorrect because AccessEnum is a Sysinternals tool that enables system administrators a view of the local file system and registry security settings.
BGInfo is incorrect because BGInfo is a Sysinternals tool that allows the wallpaper (background) to be changed for a local user.
AccessChk is incorrect because AccessChk is a Sysinternals tool that can be used to verify user permissions on files, directories, registry keys, global objects, and Windows services.
Red teaming can be used to simulate an unauthorized threat actor that has unlimited time, resources, and money. Which of the following threat actors would red teaming be used to simulate, given the scenario? A.Advanced persistent threat B.Hacktivist C.Script kiddie D,Insider threat
A.Advanced persistent threat
Explanation
Correct Answer: Advanced persistent threat is correct. An advanced persistent threat (APT) has the time and resources available to pursue a target at any cost. A red team assessment, or red teaming, will evaluate how well an organization would fare given a scenario of a real-world attack (cyber threat). Red teaming involves stealth and blended methodologies (such as network penetration testing and social engineering) to simulate an attacker in the category of an APT.
Incorrect Answers: Hactivist is incorrect because a Hactivist will have various levels of expertise.
Script kiddie is incorrect because Script kiddies are less skilled hackers that use public tools, exploits, and techniques.
nsider threat is incorrect because the Insider threat would be an authorized user of the network, not unauthorized.
A \_\_\_\_\_\_\_ computes all of the possible hash values for plaintext values of a certain length. A.Brute force attack B.Rainbow table C.Password guessing attack D.Dictionary attack
B.Rainbow table
Explanation
Correct Answer: Rainbow table is correct. A rainbow table computes all of the possible hash values for plaintext values, up to a certain length. Regardless of your computing power, these tables can become massive and require hefty storage capacity, some over 300GB in size. Each table is usually strategically designed for a specific hash requirement.
Incorrect Answers: Password guessing, Dictionary attack, and brute force attack are incorrect as each of the answers describe a password attack.
Prior to the pentest, the customer provides your team with support resources and artifacts in order for your team to assist with the validation testing during an internal assessment. Among these artifacts is the SOAP project file. Which of the following best describes the purpose of this artifact?
A.Provides a machine-readable XML description of HTTP-based web services
B.Fomarily describes the elements comprising an XML document
C.Describes the format for receiving and sending messages
D.Elaborate on the framework used to develop the software application
C.Describes the format for receiving and sending messages
Explanation
Correct Answer: Describes the format for receiving and sending messages is correct. The Simple Object Access Protocol (SOAP) project file describes the format for receiving and sending messages between web-based services.
Incorrect Answers: Provides a machine-readable XML description of HTTP-based web services is incorrect because a machine-readable XML description of HTTP-based web services is found in the Web Services Description Language (WSDL).
Elaborates on the framework used to develop the software application is incorrect because the software development kit (SDK) documentation elaborates on the framework used to develop the software application.
Formally describes the elements comprising an XML document is incorrect because the Extensible Markup Language (XML) scheme definition (XSD) is used to formally describe the elements comprising an XML document.
During an internal pentest of a company’s network, you find that a substantial number of Active Directory user account passwords on the Windows domain are susceptible to brute-force login attacks, using passwords of no more than six characters in length, with little to no password complexity. Which mitigation strategy should you recommend to the customer?
A.Limit character reuse
B.Remove default user accounts on the system
C.Enforce a stronger password policy
D.Dont use password susceptible to dictionary attacks
C.Enforce a stronger password policy
Explanation
Correct Answer: Enforce a stronger password policy is correct. The customer’s network in the scenario provided lacks the ability to enforce stronger password settings, which can be controlled using both a technical policy and an administrative control policy. The administrative policy can inform users that they must use passwords that meet a certain level of complexity, and a technical policy can enforce the actions of the administrative policy using a configuration setting.
Incorrect Answers: Don’t use passwords susceptible to dictionary attacks is incorrect because telling the customer to not use passwords susceptible to dictionary attacks only highlights the weakness and is not a mitigation strategy.
Limit character reuse is incorrect because limiting character reuse during the password creation process may not alter the complexity of the password, thus not preventing passwords used on the domain from being susceptible to brute-force logins.
Remove default user accounts on the system is incorrect because removing default user accounts on the system doesn’t address the issue of weak passwords.
During a physical pentest, your team was able to duplicate a valid employee's proximity card and would like to use it to gain access to the server room. What type of attack is described in this scenario? A.Engress sensor bypass B.RFID cloning C.Lock bumping D.SPP
B.RFID cloning
Explanation
Correct Answer: RFID cloning is correct. RFID cloning (badge cloning) is the process of duplicating a valid identification card used for physical entry.
Incorrect Answers: SPP is incorrect because single pin picking (SPP) is a technique used for picking the pins in pin tumbler locks.
Lock bumping is incorrect because lock bumping is a technique used for brute-forcing door locks.
Egress sensor bypass is incorrect because an egress sensor bypass is not used to clone identification cards, but rather accomplished by wedging a piece of paper between the top of the door and the door frame to trigger the motion sensor to release the magnetic lock, allowing unauthorized entry through the door.
During a wireless pentest, your team has asked you to recover the four-way handshake for a WPA2 network. Which type of attack will you execute? A.Wi-Fi jamming B.Downgrade attack C.Deuahtneitcation attack D.Repeating
C.Deuahtneitcation attack
Explanation
Correct Answer: Deauthentication attack is correct. A deauthentication attack will force the wireless client to deauthenticate from the WPA2 wireless network, and when the client reestablishes the connection with the access point, you will be able to capture the handshake.
Incorrect Answers: Wi-Fi jamming is incorrect because Wi-Fi jamming (or RF jamming) is an illegal technique used to block radio frequencies originating from legitimate devices that rely on RF, such as equipment found in hospitals.
Downgrade attack is incorrect because downgrade attacks are used to target weak encryption protocols or ciphers for man-in-the-middle attacks.
Repeating is incorrect because repeating is used to extend a wireless network for clients outside the range of a wireless access point.
During a physical pentest, you find that your customer is using a cipher lock to secure access to their server room. Which of the following are attacks that you can perform to bypass the locking mechanism using a forensically sound approach? (Choose two.) A.Shim B.Brute-force the cipher C.HAmmer D.High-powered magnet
B.Brute-force the cipher
D.High-powered magnet
Explanation
Correct Answers: High-powered magnet is correct because placing a high-powered magnet on the exterior housing of the cipher lock will draw the internal flag out of position so the lock can be opened.
Brute-force the cipher is correct because the lock is susceptible to brute-force methods, but depending on the combination it could take a considerable amount of time to execute successfully.
Incorrect Answers: Shim is incorrect because the exterior housing of the cipher lock is closed off, preventing the shim from being an effective method of attack.
Hammer is incorrect because a hammer is destructive and is not a forensically sound method for opening the lock.
In the context of a pentest report, a finding is a weakness that could be advantageous to an attacker and, when documented in the report, includes actionable items from exploitation and post-exploitation activities. Which of the following would be considered findings that should be included in the pentest report? (Choose two.)
A.The pentest team successfully bypassed the physical locking mechanism of the cipher lock using a known bypass to gain access to the organizations telecommunications closet
B.The vulnerability scanner found that the version of SSL being used does not meet industry best practices. However, this vulnerability was not found when the scan was executed from inside the trusted network
C.The pentest team conducted MTM exploitation against assets operating on the LAN
D.A SQL Injection vulnerability provided the pentest team direct access to the production database server
A.The pentest team successfully bypassed the physical locking mechanism of the cipher lock using a known bypass to gain access to the organizations telecommunications closet
D.A SQL Injection vulnerability provided the pentest team direct access to the production database server
Explanation
Correct Answers: A SQL injection vulnerability provided the pentest team direct access to the production database server and the pentest team successfully bypassed the physical locking mechanism of the cipher lock using a known bypass to gain access to the organization’s telecommunications close are correct. They describe the exploitation of a vulnerability and provide supporting written evidence of a finding.
Incorrect Answers: The pentest team conducted MiTM exploitation against assets operating on the LAN is incorrect because conducting man-in-the-middle (MiTM) testing does not constitute a finding; rather, it’s a testing activity or methodology that can be added to the testing narrative to describe internal testing on the local area network (LAN). However, there are valid mitigations that environments can put in place to reduce or remove the ability for an attacker to successfully perform MiTM attacks. The vulnerability scanner found that the version of SSL being used does not meet industry best practices. However, this vulnerability was not found when the scan was executed from inside the trusted network is incorrect because a vulnerability produced from a vulnerability scanner is not always valid. Sometimes the results are false positives that require further investigation.
Requirements management is a continuous process that enables personnel to manage the needs of an organization. A key aspect of requirements management is the \_\_\_\_\_\_\_\_\_\_\_\_\_, which is a formal approach to assessing the pros and cons of pursuing a course of action. A.Organizational budget B.Impact statement C.Impact analysis D.technical constraints
C.Impact analysis
Explanation
Correct Answer: Impact analysis is correct. The impact analysis (IA) is a key aspect of requirements management and the formal approach to assessing the pros and cons of pursuing a course of action.
Incorrect Answers: Impact statement is incorrect because the impact statement is an output from the impact analysis process, so the analysis/research needs to be conducted prior to deriving any results.
Organizational budget is incorrect because the organizational budget is used to determine if funds are available to support a particular activity, such as a pentest.
Technical constraints is incorrect because technical constraints identify technological challenges and obstacles that could negatively affect the organization.
Organizations looking for an evaluation that tests their defense posture against real-world attacks that involve stealth and blended methodologies and that tests time to detection, time to response, and resilience against specific modeled threats would be looking for which type of assessment? A.Goals-based B.PCI-DSS C.Red team D.Compliance-based
C.Red team
Explanation
Correct Answer: Red team is correct. A red team assessment, or red teaming, will evaluate how well an organization would fare given a scenario of a real-world attack of skilled attackers. Red teaming involves stealth and blended methodologies (such as social engineering and network penetration testing). The goals of red teaming are to test time to detection, time to response, and resilience against specifically modeled threats using tactics not limited to a single attack scope.
Incorrect Answer:Compliance-based and PICI DSS incorrect because those types of assessments would satisfy compliance and regulatory based assessments.
Goals-based is incorrect because goals-based assessments cover specific goals, or objectives, within a defined scope, whereas red teaming could expand using tactics that are not limited to a single attack scope.
After gaining a foothold in customer ABC’s network, you want to set up persistence on the target Linux host you compromised root-level access on. The host is configured to allow SSH logins as root, and the root account is configured to support VNC and SSH connectivity from anywhere. Which of the following options are an alternative to creating a cronjob that sends a reverse shell to your attack box occasionally? (Choose two.)
A.Generate an SSH key and append a self-generated public key to root’s authorized_user file
B.Create a new user account with sudo privilege’s
C.Change the VNC password
D.All of the answer choices are correct
A.Generate an SSH key and append a self-generated public key to root’s authorized_user file
B.Create a new user account with sudo privilege’s
Explanation
Correct Answer: Create a new user account with sudo privileges is correct because creating a new user account will not interfere with existing accounts on the network, and allowing sudo access will ensure you can still obtain root-level access to the target host.
Generate an SSH key and append a self-generated public key to root’s authorized_user file is correct because root SSH logins are permitted and you are using a self-generated key (that no one else should have but you) to access the root user account, which can be removed after testing is completed.
Incorrect Answer:Change the VNC password is incorrect because changing the VNC password would prevent the authorized user from logging in, which could prevent the user from doing legitimate work and impact the productivity for the organization.
“All of the answers are correct” is incorrect because change the VNC password is incorrect.
The rules of engagement (RoE) document MUST contain a signature from which of the following? (Choose two.) A.Contracts department B.Finance department C.Organizational management D.Service vendor
C.Organizational management
D.Service vendor
Explanation
Correct Answers: Service vendor is correct because the service vendor is the one who carries out the execution of the pentest.
Organizational management is correct because organizational management is responsible for working with the vendor to ensure they have what they need to be successful, and providing direct oversight of the project.
Incorrect Answers: Finance department is incorrect because the financial department is responsible for paying the purchase order for the work and verifying the service vendor’s invoice.
Contracts department is incorrect because the contracts department is involved when signing other contractual documents such as the MSA or SOW, and holds the service vendor accountable for all contractual obligations. Neither department needs to sign the RoE document.
In a SCADA system, Modbus typically operates on which of the following ports? A.502/tcp B.3306/tcp C.902/tcp D.161/udp
A.502/tcp
Explanation
Correct Answer: 502/tcp is correct.
Incorrect Answers: Modbus is a common Supervisory Control and Data Acquisition (SCADA) protocol that operates on port 502/tcp.
161/udp is incorrect because port 161/udp is used for SNMP. 902/udp is incorrect because port 902/tcp is used for VMware Server.
3306/tcp is incorrect because port 3306/tcp is used for MySQL Server.
Open-source intelligence (OSINT) gathering is the process of data mining public sources of information about your target or target environment. Which of the following is a valid source for conducting OSINT? A.Websites B.All of the answer choices are correct C.Social media D.Public records
B.All of the answer choices are correct
Explanation
Correct Answers: All of the answers are correct. All of the choices can provide open-source intelligence and knowledge from public sources of information regarding your target’s environment.
Incorrect Answer: All of the other choices are incorrect as individual responses because they all are valid sources for conducting OSINT, making choice “all the answers” the best answer.
IEEE 802.3 is the standard for which of the following options? A.Bluetooth B.Wired Ethernet C.Wi-Fi D.Zigbee
B.Wired Ethernet
Explanation
Correct Answer: Wired Ethernet is correct. The IEEE 802.3 standard describes all the physical characteristics of wired Ethernet, including the physical layer, data link layer, and media access control (MAC) that are used to communicate over local area networks (LANs) and wide area networks (WANs).
Incorrect Answers: Wi-FI is incorrect because Wi-Fi standards are defined in IEEE 802.11.
Bluetooth and Zigbee are incorrect because Bluetooth and Zigbee are defined in IEEE 802.15.
During a pentest, you were able to compromise the local `/etc/shadow` file for a Linux server. Given limited time and resources, you won't be able to use advanced methods to crack the passwords. Given these constraints, which of the following will allow you to apply a best effort to crack the password hashes? (Choose three.) A.Password guessing B.Dictionary attack C.Brute force D.Rainbow table
A.Password guessing
B.Dictionary attack
C.Brute force
Explanation
Correct Answers: Brute force, dictionary attack, and password guessing are correct. These answers are brute-force/guessing attacks that can be used to recover the plaintext value of a hash that has little to no password complexity, or is subject to a dictionary attack using a word list.
Incorrect Answer: Rainbow table is incorrect. It will take some time to compute a hash table, given the current constraints in the scenario.
Disassembling and decompiling an application from its original format to look for security bugs is considered which of the following activities?
A.Debugging
B.Dynamic application security testing (DAST)
C.Source code analysis
D.Static application security testing (SAST)
D.Static application security testing (SAST)
Explanation
Correct Answer: Static application security testing (SAST) is correct. SAST is a debugging method used to examine source code, bytecode, and binaries for security deficiencies and does not involve executing the application.
Incorrect Answers: Dynamic application security testing (DAST) is incorrect because DAST is used when the application is running.
Debugging is incorrect because debugging is not necessarily used just for finding security bugs as it can be used by the developer for troubleshooting purposes.
Source code analysis is incorrect because source code analysis is not a process that decompiles or disassemble an application. Source code is typically the noncompiled functionality of a program.
After obtaining root access through a local privilege escalation vulnerability on a Linux server, you decide to create a cronjob to call back to your attack host with a remote shell every hour in case the system administrator reboots the server. This technique is known as what? (Choose two.) A.Creating a back door B.Lateral movement C.Pivoting D. Maintaining persistence
A.Creating a back door
D. Maintaining persistence
Explanation
Correct Answer: Maintaining persistence and Creating a back door are correct. Creating a cronjob to call back to your attack host would be considered both maintaining persistence and creating a backdoor into the customer’s network.
Incorrect Answer: Lateral movement is incorrect because lateral movement would be remotely connecting to other hosts on the customer’s network or domain using native operating system commands, such as ssh with the same user’s domain credentials.
Pivoting is incorrect because pivoting would be the process of utilizing a compromised target or host within your control to exploit trust relationships within the domain. For example, establishing a foothold on a compromised target in the customer network behind an external firewall, then creating an SSH tunnel through the firewall to stage attacks against other internal network targets from the compromised target.
Directory indexing attacks can exploit which feature of a web server?
A.Weak access controls
B.Listing files and other objects within the current directory
C.Authentication bypass
B.Listing files and other objects within the current directory
Explanation
Correct Answer: Listing files and other objects within the current directory is correct. Directory indexing (directory browsing) is similar to an ls command in Unix or dir command in Windows. With directory browsing enabled on the web server and a lack of access controls, an attacker would not have to rely on brute-force methods to derive web pages and/or subdirectories as they would be exposed from the within the current directory.
Incorrect Answer: Authentication bypass is incorrect because authentication bypass is a different type of attack, and would only be possible if the web server or application hosted on the server was vulnerable to that type of attack.
Weak access controls is incorrect because simply being able to list the contents of a web directory remotely does not mean the server has weak access controls. The listing of files and objects within the current directory can save a pentester time with having to brute-force all of those objects; however, in some cases, the customer may have allowed directory indexing for a reason.
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ is a tactical process for surveying an area for wireless access points while in a moving vehicle. A.Stumbling B.Wardriving C.Enumeration D.Scanning
B.Wardriving
Explanation
Correct Answer: Wardriving is correct. Wardriving is a tactical process for surveying an area for wireless access points while in a moving vehicle in order to identify wireless networks and potential targets in a certain area of interest.
Incorrect Answers: Stumbling is incorrect because stumbling is a surveillance technique used for discovering SSIDs, router vendor information and signal strength, MAC addresses, channels, and so on.
Scanning is incorrect because scanning is the process of examining or studying the surface of an object. In regard to scanning a network, this option is a little more obtrusive than wardriving.
Enumeration is incorrect because enumeration is the process of extracting information from a particular target, rather than passive surveillance of a target area during reconnaissance
Given the following example, which of these statements is correct?
A.Netcat is listening for a reverse shell from the kali host
B.Netcat was used to connect to a bind shell on dns1
C.Netcat was executed from the kali host to connect to dns1
D.Netcat was used to connect back to the kali host using a reverse shell
D.Netcat was used to connect back to the kali host using a reverse shell
Explanation
Correct Answer: Netcat was used to connect back to the kali host using a reverse shell is correct.
Incorrect Answers: The netcat command was used to establish a reverse shell with the kali host.
Netcat was executed from the kali host to connect to dns1 is incorrect because the reverse shell was executed from the target host (dns1), not the kali host.
Netcat is listening for a reverse shell from the kali host is incorrect because the target host (dns1) was used to establish a reverse shell with the kali host.
Netcat was used to connect to a bind shell on dns1 is incorrect because the target host (dns1) used a reverse shell, not a bind shell, to call back to the kali host.
