Dump 3 Flashcards
(100 cards)
A penetration tester exploited a vulnerability on a server and remotely ran a payload to gain a
shell. However, a connection was not established, and no errors were shown on the payload
execution. The penetration tester suspected that a network device, like an IPS or next-generation
firewall, was dropping the connection. Which of the following payloads are MOST likely to
establish a shell successfully?
A.
windows/x64/meterpreter/reverse_tcp
B.
windows/x64/meterpreter/reverse_http
C.
windows/x64/shell_reverse_tcp
D.
windows/x64/powershell_reverse_tcp
E.
windows/x64/meterpreter/reverse_https
Answer: E
A penetration tester has been hired to examine a website for flaws. During one of the time
windows for testing, a network engineer notices a flood of GET requests to the web server,
reducing the website’s response time by 80%. The network engineer contacts the penetration
tester to determine if these GET requests are part of the test. Which of the following BEST
describes the purpose of checking with the penetration tester?
A.
Situational awareness
B.
Rescheduling
C.
DDoS defense
D.
Deconfliction
Answer: D
Which of the following is the BEST resource for obtaining payloads against specific network
infrastructure products?
A.
Exploit-DB
B.
Metasploit
C.
Shodan
D.
Retina
Answer: A
A penetration tester gives the following command to a systems administrator to execute on one of
the target servers:
rm -f /var/www/html/G679h32gYu.php
Which of the following BEST explains why the penetration tester wants this command executed?
A.
To trick the systems administrator into installing a rootkit
B.
To close down a reverse shell
C.
To remove a web shell after the penetration test
D.
To delete credentials the tester created
Answer: C
The following PowerShell snippet was extracted from a log of an attacker machine:
A penetration tester would like to identify the presence of an array. Which of the following line
numbers would define the array?
A.
Line 8
B.
Line 13
C.
Line 19
D.
Line 20
Answer: B
A company provided the following network scope for a penetration test:
169.137.1.0/24
221.10.1.0/24
149.14.1.0/24
A penetration tester discovered a remote command injection on IP address 149.14.1.24 and
exploited the system. Later, the tester learned that this particular IP address belongs to a third
party. Which of the following stakeholders is responsible for this mistake?
A.
The company that requested the penetration test
B.
The penetration testing company
C.
The target host’s owner
D.
The penetration tester
E.
The subcontractor supporting the test
Answer: A
In an unprotected network file repository, a penetration tester discovers a text file containing
usernames and passwords in cleartext and a spreadsheet containing data for 50 employees,
including full names, roles, and serial numbers. The tester realizes some of the passwords in the
text file follow the format: <name-serial_number>. Which of the following would be the best action
for the tester to take NEXT with this information?</name-serial_number>
A.
Create a custom password dictionary as preparation for password spray testing.
B.
Recommend using a password manager/vault instead of text files to store passwords securely.
C.
Recommend configuring password complexity rules in all the systems and applications.
D.
Create a TPM-backed sealed storage location within which the unprotected file repository can be
reported.
Answer: A
During the reconnaissance phase, a penetration tester obtains the following output:
Reply from 192.168.1.23: bytes=32 time<54ms TTL=128
Reply from 192.168.1.23: bytes=32 time<53ms TTL=128
Reply from 192.168.1.23: bytes=32 time<60ms TTL=128
Reply from 192.168.1.23: bytes=32 time<51ms TTL=128
Which of the following operating systems is MOST likely installed on the host?
A.
Linux
. NetBSD
B.
Windows
C.
macOS
Answer: A
A penetration tester joins the assessment team in the middle of the assessment. The client has
asked the team, both verbally and in the scoping document, not to test the production networks.
However, the new tester is not aware of this request and proceeds to perform exploits in the
production environment. Which of the following would have MOST effectively prevented this
misunderstanding?
A.
Prohibiting exploitation in the production environment
B.
Requiring all testers to review the scoping document carefully
C.
Never assessing the production networks
D.
Prohibiting testers from joining the team during the assessment
Answer: C
A penetration tester is using the following script:
Which of the following BEST describes the purpose of this script?
A.
To determine if a web server’s date/time function is susceptible to attack
B.
To determine if a web server’s time zone has been misconfigured
C.
To determine the difference between local and server time
D.
To determine and display the round-trip time of HTTP requests
Answer: C
A penetration tester attempted a DNS poisoning attack. After the attempt, no traffic was seen from
the target machine. Which of the following MOST likely caused the attack to fail?
A.
The injection was too slow.
B.
The DNS information was incorrect.
C.
The DNS cache was not refreshed.
D.
The client did not receive a trusted response.
Answer: D
During an assessment, a penetration tester was able to access the organization’s wireless
network from outside of the building using a laptop running Aircrack-ng. Which of the following
should be recommended to the client to remediate this issue?
A.
Changing to Wi-Fi equipment that supports strong encryption
B.
Using directional antennae
C.
Using WEP encryption
D.
Disabling Wi-Fi
Answer: B
A penetration tester is conducting a penetration test and discovers a vulnerability on a web server
that is owned by the client. Exploiting the vulnerability allows the tester to open a reverse shell.
Enumerating the server for privilege escalation, the tester discovers the following:
Which of the following should the penetration tester do NEXT?
A.
Close the reverse shell the tester is using.
B.
Note this finding for inclusion in the final report.
C.
Investigate the high numbered port connections.
D.
Contact the client immediately.
Answer: C
A penetration tester successfully performed an exploit on a host and was able to hop from VLAN
100 to VLAN 200. VLAN 200 contains servers that perform financial transactions, and the
penetration tester now wants the local interface of the attacker machine to have a static ARP entry
in the local cache. The attacker machine has the following:
IP Address: 192.168.1.63
Physical Address: 60-36-dd-a6-c5-33
Which of the following commands would the penetration tester MOST likely use in order to
establish a static ARP entry successfully?
A.
tcpdump -i eth01 arp and arp[6:2] == 2
B.
arp -s 192.168.1.63 60-36-DD-A6-C5-33
C.
ipconfig /all findstr /v 00-00-00 | findstr Physical
D.
route add 192.168.1.63 mask 255.255.255.255.0 192.168.1.1
Answer: B
During an internal penetration test against a company, a penetration tester was able to navigate to
another part of the network and locate a folder containing customer information such as
addresses, phone numbers, and credit card numbers. To be PCI compliant, which of the following
should the company have implemented to BEST protect this data?
A.
Vulnerability scanning
B.
Network segmentation
C.
System hardening
D.
Intrusion detection
Answer: B
A security analyst needs to perform a scan for SMB port 445 over a/16 network. Which of the
following commands would be the BEST option when stealth is not a concern and the task is time
sensitive?
A.
Nmap -s 445 -Pn -T5 172.21.0.0/16
B.
Nmap -p 445 -n -T4 -open 172.21.0.0/16
. Nmap -sV –script=smb* 172.21.0.0/16
C.
Nmap -p 445 -max -sT 172. 21.0.0/16
Answer: B
Penetration tester has discovered an unknown Linux 64-bit executable binary. Which of the
following tools would be BEST to use to analyze this issue?
A.
Peach
B.
WinDbg
C.
GDB
D.
OllyDbg
Answer: C
A penetration tester found several critical SQL injection vulnerabilities during an assessment of a
client’s system. The tester would like to suggest mitigation to the client as soon as possible.
Which of the following remediation techniques would be the BEST to recommend? (Choose two.)
A.
Closing open services
B.
Encryption users’ passwords
C.
Randomizing users’ credentials
D.
Users’ input validation
E.
Parameterized queries
F.
Output encoding
Answer: D,E
Which of the following is a rules engine for managing public cloud accounts and resources?
A.
Cloud Custodian
B.
Cloud Brute
C.
Pacu
D.
Scout Suite
Answer: A
A penetration tester will be performing a vulnerability scan as part of the penetration test on a
client’s website. The tester plans to run several Nmap scripts that probe for vulnerabilities while
avoiding detection. Which of the following Nmap options will the penetration tester MOST likely
utilize?
A.
-8 -T0
B.
–script “httpvuln”
C.
-sn
D.
-O -A
Answer: B
A penetration tester discovered that a client uses cloud mail as the company’s email system.
During the penetration test, the tester set up a fake cloud mail login page and sent all company
employees an email that stated their inboxes were full and directed them to the fake login page to
remedy the issue. Which of the following BEST describes this attack?
A.
Credential harvesting
B.
Privilege escalation
C.
Password spraying
D.
Domain record abuse
Answer: A
During an assessment, a penetration tester obtains a list of 30 email addresses by crawling the
target company’s website and then creates a list of possible usernames based on the email
address format. Which of the following types of attacks would MOST likely be used to avoid
account lockout?
A.
Mask
B.
Rainbow
C.
Dictionary
D.
Password spraying
Answer: D
Which of the following is the activity that is typically required the MOST during the postengagement
cleanup phase?
A.
Removing shells
B.
Launching new attacks
C.
Documenting vulnerabilities
D.
Requesting payment
Answer: A
Which of the following tools should a penetration tester use to crawl a website and build a wordlist
using the data recovered to crack the password on the website?
A.
DirBuster
B.
CeWL
C.
w3af
D.
Patator
Answer: B
