CompTIA PenTest+ Certification PT0-001: Practice Test #4 (Total Seminars) Flashcards
Post-engagement cleanup involves completing which of the following activities? A.All of the answer choices are correct B.Removing tools C.Removing shells D.Removing tester-created credentials
A.All of the answer choices are correct
Explanation
Correct Answer: All of the answers are correct. Removing shells, tools, and tester-created credentials is part of cleaning up the customer environment. It is import to ensure the environment is left the way you found it. However, some of these activities may require coordination with the customer to ensure they are properly taken care of (for example, cleaning up tester-created users/passwords).
Incorrect Answers: The other answers are incorrect when selected individually because all of these answers are correct.
What defines the requirements and objectives for a penetration test? A.Executive summary B.Scope C.Rule of engagement D.Nondisclosure agreement
B.Scope
Explanation
Correct Answer: Scope is correct. The scope outlines the objectives and requirements for the assessment. During the scoping phase, you attempt to address the testing requirements, target selection, scheduling and timelines, and strategy for testing.
Incorrect Answers: Executive summary is incorrect because the executive summary is a section in the pentest report that includes nontechnical or high-level findings and observations of a pentest.
Rules of engagement is incorrect because the rules of engagement (RoE) document puts into writing the guidelines and constraints regarding the execution of a pentest.
Nondisclosure agreement is incorrect because a nondisclosure agreement (NDA) is a confidentiality agreement that protects a business’s competitive advantage by protecting its proprietary information and intellectual property.
In which of the following situations is it appropriate to immediately halt testing and initiate communication with the client?
A.Discovery of software version number disclosure in an internally facing, business critical web application
B.Discovery of a file named”rs.pl” in the CGI directory of a web application that contains a one-line reverse shell to a system not under your control
C.A system in scope being unresponsive tp pings or port scanning attempts
D.Port scanning taking a little longer than expected
B.Discovery of a file named”rs.pl” in the CGI directory of a web application that contains a one-line reverse shell to a system not under your control
Explanation
Correct Answer: Discovery of a file named “rs.pl” in the CGI directory of a web application that contains a one-line reverse shell to a system not under your control is correct. The scenario described here seems to indicate that there has been a prior breach of the client’s systems. As such, the appropriate action to take is to immediately halt all testing and notify the client. Remember that penetration testing and forensic analysis are different tasks that require different approaches, training, and tools.
Incorrect Answers: Discovery of software version number disclosure in an internally facing, business-critical web application is incorrect because noncritical findings do not merit immediate communication with the client; their time is valuable, as is yours as the penetration tester. The correct decision in this case would be to note the finding and continue testing.
Port scanning taking a little longer than expected is incorrect because port scanning can vary wildly in its duration, depending on numerous network factors and the flags used when executing the port scan. As such, the best course of action would be to simply exercise patience.
A system in scope being unresponsive to pings or port scanning attempts is incorrect because although the unavailability of a system in scope does merit communication with the listed point of contact, it does not necessitate a cessation of all testing.
In Microsoft Windows, the \_\_\_\_\_\_\_\_\_\_\_\_\_ is used to store credentials in memory after a user successfully logs in to a system. A.SAM B.Widgest C.Kerberos D.LSASS
D.LSASS
Explanation
Correct Answer: LSASS is correct. The Local Security Authority Subsystem Service (LSASS) is used to store credentials in memory after a user successfully logs in to a system. The credentials may be an NT LAN Manager (NTLM) password hash, LM password hash, or even a cleartext password. This helps make credential sharing between trusted applications efficient and not require the user to enter a username and password every time authentication is required.
Incorrect Answers: Wdigest is incorrect because Wdigest is a protocol designed to share credentials with applications that use HTTP and the Simple Authentication Security Layer (SASL).
Kerberos is incorrect because Kerberos is a network authentication protocol that leverages a ticketing system to allow hosts and users operating over the network to prove their identity to one another in a secure fashion.
SAM is incorrect because the Security Accounts Manager (SAM) database is a file that contains local account settings and password hashes for the host.
Which attack occurs when an attacker is able to trick a victim into performing unexpected actions on a web application to which they are presently authenticated? A.Local file inclusion B.Cross-site request forgery C.Code injection D.DOM-based XSS
B.Cross-site request forgery
Explanation
Correct Answer: Cross-site request forgery is correct. The attack described is a cross-site request forgery, wherein an application’s trust of a given client (based on their session ID) is exploited to execute changes that are not intended by the user in question. Although the target of a CSRF attack is the server, the attack is necessarily initiated by the abuse of the authenticated victim’s session (perhaps via a well-crafted link in a phishing e-mail), making this a client-side attack.
Incorrect Answers: Code injection is incorrect because code injection would involve an attacker abusing an application system call that relies on unsanitized user input, rather than tricking a user into performing an action they otherwise would not have taken, as described in the question. In other words, since the attack described is not executed against the web server by the attacker directly, and instead relies on abuse of the user’s authenticated session, this answer is incorrect.
DOM-based XSS is incorrect because DOM-based XSS is a client-side attack that targets the victim’s browser rather than the remote server. Since the attack described is targeting a function found on the remote server rather than data or code execution in the user’s browser, this answer is incorrect. Recall that DOM-based XSS attacks are contained in the Document Object Model (DOM), which is a part of the environment of a victim’s browser. This attack method frequently abuses URIs (uniform resource indicators), which are not transferred to the web server but can contain snippets of code; this allows attackers to perform various actions, such as stealing a user’s session cookies.
Local file inclusion is incorrect because local file inclusion would show through the disclosure of a file on the web server, which would ordinarily not be accessible. The attack described instead tricks a user into performing an action they would otherwise be unlikely to perform. Since no disclosure of a local file is described, this answer is incorrect.
Which class of vulnerability occurs when an attacker is able to exploit an improperly configured file inclusion mechanism in a target application in such a way that a web application handles an otherwise inaccessible file, such as the system hosts file or /etc/passwd file in *nix systems?
A.HTML Injection
B.Local file inclusion
C.Remote file inclusion
D.Reflected XSS
B.Local file inclusion
Explanation
Correct Answer: Local file inclusion is correct. The attack described is local file inclusion (LFI). LFI vulnerabilities are best mitigated through the used of “jail directories” that prevent a running web service or application from traversing the entirety of a host’s operating system, and they are best mitigated by properly sanitizing user input and/or by whitelisting files or file types acceptable for inclusion.
Incorrect Answers: Remote file inclusion is incorrect because remote file inclusion would require that the web server load a resource hosted on an external system, rather than a file stored on the local system, as described in the scenario.
HTML injection is incorrect because HTML injection would show through the addition of malicious HTML to a web server that would then be executed in a visiting victim’s web browser. The attack described instead attacks the server directly in order to achieve disclosure of information or files on the target server that would otherwise be inaccessible, making this answer incorrect.
Reflected XSS is incorrect because reflected XSS attacks would require that a user be tricked into clicking a malicious link that sends the payload (typically a snippet of JavaScript that steals the user’s session token or gets them to download a malicious file) to the web server; the web server then does nothing with this payload but feed it back to the victim without storing it locally. The attack described in the question does not target a visiting user’s browser but rather information stored on the web server itself. Moreover, it does not require that a legitimate user click a malicious link, making this answer incorrect.
Which of the following items would be expected to be found in the RoE for a penetration test report?
A.A detailed explanation of the period of time the penetration test report should be stored
B.A high-level overview of findings discovered during the engagement
C.Detailed artifacts and evidence that support the findings of the penetration test but are not critical to understanding its findings
D.An account of variables and difficulties encountered during a penetration test, such as systems being unavailable for extended periods of times
A.A detailed explanation of the period of time the penetration test report should be stored
Explanation
Correct Answer: A detailed explanation of the period of time the penetration test report should be stored is correct. The storage time for a penetration test report would be expected to be found in the RoE for a penetration test. This should also include the conditions under which the report is stored, such as encryption and access requirements.
Incorrect Answers: The other answers are incorrect. These answers are all descriptions of components of a penetration test report, rather than information that should be found in the RoE of an engagement.
In the case of an account of variables and difficulties encountered during a penetration test, such as systems in scope being unavailable for extended periods of time, variables and difficulties encountered during the penetration test that may have altered the testing timeline would be expected to be found in the methodology section of a penetration test report.
A high-level overview of findings discovered during the engagement is incorrect because the executive summary exists to provide a high-level overview of the findings of the penetration test.
Finally, Detailed artifacts and evidence that support the findings of the penetration test but are not critical to understanding its findings is incorrect because detailed artifacts supporting the findings of a penetration test that are not critical to the understanding of the report would be expected in the conclusion of a penetration test report specifically in the appendixes.
Which of the following would not be expected in the findings and remediation section of a penetration test report?
A. A breakdown of steps taken to exploit, where applicable
B.Details on vulnerabilities discovered, the general threat they introduce, the service or feature they affect and the impacted host(s)
Recommendations for mitigation of each findings
D.A high-level overview of the general results of the penetration test
D.A high-level overview of the general results of the penetration test
Explanation
Correct Answer: A high-level overview of the general results of the penetration test is correct. A high-level overview of the general results of a penetration test would be expected in the executive summary of a penetration test report, rather than in the findings and remediation section.
Incorrect Answers: None of the other answers are incorrect. All of the other answer choices are expected components of the findings and remediation section of a penetration test report. Because the question asked which of the answer choices was not expected to be found in the findings and remediation section of a penetration test report, these are incorrect answers.
Which of the following would be examples of communication during a penetration test that serve to raise the client’s situational awareness of the engagement in process? (Choose two.)
A. A weekly call detailing current progress, actions taken, or thought processes that guided a particular component of testing
B.An e-mail indicating that testing will begin shortly on a system the client has identified as particularly sensitive
C.A call to notify the client that a server is no longer responding after actions conducted during the course of the engagement with the goal of making the system available for testing again
D.A call intended to identify the root cause of unexpected behavior encountered during the course of a penetration test
A. A weekly call detailing current progress, actions taken, or thought processes that guided a particular component of testing
B.An e-mail indicating that testing will begin shortly on a system the client has identified as particularly sensitive
Explanation
Correct Answers: A weekly call detailing current progress, actions taken, or the thought processes that guided a particular component of testing and an e-mail indicating that testing will begin shortly on a system the client has identified as particularly sensitive are correct. Weekly status calls and notifications that testing will begin on new areas in the engagement scope are all valid reasons to extend the courtesy of an e-mail or a phone call, so as to keep the client appraised of the ongoing status of the penetration test.
Incorrect Answers: A call intended to identify the root cause of unexpected behavior encountered during the course of a penetration test is incorrect because a call seeking to identify the cause of an unexpected behavior would be an example of communication for the sake of deconfliction, rather than to simply maintain situational awareness.
A call to notify the client that a server is no longer responding after actions conducted during the course of the engagement, with the goal of making the system available for testing again is incorrect because a call seeking to remedy an issue that has arisen as a result of penetration testing activities would be an example of communication for the sake of de-escalation.
UDP is a connectionless protocol. Which of the following options use this protocol for communication? (Choose three.) A.DNS B.TFTP C.SSH D.NetBIOS
A.DNS
B.TFTP
D.NetBIOS
Explanation
Correct Answers: DNS, NetBIOS, and TFTP are correct. DNS (53/udp), NetBIOS (137/udp, 139/udp), and TFTP (69/udp) all rely on the connectionless protocol.
Incorrect Answer: SSH is incorrect. SSH (22/tcp) is a connection-oriented protocol and relies on TCP for establishing communication with a remote host.
Which vulnerability research and analysis resource consists of thousands of known attack patterns and methodologies, categorized by both the domain of attack and the mechanism of attack? It is focused on application security and describes common techniques used by adversaries in exploiting known weaknesses. A.Full Disclosure B.CAPEC C.CVE D.CWE
B.CAPEC
Explanation
Correct Answer: CAPEC is correct. CAPEC (Common Attack Pattern Enumeration and Classification) is a publicly available vulnerability research resource that serves as a dictionary of common attack patterns and classifies various types of attacks so that they can be better understood by analysts, developers, penetration testers, and educators. Note that it can be particularly easy to confuse CAPEC with ATT&CK; the latter emphasizes general network defense rather than specific attack tactics, and may be broadly understood to be a tool better suited for use by network defenders rather than penetration testers. Refer to MITRE for further information on the differences between the two https://capec.mitre.org/about/attack_comparison.html.
Incorrect Answers: CVE is incorrect because CVE (Common Vulnerabilities and Exposures) is a list of entries for publicly known cybersecurity vulnerabilities provided by MITRE. Each entry contains an identification number, a description, and at least one public reference for further information. Because this is a dictionary of known vulnerabilities rather than one of attack tactics used by adversaries targeting applications, it is incorrect.
CWE is incorrect because CWE (Common Weakness Enumeration) is a community-developed list of common software security weaknesses managed by MITRE, providing a baseline for weakness identification, mitigation, and prevention efforts. While a list of potential software weaknesses is valuable for penetration testers, software developers, and educators, it does not focus on attack tactics used by adversaries in attacking applications, making it incorrect.
Full disclosure is incorrect because Full Disclosure is a public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques, in addition to providing tools, papers, news, and events of interest to the cybersecurity community. While some discussion of attack tactics can be expected on Full Disclosure indeed, proof-of-concept code is commonly found in posts there it is not the sole focus of the site, making it an incorrect answer.
Which attack tactic as detailed by MITRE's ATT&CK matrix details actions that may be used to obtain an additional level of permissions within a system? A.Privilege Escalation B.Command and control C.Persistence D.Credentialed access
A.Privilege Escalation
Explanation
Correct Answer: Privilege escalation is correct. Privilege escalation methods as described by ATT&CK are attack techniques that allow an attacker or penetration tester to gain additional permissions on a target system, such as popping a shell for a non-root-user-owned service running on a Linux host, or gaining a SYSTEM-level command shell on a Windows host.
Incorrect Answers: Persistence is incorrect because attacks categorized as persistence methods are techniques by attackers to ensure retention of a presence on a target system. An example of this would be a malicious cronjob snuck into the root crontab that sets up a bound shell on an unused port.
Credentialed is incorrect because attacks categorized as credentialed access methods are identified by their use of legitimate, authorized credentials to access a system.
Command and control is incorrect because attacks categorized as command and control methods are used to maintain communication within a target network; an example of this would be the use of specially crafted packets that send communications through commonly used ports and protocols such as HTTP on port 80 or DNS on port 53.
Post-engagement cleanup involves completing which of the following activities? A.All of the answer choices are correct B.Removing tools C.Removing shells D.Removing tester-created credentials
A.All of the answer choices are correct
Explanation
Correct Answer: Airodump-ng is correct. Airodump-ng is used to capture packets sent across a wireless network and save them to a .cap file for later use in analysis or key cracking.
Incorrect Answers: Airdecap-ng is incorrect because airdecap-ng is used to decrypt .cap files created from dumps of WEP and WPA-PSK wireless networks, rather than to create the initial capture file.
Airolib-ng is incorrect because airolib-ng is used to create and manage a pre-computed hash table for WPA and WPA2 network cracking efforts, and has no role to play in the creation of packet capture files.
Wash is incorrect because wash is a tool used to identify wireless networks that have WPS enabled.
In which scenario(s) can DLL hijacking occur? (Choose two.)
A.The attacker has read access to the DLL search path for the Windows target
B.The attacker has write access to a location or path of missing DLL that is called during program execution
C.The attacker removes DDLs used by the operating system in C:/Windows/system32”.
D.The attacker can create a DLL that is missing during program execution and successfully escalate privileges to a SYSTEM
B.The attacker has write access to a location or path of missing DLL that is called during program execution
D.The attacker can create a DLL that is missing during program execution and successfully escalate privileges to a SYSTEM
Explanation
Correct Answers: The attacker has write access to a location or path of a missing DLL that is called during program execution is correct because write access is required for the location where a DLL should be located; otherwise, the attacker will not be able to copy over the malicious DLL to be used in the DLL hijacking attack.
The attacker can create a DLL that is missing during program execution and successfully escalate privileges to SYSTEM is correct because the attacker has write access to the location of where the DLL should reside, and can replace the “missing” DLL with a malicious one to escalate privileges on the system.
Incorrect Answers: The attacker removes DLLs used by the operating system in C:/Windows/system32 is incorrect because removing the DLL from the System32 directory can cause a denial of service (DoS) and prevent applications from functioning, which would be the opposite of exploiting a privileged escalation vulnerability using a running program.
The attacker has read access to the DLL search path for the Windows target is incorrect because write access is required so the malicious DLL used to escalate privileges can be copied to the appropriate DLL path.
Which attack tactic as detailed by MITRE's ATT&CK matrix covers methods for the transfer of sensitive information from a system? A.Lateral movement B.Exfiltration C.Defense evasion D.Execution
B.Exfiltration
Explanation
Correct Answer: Exfiltration is correct. Exfiltration methods as described by ATT&CK are attack techniques that seek to discover and remove sensitive information from within a system. An example of this would be to send harvested data in a netcat connection to a commonly used port and protocol (such as HTTP on port 80 or DNS on port 53) on an external system to avoid scrutiny by an otherwise alert defense team.
Incorrect Answers: Lateral movement is incorrect because attacks categorized as lateral movement methods are techniques by which an attacker or penetration tester transitions from one system over the network to another; passing the hash, or sending a hashed password to obtain access without needing the cleartext password, is an example of this.
Defense evasion is incorrect because attacks categorized as defense evasion methods are meant to escape detection or system security defenses; this could be as simple as deleting temporary files created in the process of attacking a target system.
Execution is incorrect because attacks categorized as execution methods are techniques that result in the execution of malicious code on a local or remote system; an example of this would be the use of a native command-line interface, such as cmd.exe in a Windows environment or the terminal on a Linux host.
Which attack method exploits AD legacy support for older Windows clients, resulting in an attacker obtaining a weakly encrypted ticket-granting service that uses the NTLM hash of the service owner's account as the encryption key? By obtaining such a ticket, the attacker can identify the hash and crack it offline, allowing for privilege escalation, lateral movement, or persistence in a given system or environment. A.Scheduled task abuse B.Plaintext LDAP credential transmission C.Kerberoasting D.Insecure sudo access
C.Kerberoasting
Explanation
Correct Answer: Kerberoasting is correct. The attack described is Kerberoasting.
Incorrect Answers: Modules to simplify this attack are found in both PowerSploit and Empire.Plaintext LDAP credential transmission is incorrect because plaintext LDAP credential transmission interception does not rely Active Directory support for older, legacy Windows clients to obtain NTLM hashes. Rather, it allows credential harvesting to occur if the application making the LDAP request is not doing so via LDAPS (LDAP over SSL, or Secure LDAP). This is because the application transfers the username and password in plaintext in the very first packet it sends, leaving it vulnerable to sniffing via a network protocol analyzer like Wireshark.
Scheduled task abuse is incorrect because scheduled task abuse occurs most often when a script or .bat file run as part of a scheduled task is world-writeable, creating openings for privilege escalation, lateral movement, or persistence. Since there is no abuse of Active Directory support for legacy Windows clients, this answer is also incorrect.
Insecure sudo access is incorrect because insecure sudo access is a privilege escalation vector found in *nix environments; since the attack vector described targets NTLM hashes, as used in a Windows environment, this answer is incorrect.
When used as part of a search through the harvester, what will be the effect of the -c flag?
A.A DNS brute-force search will be conducted for the domain name provided
B.A reverse DNS query will be ran for all discovered ranges
C.A simple declaration of the domain or company name for which to search
D.Identified hosts will be cross-referenced with the Shodan database
A.A DNS brute-force search will be conducted for the domain name provided
Explanation
Correct Answer: A DNS brute-force search will be conducted for the domain name provided is correct. The -c flag in the harvester will result in a DNS brute-force search conducted for the domain name provided.
Incorrect Answers: A simple declaration of the domain or company name for which to search is incorrect because a simple declaration of the domain or company name for which to conduct the search describes the -d flag.
A reverse DNS query will be run for all discovered ranges is incorrect because a reverse DNS query will be run for all discovered ranges when the -n flag is used.
Identified hosts will be cross-referenced with the Shodan database is incorrect because the -h flag will result in identified hosts being cross-referenced with the Shodan database.
Which technique is marked by overwriting a program's execution stack with "no operation" instructions, with an end goal of shifting a program's instruction pointer to a specific command sequence? It is used extensively in the development of buffer overflow attacks. A.Return-oriented programming B.NOP sled C.Ret2libc D.Stack smashing
B.NOP sled
Explanation
Correct Answer: NOP sled is correct. The technique described is a NOP sled (also called a NOP slide or NOP ramp). A NOP instruction indicates that no action should be taken by a processor during the execution of a program, effectively sliding the instruction pointer further down the stack until it reaches an instruction that can be acted upon.
Incorrect Answers: Return-oriented programming is incorrect because return-oriented programming is a category of attack used to achieve arbitrary code execution in spite of existing defenses such as code signing and executable space protection. Briefly, return-oriented programming seeks to gain control of a program’s execution flow and then employ instruction sequences already present in memory. Since return-oriented programming is an attack type rather than a specific technique used to slide the instruction pointer along, this answer is incorrect.
Ret2libc is incorrect because ret2libc attacks are a specific type of return-oriented programming that attempts to leverage an existing library function in memory to obtain code execution rather than deploying a custom-written payload. As with the broader category of return-oriented programming, this is a category of attack rather than a specific technique used in the attack, making this answer incorrect as well.
Stack smashing is incorrect because stack smashing is a specific type of buffer overflow attack that occurs when data is written to memory addresses on a program’s call stack, taking up more storage space than the intended data buffer is meant to contain. Since stack smashing is a type of buffer overflow attack rather than a technique used in the development of buffer overflow attacks, this answer is incorrect.
Which freely available, open-source web application scanning tool provides automated vulnerability scanning, traffic interception, and HTTP parameter tampering in addition to a robust RESTful API? A.OWASP ZAP B.Qualys WAS C.Nexpose D.nikto
A.OWASP ZAP
Explanation
Correct Answer: OWASP ZAP is correct. OWASP ZAP is a free, open-source web application and web server scanning tool. It boasts numerous features similar to those found in Burp Suite, including automated scanning, site fuzzing, and a marketplace for add-ons and plugins.
Incorrect Answers: Nikto is incorrect because nikto is an open-source, command-line-based web server scanner that checks for potentially dangerous files, outdated software versions, and server configuration items. It can perform neither traffic interception nor HTTP parameter tampering, nor does it provide an API, making this answer incorrect.
Nexpose is incorrect because Rapid7’s Nexpose is a broad-scale, commercial vulnerability scanner. Since Nexpose is a commercial, proprietary product that is not limited to web server scanning and is incapable of traffic interception, this answer is incorrect.
Qualys WAS is incorrect because Qualys WAS (Web Application Scanner) is a commercial, cloud-based web application scanning and vulnerability discovery service. As Qualys WAS is also a commercial, proprietary product, this answer is also incorrect.
The role of an organization's \_\_\_\_\_\_\_\_\_\_ in a penetration test is to provide written authorization for the assessment. A.IT department B.Executive management C.Security personnel D.HR department
B.Executive management
Explanation
Correct Answer: Executive management is correct. Executive management is composed of the senior management personnel in an organization, and as such is empowered to provide written authorization for a penetration test. It is difficult to overstate the importance of written authorization; in the United States, for instance, conducting a penetration test without written authorization is a nearly guaranteed way to pick up federal charges under the Computer Fraud and Abuse Act. ‘
Incorrect Answers: HR department is incorrect because the human resources department serves to protect the organization’s interests in regard to personnel decisions, but would be highly unlikely to have any influence in the provisioning or authorization of a penetration test.
Similarly, IT department and security personnel are incorrect because although both the IT department and security personnel have a vested interest in the outcome of a penetration test as stakeholders, providing written authorization is generally a responsibility for executive management, along with heavy legal department input.
U.S. export laws prohibit which of the following?
A.Importing lock picking hardware
B.Importing certain types of encryption into the US
C.Exporting certain encryption technology
D.Use of encryption with certain parts of the US
C.Exporting certain encryption technology
Explanation
Correct Answer: Exporting certain encryption technology is correct. Encryption technology is subject to U.S. export laws.
Incorrect Answers: Importing lock picking hardware and use of encryption within certain parts of the U.S. are incorrect because the question is asking about U.S. export laws, not import restrictions.
Importing certain types of encryption into the U.S. is incorrect both because it doesn’t refer to exporting anything and because no U.S. laws regarding encryption apply only to certain parts of the country.
Which family of attack is used to obtain control of the operation of Bluetooth-enabled devices? A.Pixie dust B.Jamming C.Bluesnarfing D.Bluebugging
D.Bluebugging
Explanation
Correct Answer: Bluebugging is correct. Bluebugging attacks exploit a flaw in Bluetooth data transfers to keep the attacking system as a trusted device, allowing the attacker to pair with the victim device and assume control of its operation. Modern Bluetooth implementations have numerous security checks in place to prevent this type of attack, such as enhancements in Bluetooth device firmware and the requirement of a PIN to complete pairing. As in WPA-PSK, these security measures can still be defeated if an attacker is able to capture an authentication handshake, allowing recovery of the PIN used.
Incorrect Answers: Bluesnarfing is incorrect because bluesnarfing is the use of vulnerabilities in a device or in Bluetooth to steal information, such as phone numbers, SMS message contents, or calendar information, but does not imply or require control over the target, as stated in the question.
Jamming is incorrect because jamming attacks are those that attempt to render a wireless protocol unusable, usually by flooding the wireless spectrum used by the target protocol with additional transmissions and degrading the signal-to-noise ratio. Thus, jamming attacks are a form of denial of service attack, which cannot be used to seize control of a device, making this an incorrect answer.
Pixie dust is incorrect because a pixie dust attack is one aimed at cracking the PIN used in WPS-enabled Wi-Fi routers, with the ultimate goal of enabling an attacker to connect to and authenticate with a wireless AP; since this attack targets 802.11 Wi-Fi networks rather than Bluetooth connections, it is incorrect.
What is the process of collecting information about target systems, software, networks, or people in a manner that requires direct engagement with the target or its assets? A.Passive information gathering B.Active information gathering C.Reconnaissance D.Web searching
B.Active information gathering
Explanation
Correct Answer: Active information gathering is correct. Active information gathering is the process of collecting information about target systems, software, networks, or people in a manner that requires direct engagement with the target or its assets.
Incorrect Answers: Passive information gathering is incorrect because passive information gathering is the process of assessing a target to collect preliminary knowledge about systems, software, networks, or people without directly engaging the target or its assets.
Web searching is incorrect because web searching is a specific activity that falls under the umbrella of passive information gathering.
Reconnaissance is incorrect because reconnaissance is a broader term that can describe both passive and active information-gathering efforts.
Which document details the communication path for findings and other critical information, such as system unavailability or the discovery of evidence of a previous compromise? A.RoE B.MSA C.NDA D.Executive summary
A.RoE
Explanation
Correct Answer: NDA is correct. The communication escalation path should be detailed in the rules of engagement (RoE), with at least a primary and alternate point of contact listed.
Incorrect Answers: The other answers are incorrect. The communication escalation path exists to lay out the specific chain of command regarding the details of a penetration test. Because this is a fine detail associated with the technical specifics of a penetration test, one would not expect to find it in a nondisclosure agreement (which codifies an agreement that the client’s proprietary information will not be divulged by the penetration tester), a master service agreement (which details broader, less technical details about the penetration testing agreement such as payment terms and processes for dispute resolution), or an executive summary (a component of a penetration test report, which is delivered after the completion of the penetration test).
Which method of jailbreaking an iOS device requires a computer to turn on the device each time? A.Semi-untethered B.Tethered C.Untethered D.Semi-tethered
B.Tethered
Explanation
Correct Answer: Tethered is correct. Tethered jailbreaks require a computer to turn the device on every time.
Incorrect Answers: Semi-untethered is incorrect because a semi-untethered jailbreak method requires the device to be jailbroken on every reboot; this method can be accomplished using a jailbreak app already installed on the device in question.
Untethered is incorrect because devices jailbroken with an untethered mechanism can be turned on and off without the need for a computer.
Semi-tethered is incorrect because devices jailbroken with a semi-tethered method may be rebooted at will, but they will need to be jailbroken again on boot with the assistance of a computer.
Which nmap flag is used to denote a simple ping scan? A.'-Pn' B.'-sn' C.'-sL' D.'-v'
B.’-sn’
Explanation
Correct Answer: -sn’ is correct. The -sn nmap flag denotes a simple ping scan.
Incorrect Answers: ‘-Pn’ is incorrect because the -Pn flag disables ping and skips host discovery.
‘-v’ is incorrect because the -v flag increases output verbosity.
‘-sL’ is incorrect because the -sL flag is used when listing multiple targets to be scanned.
Which cryptographic side-channel attack exploits the delay in volatility in system RAM after a hard reboot, and is frequently used to target encryption keys that were sitting in memory on the target system? A.Serial connections B.Cold boot attack C.Timing attack D.JTAG debugging
B.Cold boot attack
Explanation
Correct Answer: Cold boot attack is correct. A cold boot attack exploits the delay in volatility in system RAM after a hard reboot, and is frequently used to target encryption keys that were sitting in memory on a target system.
Incorrect Answers: JTAG debugging is incorrect because JTAG debugging leverages the IEEE standard used to test printed circuit boards to obtain elevated access to a device; since this is not a side-channel attack and does not exploit RAM volatility delay, this answer is incorrect.
Serial connections is incorrect because serial connections are communication interfaces used to transfer information to and from various devices, such as a modem or terminal; since this is not a side-channel attack, but rather abuse of a known standard connection mechanism, this answer is incorrect.
Timing attack is incorrect because a timing attack is a cryptographic side-channel attack that is based on measuring the time required for computations to complete; since all computations take time, and the time required varies directly based on input, an attacker is able to observe the time to completion for information they would like to harvest and then compare the time expended to values based on known inputs. While this is a side-channel attack, it does not exploit the delay in the volatility of system memory, making this answer incorrect as well.
What is the significance of the [R] flag based on the following tcpdump output?
A.The kali host is sending a RST to the target host
B.The target host is sending a RST to the kali host
C.The kali host is sending a SYN to the target host
D.The target host is sending a SYN to the kali host
B.The target host is sending a RST to the kali host
Explanation
Correct Answer: The target host is sending a RST to the kali host is correct. In the results of the tcpdump output in this scenario, the [R] flag is a RST (reset) flag, informing the kali host to close the connection, as there is either nothing listening on that port or the service on the other end has requested that the connection be terminated.
Incorrect Answers: The target host is sending a SYN to the kali host is incorrect because the SYN flag is represented in the tcpdump output as [S], not as [R].
The kali host is sending a RST to the target host and The kali host is sending a SYN to the target host are incorrect because the kali host is attempting to connect to the host over multiple ports using a [S] (SYN) flag, and based on the direction (>) of the communication, the [R] (RST) is originating from the target host, not the kali host.
The Center for Internet Security (CIS) can provide which of the following?
A.Pentest reports formats
B.Risk and remediation
C.Common vulnerabilities and exposures (CVEs)
D.System hardening guidance
D.System hardening guidance
Explanation
Correct Answer: System-hardening guidance is correct. The Center for Internet Security (CIS) provides security benchmarks that offer system-hardening guidance for various operating systems, applications, and technologies.
Incorrect Answers: Risk and remediation is incorrect because risk and remediation are determined after a security evaluation of a customer’s network that takes into account different environmental behaviors and various influences that are not available through the CIS benchmarks.
Pentest report formats is incorrect because pentest report formats are not provided through the CIS benchmarks; however, PCI, FedRAMP, and PTES offer guidance for pentesters on how to lay out the pentest report.
Common vulnerabilities and exposures (CVEs) is incorrect because the common vulnerabilities and exposures (CVEs) are maintained by Mitre, not the CIS benchmarks.
