Dump 2 Flashcards
A penetration tester receives the following results from an Nmap scan:
Which of the following OSs is the target MOST likely running?
A.
CentOS
B.
Arch Linux
C.
Windows Server
D.
Ubuntu
Answer: C
A penetration tester would like to obtain FTP credentials by deploying a workstation as an on-path
attack between the target and the server that has the FTP protocol. Which of the following
methods would be the BEST to accomplish this objective?
A.
Wait for the next login and perform a downgrade attack on the server.
B.
Capture traffic using Wireshark.
C.
Perform a brute-force attack over the server.
D.
Use an FTP exploit against the server.
Answer: B
Appending string values onto another string is called:
A.
compilation
B.
connection
C.
concatenation
D.
conjunction
Answer: C
A consultant is reviewing the following output after reports of intermittent connectivity issues:
Which of the following is MOST likely to be reported by the consultant?
A.
A device on the network has an IP address in the wrong subnet.
B.
A multicast session was initiated using the wrong multicast group.
C.
An ARP flooding attack is using the broadcast address to perform DDoS.
D.
A device on the network has poisoned the ARP cache.
Answer: D
Which of the following web-application security risks are part of the OWASP Top 10 v2017?
(Choose two.)
A.
Buffer overflows
B.
Cross-site scripting
C.
Race-condition attacks
D.
Zero-day attacks
E.
Injection flaws
F.
Ransomware attacks
Answer: B,E
The results of an Nmap scan are as follows:
Which of the following would be the BEST conclusion about this device?
A.
This device may be vulnerable to the Heartbleed bug due to the way transactions over TCP/22
handle heartbeat extension packets, allowing attackers to obtain sensitive information from
process memory.
B.
This device is most likely a gateway with in-band management services.
C.
This device is most likely a proxy server forwarding requests over TCP/443.
D.
This device may be vulnerable to remote code execution because of a buffer overflow vulnerability
in the method used to extract DNS names from packets prior to DNSSEC validation.
Answer: B
When preparing for an engagement with an enterprise organization, which of the following is one
of the MOST important items to develop fully prior to beginning the penetration testing activities?
A.
Clarify the statement of work
B.
Obtain an asset inventory from the client
C.
Interview all stakeholders
D.
Identify all third parties involved.
Answer: A
A penetration tester is reviewing the following SOW prior to engaging with a client.
“Network diagrams, logical and physical asset inventory, and employees’ names are to be treated
as client confidential. Upon completion of the engagement, the penetration tester will submit
findings to the client’s Chief Information Security Officer (CISO) via encrypted protocols and
subsequently dispose of all findings by erasing them in a secure manner.?
Based on the information in the SOW, which of the following behaviors would be considered
unethical? (Choose two.)
A.
Utilizing proprietary penetration-testing tools that are not available to the public or to the client for
auditing and inspection.
B.
Utilizing public-key cryptography to ensure findings are delivered to the CISO upon completion of
the engagement.
C.
Failing to share with the client critical vulnerabilities that exist within the client architecture to
appease the client’s senior leadership team.
D.
Seeking help with the engagement in underground hacker forums by sharing the client’s public IP
address.
E.
Using a software-based erase tool to wipe the client’s findings from the penetration tester’s laptop.
F.
Retaining the SOW within the penetration tester’s company for future use so the sales team can
plan future engagements.
Answer: C,D
A penetration tester downloaded the following Perl script that can be used to identify vulnerabilities
in network switches. However, the script is not working properly.
Which of the following changes should the tester apply to make the script work as intended?
A.
Change line 2 to $ip= “10.192.168.254?;
B.
Remove lines 3, 5, and 6.
C.
Remove line 6.
D.
Move all the lines below line 7 to the top of the script.
Answer: B
A penetration tester finds a PHP script used by a web application in an unprotected internal source
code repository. After reviewing the code, the tester identifies the following:
Which of the following combinations of tools would the penetration tester use to exploit this script?
A.
Hydra and crunch
B.
Netcat and cURL
C.
Burp Suite and DIRB
D.
Nmap and OWASP ZAP
Answer: B
A penetration tester has obtained root access to a Linux-based file server and would like to
maintain persistence after reboot. Which of the following techniques would BEST support this
objective?
A.
Create a one-shot system service to establish a reverse shell.
B.
Obtain /etc/shadow and brute force the root password.
C.
Run the nc –e /bin/sh <…> command.
D.
Move laterally to create a user account on LDAP.
Answer: A
A penetration tester is conducting a penetration test. The tester obtains a root-level shell on a
Linux server and discovers the following data in a file named password.txt in the /home/svsacct
directory:
U3VQZXIkM2NyZXQhCg==
Which of the following commands should the tester use NEXT to decode the contents of the file?
A.
echo U3VQZXIkM2NyZXQhCg== | base64 –d
B.
tar zxvf password.txt
C.
hydra –l svsacct –p U3VQZXIkM2NyZXQhCg== ssh://192.168.1.0/24
D.
john –wordlist /usr/share/seclists/rockyou.txt password.txt
Answer: A
A company has recruited a penetration tester to conduct a vulnerability scan over the network. The
test is confirmed to be on a known environment. Which of the following would be the BEST option
to identify a system properly prior to performing the assessment?
A.
Asset inventory
B.
DNS records
C.
Web-application scan
D.
Full scan
Answer: A
A security firm has been hired to perform an external penetration test against a company. The only
information the firm received was the company name. Which of the following passive
reconnaissance approaches would be MOST likely to yield positive initial results?
A.
Specially craft and deploy phishing emails to key company leaders.
B.
Run a vulnerability scan against the company’s external website.
C.
Runtime the company’s vendor/supply chain.
D.
Scrape web presences and social-networking sites.
Answer: D
A security firm is discussing the results of a penetration test with the client. Based on the findings,
the client wants to focus the remaining time on a critical network segment. Which of the following
BEST describes the action taking place?
A.
Maximizing the likelihood of finding vulnerabilities
B.
Reprioritizing the goals/objectives
C.
Eliminating the potential for false positives
D.
Reducing the risk to the client environment
Answer: B
Which of the following tools would be BEST suited to perform a manual web application security
assessment? (Choose two.)
A.
OWASP ZAP
B.
Nmap
C.
Nessus
D.
BeEF
E.
Hydra
F.
Burp Suite
Answer: A,F
Running a vulnerability scanner on a hybrid network segment that includes general IT servers and
industrial control systems:
A.
will reveal vulnerabilities in the Modbus protocol
B.
may cause unintended failures in control systems
C.
may reduce the true positive rate of findings
D.
will create a denial-of-service condition on the IP networks
Answer: B
Which of the following provides a matrix of common tactics and techniques uses by attackers
along with recommended mitigations?
A.
NIST SP 800-53
B.
OWASP Top 10
C.
MITRE ATT&CK framework
D.
PTES technical guidelines
Answer: C
A security engineer identified a new server on the network and wants to scan the host to
determine if it is running an approved version of Linux and a patched version of Apache. Which of
the following commands will accomplish this task?
A.
nmap –f –sV –p80 192.168.1.20
B.
nmap –sS –sL –p80 192.168.1.20
C.
nmap –A –T4 –p80 192.168.1.20
D.
nmap –O –v –p80 192.168.1.20
Answer: C
A mail service company has hired a penetration tester to conduct an enumeration of all user
accounts on an SMTP server to identify whether previous staff member accounts are still active.
Which of the following commands should be used to accomplish the goal?
A.
VRFY and EXPN
B.
VRFY and TURN
C.
EXPN and TURN
D.
RCPT TO and VRFY
Answer: A
A penetration tester is evaluating a company’s network perimeter. The tester has received limited
information about defensive controls or countermeasures, and limited internal knowledge of the
testing exists. Which of the following should be the FIRST step to plan the reconnaissance
activities?
A.
Launch an external scan of netblocks.
B.
Check WHOIS and netblock records for the company.
C.
Use DNS lookups and dig to determine the external hosts.
D.
Conduct a ping sweep of the company’s netblocks.
Answer: B
A penetration tester captured the following traffic during a web-application test:
Which of the following methods should the tester use to visualize the authorization information
being transmitted?
A.
Decode the authorization header using UTF-8.
B.
Decrypt the authorization header using bcrypt.
C.
Decode the authorization header using Base64.
D.
Decrypt the authorization header using AES.
Answer: C
A penetration tester was hired to perform a physical security assessment of an organization’s
office. After monitoring the environment for a few hours, the penetration tester notices that some
employees go to lunch in a restaurant nearby and leave their belongings unattended on the table while getting food. Which of the following techniques would MOST likely be used to get legitimate
access into the organization’s building without raising too many alerts?
A.
Tailgating
B.
Dumpster diving
C.
Shoulder surfing
D.
Badge cloning
Answer: A
A penetration tester wants to find hidden information in documents available on the web at a
particular domain. Which of the following should the penetration tester use?
A.
Netcraft
B.
CentralOps
C.
Responder
D.
FOCA
Answer: D
