Jason Dion's Pentest+ Course Practice Exam Flashcards
A penetration tester hired by a bank began searching for the bank's IP ranges by performing lookups on the bank's DNS servers, reading news articles online about the bank, monitoring what times the bank's employees came into and left work, searching job postings (with a special focus on the bank's information technology jobs), and even searching the corporate office of the bank's dumpster. Based on this description, what portion of the penetration test is being conducted? A.Information reporting B.Vulnerability assessment C.Passive information gathering D.Active information gathering
C.Passive information gathering
Explanation
OBJ-2.1: Passive information gathering consists of numerous activities where the penetration tester gathers open-source or publicly available information without the organization under investigation being aware that the information has been accessed. Instead, active information gathering starts to probe the organization using techniques like DNS Enumeration, Port Scanning, and OS Fingerprinting. Vulnerability assessments are another form of active information gathering. Information reporting occurs after the penetration test is complete, and it involves writing a final report with the results, vulnerabilities, and lessons learned during the assessment.
An analyst just completed a port scan and received the following results of open ports:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
TCP: 80 TCP: 110 TCP: 443 TCP: 1433 TCP: 3306 TCP: 3389
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Based on these scan results, which of the following services are NOT currently operating? A.Database B.SSH C.RDP D.Web
B.SSH
Explanation
OBJ-2.1: Based on the port numbers shown as open in the nmap scan results, SSH is not currently operating. SSH operates over port 22. Web servers use port 80 for HTTP and 443 for HTTPS. Database servers run on port 1433 (Microsoft SQL) or 3306 (MySQL). Remote Desktop Protocol runs on port 3389.
What programming language is most vulnerable to buffer overflow attacks? A.Java B.Swift C.C++ D.Python
C.C++
Explanation
OBJ-3.4: Many memory manipulation functions in C and C++ do not perform bounds checking and can easily overwrite the allocated bounds of the buffers they operate upon. Newer languages like Python, Java, and Swift do a better job of protecting against a buffer overflow, but even they are not perfect.
A security analyst wants to implement a layered defense posture for this network, so he uses multiple antivirus defensive layers, including both an end-user desktop antivirus software and an email gateway scanner. What kind of attack would this approach help to mitigate? A.Scanning attack B.Social engineering attack C.Forensic attack D.ARP spoofing attack
B.Social engineering attack
Explanation
OBJ-3.1: By utilizing both endpoint protection (desktop antivirus software) and the email gateway scanner, the security analyst works to prevent phishing and other social engineering attacks. Emails are a common attack vector used in social engineering attacks.
A pentester is trying to map the organization's internal network. The analyst enters the following command (nmap -n -sS -T4 -p 80 10.0.3.0/24). What type of scan is this? A.Comprehensive Scan B.Intense Scan C.Quick Scan D.Stealth Scan
D.Stealth Scan
Explanation:
Explanation
OBJ-4.1: In nmap, the -sS flag signifies a stealth scan. This is also known as an SYN scan and is the most popular scan option for good reasons. It can be performed quickly, scanning thousands of ports per second on a fast network, and is not hampered by restrictive firewalls. It is also relatively unobtrusive and stealthy since it never completes TCP connections.
When you are managing a risk, what is considered an acceptable option? A.Mitigate it B.Reject it C.Initiate it D.Deny it
A.Mitigate it
Explanation
OBJ-5.1: Mitigating a risk makes the effect of a risk a little less unpleasant, harmful, or serious. The majority of risk management is focused on mitigating risks down to an acceptable level of loss or risk.
alert(“This site is vulnerable to an attack!”)
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Then, you clicked the search button, and a pop-up box appears on your screen showing the following text, “This site is vulnerable to an attack!” Based on this response, what vulnerability have you uncovered in the web application
A.Distributed Denial of Service
B.Buffer Overflow
C.Cross-site scripting
D.Cross-site request forgery
C.Cross-site scripting
Explanation:
OBJ-3.4: This is a form of Cross-Site Scripting (XSS). Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. Attackers may use a cross-site scripting vulnerability to bypass access controls such as the same-origin policy. Cross-site request forgery (CSRF or XSRF) is a malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts. There are many ways in which a malicious website can transmit commands, such as specially-crafted image tags, hidden forms, and JavaScript XMLHttpRequests can all work without the user’s interaction or even knowledge. A distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt normal traffic of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic. A buffer overflow is an anomaly that occurs when a program overruns the buffer’s boundary and overwrites adjacent memory locations while writing data to a buffer.
Your organization's networks contain 4 subnets: 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0. Using nmap, how can you scan all 4 subnets using a single command? A.nmap -Pn 10.0.0.0/25 B.nmap -Pn 10.0.0.0,1.0,2.0,3.0 C.nmap -Pn 10.0.0.-3.0 D.nmap -Pn 10.0.0.0/23
C.nmap -Pn 10.0.0.-3.0
Explanation
OBJ-4.1: The simplest way to scan multiple subnets adjacent to each other is to use the -Pn tells the command to conduct a host-only scan of every IP in this target space. Using the dash (-) in the IP address means to scan “this network through this network.” So, 10.0.0-3.0 will scan every IP from 10.0.0.0 through 10.0.3.255.q
You walked up behind a penetration tester in your organization and saw the following output on their Kali Linux terminal:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
[ATTEMPT] target 192.168.1.142 – login “root” – pass “abcde” 1 of 10
[ATTEMPT] target 192.168.1.142 – login “root” – pass “efghi” 2 of 10
[ATTEMPT] target 192.168.1.142 – login “root” – pass “12345” 3 of 10
[ATTEMPT] target 192.168.1.142 – login “root” – pass “67890” 4 of 10
[ATTEMPT] target 192.168.1.142 – login “root” – pass “a1b2c” 5 of 10
[ATTEMPT] target 192.168.1.142 – login “user” – pass “abcde” 6 of 10
[ATTEMPT] target 192.168.1.142 – login “user” – pass “efghi” 7 of 10
[ATTEMPT] target 192.168.1.142 – login “user” – pass “12345” 8 of 10
[ATTEMPT] target 192.168.1.142 – login “user” – pass “67890” 9 of 10
[ATTEMPT] target 192.168.1.142 – login “user” – pass “a1b2c” 10 of 10
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
What type of test is the penetration tester currently conducting?
A.Conducting a brute force login attempt of a remote service of 192.168.1.142
B.Conducting a brute force login attempt of a remote service on 192.168.1.142
C.Conducting a ping sweep of 192.168.1.142/24
D.Conducting a Denial of Service attack on 192.168.1.142
B.Conducting a brute force login attempt of a remote service on 192.168.1.142
Explanation
OBJ-2.4: The penetration tester is attempting to conduct a brute force login attempt of a remote service on 192.168.1.142, as shown by the multiple login attempts with common usernames and passwords. A brute force attack attempts to crack a password or username or find a hidden web page, or find the key used to encrypt a message, using a trial and error approach and hoping, eventually, to guess correctly. Port Scanning is the name for the technique used to identify open ports and services available on a network host. A denial-of-service (DoS) attack occurs when legitimate users cannot access information systems, devices, or other network resources due to the actions of a malicious cyber threat actor. A ping sweep is a basic network scanning technique used to determine which range of IP addresses map to live hosts.
A security analyst conducts a nmap scan of a server and found that port 25 is open. What risk might this server be exposed to? A.Web portal data leak B.Clear text authentication C.Open file/print sharing D.Open mail relay
D.Open mail relay
Explanation:
OBJ-3.2: Port 25 is the default port for SMTP (Simple Message Transfer Protocol), which is used for sending an email. An active mail relay occurs when an SMTP server is configured in such a way that it allows anyone on the Internet to send email through it, not just mail originating from your known and trusted users. Spammers can exploit this type of vulnerability to use your email server for their own benefit. File/print sharing usually operates over ports 135, 139, and 445 on a Windows server. Web portals run on ports 80 and 443. Clear text authentication could occur using an unencrypted service, such as telnet (23), FTP (20/21), or the web (80).
What nmap switch would you use to perform operating system detection? A.-OS B.-sP C.-O D.-s0
C.-O
Explanation:
OBJ-4.1: The –O switch is used to tell nmap to conduct fingerprinting of the operating system based on the responses received during scanning. Nmap will then report on the suspected operating system of the scanned host. If you use –O –v, you will get additional details, as this runs the operating system scan in verbose mode. The -OS flag is made up and not supported by nmap. The -s0 flag conducts an IP protocol scan of the target. The -sP flag conducts a simple ping scan against the target.
An ethical hacker has been hired to conduct a physical penetration test of a company. During the first day of the test, the ethical hacker dresses up like a plumber and waits in the building's main lobby until an employee goes through the main turnstile. As soon as the employee enters his access number and proceeds to go through the turnstile, the ethical hacker follows them through the access gate. What type of attack did the ethical hacker utilize to access the restricted area of the building? A.Shoulder surfing B.Mantrap C.Tailgating D.Social engineering
C.Tailgating
Explanation
OBJ-3.6: Based on the description, the ethical hacker conducted a very specialized type of social engineering attack known as tailgating. Sometimes on a certification exam, there are two correct answers, but one is more correct. This question is an example of that concept. Tailgating involves someone who lacks the proper authentication following an employee into a restricted area. Social engineering uses deception to manipulate individuals into divulging confidential or personal information that may be used for fraudulent purposes. Shoulder surfing is a type of social engineering technique used to obtain personal identification numbers (PINs), passwords, and other confidential data by looking over the victim’s shoulder.
What command could be used to list the active services from the Windows command prompt? A. sc query \\servername B.sc config C.sc query D.sc query type= running
C.sc query
Explanation
OBJ-2.1: Windows uses the sc query to display information about the running service. It is part of the Service Control command-line tool, known as sc. The sc config command will modify the value of a service’s entries in the registry and the Service Control Manager database. The sc query command will obtain and display information about the specified service, driver, type of service, or driver type. By entering just the sc query, the command will return the information on the active services only. By using the type=running option, only the information on the running service will be displayed. If the command sc query \servername is used, then the remote server’s active services (\servername) will be displayed.
A penetration tester has been hired to conduct an assessment, but the company wants to exclude social engineering from the list of authorized activities. Which of the following documents would include this limitation? A.Rules of engagement B.Memorandum of understanding C.Service level agreement D.Acceptable Use Policy
A.Rules of engagement
Explanation
OBJ-1.1: While the contract documents’ network scope will define what will be tested, the rules of engagement define how that testing is to occur. Rules of engagement can state things like no social engineering is allowed, no external website scanning, etc. A memorandum of understanding (MOU) is a preliminary or exploratory agreement to express an intent to work together that is not legally binding and does not involve monetary exchange. A service level agreement contains the operating procedures and standards for a service contract. An acceptable use policy is a policy that governs employees’ use of company equipment and internet services.
You are logged into the Windows command prompt and want to find what systems are alive in a portion of a Class B network (172.16.0.0/24) using ICMP. What command would best accomplish this?
A. for /L %X in (1 1 254) do PING -n 1 172.16.0.%X | FIND /I “REPLY”
B.ping 172.16.0.255
C. for %X in (1 1 255) do PING 172.16.0.%X
D.Ping 172.16.0.0
A. for /L %X in (1 1 254) do PING -n 1 172.16.0.%X | FIND /I “REPLY”
Explanation:
OBJ-4.4: The Windows command line does support some fundamental scripting, as shown in this answer. Use an iterative variable to set the starting value (start#) and then step through a set range of values until the value exceeds the set ending value (end#). /L will execute the iterative by comparing start# with end#. If start# is less than end#, the command will execute. When the iterative variable exceeds end#, the command shell exits the loop. You can also use a negative step# to step through a range in decreasing values. For example, (1,1,5) generates the sequence 1 2 3 4 5 and (5,-1,1) generates the sequence (5 4 3 2 1). The syntax is: “for /L %variable in (start# step# end#) do command [CommandLineOptions].”
What must be developed to show security improvements over time? A.Reports B.Testing Tools C.Taxonomy of vulnerabilities D.Metrrics
D.Metrrics
Explanation:
OBJ-5.1: Metrics are a method of measuring something over time. If you wish to show the effect of security improvements over time, creating metrics would be a good option. For example, you may wish to look at the number of unpatched and known vulnerabilities. As this number decreases, your network would be considered to have improved security. Reports and testing tools alone cannot show progress. You must have measurable results using metrics.
A penetration tester has exploited an FTP server using Metasploit and now wants to pivot to the organization’s LAN. What is the best method for the penetration tester to use to conduct the pivot?
A.Create a route statement in meterpreter
B.Set the payload to propagate through meterpreter
C.Issue the pivot exploit and setup meterpreter
D.Reconfigure the network settings in meterpreter
A.Create a route statement in meterpreter
Explanation:
OBJ-3.7: Since the penetration tester has exploited the FTP server from outside the LAN, they will need to set up a route statement in meterpreter. Metasploit makes this very simple since it also has an autoroute meterpreter script that will allow us to attack this second network through our first compromised machine (the FTP server) and then create the routes needed.
What results will the following command yield: NMAP -sS -O -p 80-443 145.18.24.7?
A.A stealth scan thats scans all open ports excluding ports 80 to 443
B.A stealth scan that scans ports 80 and 443
C.A stealth scan that scans all ports from 80 to 443 and determines a targets operating system
D.A stealth scan that scans ports 80 to 443
C.A stealth scan that scans all ports from 80 to 443 and determines a targets operating system
Explanation:
OBJ-4.1: When using NMAP, the -sS tells the tool to use a stealth scan using a TCP SYN packet, the -O is used to determine the operating system, and -p dictates which ports to scan. Since the ports were listed as 80-443, this indicates it includes all the ports from 80 through 443.
What is a formal document that states what will and will not be performed during a penetration test? A.NDA B.MSA C.Corporate Policy D.SOW
D.SOW
Explanation:
OBJ-1.2: The Scope of Work is a formal document stating what will and will not be performed during a penetration test. It should also contain the size and scope of the assessment and a list of the assessment’s objectives. A master service agreement, or MSA, is a contract reached between parties, in which the parties agree to most of the terms that will govern future transactions or future agreements. The MSA is used when a pentester will be on retainer for a multi-year contract, and an individual SOW will be issued for each assessment to define the individual scopes for each one. A non-disclosure agreement (NDA) is a legal contract between at least two parties that outlines confidential material, knowledge, or information that the parties wish to share for certain purposes but wish to restrict access. Corporate policy is a documented set of broad guidelines, formulated after analyzing all internal and external factors that can affect an organization’s objectives, operations, and plans.
A hacker successfully modified the sale price of items purchased through your company's web site. During the investigation that followed, the security analyst has verified the web server, and the Oracle database was not compromised directly. The analyst also found no attacks that could have caused this during their log verification of the Intrusion Detection System (IDS). What is the most likely method that the attacker used to change the items' sale price? A.Changing hidden from values B.Cross-site scripting C.SQL injection D.Buffer overflow attacl
A.Changing hidden from values
Explanation:
OBJ-3.4: Since there are no indications in the IDS logs, the database, or the server, it is most likely that the hacker changed hidden form values to change the items’ price in the shopping cart. A buffer overflow is an anomaly that occurs when a program overruns the buffer’s boundary and overwrites adjacent memory locations while writing data to a buffer. Cross-Site Scripting (XSS) attacks are a type of injection in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in a browser side script, to a different end-user. SQL injection is a code injection technique used to attack data-driven applications. Malicious SQL statements are inserted into an entry field for execution, such as dumping the database contents to the attacker.
What kind of attack is an example of IP spoofing? A.ARP Poisoning B.SQL Injections C.Man-in-the-Middle D.Cross-site scripting
C.Man-in-the-Middle
Explanation:
OBJ-3.2: The man-in-the-middle attack intercepts communications between two systems. For example, in an HTTP transaction, the target is the TCP connection between client and server. Using different techniques, the attacker splits the original TCP connection into 2 new connections, one between the client and the attacker and the other between the attacker and the server. This often uses IP spoofing to trick a victim into connecting to the attack. SQL injection is a code injection technique used to attack data-driven applications. Malicious SQL statements are inserted into an entry field for execution, such as dumping the database contents to the attacker. A man-in-the-middle attack (MITM) is an attack where the attacker secretly relays and possibly alters the communications between two parties who believe that they are directly communicating with each other. ARP Poisoning, also known as ARP Spoofing, is a type of cyber attack carried out over a Local Area Network (LAN) that involves sending malicious ARP packets to a default gateway on a LAN to change the pairings in its IP to MAC address table. Cross-Site Scripting (XSS) attacks are a type of injection in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in a browser side script, to a different end-user.
Which of the following is true concerning LM hashes?
A.LM hashes consist of 48 hexadecimal characters
B.LM Hases are based on AES128 cryptographic standard
C.LM Hashes are not generated when the password length exceeds 15 characters
D.Uppercase characters in the password are converted to lwoercase
C.LM Hashes are not generated when the password length exceeds 15 characters
Explanation:
OBJ-3.4: LM hash, also known as LanMan hash or LAN Manager hash, is a compromised password hashing function. This was the primary hash that Microsoft LAN Manager and Microsoft Windows versions before Windows NT used to store user passwords. Support for the legacy LAN Manager protocol continued in later versions of Windows for backward compatibility. Still, it was recommended by Microsoft to be turned off by administrators due to the LM hash’s weak strength. LM hashes are not generated when the password length exceeds 15 characters since it is stored as a 16-byte value.
What is not one of the three categories of solutions that all of the pentester's recommended mitigations should fall into? A.Technology B.Problems C.People D.PRocess
B.Problems
Explanation:
OBJ-5.3: All possible solutions can be categorized as People, Process, or Technology solutions.
An attacker was able to gain access to your organization's network closet while posing as an HVAC technician. While he was there, he installed a network sniffer in your switched network environment. The attacker now wants to sniff all of the packets in the network. What attack should he use? A.Smurg B.MAC Flood C.Fraggle D.Tear Drop
B.MAC Flood
Explanation:
OBJ-3.2: MAC flooding is a technique employed to compromise the security of switched network devices. The attack forcing legitimate MAC addresses out of the table of contents in the switch and forcing a unicast flooding behavior, potentially sending sensitive information to portions of the network where it is not normally intended to go. Essentially, since the switch table of contents is flooding with bad information, the switch could fail open and begin to act like a hub, broadcasting all the frames out of every port. This would allow the attacker to sniff all network packets since he is connected to one of those switch ports. A fraggle attack is a denial-of-service (DoS) attack that involves sending a large amount of spoofed UDP traffic to a router’s broadcast address within a network. A teardrop attack is a denial-of-service (DoS) attack that involves sending fragmented TCP packets to a target machine. The Smurf attack is a distributed denial-of-service attack. Large numbers of Internet Control Message Protocol (ICMP) packets with the intended victim’s spoofed source IP are broadcast to a computer network using an IP broadcast address.
What type of assessment seeks to validate a systems security posture against a particular checklist? A.Compliance-based B.Objective-based C.Red team D.Goal-based
A.Compliance-based
Explanation:
OBJ-1.3: Compliance-based assessments seek to validate a system against a given checklist. This could validate organizational policies, be risk-based, or be used to validate PCI-DSS compliance. Objective-based penetration testing approaches an objective from all angles to ensure that information remains secure. This testing more accurately simulates the attacks launched by a malicious party. Goal-based assessments use goals defined before the assessment begins, and the penetration tester works to achieve the goals. Once a goal is achieved, the penetration testers should determine how many unique ways the goal can be achieved. A red team is a group that helps organizations to improve themselves by providing opposition to the point of view of the organization that they are helping.
What tool can be used to scan a network to perform vulnerability checks and compliance auditing? A.Nessus B.NMAP C.Metasploit D.BeEF
A.Nessus
Explanation:
OBJ-4.2: Nessus is a popular vulnerability scanner. It can be used to check how vulnerable your network is by using various plugins to test for vulnerabilities. Also, Nessus can perform compliance auditing, like internal and external PCI DSS audit scans. The nmap tool is a port scanner. The Metasploit Project is a computer security project that provides information about security vulnerabilities and aids in penetration testing and IDS signature development. BeEF is short for The Browser Exploitation Framework. It is a penetration testing tool that focuses on the web browser.
What term describes the amount of risk an organization is willing to accept? A.Risk avoidance B.Risk acceptance C.Risk appetite D.Risk mitigations
C.Risk appetite
Explanation:
OBJ-5.1: Risk appetite describes how much risk an organization is willing to accept. This is a crucial factor both in designing the assessment and determining the recommended mitigations. Risk mitigation is a strategy to prepare for and lessen the effects of threats faced by a data center. Risk mitigation refers to applying security controls to reduce the risk of a known vulnerability. Risk avoidance is the elimination of hazards, activities, and exposures that can negatively affect an organization’s assets. Risk acceptance is the act of accepting the identified risk and not taking additional actions to reduce the risk because the risk is low enough. Risk acceptance should only be done once an organization’s risk tolerance is defined and communicated amongst the decision-makers.
An attacker is searching in Google for Cisco VPN configuration files by using the filetype:pcf modifier. The attacker could locate several of these configuration files and now wants to decode any connectivity passwords that they might contain. What tool should the attacker use? A.Nessus scripting engine B.Cain and Abel C.CUPP D.Netcat
B.Cain and Abel
Explanation: OBJ-4.2: Cain and Abel is a popular password cracking tool. It can recover many password types using methods such as network packet sniffing, cracking various password hashes by using methods such as dictionary attacks, brute force, and cryptanalysis attacks. It also includes a module to conduct Cisco VPN Client Password Decoding too. CUPP is used to create password lists. Nessus is a vulnerability scanner. The netcat tool is used to create reverse shells for remote access.
