Crucial Exams - Practice Questions

Question 1

As part of an internal security assessment, you are required to scan a network segment that contains older, production-critical systems known for their fragility in terms of network traffic handling. Your objective is to identify vulnerabilities without causing system disruptions. Which scanning method would be most appropriate for this scenario?

• Credentialed scan
• TCP connect scan
• Non-credentialed scan
• Stealth scan

Answer 1

Credentialed scan

A credentialed scan is the appropriate choice when dealing with fragile systems. This method uses valid access credentials to perform a more in-depth and safer examination of the target systems, reducing the risk of causing disruptions which may occur with more aggressive uncredentialed scans that can overwhelm sensitive systems. A non-credentialed scan can risk causing issues with fragile systems due to the more intrusive nature of the probing. A stealth scan’s main purpose is to avoid detection, and while it can be less noisy on the network, it might still cause a fragile system to become unstable. Transmission Control Protocol (TCP) connect scans are more intrusive as they establish a full TCP connection, potentially leading to system instability.

Question 2

When attempting to identify vulnerabilities in a thick client application that interacts with a web service backend, which feature of the Burp Suite community edition should a penetration tester use to MOST effectively analyze and manipulate the HTTP/S traffic between the client and the server?

• Repeater
• Proxy
• Intruder
• Scanner

Answer 2

Proxy

The correct answer is the Proxy feature. The Proxy feature in Burp Suite acts as an interception proxy, which allows the penetration tester to view, modify, and resend HTTP/S requests and responses passing through it. This is essential for testing thick client applications that communicate with a web service backend, as it enables the tester to analyze the traffic for potential vulnerabilities. The Scanner feature is not available in the community edition, which is why it’s an incorrect answer, and Intruder and Repeater are features that are best suited for other types of testing such as automated attacks and manual request resending respectively, rather than initial traffic analysis and interception.

Question 3

You are conducting a penetration test against an AWS environment and require a tool that can efficiently identify IAM weaknesses and escalate privileges. What is the BEST tool to perform this task while also offering the ability to automate the exploitation of several discovered vulnerabilities?

• Metasploit
• Pacu
• OWASP ZAP
• Scout Suite

Answer 3

Pacu

Pacu is designed as an open-source AWS exploitation framework, providing penetration testers with the ability to simulate an adversary that has obtained credentials to an AWS account. For IAM weaknesses and privilege escalation, Pacu is especially potent due to its specialized modules that automate the exploitation of vulnerabilities. It can aid in revealing misconfigurations that could lead to privilege escalation or other security issues within AWS services. While tools like Scout Suite and OWASP ZAP are powerful in their respective domains (configuration auditing and web application security testing), they are not specialized for IAM weakness identification and exploitation in AWS environments. Metasploit is a versatile penetration testing tool, but it is not cloud-centric like Pacu and does not offer the same in-depth functionality for AWS IAM exploitation.

Question 4

During the information gathering phase of a penetration test, you are tasked with using strategic search engine analysis to uncover potential leads about an organization’s internet-facing infrastructure. Which of the following search queries could reveal the existence of sensitive documents that the company did not intend to make public?

• example.com:2087 -site:example.com
• intitle:index.of server at example.com
• site:example.com filetype:pdf confidential
• link:example.com -site:example.com

Answer 4

site:example.com filetype:pdf confidential

The search query ‘site:example.com filetype:pdf confidential’ is correct because it explicitly looks for PDF files on the domain ‘example.com’ that contain the keyword ‘confidential’. This type of search is commonly used by penetration testers to find sensitive documents that might have been inadvertently exposed. The use of ‘filetype’ refines the search to a specific type of document, increasing the chances of finding documents with potentially sensitive information. Conversely, the other options do not apply the same level of specificity or relevance to finding sensitive documents unintentionally made public.

Question 5

Scout Suite

Answer 5

Scout Suite is a multi-cloud security auditing tool that assesses the configuration of cloud environments to identify potential security risks. It supports major cloud providers such as AWS, Azure, Google Cloud Platform, and others. The tool allows penetration testers to evaluate cloud configurations for misconfigurations and vulnerabilities, enabling better security postures

Question 6

As a penetration tester, you have been tasked to assess the security of a company’s wireless infrastructure. You decide to simulate an evil twin attack to test the network’s resilience to credential theft. Which tool would you use to create a rogue access point that replicates the company’s WPA2-Enterprise network in order to capture employee credentials?

• Use EAPHammer to create the rogue access point and facilitate the attack to capture credentials.
• Deploy mdk4 to conduct a denial-of-service attack on the network, effectively disrupting the wireless services.
• Implement Kismet for network detection and packet sniffing on the target wireless network.
• Utilize Aircrack-ng to crack the WPA2 password and gain unauthorized access to sensitive information.

Answer 6

Use EAPHammer to create the rogue access point and facilitate the attack to capture credentials.

EAPHammer is specifically designed for such a scenario, where it can be used to create a rogue access point that mimics the legitimate WPA2-Enterprise network. It can then capture credentials as employees unwittingly connect to this malicious access point, thinking it is the corporate network. The incorrect answers, while related to Wi-Fi security, do not provide the functionality to mimic WPA2-Enterprise networks for the purpose of capturing credentials through such an attack.

Question 7

EAP Hammer

Answer 7

• tool designed to conduct targeted wireless network attacks
• particularly against WPA2 Enterprise networks
• automates attacks such as rogue access point (EAP-based) creation, credential harvesting, and network impersonation
• identify weaknesses in enterprise wireless configurations

Question 8

Which method of using search engines for passive reconnaissance is most likely to yield comprehensive insight into potential vulnerabilities within a target organization’s web applications?

• Looking up the main company website to analyze the business’ profile and obtain general contact information.
• Reviewing the company’s public financial reports to identify budget allocations for cybersecurity.
• Searching the company’s social media feeds for general technology updates or event announcements.
• Using advanced search engine queries with operators to find exposed sensitive information or misconfigurations.

Answer 8

Using advanced search engine queries with operators to find exposed sensitive information or misconfigurations.

By using advanced search engine queries, such as those involving site:, filetype:, inurl:, or intext: operators, a penetration tester can discover sensitive information that may be inadvertently exposed on public websites. This can include configuration files, user credentials, or revealing error messages. This type of strategic search can uncover a wide array of vulnerabilities or misconfigurations more effectively than basic company details or generic searches, which tend to yield only surface-level information. The incorrect answers focus on specific narrow aspects that are less likely to provide a broad view of potential vulnerabilities across web applications.

Question 9

During a security audit of an application stack, you notice the application is utilizing an outdated open source component known for its critical vulnerabilities that have been patched in subsequent releases. Exploiting these vulnerabilities could lead attackers to compromise the hosting server. Which type of vulnerability does this scenario BEST describe?

• Patching fragmentation
• Dependency vulnerabilities
• Race conditions
• System misconfigurations

Answer 9

Dependency vulnerabilities

The scenario describes a dependency vulnerability, which occurs when an application relies on external components, libraries, or frameworks with known security issues that are not patched or updated. Attackers might exploit these vulnerabilities to breach systems if the dependencies are outdated and contain unfixed security flaws. Patching fragmentation refers to the inconsistent application of patches across systems, often seen in organizations with complex environments where some systems remain unpatched. Thus, a system using an outdated and vulnerable component is primarily at risk from dependency vulnerabilities.

Question 10

During a penetration test, who should you primarily reach out to for discussing specific technical details of the vulnerabilities found?

• C-suite executive
• Third-party stakeholder
• Emergency contact
• Technical contact

Answer 10

The technical contact is the individual within the client organization who possesses the detailed technical knowledge required to understand and act upon the technical aspects of the findings in a penetration test. Other options may have roles in the process, but the technical contact is the go-to for vulnerability discussions, making Answer A correct.

Question 11

You are conducting a security audit on a web page and have found a section where user input is dynamically inserted into the document without proper sanitation. To confirm the existence of this client-side security flaw, you intend to inject code that creates a dialog box displaying ‘Test’. Which of the following JavaScript snippets would be correctly executed to demonstrate the vulnerability?

• alert(‘Test’);
• aler’t(‘Test’);
• confirm(‘Test’);
• Alert(‘Test’);

Answer 11

alert(‘Test’);

The correct answer is snippet A, alert(‘Test’);, which is a standard method in JavaScript for invoking a dialog box with specified text content. This method is suitable for testing the insertion of malicious scripts, as it should only trigger when JavaScript is executed within the client’s browser context. Snippet B, Alert(‘Test’);, is incorrect due to the use of a capital ‘A’ in ‘Alert’, which is not recognized in JavaScript due to case sensitivity. Snippet C, aler’t(‘Test’);, contains a misplaced single quote, resulting in invalid syntax, thus, the script would not run. Snippet D, confirm(‘Test’);, would indeed create a dialog box but one that asks for confirmation (OK/Cancel) and is typically used to demonstrate a different form of interaction than just providing an alert.

Question 12

During the planning phase of a penetration test for a retailer that processes payment cards, it is essential to ensure that the testing activities comply with PCI DSS requirements. Which of the following activities during the penetration test requires special consideration to maintain PCI DSS compliance?

• Notifying Visa and Mastercard before starting the penetration test.
• Inserting a hardware keylogger into point-of-sale systems.
• Performing wireless network sniffing in areas where cardholder data is transmitted.
• Social engineering employees to reveal sensitive information.

Answer 12

Performing wireless network sniffing in areas where cardholder data is transmitted.

Performing wireless network sniffing in areas where cardholder data is transmitted requires special consideration. According to PCI DSS Requirement 4.1, strong encryption must be used during the transmission of cardholder data over open, public networks to safeguard transmission security. A penetration tester must ensure that they have permission and the proper segmentation checks in place so that they do not inadvertently capture or decrypt cardholder data, which would violate PCI DSS. Social engineering employees to reveal sensitive information isn’t directly restricted by PCI DSS during a pen test; it’s an accepted testing technique if agreed upon in the scope. Inserting a hardware keylogger into point-of-sale systems is not against PCI DSS as long as it’s permitted and controlled as part of the pen test, and there isn’t a requirement for notifying the card schemes in advance of a penetration test.

Question 13

Which PCI DSS requirements should you know?

Answer 13

• Annual and Quarterly Testing
• Scope of Testing: Test the entire cardholder data environment (CDE), including external, public-facing perimeters and LAN-to-LAN attack surfaces; Validate network segmentation to confirm systems are isolated and scope is reduced
• Vulnerability Scanning & Mitigation: both internal and external vulnerability scans quarterly and after significant changes.
• Segmentation Testing

Question 14

BurpSuite Modules to know

Answer 14

Repeater: This module allows testers to manually edit and replay HTTP/S requests to observe server responses. It’s useful for testing specific inputs and analyzing the resulting behavior

Scanner: Available in the professional version, the scanner automates the discovery of vulnerabilities in web applications by identifying issues like SQL injection or cross-site scripting

Intruder: This module is used to automate customized attacks, such as brute force, by sending a series of payloads to a target. It provides flexibility in testing various scenarios and input combinations

Question 15

Main Features of BurpSuite

Answer 15

Web Application Testing Toolset: Burp Suite is a comprehensive web application vulnerability scanning and penetration testing toolkit that includes features like vulnerability scanning and request interception

Interception Proxy: This tool can intercept HTTP/S traffic between a web browser and a web server, enabling manual manipulation of requests for testing security defenses

Versions: Available in a community edition (free) and a professional edition (paid), with the professional edition offering enhanced automation and scanning features

Usage Contexts: While primarily associated with web application security, it is also referenced in the textbook in relation to testing mobile application backends and APIs

Question 16

A penetration tester is tasked with evaluating the security of a mobile application. The tester wants to analyze the behavior of the application in a controlled environment to observe how it interacts with system resources and other applications. Which of the following is the BEST method to accomplish this goal?

• Leveraging a mobile security framework for static code analysis
• Deploying the application on a segmented area of the production network
• Using a mobile device emulator
• Running the application on a jailbroken device with monitoring tools

Answer 16

Using a mobile device emulator

Using a mobile device emulator creates a virtual mobile device on which the application can be safely run and analyzed. This allows the penetration tester to observe the application’s behavior under different conditions without risking the integrity of a physical device or the production environment. The other options either are not as relevant for analysis on a mobile application (a and c) or are general tools for mobile security testing but not specifically designed for behavioral analysis in a controlled environment like an emulator (d).

Question 17

As a penetration tester, you’re tasked with testing the strength of password hashes. Which tool would you use to perform brute-force attacks against various hash types in a scalable and effective manner?

• John the Ripper
• Aircrack-ng
• Hashcat
• Wireshark

Answer 17

Hashcat

Hashcat is known for its capability to perform brute-force and dictionary attacks against various types of hashes, making it an essential tool for penetration testers when assessing password security. It is chosen for its efficiency and broad support of hash types.

John the Ripper: While also a hash-cracking tool, it is generally less scalable compared to Hashcat.

Question 18

During an internal security assessment, a penetration tester needs to identify live hosts without performing a full port scan, to reduce network congestion. Which of the following Nmap options would be most appropriate for the tester to use to simply ping the hosts?

• -p
• -sV
• -sn
• -A

Answer 18

-sn

The ‘-sn’ option in Nmap is used to perform a host discovery, which simply pings the hosts without actually scanning any ports. This is the correct answer as it minimizes the amount of traffic and reduces the chance of causing network disruption. The ‘-sV’ option executes a service version detection, which is more intrusive and creates more traffic, going beyond the requirement of just discovering live hosts. The ‘-A’ option enables OS detection, version detection, script scanning, and traceroute, which would not only produce more traffic but also try to scan and fingerprint hosts, which is not needed in this scenario. The ‘-p’ option specifies the target ports to scan, which does not directly relate to host discovery without port scanning.

Question 19

A WPS PIN attack requires an attacker to physically access the WPS button on a router to initiate the brute-force process.

• True
• False

Answer 19

False

The correct answer is false because a WPS PIN attack can be performed remotely. Attackers do not need physical access to the router; instead, they exploit the WPS PIN feature to gain access to the network by using software tools that attempt to brute-force the WPS PIN, which is an 8-digit number. Such attacks often exploit the fact that the PIN is validated in two halves, which reduces the number of attempts needed to guess the correct PIN.

Question 20

As a penetration tester in the initial stage of assessing a target organization’s external IT infrastructure, you need to gather intelligence on potentially vulnerable Internet-facing services without triggering security alerts. Which of the following tools would effectively enable passive reconnaissance to identify exposed services and devices, including specific versions and configurations, from publicly available information?

• Nmap
• CeWL
• theHarvester
• SQLmap

Answer 20

theHarvester

The correct answer is theHarvester. It is specifically designed to gather publicly available information such as email accounts, subdomain names, virtual hosts, open ports, and banners from different public sources like search engines and PGP key servers. This makes it suitable for passive reconnaissance. Nmap is typically employed for active scanning and could inadvertently set off security alarms if used inappropriately. SQLmap is an automatic SQL injection and database takeover tool, which is not intended for initial reconnaissance. CeWL creates custom wordlists from a given URL, useful for creating targeted password lists, but does not serve the purpose of identifying services and devices.

Question 21

During the preliminary phase of a penetration test, you are given a list of web applications owned by the client company that are to be assessed. The client has emphasized the importance of staying within the boundaries of the scoped engagement. Which of the following actions BEST ensures that the penetration test aligns with the client’s requirements?

• Consult the penetration testing team’s standard checklist for application assessments before starting.
• Begin testing with automated scanning tools to quickly identify potential vulnerabilities in the web applications.
• Immediately start a manual assessment of the first web application on the list to understand its functionality.
• Review the contract and scope of work documents to confirm the web applications and types of tests that are authorized.

Answer 21

Review the contract and scope of work documents to confirm the web applications and types of tests that are authorized.

Reviewing the contract and scope of work documents provided by the client ensures that the penetration tester understands which web applications are included in the engagement and what types of tests can be performed. This helps avoid any unauthorized actions and ensures that the engagement is carried out professionally and ethically. The other options, although potentially useful, do not guarantee adherence to the engagement’s limitations and could lead to actions outside the agreed scope.

Question 22

During an active reconnaissance phase, a penetration tester is analyzing the URLs of a client’s web application to determine entry points and possible vulnerabilities. Which of the following URL formats is MOST likely to be useful for identifying potential parameters for testing inputs or discovering hidden directories?

• user@example.com?subject=Inquiry
• https://www.example.com/product.php?id=1234&category=tools
• https://www.example.com/privacy
• ftp://ftp.example.com/resources

Answer 22

https://www.example.com/product.php?id=1234&category=tools

The correct answer is ‘https://www.example.com/product.php?id=1234&category=tools’. This URL contains parameters (‘id’ and ‘category’), which can be tested for vulnerabilities such as SQL injection, XSS, and more. A penetration tester could manipulate these parameters to see how the application responds, thereby potentially discovering security flaws.

The incorrect answers listed don’t provide the same level of actionable information. The URL containing the ‘mailto’ protocol is typically used for email and does not usually have parameters that could be tested for web application vulnerabilities. The URL with ‘https://www.example.com/privacy’ is likely a static page and while it could contain potential endpoints for further investigation, it does not explicitly showcase parameters like the correct answer. Lastly, the URL ‘ftp://ftp.example.com/resources’ uses the FTP protocol, which is less likely to be the focus of this type of testing in comparison to HTTP(S), which directly interacts with web applications.

Question 23

During a penetration test, you have obtained access to a suspect’s computer where you suspect secret information is being transmitted using image files. To confirm your suspicions, you decide to analyze these image files for potential hidden data. Which tool would assist you in uncovering data hidden using steganographic techniques?

Aircrack-ng
Wireshark
Snow
Steghide
Gobuster
OWASP ZAP

Answer 23

Steghide

The correct answer is Steghide. It is a steganography program that is able to hide data in various kinds of image- and audio-files. The presence of a tool like Steghide on a suspect’s computer might suggest that the individual is using steganography to conceal data. The other options listed are also tools used in penetration testing, but they do not specialize in steganography like Steghide. Gobuster is for enumerating files and directories on web servers, Snow is a tool for hiding text in whitespace, and OWASP ZAP is for finding vulnerabilities in web applications. So although these are related to the fields of cybersecurity and penetration testing, they would not typically be used for detecting steganographic data.

Question 24

Snow

Answer 24

Snow is another steganography tool that utilizes whitespace in text files to hide data. By embedding information in spaces and tabs within the text, it allows for concealed data storage

Question 25

Steghide

Answer 25

Steghide is a steganography tool used for embedding hidden data within image or audio files and retrieving that data when needed. It supports encryption and compression of the embedded data, making it a useful tool for securely hiding information

Question 26

GoBuster

Answer 26

Gobuster is a tool designed for brute-forcing web paths, DNS subdomains, and virtual host names on target systems. It is commonly used for discovering hidden directories, files, and subdomains during penetration testing

aka enumerating files and directories on web servers

Question 27

Creating a scenario in which the attacker pretends to be a member of the IT department to gain access to sensitive information is an example of pretexting.

True
False

Answer 27

True

The correct answer is true. Pretexting is a social engineering technique where the attacker creates a fictitious scenario or assumes a false identity to manipulate a target into divulging information or gaining unauthorized access. In this case, the attacker is pretending to be a member of the IT department, which is a typical example of pretexting. The goal is to establish trust or authority to elicit sensitive information from the victim.

Question 28

When conducting a penetration test, you are to evaluate the security posture of both the public-facing (external) applications and the internal network infrastructure of an organization. Assuming that all legal permissions and access rights are in place, which approach would BEST align with the penetration testing strategy to comprehensively assess the security of both external and internal targets within the confines of the test scope?

• Exclusive external testing of the perimeter networks and public IP addresses
• Purely passive reconnaissance of both external and internal assets
• Full knowledge testing using source code analysis and network sniffing for both external and internal targets
• A combination of network-based tests for the internal infrastructure and application-based tests for the public-facing applications

Answer 28

A combination of network-based tests for the internal infrastructure and application-based tests for the public-facing applications

Choosing a combination of network-based and application-based tests specifically tailored for the respective environments is the best approach to comprehensively assess the security of both external (public-facing applications) and internal targets (internal network infrastructure). Network-based tests are suitable for evaluating the internal infrastructure, while application-based tests target public-facing applications. These two approaches complement each other by providing coverage for the different types of assets. Full knowledge testing is more aligned with white-box testing, which might not be as effective for external targets without prior knowledge. Passive reconnaissance is usually a preliminary step and doesn’t actively test security controls. External testing only does not provide coverage for internal network infrastructure vulnerabilities.

Question 29

As a penetration tester, you are tasked with gathering intelligence about a target company’s technology stack without alerting them to your activities. Which of the following methods would provide insight into the technology stack without directly engaging with the target’s systems or networks?

• Establishing a connection to the target’s network to monitor outgoing traffic
• Performing DNS lookups to identify all the subdomains of the company
• Conducting a scan of the target’s IP address space to detect running services
• Reviewing the target company’s job listings for technology skill requirements

Answer 29

Reviewing the target company’s job listings for technology skill requirements

Reviewing job listings can provide insight into the technology stack a company uses based on the skills and experience they are seeking in candidates. This method is passive because it does not require any interaction with the target’s systems. DNS lookups involve queries to DNS servers, which may still be considered passive, but it does not yield technology stack information directly. Attempting to connect to the target’s network or scanning their IP addresses are active reconnaissance methods that could potentially alert the target to the presence of a reconnaissance activity.

Question 30

During a penetration test, you discover evidence suggesting that an employee has been engaging in illegal activities using the company’s network. Which of the following actions aligns best with professional conduct and legal responsibilities?

• Confront the employee directly to investigate the matter further.
• Immediately notify the primary or emergency contact designated by the client to relay your findings confidentially.
• Turn off the affected systems to prevent any further illegal activity.
• Ignore the findings as they are beyond the scope of the penetration test

Answer 30

Immediately notify the primary or emergency contact designated by the client to relay your findings confidentially.

When encountering potential criminal activity during a penetration test, the tester must communicate this information to the primary or emergency contact within the organization as outlined in the communication plan. It is crucial to handle the situation with confidentiality and let the appropriate parties within the organization manage the legal response. Directly confronting the individual or ignoring the findings are not adhering to professional and ethical standards, and turning off the affected system could hinder further investigation by the appropriate authorities.

Question 31

As part of a penetration testing team, you are tasked with evaluating the security of a large financial corporation’s mobile banking app. The app employs certificate pinning to secure HTTPS traffic. Which of the following techniques could you leverage to bypass the certificate pinning and analyze the encrypted traffic?

• Setting up a proxy and using a Frida script to bypass the application’s certificate pinning while the traffic routes through the proxy.
• Generating a new certificate pair for the server and replacing the pinned certificate within the app’s configuration.
• Cloning the server’s actual certificate and using it in a MitM position to bypass the pinning mechanism.
• Installing an unauthorized version of the app containing a rogue certificate instead of the pinned certificate.

Answer 31

Setting up a proxy and using a Frida script to bypass the application’s certificate pinning while the traffic routes through the proxy.

Modifying the network traffic routing to pass through a proxy would allow an attacker to analyze the encrypted traffic if the attacker can install their own certificate authority on the device and trust it to intercept SSL/TLS communications. Since the mobile banking app employs certificate pinning, this would typically prevent the proxy from intercepting the traffic; however, combining it with a Frida script to hook into the application and bypass the pinning check can successfully enable the interception of network traffic. Frida is a dynamic code instrumentation toolkit that allows testers to change the behavior of apps at runtime.

Installing a rogue application version would be possible if the attacker could create one but does not directly solve the challenge of bypassing certificate pinning. Generating a new certificate pair does not bypass pinning, as the app is programmed to only trust a specific certificate. Cloning the server’s actual certificate is not practical without access to the server’s private key, and the application would still recognize it as non-pinned. Spoofing DNS records would not affect HTTPS traffic in this context, as certificate pinning is designed to resist this kind of attack.

Question 32

As a penetration tester, you are authorized to test an application’s API that employs scoped access tokens. When you request a token from the authorization server specifying a particular scope, you receive a token with broader privileges than expected. What should your next course of action be to ethically continue the test according to the rules of engagement?

• Inform the client and request a token with the correct scope.
• Manually adjust the scope in the token to match the intended permissions and proceed with testing.
• Continue testing using the received token but avoid accessing the functionalities that are outside the initial scope.
• Use the broader scoped token to test additional functionalities since it will provide a more comprehensive security assessment.

Answer 32

Inform the client and request a token with the correct scope.

The correct answer is to inform the client and request a token with the correct scope, as per the test’s rules of engagement. Accidentally receiving a token that grants broader access than intended can lead to testing systems that are out of scope, which might be against the policies and potentially illegal. While tempting, using the broader scoped token without authorization would be unethical and potentially a violation of the agreed-upon rules. Continuing with the received token without notifying the client or attempting to limit its privileges on your own are both incorrect actions that could lead to adverse outcomes.

Ask Bash

Question 33

A penetration tester is conducting an assessment against a web application and has observed that session tokens are not rotated after login. Which type of attack could the penetration tester employ to take advantage of this vulnerability?

• Session fixation
• Cross-site request forgery (CSRF)
• Session replay
• Cross-site scripting (XSS)

Answer 33

Session fixation

In a session fixation attack, the attacker sets a known session ID on an application before the victim logs in, and due to the lack of session rotation upon authentication, the attacker can use this predefined session ID to hijack the session once the victim has logged in. Session rotation is a critical security measure that involves changing the session token after a user logs in to prevent session fixation attacks. The incorrect answers, while they are related to session management in various ways, do not directly exploit the lack of session rotation post-authentication.

Question 34

Session Fixation

Answer 34

Session fixation is a type of session hijacking attack where an attacker exploits web applications that reuse the same session ID across user sessions instead of expiring them. The attacker can then use this fixed session ID to access a victim’s account by:

1. Obtaining an old session ID via malware, eavesdropping, or log theft.
2. Getting the victim to authenticate with the application using the old session ID.
3. Using the same session ID to impersonate the victim.

Question 35

Session Replay

Answer 35

A session replay attack occurs when an attacker captures and reuses a user’s authentication credentials (like cookies or tokens) to impersonate the user and gain unauthorized access to a system. This type of attack often exploits insecure session handling and unencrypted communication channels​.

Question 36

XSFR

Answer 36

Cross-site request forgery (XSRF), also known as CSRF, is an attack that tricks a user into performing actions on a web application where they are authenticated. It typically involves the attacker embedding a malicious link or script in a way that causes the user’s browser to execute unauthorized actions on the target application.

Question 37

XSS

Answer 37

Cross-site scripting (XSS) is a web application vulnerability that allows an attacker to embed malicious scripts into a web page, which then execute on the browsers of users who visit the page. These attacks can be reflected (user input directly returned in a web response), stored (malicious input stored on a server), or DOM-based (script execution through the manipulation of the Document Object Model on the client side).

Question 38

A penetration tester is tasked with enumerating group memberships on a compromised system to identify potential targets for lateral movement. Which of the following commands should the tester execute to find the BEST information about group memberships that could help in identifying privileged accounts?

• net accounts /domain
• net localgroup administrators
• net share
• net user /add

Answer 38

net localgroup administrators

The net localgroup administrators command displays a list of all the members of the administrators group on a local or remote system. This group typically has the highest level of privileges, and knowing its members is vital for strategizing lateral movement and privilege escalation. The other commands do not provide direct insights into the privileged accounts that are part of the administrators group.

Question 39

After completing a penetration test, you are in the process of post-engagement cleanup. What is the BEST action to take to ensure that no backdoors or remote access methods remain accessible to potential attackers?

• Check for updates on all the software installed on the systems
• Remove all reverse shells and backdoors installed during the testing
• Uninstall all penetration testing tools from the client’s systems
• Change all passwords used during the penetration testing engagement

Answer 39

Remove all reverse shells and backdoors installed during the testing

The correct answer is to remove all reverse shells and backdoors that were installed during the testing process. This action ensures that no unauthorized entry points remain, which could be exploited by an attacker. Simply uninstalling tools doesn’t guarantee that access methods created by those tools are also removed. Changing all passwords could be a prudent post-engagement action but it may not remove any shells that were installed. Checking for updates is important, but it focuses on patch management rather than the removal of intentionally installed access methods.

Question 40

mitm6

Answer 40

Mitm6 is a tool used to exploit Windows DNS servers by responding to DHCPv6 messages with a link-local IPv6 address and an attacker-controlled system as the default DNS server. This allows attackers to perform man-in-the-middle (on-path) attacks, redirecting traffic to arbitrary destinations.

Question 41

What is the primary purpose of the penetration testing tool known as ‘mitm6’?

• It performs man-in-the-middle attacks on IPv6 networks.
• t acts as a packet analyzer for inspecting network traffic.
• It operates as a proxy server to forward requests between clients and servers.
• It functions as a vulnerability scanner to identify security weaknesses.

Answer 41

It performs man-in-the-middle attacks on IPv6 networks.

Mitm6 is specifically designed to exploit weaknesses in the configuration and use of IPv6 networks to carry out man-in-the-middle (MITM) attacks. These attacks can intercept and manipulate traffic to gain unauthorized access to data flows between clients and servers. The incorrect answers provided are related to penetration testing but do not accurately depict the primary function of ‘mitm6’. A packet analyzer is used to capture and analyze network traffic, a vulnerability scanner is meant to identify and report potential security holes, and a proxy server is used to redirect client requests to the server.

Question 42

During a penetration test, you are writing a Python script to automate the extraction of subdomains from a lengthy DNS enumeration tool output. You decide to use a string operator to check if a specific subdomain exists within a line of the output before adding it to your list. Which of the following string operators would allow you to perform this check?

• %
• +=
• in
• ==

Answer 42

in

The in operator in Python can be used to check if a particular substring exists within a string. This is why it is the correct choice. The += operator is used to append a value to an existing variable, typically used in loops for concatenation or arithmetic operations but doesn’t check the existence of a substring. The == operator compares two values for equality, which is not useful when looking for a substring within a larger string. % is the modulus operator in arithmetic operations and can be used as a string formatting operator in Python, but it does not check for substring existence either.

Question 43

What type of information is primarily returned by querying Shodan?

• Usernames and passwords for compromised accounts
• Complete source code of web applications
• IP addresses, device types, and services
• GPS coordinates of mobile devices

Answer 43

IP addresses, device types, and services

Shodan is designed to provide information about devices connected to the internet, such as the types of devices, their IP addresses, and the services they are running. This information is essential for penetration testers to locate potential targets and understand their network landscape. The correct answer is ‘IP addresses, device types, and services’. The other options either do not directly relate to the primary information obtained from Shodan queries or only partially describe the vast data Shodan could return, but not as its primary set of information.

Question 44

During a recent penetration testing engagement for a financial firm, you discovered that an employee’s credentials were used to access sensitive client data during a time when the employee was on a mandatory vacation. This finding should prompt which of the following recommendations in your final report?

• Advise additional system hardening techniques to ensure that the employee’s credentials cannot be misused during their mandatory vacation period.
• Recommend reinforcing the use of mandatory vacations as an operational control, along with auditing account activity during such periods to uncover potential unauthorized access or internal threats.
• Suggest implementing job rotation so that no single employee has exclusive access to sensitive client data for an extended period.
• Propose enhanced user training focused on security best practices to prevent employees from sharing their credentials.

Answer 44

Recommend reinforcing the use of mandatory vacations as an operational control, along with auditing account activity during such periods to uncover potential unauthorized access or internal threats.

The correct answer involves implementing mandatory vacations as an operational control. Mandatory vacations can potentially reveal fraudulent activities and are part of a good security strategy, as unauthorized access during an employee’s absence may indicate account misuse or compromise. Mentioning system hardening ignores the operational control aspect related to employee absence. While job rotation is an operational control, it does not directly address the issue of detecting unauthorized access during an employee’s absence. Similarly, user training is always beneficial but does not directly relate to the specific situation presented in the question.

Question 45

A client, operating a multinational corporation, requires a penetration test for their network infrastructure. However, due to strict data sovereignty laws, they insist that any discovered data must not leave the country of origin. The penetration test is to be performed remotely from your location in another country. Which of the following approaches would BEST align with the client’s data sovereignty restrictions?

• Utilize a jump box located within the client’s country to conduct tests and analyze results
• Instantiating a VPN to the client’s network to ensure a secure connection for testing
• Limit the scope to include only the testing of public-facing services to avoid data sovereignty complications
• Encrypting all test results to prevent unauthorized access while transmitting data back to your location

Answer 45

Utilize a jump box located within the client’s country to conduct tests and analyze results

The correct answer is ‘Utilize a jump box located within the client’s country to conduct tests and analyze results,’ because it addresses the data sovereignty issue by ensuring that any testing and resulting data remain within the country, adhering to local laws while still allowing the penetration tester to perform their duties from a remote location. Instantiating a VPN would not ensure compliance with data sovereignty as the data might transit through other jurisdictions. Encrypting all test results has merit for securing the data but doesn’t prevent data from leaving the country. Testing only public-facing services may still risk violating data sovereignty laws if any resulting data is stored or analyzed outside the target country.

Question 46

During a penetration test, you perform an initial port scan using Nmap against the target web server. The scan results show that ports 80 (http) and 443 (https) are open. To expedite the testing process, which script should be executed next to further examine these services and look for potential vulnerabilities, while maintaining a degree of stealth?

• Execute an aggressive Nessus vulnerability scan on the entire target network to identify all potential vulnerabilities regardless of service.
• Use the sqlmap tool to automatically attempt SQL injection attacks on the web server’s database services.
• Run the Nmap script engine (NSE) with the http-enum script to locate directories that might reveal the web server’s configuration and content.
• Launch a brute force attack on the SSH service using Hydra to identify weak credentials that may be used to access the system.

Answer 46

Run the Nmap script engine (NSE) with the http-enum script to locate directories that might reveal the web server’s configuration and content.

The correct option automates testing for common vulnerabilities on web servers after an initial port scan shows that web services are available. The script provided by Nmap for http-enum can be used to enumerate potential files and directories on the web server, which is a logical next step when ports 80 and 443 are open. The incorrect options either are not designed for analyzing web vulnerabilities directly (such as a DNS enumeration script or a brute force attack script on an SSH service), or they do not maintain a degree of stealth (like launching a full-scale aggressive vulnerability scan which can be noisy and alert a network’s intrusion detection systems).

Question 47

During a penetration test for a client subject to the PCI DSS, you identify a service running on a system within the cardholder data environment that does not appear to be necessary for the processing, storage, or transmission of cardholder data. According to PCI DSS requirements, what is the BEST action to take?

• Recommend the disabling of unnecessary services to comply with the principle of least functionality.
• Perform a comprehensive asset inventory to confirm the presence of the service across the network.
• Advocate for stronger encryption methods for stored cardholder data to offset any risks introduced by the service.
• Suggest enhancing the intrusion detection system to monitor the unauthorized service closely.
• Review the terms within the Service Level Agreements (SLAs) regarding the operation of unauthorized services

Answer 47

Recommend the disabling of unnecessary services to comply with the principle of least functionality.

Choosing to ‘Recommend the disabling of unnecessary services to comply with the principle of least functionality’ is correct as it aligns with PCI DSS Requirement 2.2.2, which states that services and protocols not directly needed to perform the device’s specified function should be disabled. Simply encrypting cardholder data, performing asset inventory, or enhancing intrusion detection would not directly address the specific issue of unnecessary services running. While reviewing existing SLAs can be part of compliance checks, it does not address the immediate concern of extraneous services that could pose a security risk.

Question 48

During the reconnaissance phase of a penetration test, you decide to use WiGLE to gather information about wireless networks in the vicinity of your target organization. You are particularly interested in identifying Wi-Fi access points that may belong to the target organization or could provide a vector for further penetration. Which of the following actions would be the most effective first step in using WiGLE to locate potential target access points?

• Search for networks using the SSID associated with the target organization.
• Deploy a rogue access point near the target location to capture traffic.
• Perform a brute-force attack on the target’s VPN infrastructure.
• Conduct social engineering to obtain the target’s Wi-Fi passphrase

Answer 48

Search for networks using the SSID associated with the target organization.

To identify and analyze potential target wireless networks using WiGLE, the most effective first step is to search for networks based on the SSID that is known or suspected to be associated with the target organization. This first step assumes preliminary information has been gathered about the organization, such as their naming conventions for network resources. Incorrect choices involve actions either not applicable to WiGLE or less efficient initial steps.

Question 49

You have been given the task of assessing the strength of authentication methods on a client’s server. To conduct your analysis, you choose a popular brute-force tool. With the server’s IP address being ‘192.168.1.50’ and having lists of potential usernames and passwords named ‘users.txt’ and ‘passwords.txt’, respectively, determine the correct syntax to initiate the brute-force process against the secure remote login protocol.

• Medusa -h 192.168.1.50 -U users.txt -P passwords.txt -M ssh
• Medusa –target 192.168.1.50 –userlist users.txt –passwordlist passwords.txt –protocol securelogin
• ForceEntry -i 192.168.1.50 -userfile users.txt -passfile passwords.txt -mode securelogin
• BruteForceTool –ip 192.168.1.50 –users users.txt –passwords passwords.txt –attack securelogin

Answer 49

Medusa -h 192.168.1.50 -U users.txt -P passwords.txt -M ssh

The correct answer is Medusa -h 192.168.1.50 -U users.txt -P passwords.txt -M ssh. This is because the ‘-h’ flag specifies the target host’s IP address, ‘-U’ designates the file that contains potential usernames, and ‘-P’ indicates the file with potential passwords. Finally, ‘-M’ is used to define the type of service or protocol to attack, in this case, the secure remote login protocol typically associated with port 22. The incorrect answers suggest syntax that either does not correctly define the parameters for this protocol or uses invalid or nonexistent flags for the Medusa command-line syntax.

Question 50

During a vulnerability scan, you need to ensure that the scanning activities are as discreet as possible. Which protocol would be preferable for stealth scanning to reduce the chance of detection by network security devices?

TCP SYN (half-open) scan
TCP connect scan
User Datagram Protocol (UDP) scan
Transmission Control Protocol (TCP) scan

Answer 50

TCP SYN (half-open) scan

TCP connect scan is regarded as less stealthy because it completes the three-way handshake, making the scan more detectable by security devices. A SYN scan, however, is more discreet as it sends a SYN packet and if a SYN-ACK is received, it does not complete the handshake but sends an RST instead. This behavior is sometimes referred to as a ‘half-open’ scan because it doesn’t establish a full TCP connection, thereby reducing its footprint and likelihood of detection.

Question 51

All wireless network penetration tests must be conducted on-site due to limitations in technology that prevent remote testing.

True
False

Answer 51

True

It is a common misconception that wireless network penetration tests can only be conducted on-site. In fact, there are tools and technologies available that allow penetration testers to perform wireless network tests remotely. Some tests may require on-site presence, especially for capturing traffic and understanding the physical environment, but it is not a strict requirement for all wireless network tests.

Question 52

During a penetration testing engagement, you have discovered a critical vulnerability that could potentially lead to a full system compromise. The client’s team appears to be stressed and overwhelmed with the findings. What is the best course of action to de-escalate the situation while ensuring the criticality of the issue is understood?

• Schedule an immediate, one-on-one discussion to explain the findings to either the primary or technical contact before wider communication.
• Write a detailed report first and then schedule a meeting with the whole team for the next day to discuss the findings.
• Begin with presenting the issues in an unplanned team meeting to ensure everyone is on the same page.
• Send a company-wide email alerting all employees of the critical finding, emphasizing the need for immediate attention.

Answer 52

Schedule an immediate, one-on-one discussion to explain the findings to either the primary or technical contact before wider communication.

The correct answer, providing an immediate, one-on-one discussion with the primary or technical contact, is the most effective method to de-escalate and provide clear communication. It allows for a focused environment where concerns can be directly addressed and further distress to the team can be mitigated. The remaining options are not ideal as they either raise alarm (e.g., sending a company-wide email), lack immediacy and personal interaction (e.g., writing a detailed report first), or may create unnecessary confusion (e.g., presenting the issues in a meeting without prior notice).

Question 53

Which of the following is the BEST approach for a penetration tester to effectively interact with a web application without triggering query throttling mechanisms?

• Set scan configurations for high speed and maximum requests
• Disable security controls on the target system before scanning to prevent throttling
• Scan using the default rate limit provided by the scanning tool
• Introduce random delays between consecutive scans

Answer 53

Introduce random delays between consecutive scans

The correct answer is ‘Introduce random delays between consecutive scans’. This technique minimizes the chances of triggering query throttling mechanisms because it mimics normal user behavior instead of a scripted series of rapid requests that could raise flags about potential automated scanning activities. ‘Setting scan configurations for high speed and maximum requests’ is incorrect because this could easily overwhelm the application’s controls, potentially triggering throttling or causing a denial of service. ‘Scanning with the default rate limit’ might not be effective because it doesn’t take into account the specific thresholds that can trigger throttling on the target application. ‘Disabling security controls before scanning’ is not only unethical but often illegal and can result in severe consequences.

Question 54

During the planning phase of a penetration test for a federal agency, you are assessing which document should guide the identification and implementation of security controls to ensure compliance. Which publication should you refer to for a comprehensive list of security and privacy controls for all federal information systems, apart from those related to national security?

SP 800-66
SP 800-53
SP 800-34
CIS Controls

Answer 54

SP 800-53

The appropriate publication, SP 800-53, provides a catalog of security and privacy controls that federal information systems need to implement. This standard is crucial for penetration testers working on systems that need to comply with federal guidelines. SP 800-66 is specific to compliance with the HIPAA Security Rule; thus, it focuses on health information. SP 800-34 pertains to strategies for IT system contingency planning rather than security controls. Lastly, CIS Controls are developed by the Center for Internet Security and, while valuable, are not specifically a federal standard for information systems.

Question 55

NIST SP 800-66

Answer 55

regulations/guidlelines specific to HIPAA

Question 56

SP 800-53

Answer 56

provides a catalog of security and privacy controls that federal information systems need to implement

Question 57

SP 800-34

Answer 57

pertains to strategies for IT system contingency planning rather than security controls

Question 58

As a penetration tester, you are contracted to perform a security assessment for a company that utilizes multiple public cloud services. Which of the following considerations is MOST important when defining the scope of your penetration test?

• Determine if other organizations hosted by the same provider inadvertently come into scope.
• Select the tools that will be used during the engagement.
• Ensure the cloud service provider’s policy for penetration testing is followed.
• Secure the written permission to attack from local government authorities.

Answer 58

Ensure the cloud service provider’s policy for penetration testing is followed.

Understanding and adhering to the cloud service provider’s policy is most important because it dictates what actions can and cannot be taken within the provider’s environment. Conducting activities beyond allowed limits may result in account suspension or legal consequences. While knowing the tools to be used and assessing if the organization inadvertently comes into scope are also important, they follow the guidelines outlined by the providers’ policies for testing.

Question 59

During a penetration testing engagement, you are tasked with identifying cloud-based resources associated with the target organization to find potential entry points. Which tool would be best suited for enumerating subdomains and services for cloud platforms like AWS, Azure, and Google Cloud?

• Maltego
• Shodan
• CloudBrute
• theHarvester

Answer 59

CloudBrute

CloudBrute is specifically designed to discover an organization’s cloud environments. It takes a domain or keyword and systematically searches through permutations against popular cloud services, looking for misconfigured resources or hidden treasures. While other tools also focus on subdomain enumeration, they do not have the specific capability to enumerate cloud service subdomains and resources as effectively as CloudBrute.

Question 60

During a penetration test, you have successfully exploited a vulnerability on a target system. Which of the following options is the BEST method to establish a persistent and covert remote access channel?

• Set up an SSH server on the target system for remote access
• Install a new remote desktop software package on the target system
• Deploy a reverse shell with a listener on the attacker’s machine
• Configure a VPN connection back to the attacker’s machine

Answer 60

Deploy a reverse shell with a listener on the attacker’s machine

The correct answer is ‘Deploy a reverse shell with a listener on the attacker’s machine’. A reverse shell is designed to bypass firewall restrictions by initiating the connection from within the target network back to the attacker’s controlled environment. This type of connection is less likely to be flagged by security systems compared to a bind shell, which requires the attacker to connect directly into the compromised system, thus triggering firewalls or intrusion detection systems. A VPN can provide secure communications but is not designed for establishing covert remote access from an exploited system. SSH is a secure method for remote administration but does not inherently grant persistence or stealth. Lastly, installing a new software package increases the footprint on the system and could be very conspicuous to system administrators.

Question 61

A penetration tester is tasked with assessing the security of smart locks at a facility. These locks use a short-range wireless communication protocol often found in IoT devices. Which approach is MOST effective for gathering information that could facilitate unauthorized access?

• Employ a replay strategy with intercepted messages to gain unauthorized entry.
• Engage in passive eavesdropping to analyze communication patterns and intercept cryptographic keys.
• Directly sniff ongoing traffic in hopes of intercepting sensitive data exchanges.
• Attempt to pair with the lock using a brute-force method to guess the key.

Answer 61

Engage in passive eavesdropping to analyze communication patterns and intercept cryptographic keys

When dealing with short-range wireless protocols utilized by many IoT devices, passive eavesdropping is a common initial attack vector. This technique allows the penetration tester to acquire a deep understanding of the communication patterns and encryption keys in use without alerting the system to their presence. By learning about the security mechanisms in play discreetly, more advanced and targeted attacks can be designed. Attempting to brute-force the key may be ineffective and alert administrators due to multiple failed attempts. Similarly, sniffing may only capture information while active transmission is taking place and could potentially be logged or noticed. Replay attacks require specific transaction conditions and timing, and modern devices often have measures in place such as timestamps and unique transaction identifiers to mitigate such threats.

Question 62

When leveraging the Empire framework in a post-exploitation phase, which action best facilitates lateral movement while minimizing the risk of detection?

• Executing a PowerShell remoting session to move to other machines using compromised credentials.
• Using Over-Pass-The-Hash (passing the ticket) to access resources with Kerberos authentication.
• Deploying Mimikatz on the compromised machine to extract plaintext passwords directly.
• Brute-forcing network service accounts to gain access to additional systems

Answer 62

Using Over-Pass-The-Hash (passing the ticket) to access resources with Kerberos authentication.

Using Over-Pass-The-Hash (passing the ticket) is a technique that allows an attacker to authenticate to services that leverage Kerberos for authentication using a stolen ticket without the need to crack the password. This method is more stealthy than Pass-The-Hash, which can be detected with modern security systems. PowerShell remoting can potentially leave obvious logs, Mimikatz is useful but can be detected by antivirus software, and brute-forcing would be noisy and likely draw attention from system administrators.

Question 63

During a penetration test, what is the PRIMARY purpose of maintaining confidentiality?

• To increase the availability of the system to all users.
• To protect sensitive information from being accessed by unauthorized individuals.
• To ensure the integrity of the data by preventing unauthorized alterations.
• To guarantee the systems remain in a constant state of compliance with regulatory standards.

Answer 63

To protect sensitive information from being accessed by unauthorized individuals.

The primary purpose of maintaining confidentiality is to ensure that sensitive information is accessible only to authorized individuals. This is crucial in penetration testing, as testers may come across personal, financial, or other types of protected data. Disclosing such data to unauthorized parties could lead to legal issues, loss of reputation, or financial harm to the organization. The other options presented are related to security, but they do not directly describe the purpose of maintaining confidentiality.

Question 64

What is a common but often overlooked security concern when dealing with outdated firmware on network equipment?

Physical wear and tear potentially leading to device failure
Persistent backdoor accounts left from legacy firmware iterations
Increased electrical consumption causing operational disruption
Limited vendor support to assist with technical issues

Answer 64

Persistent backdoor accounts left from legacy firmware iterations

Backdoor accounts, which are sometimes left by manufacturers for maintenance purposes, may not be removed or secured over time, especially with outdated firmware that is no longer supported or updated. These can provide attackers with an easy entry point into the system. The other options could be symptoms of outdated equipment but do not inherently represent security-specific risks posed by outdated firmware or hardware as clearly as the issue of backdoor accounts.

Question 65

A penetration tester is conducting an assessment and has gained initial access to a target system. To maintain access without alerting the network-based intrusion detection system (IDS), they decide to exfiltrate sensitive data. Which of the following techniques would effectively obfuscate the data being exfiltrated and is less likely to trigger an IDS alert?

• Compressing the data into a ZIP file with password protection before transmission
• Encoding the data with Base64 before transmission
• Encrypting the data using a symmetric encryption algorithm before transmission
• Using steganography to embed the data within an image file

Answer 65

Using steganography to embed the data within an image file

Steganography is the practice of hiding a file, message, image, or video within another file, message, image, or video. The correct answer is steganography because it is a method of hiding data within other non-suspicious data, making it difficult for intrusion detection systems to identify the hidden data or the act of exfiltration. Other methods such as encoding or encrypting data can still produce network traffic that might be recognized by an IDS, especially if it uses atypical ports or protocols or if substantial volumes of data are being transmitted.

Question 66

You have completed a penetration test for a large financial organization and are required to share the final report containing sensitive vulnerability details with multiple stakeholders. Which method should you use to distribute the report securely, as per best practices?

• Distributing physical copies of the report in sealed envelopes via courier services.
• Encrypting the report and sending it via an encrypted email service, accessible only to authorized stakeholders with the decryption key.
• Posting direct download links to the report on a private forum frequented by the stakeholders.
• Uploading the report to a password-protected public website where stakeholders can download it.
• Storing the report on a cloud service without implementing user-specific access controls.
• Sending the report via standard email with no encryption.

Answer 66

Encrypting the report and sending it via an encrypted email service, accessible only to authorized stakeholders with the decryption key.

Using an encrypted email ensures that the contents of the report are protected during transit and can only be accessed by individuals who have the encryption key or password. This maintains confidentiality and integrity of the findings. Using a standard email without encryption risks exposure of sensitive data to unauthorized individuals due to potential interception. A cloud service without proper security controls or a password-protected public website fails to control access appropriately, potentially allowing unauthorized users to access the report. Physical documents can be secure but are not practical for distributing to multiple stakeholders, especially those in different geographical locations.

Question 67

What is the primary purpose of using NSE scripts during a penetration test?

• To change the graphical user interface of the Nmap tool
• To reduce the total scan time by increasing the scanning speed
• To enhance scanning capabilities with advanced vulnerability detection and network discovery
• To bypass network security devices by encrypting the scan traffic

Answer 67

To enhance scanning capabilities with advanced vulnerability detection and network discovery

NSE scripts are used to automate networking tasks for enhanced scanning capabilities, such as advanced vulnerability detection, exploitation, and network discovery. This is because NSE scripts extend the basic functionality of Nmap scans with scripts that can probe systems in more depth to identify vulnerabilities, misconfigurations, or gather more detailed information.

Question 68

During a penetration test, you are tasked with evaluating the security of a network application. If your goal is to assess its resilience to attacks that may corrupt data handled by the application, which action would BEST demonstrate the application’s vulnerability to data corruption?

• Intercepting traffic between the application and its clients to analyze data packets
• Jamming the network to interrupt the application’s transmission
• Conducting fuzz testing by sending a variety of malformed inputs to the application
• Overloading the application with an intentional buffer overflow

Answer 68

Conducting fuzz testing by sending a variety of malformed inputs to the application

The use of fuzz testing is the best answer because fuzz testing involves providing invalid, unexpected, or random data as input to the network application. The intent is to stress test the application to see if it can handle the data without crashing or misbehaving, which could lead to data corruption. It directly targets the application’s ability to manage data integrity when facing incorrect input. Overloading the application with a buffer overflow is also a valid attack vector but is more specifically aimed at causing a memory error that could result in unauthorized access or a crash rather than corruption of data within the application. Jamming and intercepting traffic are usually aimed at disrupting communications rather than corrupting the data within an application.

Question 69

What is the primary function of the penetration testing tool mdk4?

• Conducting denial of service attacks on wireless networks
• Mapping wireless network topology
• Discovering hidden wireless networks
• Decrypting WiFi network passwords

Answer 69

Conducting denial of service attacks on wireless networks

The correct answer is ‘Conducting denial of service attacks on wireless networks’, as mdk4 is a tool used for testing WiFi networks for vulnerabilities, including the ability to perform disruptive operations. It is not used for decrypting WiFi passwords, finding hidden networks, or mapping network topology, which are different aspects of wireless network analysis and penetration testing.

Question 70

During a penetration test, you have identified multiple vulnerabilities within the client’s network. Which of the following would be the BEST approach for highlighting these issues within the written report to ensure proper prioritization?

• Suggest immediate system downtime for all identified vulnerabilities
• Categorize each vulnerability by its risk rating referencing a recognized framework
• List the vulnerabilities in alphabetical order
• Provide a detailed technical description for each discovered issue

Answer 70

Categorize each vulnerability by its risk rating referencing a recognized framework

The correct answer is ‘Categorize each vulnerability by its risk rating referencing a recognized framework.’ This is essential because utilizing a standardized risk rating framework facilitates a clear, objective, and consistent analysis of the vulnerabilities. This enables stakeholders to understand the severity and potential impact of each issue on the business, prioritizing remediation efforts accordingly. Answer ‘Provide a detailed technical description for each discovered issue’ is not the best option because it only communicates the technical details without prioritization. While ‘Suggest immediate system downtime for all identified vulnerabilities’ may be appropriate in some critical circumstances, it is not a recommended general approach as it lacks an assessment of the individual risks and impacts. ‘List the vulnerabilities in alphabetical order’ does not provide any indication of their importance or potential impact, thus this is not an effective way to convey criticality to the report audience.

Question 71

Which tool is most effective for identifying whether a target website is hosted on a third-party service?

• Wireshark
• BuiltWith
• Nessus
• john the ripper

Answer 71

BuiltWith

Using ‘BuiltWith’ is correct because it is a tool that provides information on the technology behind websites, including where the site is hosted. It can detect content management systems, server technologies, analytics tools, and many other details that indicate the use of third-party services.

Question 72

When preparing a report of a recent penetration test for the C-suite of a client company, which section should you emphasize to ensure it aligns with their focus on strategic decisions and risk management?

• Appendix
• Findings - Risk rating (reference framework)
• Executive summary
• Scope details

Answer 72

Executive summary

The executive summary is the most appropriate section to emphasize in a report intended for the C-Suite as it provides a high-level overview of the penetration test outcomes, key findings, and possible strategic implications or risks to the business. The C-suite executives are interested in how security findings could impact business goals and objectives, as well as an understanding of risk in terms which facilitate decision-making at the strategic level. Other detailed sections of the report, while important, are typically more relevant to technical staff who need to understand and implement the specific technical remediation measures.

Question 73

A penetration tester can capture and analyze all network traffic passing through a switch by simply connecting to any of its ports without additional configurations.

False
True

Answer 73

False

This statement is false because switches are designed to send packets only to the designated port based on the MAC address, starkly contrasting with hubs, which sends packets to all ports. To capture all network traffic, a penetration tester would need to perform a specific attack, such as ARP spoofing, to trick the switch into sending them traffic intended for another host, or otherwise configure the port for mirroring (also known as port spanning).

Question 74

What is the main purpose of using a web crawler in the context of penetration testing?

• To facilitate the process of downloading all the content from the targeted website for offline access and review.
• To systematically browse and map out the website’s pages and links for further reconnaissance and vulnerability discovery.
• To provide a real-time user experience analysis for the targeted website’s navigation and functionality.
• To optimize the website’s search engine ranking by suggesting improvements to its structure and content.

Answer 74

To systematically browse and map out the website’s pages and links for further reconnaissance and vulnerability discovery.

The main purpose of using a web crawler in penetration testing is to systematically browse and map out the website’s pages and links, which can reveal the overall structure of the site and help identify potential areas for further exploration or vulnerability assessment. It is an essential tool for gathering information about a target website during the reconnaissance phase. While web crawlers can be used for other purposes such as SEO optimization and data extraction, in the context of penetration testing, the focus is on understanding the website’s layout and discovering hidden or unlinked content that might be vulnerable to attack.

Question 75

During a penetration test, you are tasked with automating the extraction of form field names from a collection of HTML files. Which programming language would be most efficient to employ for writing a script to perform this operation, considering its powerful libraries for parsing HTML and XML?

Ruby
JavaScript
Perl
Python

Answer 75

Python

Python is the correct answer because it has powerful libraries such as Beautiful Soup and lxml, which are specifically designed for parsing and interacting with HTML and XML documents. These libraries make it easy to navigate the document tree and retrieve the information needed, such as form field names. Perl, while powerful in text manipulation, does not have as streamlined libraries for parsing HTML as Python. Ruby and JavaScript can also be used for parsing HTML, but Python’s libraries and widespread usage for such tasks generally make it a more efficient choice in scenarios involving HTML parsing in penetration testing.

Question 76

During a penetration testing exercise, you have gained access to a Windows server and intend to use a post-exploitation tool to extract credential data from the system memory. Which command would you use with the tool to retrieve this sensitive information?

• mimikatz::export cache
• kerberos::list_creds
• tokenselevate sekurlsacredentials
• privilegedebug sekurlsalogonpasswords

Answer 76

privilegedebug sekurlsalogonpasswords

The correct answer is privilege::debug sekurlsa::logonpasswords because when using Mimikatz, one must first obtain the proper privileges to interact with the system processes. The privilege::debug command grants the necessary rights to access sensitive areas of the operating system, and the sekurlsa::logonpasswords command then extracts the plaintext passwords, hashes, and other details for accounts that are logged in or have logged in previously. The other options listed either represent incorrect or non-existent commands in the context of Mimikatz and thus would not achieve the desired outcome.

Question 77

As a penetration tester, you have been provided a binary file from a client who suspects it might contain malicious code. Your task is to analyze the functionality of this binary without executing it directly on your system. Which technique would best serve this purpose?

• Decompiling the binary to its source code to check for any suspicious functions.
• Performing static analysis of the binary to understand its structure and behavior without executing it.
• Disassembling the binary to view the assembly code for further clues to its functionality.
• Executing the binary in a secure sandbox environment to observe its behavior.

Answer 77

Performing static analysis of the binary to understand its structure and behavior without executing it.

Reverse engineering the binary through static analysis is the correct answer as it allows the examiner to inspect the code without executing it, which prevents potential harm to the examiner’s system or network. Simply executing the binary would be unsafe as it might execute malicious functions. Disassembling and using a sandbox, though both useful techniques, are incorrect because disassembly is part of reverse engineering and using a sandbox still involves execution of the binary; hence it does not match the constraint of analyzing without execution as stated in the question. Decompilation alone is insufficient without the broader context and processes involved in reverse engineering.

Question 78

uring an engagement, a penetration tester is analyzing an Azure environment and notices that the metadata service for a virtual machine is accessible without proper restrictions. What type of attack could be attempted to exploit this service misconfiguration?

• Misconfigured cloud assets
• Metadata service attack
• Privilege escalation
• Account takeover

Answer 78

Metadata service attack

The correct answer is ‘Metadata service attack’. This type of attack takes advantage of open access to the metadata service, which often contains sensitive information, such as credentials or signed tokens that can be used to escalate privileges or move laterally within the cloud infrastructure. A ‘Misconfigured cloud assets’ answer does not describe a specific type of attack but rather a condition that could lead to multiple types of attacks. The ‘Privilege escalation’ answer can be a result of a successful metadata service attack but is not directly the method of exploiting the misconfigured service itself. ‘Account takeover’ refers to gaining control over another user’s cloud account, which is not immediately achievable through exploiting the metadata service alone.

Question 79

Vulnerability scanning tools automatically adjust their scanning techniques based on the detected network topology.

True
False

Answer 79

False

Vulnerability scanning tools cannot automatically adjust their scanning techniques based on the detected network topology. Penetration testers must understand the network topology and manually configure the scanning tools to ensure effective and thorough scanning. This involves selecting the appropriate scanning methods and settings that align with the network’s architecture and design in order to minimize the risk of disruption and maximize the detection of potential vulnerabilities.

Question 80

A penetration tester is performing passive reconnaissance on a target organization and wants to gather information about various subdomains without directly interacting with the organization’s name server. Which of the following methods would be the BEST to accomplish this task?

• Analyze web traffic between the organization and public web services to find DNS-related data
• Deploy an outdated version of a DNS analysis tool in hopes it may bypass notice
• Use a third-party service to obtain DNS records
• Perform speculative execution of domain names to reveal subdomains

Answer 80

Use a third-party service to obtain DNS records

The correct answer is ‘Use a third-party service to obtain DNS records’. This method allows the penetration tester to gather information about the organization’s subdomains without interacting with the target’s name servers and potentially revealing their intentions. The third party has likely already collected this data, so the activity is less likely to be traced back to the penetration tester when compared to more direct methods such as querying the organization’s name servers. Using an outdated DNS tool might not provide current information. Speculative execution of domain names is not a practical method for DNS enumeration, as it wouldn’t necessarily provide accurate results since not every permutation of a domain name is valid or in use. Analyzing web traffic requires direct interaction and is an active reconnaissance technique.

Question 81

During a penetration testing engagement, you have been tasked with assessing the susceptibility of employees to phishing attacks. Drawing upon the principles of influence, you decide to craft an email that will appear urgent, persuading recipients to click on a link to update their password immediately. The email will warn the recipients about a series of unauthorized login attempts detected on their accounts. Which method of influence best describes this tactic?

Urgency
Scarcity
Authority
Social proof

Answer 81

Urgency

The urgency in the email is crafted to compel the recipient to act quickly, thus exploiting the ‘Urgency’ principle of influence. This method is commonly utilized in phishing campaigns to create a sense of immediate threat, making the targets less likely to think critically and more likely to comply with the attacker’s request without proper scrutiny.

Question 82

While performing a penetration test, you have acquired limited shell access to a target Windows server. After enumerating the system, you discover that it’s vulnerable to an unpatched version of Windows Kernel. Which of the following techniques has the highest chance of successfully escalating your privileges to NT AUTHORITY\SYSTEM?

• Installing unauthorized third-party remote administration tools
• Exploiting the unpatched Windows Kernel vulnerability
• Modifying Group Policy to allow users to run Windows Update
• Executing a buffer overflow attack on a running network service

Answer 82

Exploiting the unpatched Windows Kernel vulnerability

Using a kernel exploit to gain higher privileges is likely to be successful if you’ve identified that the kernel on the target system is unpatched and vulnerable. Kernel exploits can provide the highest level of system access, often bypassing security mechanisms and giving the attacker full control over the system. In this scenario, exploiting the unpatched Windows Kernel vulnerability is a direct and effective method for privilege escalation to NT AUTHORITY\SYSTEM. Changing group policy settings or installing unauthorized software would generally require administrator-level privileges to begin with and would thus not be feasible from a limited shell access. Although buffer overflow vulnerabilities can lead to privilege escalation, they are not directly related to the kernel vulnerability in this context, making the kernel exploit the more appropriate choice.

Question 83

TTP

Answer 83

TTP stands for Tactics, Techniques, and Procedures, which describe the behavior patterns and operational methods used by adversaries during attacks. This term is part of threat intelligence and is used to characterize and predict threat activities

Question 84

ISSAF

Answer 84

• Information Systems Security Assessment Framework (ISSAF)
• comprehensive framework designed for performing penetration tests and security assessments.
• created by the Open Information Systems Security Group (OISSG)
• provides detailed guidelines for assessing security across various areas, such as networks, applications, and physical security.
• is outdated, with no active updates since 2005

Question 85

OISSG

Answer 85

The Open Information Systems Security Group (OISSG) is the organization behind the creation of the Information Systems Security Assessment Framework (ISSAF). The OISSG developed this detailed framework to provide a structured methodology for conducting penetration tests and security assessments​.

Question 86

Which of the following tools is a cross-platform collaborative .NET based post-exploitation framework primarily used by penetration testers to manage compromised environments?

Metasploit
Responder
Empire
Covenant

Answer 86

Covenant

Covenant is the correct answer because it is known as a .NET based post-exploitation framework designed for command and control of compromised systems, and it is used collaboratively among penetration testers. Metasploit, although a widely used tool for exploitation tasks, is not exclusively a .NET based framework. Empire was a popular post-exploitation framework but it was written in Python and PowerShell, not .NET. Responder is a tool used for LLMNR, NBT-NS and MDNS poisoning and does not serve as a post-exploitation command and control framework.

Question 87

Upon completing a penetration test, you identified that while extensive surveillance covered the perimeter of the server room, the individual server cabinets were not independently monitored. Additionally, entry to the server room was secured using a keyless entry pad. Which of the following recommendations in your report would best improve the physical security of the server infrastructure?

• Suggest the installation of additional internal surveillance devices focused on each cabinet.
• Propose coupling the entry mechanism with an alert system that notifies security personnel when access is granted.
• Advise extending the complexity of the access code required on the entry pad.
• Recommend the implementation of biometric verification for both the server room entry and individual cabinet locks

Answer 87

Recommend the implementation of biometric verification for both the server room entry and individual cabinet locks.

The correct answer is introducing biometric security measures heightens the difficulty for unauthorized individuals to gain access, by requiring a unique physical attribute of an authorized person, such as a fingerprint or iris scan. This recommendation is appropriate as it complements the existing surveillance system, which by itself, may not deter or prevent unwanted access but can help in after-the-fact investigations. C is incorrect as it suggests solely increasing the complexity of the passcode, which, despite being a step in the right direction, lacks the robustness of biometric verification and can still be vulnerable to social engineering or other forms of compromise. A and B are incorrect because while they may assist in after-the-fact investigations by monitoring or alerting to unauthorized access, they do not directly strengthen the entry control mechanism, and hence, are not as effective in improving physical access security.

Question 88

While conducting a penetration test, you find that a critical application used by the target organization is susceptible to a recently discovered vulnerability. You need to find a proof-of-concept exploit to test the system’s defenses against this vulnerability. Which of the following resources is most appropriate for locating the specific exploit code?

• Packet Storm
• Vendor’s security bulletin
• Common Vulnerability Scoring System (CVSS) database
• Official CVE website

Answer 88

Packet Storm

The correct answer is Packet Storm. It is a widely recognized source for tracking the latest vulnerabilities, exploits, and security information and offers a comprehensive database which penetration testers can use to find specific exploit code for known vulnerabilities. The incorrect answers, although they might offer security information or vulnerability databases, are not as specialized as Packet Storm for the purpose of finding specific exploit codes.

Question 89

Packet Storm

Answer 89

Packet Storm is a website that provides resources for penetration testing, including news, exploit information, and actual exploit code. It is a useful repository for penetration testers to access when researching and leveraging vulnerabilities during testing

Question 90

What situation would MOST likely necessitate the revocation of an SSL certificate?

• The certificate is within 90 days of its expiration date.
• The certificate chain includes an intermediate certificate about to expire.
• The private key associated with the certificate has been compromised.
• The certificate utilizes a SHA-256 hash instead of the more secure SHA-3

Answer 90

The private key associated with the certificate has been compromised.

The correct answer is ‘The private key associated with the certificate has been compromised.’ Revocation of an SSL certificate is a critical action typically performed to mitigate the risk associated with a compromised private key, as anyone with access to it could potentially decrypt or spoof secure communications. The other options, while associated with SSL certificates, do not directly relate to the immediate need for revocation. Certificate chains and SHA-256 hashes are components for ensuring the integrity and trustworthiness of certificates, but they do not constitute reasons for revocation. Certificate expiration is a natural lifecycle event and does not require revocation, as the certificate will become invalid at the expiration date.

Question 91

During a penetration testing engagement, you have established persistent access on a target system. Which of the following methods is the BEST to mask your continued presence from the system administrators?

• Cleaning all log files daily to remove any trace of unauthorized access
• Disabling all logging services on the target system
• Hosting all backdoor connections on non-standard ports to avoid attention
• Installing a rootkit to conceal the presence of your tools and activities
• Frequently changing file and directory permissions to maintain access
• Renaming all penetration testing tools with system default process names

Answer 91

Installing a rootkit to conceal the presence of your tools and activities

The use of a rootkit is a sophisticated method for maintaining access while avoiding detection since it can intercept and alter system calls and manipulate the normal behavior of the operating system to hide the presence of processes, files, network connections, and logs associated with the penetration tester’s activities. The complexity and stealthiness of rootkits make them particularly effective at evading detection from system monitoring tools. Cleaning log files might remove evidence of initial access, but it’s a detectable action and can alert administrators due to missing logs. Disabling logging could raise immediate suspicion when log files stop updating. Using non-standard ports could help to hide network traffic but does not cover tracks on the host system itself. Renaming tools with inconspicuous names does little to prevent detection from system or network monitoring, and frequent permission changes can be suspicious and are likely to be scrutinized.

Question 92

Ruby, unlike Python, cannot be used to implement metaprogramming techniques because it strictly adheres to the object-oriented paradigm without the flexibility of runtime code generation.

• True
• False

Answer 92

False

The statement is false. Both Ruby and Python are multi-paradigm languages and support metaprogramming techniques, which include the capacity for runtime code generation. Particularly, Ruby is known for its powerful metaprogramming capabilities. This question tests the test taker’s knowledge of programming language characteristics and dispels a common misconception that a language’s primary paradigm limits its capabilities. It’s important for penetration testers to recognize the breadth of functionality provided by various programming languages to select the best tool for the task

Question 93

What term is used to describe the principle that ensures sensitive information is accessible only to those authorized to have access to it?

• Authenticity
• Integrity
• Availability
• Confidentiality

Answer 93

Confidentiality

The term ‘Confidentiality’ refers to the principle that ensures sensitive information is accessible only to those authorized to have access, and it’s a core tenet of information security alongside integrity and availability (commonly referred to as the CIA triad). ‘Authenticity’ refers to the assurance that a message, transaction, or other form of data communication is from the source it claims to be from. ‘Integrity’ ensures that information has not been tampered with and ‘Availability’ refers to the information being accessible to authorized users when needed.

Question 94

During a penetration test, you have gained access to a Windows server and extracted NTLM hash values from the Security Account Manager (SAM) file. Which of the following tools or methods would you use to leverage these hash values to authenticate to another server without cracking the passwords?

• Rainbow tables
• Pass-the-Hash Toolkit
• John the Ripper
• Password spraying

Answer 94

Pass-the-Hash Toolkit

The answer is ‘Pass-the-Hash Toolkit’ because it is designed to use hash values to authenticate to another system using the extracted NTLM or LM hash directly, bypassing the need for the actual plaintext password, which is consistent with the pass-the-hash attack method. ‘John the Ripper’ is a password cracking tool mainly used for cracking hashes offline, not for authentication with hashes. ‘Password spraying’ is an attack method that attempts to log in to many accounts with a few commonly used passwords. ‘Rainbow tables’ are precomputed tables for reversing cryptographic hash functions, mainly used for cracking password hashes, not for pass-the-hash attacks.

Question 95

Pass-the-Hash Toolkit

Answer 95

designed to use hash values to authenticate to another system using the extracted NTLM or LM hash directly, bypassing the need for the actual plaintext password, which is consistent with the pass-the-hash attack method

Mimikatz and Metasploit include functionality for pass-the-hash attacks

Question 96

LSASS

Answer 96

Local Security Authority Subsystem Service

• Windows process responsible for enforcing security policies, managing user authentication, and handling password changes
• generates access tokens used to verify users’ privileges.
• Attackers often target LSASS to extract credential information, such as NTLM hashes, for pass-the-hash attacks or other forms of lateral movement

Question 97

You are performing a penetration test on a web application that requires testing for Cross-Site Scripting (XSS) vulnerabilities. You need to select a tool that allows for both automated scanning and the ability to intercept and modify HTTP requests in real-time to test for reflected XSS. Which tool would be the best fit for this specific requirement?

• OWASP ZAP
• Nikto
• Burp Suite
• Gobuster

Answer 97

Burp Suite

Burp Suite is the correct answer because it offers a full suite of web application testing tools, including an automated scanner for identifying vulnerabilities like XSS and an intercepting proxy for real-time HTTP request manipulation, which is crucial for testing reflected XSS. OWASP ZAP also provides similar features, but Burp Suite is typically recognized for its more advanced manual testing capabilities, including intercepting and modifying HTTP requests, making it the better match for the requirement specified in the question. Nikto is mainly a web server scanner and is not designed for intercepting HTTP traffic or digging deep into specific vulnerability classes such as XSS. Gobuster is focused on brute-forcing URIs, DNS subdomains, and virtual host names on target web servers and does not provide the required functionality for testing XSS vulnerabilities.

Question 98

When conducting a penetration test, which tool would be appropriate for crafting custom ICMP echo requests and analyzing responses to perform network testing?

• Hping
• Nmap
• Netcat
• Tcpdump

Answer 98

Hping

Hping is a network tool that can send custom packets with a varying degree of complexity and analyze responses, making it specifically appropriate for crafting custom ICMP echo requests (ping) and other types of traffic, which is vital for penetration testing and network security assessments. Nmap, while versatile in network scanning, isn’t specifically tailored for packet crafting as Hping is. Tcpdump is primarily a packet sniffer and does not have the capability to craft packets. Netcat is known primarily for its network utility for reading from and writing to network connections using TCP or UDP, but it does not have the capacity to craft ICMP packets like Hping.

Question 99

Hping

Answer 99

network tool used for packet crafting, capable of sending custom packets over different protocols (TCP, UDP, ICMP). It allows penetration testers to perform tasks such as SYN scans, denial-of-service attacks, and firewall testing

Question 100

Tcpdump

Answer 100

command-line network packet capture tool used by penetration testers and network administrators to analyze network traffic in real time. It allows users to filter packets based on various parameters, making it useful for identifying issues or gathering data about communication on a network

Question 101

You are conducting a penetration test against an organization and have obtained the following information from an Nmap scan:

Nmap scan report for 192.168.1.105 Host is up (0.0010s latency). Not shown: 995 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: 2048 SHA256:XxXXXxxXxxxXxXxxxXxxXxxXxXXXxxXxX (RSA) 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) 111/tcp open rpcbind 2-4 (RPC #100000) 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)

Based on the fingerprinting data obtained from the scan, which of the following conclusions can be accurately drawn about the target system?

• The target system is likely running a Linux-based operating system.
• The target uses a custom operating system, as indicated by the mix of services.
• The target system is running outdated network services with no implications of the underlying OS.
• The target system is a dedicated Microsoft Windows Server machine

Answer 101

The target system is likely running a Linux-based operating system.

The output from Nmap provides information about the services running and their versions. The correct answer can be deduced by examining the provided versions and services. OpenSSH 7.2p2 suggests a Linux-based system, as it mentions Ubuntu in the service version detail. Apache 2.4.18 further confirms this as it is running on Ubuntu. The presence of Samba smbd in the service versions also aligns with a Linux environment that is configured to share files with Windows systems. The incorrect answers indicate either a different operating system or a conclusion that is not directly supported by the information given.

Question 102

As a penetration tester preparing for a client engagement, you need to acquire the point of contact and registration tenure of a suspicious domain linked to your client’s industry. Given the transient nature of domain registrations and the need for the most current data, which methodology would be MOST effective in obtaining the precise, real-time domain registration information?

• Retrieving historical domain ownership information via the Internet Archive’s Wayback Machine
• Running a passive DNS analysis tool to deduce ownership based on DNS record patterns
• Performing a direct WHOIS lookup using an updated WHOIS client or service
• Conducting a domain footprint using a search engine cache to potentially find recent contact information

Answer 102

Performing a direct WHOIS lookup using an updated WHOIS client or service

While options such as search engines, Internet Archive, or DNS enumeration techniques might offer insights into a domain’s various attributes, for obtaining the latest registration and point of contact details, directly querying current WHOIS database records ensures the most accurate and time-critical information. Other sources may supplement WHOIS data but are not as reliable for up-to-the-minute record accuracy.

Question 103

During a penetration testing engagement, you are tasked with gathering as much information as possible about the target organization’s internal domain structure and network resources without directly interacting with the company’s network. You decide to use a tool that allows you to analyze publicly available files retrieved from the organization’s website for hidden metadata and potential security lapses. Which tool facilitates the extraction and analysis of metadata from these documents to accomplish your objective?

• FOCA
• OWASP ZAP
• Nikto
• Responder

Answer 103

FOCA

The correct answer is FOCA, which stands for Fingerprinting Organization with Collected Archives. This tool is specifically designed to download public documents from a given domain and analyze the metadata contained within those documents to extract internal information such as network shares, domain names, user names, and more. This information can be extremely valuable during the reconnaissance phase of a penetration test. The other options provided are either not primarily used for metadata analysis or are related to different phases of penetration testing.

Question 104

OWASP

Answer 104

Open Web Application Security Project

Question 105

During a penetration test, you are required to capture and analyze traffic on a client’s network to identify unencrypted protocols transmitting sensitive information. The client’s network consists of switched Ethernet. What approach could you take to effectively sniff network packets considering the network configuration?

• Using Switched Port Analyzer (SPAN) to mirror traffic
• Creating a rogue DHCP server
• Enabling promiscuous mode on a network adapter
• ARP poisoning
• Subnetting the network to isolate traffic
• Broadcasting ICMP echo requests

Answer 105

ARP poisoning

ARP poisoning is the correct answer because it allows the penetration tester to intercept traffic in a switched network environment. By sending falsified ARP (Address Resolution Protocol) messages onto the network, the attacker can link their MAC address with the IP address of another host (usually the gateway), causing the traffic of the target host to pass through the attacker’s machine, allowing packet capture and analysis. Switched Port Analyzer (SPAN) is incorrect as it is not a practical sniffing approach for an attacker since it requires configuring the switch, which is not typically viable during a penetration test. The remaining options are incorrect because they either do not apply to sniffing network traffic (like Subnetting) or are less effective in a switched network environment without additional network manipulation (like promiscuous mode alone).

Question 106

When conducting a penetration test, which of the following best describes a scenario where Ettercap is MOST effective?

• ARP poisoning to intercept and modify traffic between two systems on a local network.
• Creating an encrypted reverse shell to secure the communication channel with a compromised host.
• Exploiting misconfigured server-side request forgery (SSRF) vulnerabilities.
• Code signing to ensure the integrity and origin of the software to be installed.

Answer 106

ARP poisoning to intercept and modify traffic between two systems on a local network.

Ettercap is highly effective for ARP poisoning, which is a technique used to intercept the traffic between two hosts on a network. Its ability to conduct ARP spoofing allows a penetration tester to reroute traffic through their own system, permitting them to sniff packets or even modify them on-the-fly before forwarding them to the intended recipient. This makes ARP poisoning the best scenario for making use of Ettercap’s capabilities, as it is designed specifically to handle such types of attacks efficiently. Other options, like creating a reverse shell or code signing, are unrelated to Ettercap’s core functionality and thus are incorrect in this context.

Question 107

Ettercap

Answer 107

• network security tool used for performing on-path (formerly known as man-in-the-middle) attacks on a local network
• supports sniffing, intercepting, and altering traffic in real time and includes plugins for additional network attack capabilities

Question 108

A penetration tester has gained access to a network and would like to determine what other machines are active on the subnet. Which of the following techniques should the tester use to quickly and efficiently enumerate devices on the network without triggering potential intrusion detection systems?

• ARP scan
• Port scan with SYN packets
• Service version scan
• ICMP echo request

Answer 108

ARP scan

The correct answer is ARP scan. An ARP scan is an efficient and less intrusive method of enumerating live hosts on a local subnet by resolving IP addresses to MAC addresses within the same broadcast domain. It is less likely to be noticed by intrusion detection systems compared to more aggressive scanning techniques that generate a larger amount of network traffic. ICMP echo request might be blocked by firewalls or might trigger IDS systems due to its commonly known usage in scanning activities. Service version scan is not directly used to enumerate active hosts, but rather to identify service versions running on known up hosts. Port scan with SYN packets generates SYN packets, which can be easily detected by IDS systems due to their typical association with reconnaissance activities.

Question 109

When preparing to distribute the final penetration testing report to the intended stakeholders, which method would BEST ensure both the confidentiality and integrity of the report?

• Encrypting the report as an email attachment using an encrypted email service without providing an additional integrity check.
• Uploading the report to a common network drive which the stakeholders have access to without using additional encryption.
• Sending the report via a secure file transfer method with encryption and providing a checksum or cryptographic hash for integrity checking.
• Physically mailing a password-protected USB drive containing the report to the stakeholders.

Answer 109

Sending the report via a secure file transfer method with encryption and providing a checksum or cryptographic hash for integrity checking.

Using a secure file transfer method with encryption, such as SFTP, HTTPS, or a secure file-sharing platform, guarantees that the report remains confidential during transmission, preventing unauthorized access. Additionally, implementing a checksum or hash can provide integrity by allowing the recipient to verify that the report has not been altered during transmission. Option A is correct because an encrypted email service may not ensure the integrity of large files and could still be vulnerable to interception if not paired with file encryption. Option B lacks encryption and therefore does not secure the confidentiality of the report. Option C, physically mailing the report, may ensure confidentiality but has no mechanisms to handle integrity verification.

Question 110

Whats the difference between a credential stuffing attack and a dictionary attack?

Answer 110

Dictionary Attack: This involves systematically attempting to log in using a predefined list of possible passwords (a “dictionary”), often paired with a single username or user account

Credential Stuffing: This uses a large dataset of username-password pairs (typically harvested from data breaches) to attempt logins on various accounts or services. It leverages the tendency of users to reuse credentials across platforms

Question 111

Which of the following tools is primarily used for gathering open-source intelligence (OSINT) by querying a variety of data sources including websites, whois records, and social networks?

• OpenSSL
• EnCase
• Recon-ng
• Wireshark

Answer 111

Recon-ng

Recon-ng is a full-featured Web Reconnaissance framework written in Python, designed to perform comprehensive OSINT gathering from various public sources. It has modules to interact with different data sources like websites, whois records, social networks, and more. This makes it the correct answer. Wireshark, on the other hand, is a network protocol analyzer for network troubleshooting, analysis, and communications protocol development, not primarily for OSINT gathering. EnCase is a forensic tool used in digital investigations and does not specialize in gathering OSINT. OpenSSL is a software library for applications that require secure communications over networks, and is not an OSINT gathering tool.

Question 112

Recon-ng

Answer 112

• modular web reconnaissance framework that facilitates and organizes OSINT (Open Source Intelligence) work
• operates in a Metasploit-like manner with plug-ins to automate various types of information gathering tasks

Question 113

A penetration test for a retail organization with multiple physical locations reveals that certain branch managers have the ability to grant themselves higher privileges in the corporate network, potentially enabling access to sensitive customer data. Considering the separation of duties and mitigation of insider threat, what operational control should be recommended in the report to address this finding?

• Enforce mandatory vacations for branch managers to identify inappropriate system dependencies.
• Set up time-of-day restrictions on when branch managers can access the network.
• Implement multifactor authentication for sensitive systems access.
• Implement role-based access control to enforce separation of duties.

Answer 113

Implement role-based access control to enforce separation of duties.

The correct answer is the implementation of role-based access control (RBAC). RBAC is an administrative control that ensures employees are only granted access rights that are necessary to perform their jobs. In this scenario, RBAC would prevent managers from arbitrarily increasing their privileges, as their roles do not require such access, thereby enforcing separation of duties. While mandatory vacations could highlight if any inappropriate access or system dependencies exist, they do not prevent the escalation of privileges. Time-of-day restrictions also do not prevent the managers from granting themselves higher access during allowed hours. Implementing multifactor authentication would increase security but does not directly address the issue of inappropriate privilege escalation.

Question 114

Which password attack method involves using a pre-compiled list of likely passwords in an attempt to gain unauthorized access to a user’s account?

• Dictionary attack
• Keylogging
• Rainbow table attack
• Credential stuffing

Answer 114

Dictionary Attack

A dictionary attack uses a list of words that are most likely to be used as passwords. This list can be compiled from numerous sources and can be customized to target specific users based on their personal information or commonly used password patterns. Unlike brute force attacks that try every possible combination, dictionary attacks are more efficient by using a curated set of potential passwords.

Question 115

During a penetration test, you notice an unusually large number of files with a .tmp extension in a system directory that typically contains very few files. What might this observation suggest?

• Potential remnants of malware execution
• Sequentially named document files
• Presence of standard backup files
• Large log file sizes

Answer 115

Potential remnants of malware execution

The presence of an unusually large number of .tmp files in a system directory could suggest that malware or unauthorized scripts have been executed on the system. These files could be remnants of malicious software that was downloaded and executed to compromise the system. It’s important for penetration testers to recognize such abnormalities as potential indicators of prior compromise. Large log file sizes might simply indicate verbose logging settings or a long period without maintenance. Standard backup files are common for recovery purposes and do not necessarily suggest a compromise. Sequentially named document files could be a sign of normal user or system activity rather than a compromise.

Question 116

During a penetration testing engagement, you have identified that an organization’s data center lacks appropriate monitoring. Which of the following recommendations aligns BEST with strengthening their physical security control?

• Secure administrative interfaces of critical infrastructure systems.
• Install an access control vestibule to restrict unauthorized entries.
• Implement biometric controls at all access points.
• Outfit the data center and its perimeter with video surveillance.

Answer 116

Outfit the data center and its perimeter with video surveillance.

Implementing biometric controls is a form of strengthening security, but it does not directly relate to monitoring. Securing administrative interfaces improves management of systems but does not address the lack of surveillance. Installing an access control vestibule limits entry points without addressing monitoring. Outfitting the area with video surveillance directly improves the organization’s monitoring capabilities.

Question 117

During a penetration test, you discovered that an organization’s server room is protected by a single door requiring a proximity card for entry. During your assessment, you noted several instances where unauthorized personnel could follow authorized personnel through the door without presenting a proximity card (tailgating). Which recommendation would best enhance physical security to mitigate this issue in the future?

• Install an access control vestibule that requires authentication before entry to the secure area.
• Issue additional proximity cards to all personnel to ensure everyone has their own means of access.
• Increase the frequency of security guard patrols in the area of the server room door.
• Set up a man trap with biometric security features at the server room entrance.

Incorrect Reporting and Communication
Report Issue
Answer Description
The correct answer is to install an access control vestibule, as it is specifically designed to prevent tailgating by enforcing a single person entry. A vestibule often has two sets of doors with an authentication process in between, ensuring that only one person can enter after authentication. A man trap is also a valid physical security measure, but it generally implies a more restrictive environment that may not be suitable for all organizations. Additional proximity cards or more frequent guard patrols would not necessarily prevent tailgating, as they do not address the issue of single-entry authentication.

Answer 117

Install an access control vestibule that requires authentication before entry to the secure area.

The correct answer is to install an access control vestibule, as it is specifically designed to prevent tailgating by enforcing a single person entry. A vestibule often has two sets of doors with an authentication process in between, ensuring that only one person can enter after authentication. A man trap is also a valid physical security measure, but it generally implies a more restrictive environment that may not be suitable for all organizations. Additional proximity cards or more frequent guard patrols would not necessarily prevent tailgating, as they do not address the issue of single-entry authentication.

Question 118

A penetration tester is performing an Nmap scan on a target system to gather as much information as possible without raising suspicion. The tester suspects the presence of a fairly updated intrusion detection system (IDS) on the network. Which of the following Nmap options should the tester use to perform OS detection in the most efficient manner while maintaining a lower profile?

• -O
• –osscan-limit -O -T2
• -T4 -O
• -T2 -O

Answer 118

–osscan-limit -O -T2

Option B is correct because the -O flag in Nmap is used for operating system detection. However, when trying to maintain a lower profile to avoid detection by an IDS, it’s important to adjust the timing of the scan to make it slower and less aggressive. Option A is incorrect because it speeds up the scan, which increases the chances of detection. Option C is incorrect because the –osscan-limit option limits OS detection to promising targets and -T2 makes the scan quite slow but does not specify stealth measures. Option D is incorrect because -O merely activates OS detection without considering stealth or timing concerns.

Question 119

what is the –osccan-limit option in nmap?

Answer 119

Restricts OS detection to hosts that respond to probes, minimizing unnecessary traffic, which helps reduce suspicion.

Question 120

During a penetration test, you are tasked with crafting a phishing campaign to test the organization’s resilience to social engineering efforts. Using the Social Engineering Toolkit, which of the following would be the BEST approach to emulate a realistic spear-phishing attack?

• Replicate an exact copy of their public website to confuse employees.
• Clone a known trusted site and slightly modify it to collect user credentials.
• Send out generic business-related documents that contain no organization-specific information.
• Modify the organization’s public website to redirect to your malicious site.

Answer 120

Clone a known trusted site and slightly modify it to collect user credentials.

The correct answer is to clone a known trusted site and slightly modify it (e.g., a login page of their webmail) to collect user credentials. This approach is considered the most effective because it presents a familiar interface to the target, thereby increasing the likelihood of the phishing attack being successful. In contrast, replicating an exact copy of a website may raise red flags if the URL or security certificates don’t match, while modifying a company’s public website or sending unrelated documents might not be as convincing or relevant to the targeted individual.