CompTIA PenTest+ (PT0-001) Practice Certifications Exams (Jason DIon5 of 6) Flashcards
Your company, HackMe Incorporated, is a US-based company specializing in conducting penetration tests for large corporations. Big Corp has recently asked you to perform a penetration test of its offices in Saudi Arabia and Iran. The penetration test would include both remote attacks and on on-site USB key drop attack. Which of the following MUST you investigate BEFORE you begin to negotiate the contract for this engagement?
A.Support resources available to your team
B.Export restrictions that may apply to your tools
C.Type of threat actor your team will emulate
D.Budget allocate to the penetration test
.B.Export restrictions that may apply to your tools
Explanation: The United States has export restrictions that govern the shipment or transfer of software, technology, services, and other controlled items outside of the United States borders. The Export Administration Regulations (EAR) is regulated by the Bureau of Industry and Security (BIS) within the U.S. Department of Commerce. The EAR may control the export, re-export, or transfer of items such as software, hardware, algorithms, and other technical items you may require for your on-site penetration test. Exports can include the transfer of a physical product from inside the US to an external location and other actions. The simple act of releasing technology to someone other than a US citizen or lawful permanent resident within the United States is deemed an export. This includes making available software for electronic transmission that can be received by individuals outside the US.
Which of the following considerations should be discussed with a client during the engagement planning to determine if the penetration tester will need to bypass the requirement of gaining a PKI key for their host to connect to the client’s network?
A.Blacklisting
B.Certificate pinning
C.Organizational policies
D.Packet crafting
B.Certificate pinning
Explanation: OBJ-1.3: Certificate pinning is the process of associating a host with its expected X.509 certificate or public key. Pinning bypasses the certificate authority (CA) hierarchy and chain of trust to lessen the impact of man-in-the-middle attacks. If the client’s network uses certificate pinning, the penetration test may request an exception or a certificate issued to their machine.
After analyzing and correlating activity from the firewall logs, server logs, and the intrusion detection system logs, a cybersecurity analyst has determined that a sophisticated breach of the company’s network security may have occurred from a group of specialized attackers in a foreign country over the past five months. Up until now, these cyberattacks against the company network had gone unnoticed by the company’s information security team.
How would you best classify this threat?
A.Advanced Persistent Threat
B.Spear Phishing
C.Insider threat
D.Privilege escalation
A.Advanced Persistent Threat
Explanation: OBJ-1.3: An advanced persistent threat (APT) is a network attack in which an unauthorized person gains access to a network and stays there undetected for a long period of time. An APT attack intends to steal data rather than to cause damage to the network or organization. An APT refers to an adversary’s ongoing ability to compromise network security, obtain and maintain access, and use various tools and techniques. They are often supported and funded by nation-states or work directly for a nation-states’ government. Spear phishing is the fraudulent practice of sending emails ostensibly from a known or trusted sender to induce targeted individuals to reveal confidential information. An insider threat is a malicious threat to an organization from people within the organization, such as employees, former employees, contractors, or business associates, who have inside information concerning the organization’s security practices, data, and computer systems. Privilege escalation is the act of exploiting a bug, design flaw, or configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user. While an APT may use spear phishing, privilege escalation, or an insider threat to gain access to the system, the scenario presented in this question doesn’t specify what method was used. Therefore, APT is the best answer to select.
You have just completed writing the scoping document for your next penetration test, which clearly defines what tools, techniques, and targets you intend to include during your assessment. Which of the following actions should you take next?
A.Conduct a port scan of the target network
B.Get leadership concurrence on the scoping document
C.Conduct passive fingerprinting on the target servers
D.Provide a copy of the scoping document to local law enforcement
B.Get leadership concurrence on the scoping document
Explanation: OBJ-1.2: Once the scoping document has been prepared, you must get concurrence with your plan before you begin your penetration test. Therefore, you must get the scoping plan signed off by the organization’s leadership as your next action. You should never begin a penetration test before you have written permission and concurrence from the target organization. Port scanning of the target and even passive fingerprinting could be construed as a cybercrime if you did not get the scoping document signed off before beginning your assessment. There is no requirement to notify local law enforcement of your upcoming penetration test as long as you have a signed scoping document and contract with the targeted company.
Which of the following information is traditionally found in the SOW for a penetration test?
A.Timing of the scan
B.Format of the executive summary report
C.Excluded Hosts
D.Maintenance windows
C.Excluded Hosts
Explanation: OBJ-1.2: A Scope of Work (SOW) for a penetration test normally contains the list of excluded hosts. This ensures that the penetration tester does not affect hosts, workstations, or servers outside the assessment scope. The timing of the scan and the maintenance windows are usually found in the rules of engagement (ROE). The executive summary report contents are usually not identified in any of the scoping documents, only the requirement of whether such a report is to be delivered at the end of the assessment.
Which of the following types of attackers are sophisticated and highly organized people or teams typically sponsored by a nation-state?
A.Script Kiddies
B.Hacktivists
C.Advanced Persistent Threat
D.Ethical Hacker
C.Advanced Persistent Threat
Explanation: OBJ-1.3: Advanced Persistent Threat (APT) attackers are sophisticated and have access to financial and technical resources typically provided by a government. An APT is an attacker with the ability to obtain, maintain, and diversify access to network systems using exploits and malware. A hacktivist is an attacker that is motivated by a social issue or political cause. A script kiddie has little skill or sophistication and uses publicly available tools and techniques. An ethical hacker specializes in penetration testing and in other testing methodologies that ensure the security of an organization’s information systems. An ethical hacker is also known as a white hat hacker.
Matt is creating a scoping worksheet for an upcoming penetration test for his organization. Which of the following techniques is NOT usually included in a penetration test?
A.Reverse engineering
B.Social Engineering
C.Denial-of-Service attack
D.Physical Penetration attempts
C.Denial-of-Service attack
Explanation OBJ-1.3: A denial-of-service or DoS attack isn’t usually included as part of a penetration test. This type of attack contains too much risk for an organization to allow it to be included in an assessment scope. Social engineering, physical penetration attempts, and reverse engineering are all commonly included in a penetration test’s scope.
You have been contracted to conduct a wireless penetration test for a corporate client. Which of the following should be documented and agreed upon in the scoping documents before you begin your assessment?
A.The make and model of the wireless access points used by the client
B.The number of wireless access points and devices used by the client
C.The frequencies of the wireless access points and devices used by the client
D.The network diagrams with the SSIDs of the wireless access points used by the client
C.The frequencies of the wireless access points and devices used by the client
Explanation OBJ-1.3: To ensure you are not accidentally targeting another organization’s wireless infrastructure during your penetration test, you should have the frequencies of the wireless access points and devices used by the client documented in the scoping documents. This would include whether your clients use Wireless A, B, G, N, or AC and if they are using the 2.4 GHz or 5.0 GHz spectrum if they are using Wireless N or AC.
What is a formal document that states what will and will not be performed during a penetration test?
A.SOW
B.MSA
C.NDA
D.Corporate Policy
A.SOW
Explanation: OBJ-1.2: The Scope of Work is a formal document stating what will and will not be performed during a penetration test. It should also contain the assessment’s size and scope and a list of the assessment’s objectives. A master service agreement, or MSA, is a contract reached between parties, in which the parties agree to most of the terms that will govern future transactions or future agreements. The MSA is used when a pentester will be on retainer for a multi-year contract, and an individual SOW will be issued for each assessment to define the individual scopes for each one. A non-disclosure agreement (NDA) is a legal contract between at least two parties that outlines confidential material, knowledge, or information that the parties wish to share for certain purposes but wish to restrict access. Corporate policy is a documented set of broad guidelines, formulated after analyzing all internal and external factors that can affect an organization’s objectives, operations, and plans.
Based on some old SIEM alerts, you have been asked to perform a forensic analysis on a given host. You have noticed that some SSL network connections are occurring over ports other than port 443. The SIEM alerts indicate that copies of svchost.exe and cmd.exe have been found in the host’s %TEMP% folder. The logs indicate that RDP connections have previously connected with an IP address that is external to the corporate intranet, as well. What threat might you have uncovered during your analysis?
A.DDoS
B.APT
C.Ransomware
D.Software Vulnerability
B.APT
Explanation: OBJ-1.3: The provided indicators of compromise appear to be from an Advanced Persistent Threat (APT). These attacks tend to go undetected for several weeks or months and utilize secure communication to external IPs and Remote Desktop Protocol connections to provide the attackers with access to the infected host. While an APT might use a software vulnerability to gain their initial access, the full description provided in the question that includes the files being copied and executed from the %TEMP% folder and the use of SSL/RDP connections indicates longer-term exploitation, such as one caused by an APT.
What is the utilization of insights gained from threat research and threat modeling to proactively discover evidence of adversarial TTPs within a network or system called?
A.Threat hunting
B.Penetration testing
C.Information assurance
D.Incident response
A.Threat hunting
Explanation: OBJ-1.3: Threat hunting is the utilization of insights gained from threat research and threat modeling to proactively discover evidence of adversarial TTPs within a network or system. Penetration testing uses active tools and security utilities to evaluate security by simulating an attack on a system. A penetration test verifies that a threat exists, actively tests and bypasses security controls, and finally exploits vulnerabilities on the system. Information assurance (IA) is the practice of assuring information and managing risks related to the use, processing, storage, and transmission of information or data and the systems and processes used for those purposes. Incident response is an organized approach to addressing and managing the aftermath of a security breach or cyberattack, also known as an IT incident, computer incident, or security incident. The goal is to handle the situation to limit damage and reduce recovery time and costs.
You are a penetration tester hired by an organization that wants you to conduct a risk assessment of their DMZ. The company provided Rules of Engagement states that you must do all penetration testing from an external IP address without any prior knowledge of the internal IT system architecture. What kind of penetration test will you perform?
A.White box
B.Gray box
C.Red team
D.Black Box
D.Black Box
Explanation: OBJ-1.3: A black box penetration test requires no previous information and usually takes the approach of an uninformed attacker. The penetration tester has no prior information about the target system or network in a black box penetration test. These tests provide a realistic scenario for testing the defenses, but they can be costlier and takes much more time to conduct. A black box tester is examining a system from an outsider’s perspective. A gray-box tester has the user’s access and knowledge levels, potentially with elevated privileges on a system. Gray-box penetration testers typically have some knowledge of a network’s internals, potentially including design and architecture documentation and an account internal to the network. White-box testing goes by several different names, including clear-box, open-box, auxiliary and logic-driven testing. It falls on the opposite end of the spectrum from black-box testing, and penetration testers have full access to source code, architecture documentation, and so forth. Unlike black-box and gray-box testing, white-box penetration testers can perform static code analysis, so familiarity with source code analyzers, debuggers, and similar tools are necessary for this type of testing. A red team is a group that helps organizations to improve themselves by providing opposition to the point of view of the organization that they are helping. Penetration testers often work as part of a red team.
A security engineer is using the Kali Linux operating system and is writing exploits in C++.
What command should they use to compile their new exploit and name it notepad.exe?
A.g+ + exploit.cpp -o notepad.exe
B.g++ exploit.py -o notepad.exe
C.g+ + -i exploit.pl -e notepad.exe
D.g+ + –compile -i exploit.cpp notepad.exe
A.g+ + exploit.cpp -o notepad.exe
Explanation: OBJ-2.4: g++ is free C++ compiler that is available across a wide variety of operating systems, and is installed by default as part of Kali Linux. The proper syntax to compile a C++ file (*.cpp) is “g++ filename -o outputfile”, so “g++ exploit.cpp -0 notepad.exe” is correct.
A vulnerability scan has returned the following results:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Detailed Results
10.56.17.21 (APACHE-2.4)
Windows Shares Category:
Windows CVE ID: -
Vendor Ref: -
Bugtraq ID: -
Service Modified - 8.30.2017
Enumeration Results: print$ c:\windows\system32\spool\drivers files c:\FileShare\Accounting Temp c:\temp
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
What best describes the meaning of this output?
A.There is an unknown bug in an Apache server with no Bugtraq ID
B.Connecting to the host using a null session allows enumeration of the share names on the host
C.Windows Defender has a known exploit that must be resolved or patched
D.There is no CVE present so this is a false positive caused by Apache running on a Windows Server
B.Connecting to the host using a null session allows enumeration of the share names on the host
Explanation: OBJ-2.3: These results from the vulnerability scan conducted shows an enumeration of open Windows shares on an Apache server. The enumeration results show three share names (print$, files, Temp) were found using a null session connection. There is no associated CVE with this vulnerability, but it is not a false positive. Not all vulnerabilities have a CVE associated with them. Nothing in this output indicates anything concerning Windows Defender, so this is not the correct answer. Bugtraq IDs are a different type of identification number issued for vulnerabilities by SecurityFocus. Generally, if there is a CVE, there will also be a Bugtraq ID. Both the CVE and Bugtraq ID being blank is not suspicious since we are dealing with a null enumeration result.
Dion Training has an open wireless network called “InstructorDemos” for its instructors to use during class, but they do not want any students connecting to this wireless network. The instructors need the “InstructorDemos” network to remain open since some of their IoT devices used during course demonstrations do not support encryption. Based on the requirements provided, which of the following configuration settings should you use to satisfy the instructor’s requirements and prevent students from using the “InstructorDemos” network?
A.MAC Filtering
B.NAT
C.QoS
A.MAC Filtering
Explanation: OBJ-2.5: Since the instructors need to keep the wireless network open, the BEST option is to implement MAC filtering to prevent the students from connecting to the network while still keeping the network open. Since the instructors would most likely use the same devices to connect to the network, it would be relatively easy to implement a MAC filtering based whitelist of devices that are allowed to use the open network and reject any other devices not listed by the instructors (like the student’s laptops or phones). Reducing the signal strength would not solve this issue since students and instructors are in the same classrooms. Using Network Address Translation and Quality of Service will not prevent the students from accessing or using the open network.
You are analyzing the vulnerability scanning results from a recent web vulnerability scan in preparation for the exploitation phase of an upcoming assessment. A portion of the scan results is shown below.
A.Information disclosure
B.Local file inclusion
C.SQL Injection
D.Session hijacking
A.Information disclosure
Explanation: OBJ-2.3: Information disclosure is any condition that allows the attacker to gain access to protected information. In this case, the server is vulnerable to disclosing information about the version of PHP being used. The phpinfo.php file should not be accessible to remote users over the internet, as it can be used to provide them with valuable information to help plan an attack.
What technique is an attacker using if they review data and publicly available information to gather intelligence about the target organization without scanning or other technical information-gathering activities?
A.Passive reconnaissance
B.Active scanning
C.VUlnerability scanning
D.Patch management
A.Passive reconnaissance
Explanation: OBJ-2.1: Passive reconnaissance combines publicly available data from various sources about an organization and does not use active scanning or data gathering methods. Vulnerability scanning is an inspection of the potential points of exploitation on a computer or network to identify security holes. A vulnerability scan is usually conducted to detect and classify system weaknesses in computers, networks, and communications equipment and predict the effectiveness of countermeasures. Patch management is the process that helps acquire, test, and install multiple patches (code changes) on existing applications and software tools on a computer, enabling systems to stay updated on existing patches and determining which patches are the appropriate ones.
You were interpreting a Nessus vulnerability scan report and identified a vulnerability in the system with a CVSS attack vector rating of A. Based on this information, which of the following statements would be true?
A.The attacker must have physical or logical access to the affected system
B.Exploiting the vulnerability requires the existence of specialized conditions
C.The attacker must have access to the local network that the system is connected to
D.Exploiting the vulnerabilities does not require any specialized conditions
C.The attacker must have access to the local network that the system is connected to
Explanation: OBJ-2.3: The attack vector explains what type of access that the attacker must have to a system or network and does not refer to the types of specialized conditions that must exist. In this case, the A rating refers to Adjacent, where the attacker must launch the attack from the same shared physical (such as Bluetooth or Wi-Fi network), logical network (such as a local subnet), or a limited administrative domain (such as a VPN or MPLS). An attack vector of Network (N) would allow the attack to extend beyond these options and conduct remote exploitation of the vulnerability. An attack vector of Local (L) would require the attacker to locally exploit the workstation via the keyboard or over an SSH connection. An attack vector of Physical (P) would require the attacker to physically touch or manipulate the vulnerable component themselves, such as conducting a cold boot attack.
Vulnerability scans must be conducted continuously to meet regulatory compliance requirements for the storage of PHI. During the last vulnerability scan, a cybersecurity analyst received a report of 2,592 possible vulnerabilities and was asked by the Chief Information Security Officer (CISO) for a plan to remediate all the known issues. Which of the following should the analyst do next?
A.Attempt to identify all the false positives and exceptions, then resolve any remaining items
B.Wait to perform any additional scanning until the current list of vulnerabilities have been remediated fully
C.Place any assets that contain PHI in a sandbox environment and then remediate all the vulnerabilities
D.Filter the scan results to include only those items listed as critical in the asset inventory and remediate those vulnerabilities first
D.Filter the scan results to include only those items listed as critical in the asset inventory and remediate those vulnerabilities first
Explanation: OBJ-2.3: PHI is an abbreviation for Personal Health Information. When attempting to remediate numerous vulnerabilities, it is crucial to prioritize the vulnerabilities to determine which ones should be remediated first. In this case, there is a regulatory requirement to ensure the security of the PHI data. Therefore, those critical assets to the secure handling or storage of PHI are of the highest risk should be prioritized for remediation first. It is impractical to resolve all 2,592 vulnerabilities at once. Therefore, you should not identify all the false positives and exceptions and then resolve any remaining items since they won’t be prioritized for remediation. You should also not wait to perform additional scanning because a scan is only a snapshot of your current status. If it takes 30 days to remediate all the vulnerabilities and do not scan, new vulnerabilities may have been introduced. Placing all the PHI assets into a sandbox will not work either because you have removed them from the production environment and can no longer serve their critical business functions.
You have been asked to determine if Dion Training’s web server is vulnerable to a recently discovered attack on an older version of SSH. Which technique should you use to determine the current version of SSH running on their web server?
A.Vulnerability scan
B.Protocol analysis
C.Passive scan
D.Banner grabbing
D.Banner grabbing
Explanation: OBJ-2.1: Banner grabbing is conducted by actively connecting to the server using telnet or netcat and collecting the web server’s response. This banner usually contains the server’s operating system and the version number of the service (SSH) being run. This is the fastest and easiest way to determine the SSH version being run on this web server. While it is possible to use a vulnerability scanner, protocol analyzer, or to conduct a passive scan to determine the SSH version, these are more time consuming and not fully accurate methods to determine the version being run.
What type of technique does exploit chaining often implement?
A.Injecting parameters into a connection string using semicolons as a separator
B.Inserting malicious JavaScript code into input parameters
C.Setting a users session identifier (SID) to an explicit known value
D.Adding multiple parameters with the same name in HTTP requested
A.Injecting parameters into a connection string using semicolons as a separator
Explanation OBJ-2.4: Connection String Parameter Pollution (CSPP) exploits specifically the semicolon-delimited database connection strings that are constructed dynamically based on the user inputs from web applications. CSPP, if carried out successfully, can be used to steal user identities and hijack web credentials. CSPP is a high-risk attack because of the relative ease with which it can be carried out (low access complexity) and the potential results it can have (high impact). Exploit chaining involves multiple commands and exploits being conducted in a series to fully attack or exploit a given target.
Your network security manager wants a monthly report of the security posture of all the assets on the network (e.g., workstations, servers, routers, switches, firewalls). The report should include any feature of a system or appliance that is missing a security patch, OS update, or other essential security feature and its risk severity. Which solution would work best to find this data?
A.Security policy
B.Penetration test
C.Virus scan
D.Vulnerability scanner
D.Vulnerability scanner
Explanation OBJ-2.2: A vulnerability scanner is a computer program designed to assess computers, computer systems, networks, or applications for weaknesses. Most vulnerability scanners also create an itemized report of their findings after the scan.
You have received a laptop from a user who recently left the company. You went to the terminal in the operating system and typed ‘history’ into the prompt and see the following:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
> for i in seq 255; ping -c 1 10.1.0.$i; done
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Which of the following best describes what actions were performed by this line of code?
A.Attempted to conduct a SYN scan on the network
B.Conducted a ping sweep on the subnet
C.Conducted a sequential ICMP echo reply to the subnet
D.Sequentially sent 255 ping packets to every host on the subnet
B.Conducted a ping sweep on the subnet
Explanation OBJ-2.1: This code is performing a ping sweep of the subnet 10.1.0.0/24. The code states that for every number in the sequence from 1 to 255, conduct a ping to 10.1.0.x, where x is the number from 1 to 255. When it completes this sequence, it is to return to the terminal prompt (done). The ping command uses an echo request and then receives an echo reply from the ping’s target. A ping sweep does not use an SYN scan, which would require the use of a tool like nmap or hping.
Which of the following tools can NOT be used to conduct a banner grab from a web server on a remote host?
A.netcat
B.telnet
C.wget
D.ftp
D.ftp
Explanation: OBJ-2.1: FTP cannot be used to conduct a banner grab. A cybersecurity analyst or penetration tester uses a banner grab to gain information about a computer system on a network and the services running on its open ports. Administrators can use this to take inventory of the systems and services on their network. This is commonly done using telnet, wget, or netcat.
Due to new regulations, your organization’s CIO has the information security team institute a vulnerability management program. What framework would BEST support this program’s establishment?
A.NIST
B.OWASP
C.SDLC
D.SANS
A.NIST
Explanation: OBJ-2.1: NIST (National Institute of Standards and Technology) produced a useful patch and vulnerability management program framework in its Special Publication (NIST SP 800-40). It would be useful during the program’s establishment and provide a series of guidelines and best practices. SANS is a company specializing in cybersecurity and secure web application development training and sponsors the Global Information Assurance Certification (GIAC). The SDLC is the software development lifecycle. It is a method for dividing programming projects into separate phases. The Open Web Application Security Project (OWASP) is a community effort that provides free access to many secure programming resources. The resources provided include documentation on web app vulnerabilities and mitigation tactics, software tools used to identify and handle threats that target web applications, frameworks for secure development life cycle implementation, frameworks for penetration testing web apps, general secure coding best practices, guidelines for specific web-based languages, and more.
You have determined that your client uses several networked devices that rely on an embedded operating system during your reconnaissance. Which of the following methods would MOST likely be the best method for exploiting these?
A.Use social engineering to trick a user into opening a malicious APK
B.Use web-based exploits against the devices web interfaces
C.Identify a jail broken device for easy exploitation
D.Use a spearfishing campaign top trick a user into installing a RAT
B.Use web-based exploits against the devices web interfaces
Explanation: OBJ-2.5: Most embedded operating systems use a web interface to access their configurations for setup and installation. Focusing on this web interface and using common web-based exploits is usually one of the best methods of exploiting a device with an embedded OS.
During your reconnaissance, you have determined that your client’s employees all use Android smartphones that connect back to the corporate network over a secure VPN connection. Which of the following methods would MOST likely be the best method for exploiting these?
A.Use social engineering to trick a user into opening a malicious APK
B.Use web-based exploits against the devices web interfaces
C.Identify a jailbroken device for easy exploitation
D.Use a tool like ICSSPLOIT to target specific vulnerabilities
A.Use social engineering to trick a user into opening a malicious APK
Explanation: OBJ-2.5: When targeting mobile devices, you must first determine if the company uses iPhones or Android-based devices. If they are using Android-based devices, you can use social engineering to trick a user into installing a malicious APK. As a penetration tester, you can create a malicious APK using msfvenom in the Metasploit framework. The user can install it directly from your website instead of the Google Play store.
What command could be used to list the active services from the Windows command prompt?
A.sc query type=running
B.sc query \servername
C.sc query
D.sc config
C.sc query
Explanation: OBJ-2.1: Windows uses the sc query to display information about the running service. It is part of the Service Control command-line tool, known as sc. The sc config command will modify the value of a service’s entries in the registry and the Service Control Manager database. The sc query command will obtain and display information about the specified service, driver, type of service, or driver type. By entering just the sc query, the command will return the information on the active services only. By using the type=running option, only the information on the running service will be displayed. If the command sc query \servername is used, then the remote server’s active services (\servername) will be displayed.
You have just conducted an automated vulnerability scan against a static webpage without any user input fields. You have been asked to adjudicate the scanner’s findings in the automated report. Which of the following is MOST likely to be a false positive?
A.Reflected XSS
B.Insecure HTTP methods allowed
C.Command injection allowed
D.Directory listing enabled
C.Command injection allowed
Explanation: OBJ-2.3: A command injection is unlikely since this is a static webpage and does not accept any user input. A command injection allows the user to supply malicious input to the web server and then passes that data to a system shell for execution. In this sense, command injection does create new instances of execution and can, therefore, leverage languages that the web app does not directly support.
You have been asked to provide some training to Dion Training’s system administrators about the importance of proper patching of a system before deployment. To demonstrate the effects of deploying a new system without patching it first, you ask the system administrators to provide you with an image of a brand-new server they plan to deploy. How should you deploy the image to demonstrate the vulnerabilities exposed while maintaining the security of the corporate network?
A.Deploy the image to a brand new physical server, connect it to the corporate network, then conduct a vulnerability scan to demonstrate how many vulnerabilities are now on the network
B.Utilize a server with multiple virtual machine snapshots installed to it, restore from a known compromised image then scan it for vulnerabilities
C.Deploy the system image within a virtual machine, ensure it is an isolated sandbox environment, then scan it for vulnerabilities
D.Deploy the vulnerable image to a virtual machine on a physical server, create an ACL to restrict all incoming connections to the system, then scan it for vulnerabilties
C.Deploy the system image within a virtual machine, ensure it is an isolated sandbox environment, then scan it for vulnerabilities
Explanation OBJ-2.2: To ensure your corporate network’s safety, any vulnerable image you deploy should be done within a sandboxed environment. This will ensure that an outside attacker cannot exploit the vulnerabilities but will still allow you to show the vulnerabilities found during a scan to demonstrate how important patching is to the security of the server.
An insurance company has developed a new web application to allow its customers to choose and apply for an insurance plan. You have been asked to help perform a security review of the new web application. You have discovered that the application was developed in ASP and used MSSQL for its backend database. You have been able to locate an application’s search form and introduced the following code in the search input field:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
IMG SRC=vbscript:msgbox(“Vulnerable_to_Attack”);> originalAttribute=”SRC” originalPath=”vbscript:msgbox(“Vulnerable_to_Attack “);>” -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
When you click submit on the search form, your web browser returns a pop-up window that displays Vulnerable_to_Attack. Which of the following vulnerabilities did you discover in the web application?
A.Cross-site request forgery
B.Command Injection
C.Cross-site scripting
D.SQL Injection
C.Cross-site scripting
Explanation: OBJ-3.4: This is a form of Cross-Site Scripting (XSS). Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. Attackers may use a cross-site scripting vulnerability to bypass access controls such as the same-origin policy. Cross-site request forgery (CSRF or XSRF) is a malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts. There are many ways in which a malicious website can transmit commands, such as specially-crafted image tags, hidden forms, and JavaScript XMLHttpRequests can all work without the user’s interaction or even knowledge. SQL injection is a code injection technique used to attack data-driven applications. Malicious SQL statements are inserted into an entry field for execution, such as dumping the database contents to the attacker. Command injection is an attack in which the goal is to execute arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user-supplied data (forms, cookies, HTTP headers, etc.) to a system shell.
Your service desk has received many complaints from external users that a web application is responding slowly to requests and frequently receives a “connection timed out” error message when they attempt to submit information to the application.
Which software development best practice should have been implemented to prevent this from occurring?
A.Stress testing
B.Regression testing
C.Input validation
D.Fuzzing
A.Stress testing
Explanation: OBJ-3.2: Stress testing is a software testing activity that determines the robustness of software by testing beyond normal operating limits. Stress testing is essential for mission-critical software but can be used with all types of software. Stress testing is an important component of the capacity management process of IT service management. It ensures adequate resources are available to support the end user’s needs when an application goes into a production environment. Regression testing confirms that a recent program or code change has not adversely affected existing features. Input validation is the process of ensuring any user input have undergone cleansing to ensure it is properly formatted, correct, and useful. Fuzzing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program.
You are analyzing the SIEM for your company’s e-commerce server when you notice the following URL in the logs of your SIEM: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- https://www.diontraining.com/add_to_cart.php?itemId=5”+perItemPrice=”0.00”+quantity=”100”+/>
C.XML Injection Explanation: OBJ-3.4: This is an example of an XML injection. XML injection manipulates or compromises the logic of an XML application or service. The injection of unintended XML content and/or structures into an XML message can alter an application’s intended logic. XML Injection can cause the insertion of malicious content into resulting messages/documents. In this case, the URL is attempting to modify the server’s XML structure. The original XML structure would be: . By using the URL above, this would be modified to the following: . The result would be that a new line was added in the XML document that could be processed by the server. This line would allow 10 of the product at $0.00 to be added to the shopping cart, while 0 of the product at $50.00 is added to the cart. This defeats the integrity of the e-commerce store’s add to cart functionality through this XML injection. A SQL injection occurs when data input by a user is interpreted as a SQL command rather than as normal data by the backend database. A buffer overflow is an exploit that attempts to write data to a buffer and exceed that buffer’s boundary to overwrite an adjacent memory location. A session hijacking attack consists of exploiting the web session control mechanism, normally managed for a session token. The real key to answering this question is identifying the XML structured code being entered as part of the URL, shown by the bracketed data.
A security analyst wants to implement a layered defense posture for this network, so he uses multiple antivirus defensive layers, including both an end-user desktop antivirus software and an email gateway scanner. What kind of attack would this approach help to mitigate?
A.Forensic attack
B.ARP Spoofing Attack
C.Social Engineering Attack
D.Scanning attack
C.Social Engineering Attack
Explanation: OBJ-3.1: By utilizing both endpoint protection (desktop antivirus software) and the email gateway scanner, the security analyst works to prevent phishing and other social engineering attacks. Emails are a common attack vector used in social engineering attacks.
