MoreExam
1. Question Content...
EXPLANATION
Answer: X - EXPLANATION Content.
Question1: Which of the following would MOST likely be included in the final report of a static application-security test that was written with a team of application developers as the intended audience?
Question2: A penetration tester is testing a new version of a mobile application in a sandbox environment. To intercept and decrypt the traffic between the application and the external API, the tester has created a private root CA and issued a certificate from it. Even though the tester installed the root CA into the trusted stone of the smartphone used for the tests, the application shows an error indicating a certificate mismatch and does not connect to the server. Which of the following is the MOST likely reason for the error?
Question3: A penetration tester wants to test a list of common passwords against the SSH daemon on a network device.Which of the following tools would be BEST to use for this purpose?
Question4: You are a security analyst tasked with hardening a web server.You have been given a list of HTTP payloads that were flagged as malicious.INSTRUCTIONSGiven the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Question5: During the assessment of a client's cloud and on-premises environments, a penetration tester was able to gain ownership of a storage object within the cloud environment using the provided on-premises credentials. Which of the following best describes why the tester was able to gain access?
Question6: The following output is from reconnaissance on a public-facing banking website:Based on these results, which of the following attacks is MOST likely to succeed?
Question7: A penetration tester is able to use a command injection vulnerability in a web application to get a reverse shell on a system After running a few commands, the tester runs the following:python -c 'import pty; pty.spawn("/bin/bash")'Which of the following actions Is the penetration tester performing?
Question8: A penetration tester who is conducting a web-application test discovers a clickjacking vulnerability associated with a login page to financial data. Which of the following should the tester do with this information to make this a successful exploit?
Question9: A penetration tester executes the following Nmap command and obtains the following output:Which of the following commands would best help the penetration tester discover an exploitable service?A)B)C)D)
Question10: A penetration tester receives the following results from an Nmap scan:Which of the following OSs is the target MOST likely running?
Question11: A penetration tester has extracted password hashes from the lsass.exe memory process. Which of the following should the tester perform NEXT to pass the hash and provide persistence with the newly acquired credentials?
Question12: A penetration tester discovered that a client uses cloud mail as the company's email system. During the penetration test, the tester set up a fake cloud mail login page and sent all company employees an email that stated their inboxes were full and directed them to the fake login page to remedy the issue. Which of the following BEST describes this attack?
Question13: A security company has been contracted to perform a scoped insider-threat assessment to try to gain access to the human resources server that houses PII and salary data. The penetration testers have been given an internal network starting position.Which of the following actions, if performed, would be ethical within the scope of the assessment?
Question14: A customer adds a requirement to the scope of a penetration test that states activities can only occur during normal business hours. Which of the following BEST describes why this would be necessary?
Question15: An assessor wants to use Nmap to help map out a stateful firewall rule set. Which of the following scans will the assessor MOST likely run?
Question16: While performing the scanning phase of a penetration test, the penetration tester runs the following command:........v -sV -p- 10.10.10.23-28....ip scan is finished, the penetration tester notices all hosts seem to be down. Which of the following options should the penetration tester try next?
Question17: An exploit developer is coding a script that submits a very large number of small requests to a web server until the server is compromised. The script must examine each response received and compare the data to a large number of strings to determine which data to submit next. Which of the following data structures should the exploit developer use to make the string comparison and determination as efficient as possible?
Question18: Which of the following is a regulatory compliance standard that focuses on user privacy by implementing the right to be forgotten?
Question19: Which of the following tools would be the best to use to intercept an HTTP response at an API, change its content, and forward it back to the origin mobile device?
Question20: When planning a penetration-testing effort, clearly expressing the rules surrounding the optimal time of day for test execution is important because:
Question21: During an assessment, a penetration tester gathered OSINT for one of the IT systems administrators from the target company and managed to obtain valuable information, including corporate email addresses. Which of the following techniques should the penetration tester perform NEXT?
Question22: During a client engagement, a penetration tester runs the following Nmap command and obtains the following output:nmap -sV -- script ssl-enum-ciphers -p 443 remotehost| TLS_ECDHE_ECDSA_WITH_RC4_128_SHA| TLS_ECDHE_RSA_WITH_RC4_128_SHATLS_RSA_WITH_RC4_128_SHA (rsa 2048)TLS_RSA_WITH_RC4_128_MD5 (rsa 2048)Which of the following should the penetration tester include in the report?
Question23: A security firm is discussing the results of a penetration test with a client. Based on the findings, the client wants to focus the remaining time on a critical network segment. Which of the following best describes the action taking place?
Question24: Which of the following is a rules engine for managing public cloud accounts and resources?
Question25: Given the following Nmap scan command:[root@kali ~]# nmap 192.168.0 .* -- exclude 192.168.0.101Which of the following is the total number of servers that Nmap will attempt to scan?
Question26: A client evaluating a penetration testing company requests examples of its work. Which of the following represents the BEST course of action for the penetration testers?
Question27: A penetration tester runs the unshadow command on a machine. Which of the following tools will the tester most likely use NEXT?
Question28: A security firm is discussing the results of a penetration test with the client. Based on the findings, the client wants to focus the remaining time on a critical network segment. Which of the following BEST describes the action taking place?
Question29: A penetration tester managed to exploit a vulnerability using the following payload:IF (1=1) WAIT FOR DELAY '0:0:15'Which of the following actions would best mitigate this type ol attack?
Question30: A penetration tester needs to perform a vulnerability scan against a web server. Which of the following tools is the tester MOST likely to choose?
Question31: During a vulnerability scan a penetration tester enters the following Nmap command against all of the non-Windows clients:nmap -sX -T4 -p 21-25, 67, 80, 139, 8080 192.168.11.191The penetration tester reviews the packet capture in Wireshark and notices that the target responds with an RST packet flag set for all of the targeted ports. Which of the following does this information most likely indicate?
Question32: Which of the following should a penetration tester do NEXT after identifying that an application being tested has already been compromised with malware?
Question33: A company has recruited a penetration tester to conduct a vulnerability scan over the network. The test is confirmed to be on a known environment. Which of the following would be the BEST option to identify a system properly prior to performing the assessment?
Question34: A penetration tester wants to find hidden information in documents available on the web at a particular domain. Which of the following should the penetration tester use?
Question35: Which of the following OSSTM testing methodologies should be used to test under the worst conditions?
Question36: A penetration-testing team needs to test the security of electronic records in a company's office. Per the terms of engagement, the penetration test is to be conducted after hours and should not include circumventing the alarm or performing destructive entry. During outside reconnaissance, the team sees an open door from an adjoining building. Which of the following would be allowed under the terms of the engagement?
Question37: A penetration tester initiated the transfer of a large data set to verify a proof-of-concept attack as permitted by the ROE. The tester noticed the client's data included PII, which is out of scope, and immediately stopped the transfer. Which of the following MOST likely explains the penetration tester's decision?
Question38: A penetration tester is contracted to attack an oil rig network to look for vulnerabilities. While conducting the assessment, the support organization of the rig reported issues connecting to corporate applications and upstream services for data acquisitions. Which of the following is the MOST likely culprit?
Question39: A company recruited a penetration tester to configure wireless IDS over the network. Which of the following tools would BEST test the effectiveness of the wireless IDS solutions?
Question40: A company is concerned that its cloud service provider is not adequately protecting the VMs housing its software development. The VMs are housed in a datacenter with other companies sharing physical resources.Which of the following attack types is MOST concerning to the company?
Question41: During an assessment, a penetration tester obtains a list of 30 email addresses by crawling the target company's website and then creates a list of possible usernames based on the email address format. Which of the following types of attacks would MOST likely be used to avoid account lockout?
Question42: A client wants a security assessment company to perform a penetration test against its hot site. The purpose of the test is to determine the effectiveness of the defenses that protect against disruptions to business continuity.Which of the following is the MOST important action to take before starting this type of assessment?
Question43: A penetration tester exploited a vulnerability on a server and remotely ran a payload to gain a shell. However, a connection was not established, and no errors were shown on the payload execution. The penetration tester suspected that a network device, like an IPS or next-generation firewall, was dropping the connection. Which of the following payloads are MOST likely to establish a shell successfully?
Question44: An organization wants to identify whether a less secure protocol is being utilized on a wireless network.Which of the following types of attacks will achieve this goal?
Question45: A penetration tester would like to obtain FTP credentials by deploying a workstation as an on-path attack between the target and the server that has the FTP protocol. Which of the following methods would be the BEST to accomplish this objective?
Question46: A penetration tester received a 16-bit network block that was scoped for an assessment. During the assessment, the tester realized no hosts were active in the provided block of IPs and reported this to the company. The company then provided an updated block of IPs to the tester. Which of the following would be the most appropriate NEXT step?
Question47: Which of the following factors would a penetration tester most likely consider when testing at a location?
Question48: An Nmap network scan has found five open ports with identified services. Which of the following tools should a penetration tester use NEXT to determine if any vulnerabilities with associated exploits exist on the open ports?
Question49: A penetration tester wrote the following script to be used in one engagement:Which of the following actions will this script perform?
Question50: A penetration tester is testing input validation on a search form that was discovered on a website. Which of the following characters is the BEST option to test the website for vulnerabilities?
Question51: The results of an Nmap scan are as follows:Which of the following would be the BEST conclusion about this device?
Question52: A penetration tester is conducting a penetration test. The tester obtains a root-level shell on a Linux server and discovers the following data in a file named password.txt in the /home/svsacct directory:U3VQZXIkM2NyZXQhCg==Which of the following commands should the tester use NEXT to decode the contents of the file?
Question53: A penetration tester runs the following command:nmap -p- -A 10.0.1.10Given the execution of this command, which of the following quantities of ports will Nmap scan?
Question54: During an internal penetration test against a company, a penetration tester was able to navigate to another part of the network and locate a folder containing customer information such as addresses, phone numbers, and credit card numbers. To be PCI compliant, which of the following should the company have implemented to BEST protect this data?
Question55: A penetration tester needs to access a building that is guarded by locked gates, a security team, and cameras.Which of the following is a technique the tester can use to gain access to the IT framework without being detected?
Question56: A penetration tester who is doing a company-requested assessment would like to send traffic to another system using double tagging. Which of the following techniques would BEST accomplish this goal?
Question57: A company is concerned that its cloud VM is vulnerable to a cyberattack and proprietary data may be stolen.A penetration tester determines a vulnerability does exist and exploits the vulnerability by adding a fake VM instance to the IaaS component of the client's VM. Which of the following cloud attacks did the penetration tester MOST likely implement?
Question58: Which of the following is the BEST resource for obtaining payloads against specific network infrastructure products?
Question59: Which of the following situations would MOST likely warrant revalidation of a previous security assessment?
Question60: An executive needs to use Wi-Fi to connect to the company's server while traveling. While looking for available Wi-Fi connections, the executive notices an available access point to a hotel chain that is not available where the executive is staying. Which of the following attacks is the executive most likely experiencing?
Question61: After running the enum4linux.pl command, a penetration tester received the following output:Which of the following commands should the penetration tester run NEXT?
Question62: A penetration tester ran an Nmap scan on an Internet-facing network device with the -F option and found a few open ports. To further enumerate, the tester ran another scan using the following command:nmap -O -A -sS -p- 100.100.100.50Nmap returned that all 65,535 ports were filtered. Which of the following MOST likely occurred on the second scan?
Question63: A penetration tester conducted a discovery scan that generated the following:Which of the following commands generated the results above and will transform them into a list of active hosts for further analysis?
Question64: You are a penetration tester running port scans on a server.INSTRUCTIONSPart 1: Given the output, construct the command that was used to generate this output from the available options.Part 2: Once the command is appropriately constructed, use the given output to identify the potential attack vectors that should be investigated further.If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Question65: A penetration tester ran the following command on a staging server:python -m SimpleHTTPServer 9891Which of the following commands could be used to download a file named exploit to a target machine for execution?
Question66: A penetration tester is required to perform a vulnerability scan that reduces the likelihood of false positives and increases the true positives of the results. Which of the following would MOST likely accomplish this goal?
Question67: During enumeration, a red team discovered that an external web server was frequented by employees. After compromising the server, which of the following attacks would best support ------------company systems?
Question68: A security analyst needs to perform a scan for SMB port 445 over a/16 network. Which of the following commands would be the BEST option when stealth is not a concern and the task is time sensitive?
Question69: A penetration tester logs in as a user in the cloud environment of a company. Which of the following Pacu modules will enable the tester to determine the level of access of the existing user?
Question70: A company requires that all hypervisors have the latest available patches installed. Which of the following would BEST explain the reason why this policy is in place?
Question71: A penetration tester joins the assessment team in the middle of the assessment. The client has asked the team, both verbally and in the scoping document, not to test the production networks. However, the new tester is not aware of this request and proceeds to perform exploits in the production environment. Which of the following would have MOST effectively prevented this misunderstanding?
Question72: Which of the following tools would BEST allow a penetration tester to capture wireless handshakes to reveal a Wi-Fi password from a Windows machine?
Question73: Which of the following situations would require a penetration tester to notify the emergency contact for the engagement?
Question74: A penetration-testing team is conducting a physical penetration test to gain entry to a building. Which of the following is the reason why the penetration testers should carry copies of the engagement documents with them?
Question75: The following line-numbered Python code snippet is being used in reconnaissance:Which of the following line numbers from the script MOST likely contributed to the script triggering a"probable port scan" alert in the organization's IDS?
Question76: Which of the following should be included in scope documentation?
Question77: A penetration tester recently performed a social-engineering attack in which the tester found an employee of the target company at a local coffee shop and over time built a relationship with the employee. On the employee's birthday, the tester gave the employee an external hard drive as a gift. Which of the following social-engineering attacks was the tester utilizing?
Question78: Which of the following assessment methods is the most likely to cause harm to an ICS environment?
Question79: A penetration tester is explaining the MITRE ATT&CK framework to a company's chief legal counsel.Which of the following would the tester MOST likely describe as a benefit of the framework?
Question80: In the process of active service enumeration, a penetration tester identifies an SMTP daemon running on one of the target company's servers. Which of the following actions would BEST enable the tester to perform phishing in a later stage of the assessment?
Question81: Whenaccessing the URL http://192.168.0-1/validate/user.php, a penetration tester obtained the following output:..d index: eid in /apache/www/validate/user.php line 12..d index: uid in /apache/www/validate/user.php line 13..d index: pw in /apache/www/validate/user.php line 14..d index: acl in /apache/www/validate/user.php line 15
Question82: A penetration tester has obtained root access to a Linux-based file server and would like to maintain persistence after reboot. Which of the following techniques would BEST support this objective?
Question83: A penetration tester is scanning a corporate lab network for potentially vulnerable services. Which of the following Nmap commands will return vulnerable ports that might be interesting to a potential attacker?
Question84: A penetration tester downloaded the following Perl script that can be used to identify vulnerabilities in network switches. However, the script is not working properly.Which of the following changes should the tester apply to make the script work as intended?
Question85: A penetration tester performs the following command:curl -I -http2 https://www.comptia.orgWhich of the following snippets of output will the tester MOST likely receive?
Question86: Which of the following documents must be signed between the penetration tester and the client to govern how any provided information is managed before, during, and after the engagement?
Question87: A penetration tester is conducting an unknown environment test and gathering additional information that can be used for later stages of an assessment. Which of the following would most likely produce useful information for additional testing?
Question88: During a penetration test, you gain access to a system with a limited user interface. This machine appears to have access to an isolated network that you would like to port scan.INSTRUCTIONSAnalyze the code segments to determine which sections are needed to complete a port scanning script.Drag the appropriate elements into the correct locations to complete the script.If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Question89: A security firm has been hired to perform an external penetration test against a company. The only information the firm received was the company name. Which of the following passive reconnaissance approaches would be MOST likely to yield positive initial results?
Question90: During a vulnerability scanning phase, a penetration tester wants to execute an Nmap scan using custom NSE scripts stored in the following folder:/home/user/scriptsWhich of the following commands should the penetration tester use to perform this scan?
Question91: A penetration tester has been contracted to review wireless security. The tester has deployed a malicious wireless AP that mimics the configuration of the target enterprise WiFi. The penetration tester now wants to try to force nearby wireless stations to connect to the malicious AP. Which of the following steps should the tester take NEXT?
Question92: A penetration tester has completed an analysis of the various software products produced by the company under assessment. The tester found that over the past several years the company has been including vulnerable third-party modules in multiple products, even though the quality of the organic code being developed is very good. Which of the following recommendations should the penetration tester include in the report?
Question93: A Chief Information Security Officer wants a penetration tester to evaluate whether a recently installed firewall is protecting a subnetwork on which many decades- old legacy systems are connected. The penetration tester decides to run an OS discovery and a full port scan to identify all the systems and any potential vulnerability. Which of the following should the penetration tester consider BEFORE running a scan?
Question94: A compliance-based penetration test is primarily concerned with:
Question95: During an assessment, a penetration tester found a suspicious script that could indicate a prior compromise.While reading the script, the penetration tester noticed the following lines of code:Which of the following was the script author trying to do?
Question96: A company that developers embedded software for the automobile industry has hired a penetration-testing team to evaluate the security of its products prior to delivery. The penetration-testing team has stated its intent to subcontract to a reverse-engineering team capable of analyzing binaries to develop proof-of-concept exploits. The software company has requested additional background investigations on the reverse- engineering team prior to approval of the subcontract. Which of the following concerns would BEST support the software company's request?
Question97: A penetration tester is conducting an assessment against a group of publicly available web servers and notices a number of TCP resets returning from one of the web servers. Which of the following is MOST likely causing the TCP resets to occur during the assessment?
Question98: A red team completed an engagement and provided the following example in the report to describe how the team gained access to a web server:x' OR role LIKE '%admin%Which of the following should be recommended to remediate this vulnerability?
Question99: A penetration tester fuzzes an internal server looking for hidden services and applications and obtains the following output:Which of the following is the most likely explanation for the output?
Question100: A penetration tester wrote the following Bash script to brute force a local service password:..ting as expected. Which of the following changes should the penetration tester make to get the script to work?
Question101: Which of the following is the MOST common vulnerability associated with IoT devices that are directly connected to the Internet?
Question102: A penetration tester discovered a vulnerability that provides the ability to upload to a path via directory traversal. Some of the files that were discovered through this vulnerability are:Which of the following is the BEST method to help an attacker gain internal access to the affected machine?
Question103: Given the following script:while True:print ("Hello World")Which of the following describes True?
Question104: A company hired a penetration-testing team to review the cyber-physical systems in a manufacturing plant.The team immediately discovered the supervisory systems and PLCs are both connected to the company intranet. Which of the following assumptions, if made by the penetration-testing team, is MOST likely to be valid?
Question105: During a penetration test, the domain names, IP ranges, hosts, and applications are defined in the:
Question106: A penetration tester who is performing an engagement notices a specific host is vulnerable to EternalBlue.Which of the following would BEST protect against this vulnerability?
Question107: A consultant just performed a SYN scan of all the open ports on a remote host and now needs to remotely identify the type of services that are running on the host. Which of the following is an active reconnaissance tool that would be BEST to use to accomplish this task?
Question108: A penetration tester obtained the following results after scanning a web server using the dirb utility:...GENERATED WORDS: 4612----Scanning URL: http://10.2.10.13/ ----+http://10.2.10.13/about (CODE:200|SIZE:1520)+http://10.2.10.13/home.html (CODE:200|SIZE:214)+http://10.2.10.13/index.html (CODE:200|SIZE:214)+http://10.2.10.13/info (CODE:200|SIZE:214)...DOWNLOADED: 4612 - FOUND: 4Which of the following elements is MOST likely to contain useful information for the penetration tester?
Question109: A company provided the following network scope for a penetration test:169.137.1.0/24221.10.1.0/24149.14.1.0/24A penetration tester discovered a remote command injection on IP address 149.14.1.24 and exploited the system. Later, the tester learned that this particular IP address belongs to a third party. Which of the following stakeholders is responsible for this mistake?
Question110: After gaining access to a previous system, a penetration tester runs an Nmap scan against a network with the following results:The tester then runs the following command from the previous exploited system, which fails:Which of the following explains the reason why the command failed?
Question111: A penetration tester needs to perform a test on a finance system that is PCI DSS v3.2.1 compliant. Which of the following is the MINIMUM frequency to complete the scan of the system?
Question112: A penetration tester is conducting an engagement against an internet-facing web application and planning a phishing campaign. Which of the following is the BEST passive method of obtaining the technical contacts for the website?
Question113: A penetration tester is examining a Class C network to identify active systems quickly. Which of the following commands should the penetration tester use?
Question114: During the reconnaissance phase, a penetration tester obtains the following output:Reply from 192.168.1.23: bytes=32 time<54ms TTL=128Reply from 192.168.1.23: bytes=32 time<53ms TTL=128Reply from 192.168.1.23: bytes=32 time<60ms TTL=128Reply from 192.168.1.23: bytes=32 time<51ms TTL=128Which of the following operating systems is MOST likely installed on the host?
Question115: Which of the following documents describes specific activities, deliverables, and schedules for a penetration tester?
Question116: A security analyst is conducting an unknown environment test from 192.168 3.3. The analyst wants to limit observation of the penetration tester's activities and lower the probability of detection by intrusion protection and detection systems. Which of the following Nmap commands should the analyst use to achieve This objective?
Question117: A company hired a penetration tester to do a social-engineering test against its employees. Although the tester did not find any employees' phone numbers on the company's website, the tester has learned the complete phone catalog was published there a few months ago.In which of the following places should the penetration tester look FIRST for the employees' numbers?
Question118: A penetration tester, who is doing an assessment, discovers an administrator has been exfiltrating proprietary company information. The administrator offers to pay the tester to keep quiet. Which of the following is the BEST action for the tester to take?
Question119: A CentOS computer was exploited during a penetration test. During initial reconnaissance, the penetration tester discovered that port 25 was open on an internal Sendmail server. To remain stealthy, the tester ran the following command from the attack machine:Which of the following would be the BEST command to use for further progress into the targeted network?
Question120: A penetration tester ran the following commands on a Windows server:Which of the following should the tester do AFTER delivering the final report?
Question121: A company has hired a penetration tester to deploy and set up a rogue access point on the network.Which of the following is the BEST tool to use to accomplish this goal?
Question122: A penetration tester created the following script to use in an engagement:However, the tester is receiving the following error when trying to run the script:Which of the following is the reason for the error?
Question123: Which of the following is the MOST important information to have on a penetration testing report that is written for the developers?
Question124: User credentials were captured from a database during an assessment and cracked using rainbow tables. Based on the ease of compromise, which of the following algorithms was MOST likely used to store the passwords in the database?
Question125: A penetration tester breaks into a company's office building and discovers the company does not have a shredding service. Which of the following attacks should the penetration tester try next?
Question126: A penetration tester gives the following command to a systems administrator to execute on one of the target servers:rm -f /var/www/html/G679h32gYu.phpWhich of the following BEST explains why the penetration tester wants this command executed?
Question127: An Nmap scan of a network switch reveals the following:Which of the following technical controls will most likely be the FIRST recommendation for this device?
