Page 12 of 17 Β· 334 total questions.
A penetration tester needs to quickly transfer an exploit from a Linux system to a Windows 10 system within the network. Which of the following is the best way to accomplish this task?
The correct answer is C. Option C: python3 -m http.server 80
A penetration tester downloads a JAR file that is used in an organizationβs production environment. The tester evaluates the contents of the JAR file to identify potentially vulnerable components that can be targeted for exploit. Which of the following describes the tester's activities?
The correct answer is D. Option D: SCA
During a wireless penetration assessment for a small business client, a tester attempts to capture wireless packets. However, whenever the tester sets the capture device to monitor mode, it fails to see the client's wireless network, as provided by the scope. Which of the following is the most likely reason for this issue?
The correct answer is A. Option A: The clients network uses 6GHz and not 5GHz/2.4GHz
A tester compromises a target host and then wants to maintain persistent access. Which of the following is the best way for the attacker to accomplish the objective?
The correct answer is A. Option A: Configure and register a service
A penetration tester obtains network-level access to a hardened subnet that has no Windows-based hosts and needs to find credentials. The client mentioned that the SOC is only monitoring user endpoints and not servers. Which of the following commands should the tester use?
The correct answer is D. Option D: hydra -L root -P /path/to/wordlist -t 3 -M
A penetration tester accesses and enumerates a host and then runs the following commands: $ runlevel $ ls -l /etc/rc5.d $ vi /etc/rc5.d/S01ssh.dd Which of the following is the tester most likely attempting to do?
The correct answer is B. Option B: Establish persistence on the host
A penetration testing company is defining the rules of engagement with a client. Which of the following should the company include?
The correct answer is B. Option B: Escalation process
Which of the following differentiates MITRE ATT&CK from PTES?
The correct answer is A. Option A: MITRE ATT&CK emphasizes real-world adversary behavior patterns, while PTES outlines structured test phases
A company's incident response team determines that a breach occurred because a penetration tester left a web shell. Which of the following should the penetration tester have done after the engagement?
The correct answer is B. Option B: Remove utilized persistence mechanisms on client systems
A penetration tester gained a foothold within a network. The penetration tester needs to enumerate all users within the domain. Which of the following is the best way to accomplish this task?
The correct answer is B. Option B: net.exe
A penetration tester wants to automatically enumerate all ciphers permitted on TLS/SSL configurations across a client's internet-facing and internal web servers. Which of the following tools or frameworks best supports this objective?
The correct answer is A. Option A: Nmap Scripting Engine
A penetration tester gains initial access to a system and gets ready to perform additional reconnaissance. The tester cannot use Nmap on the system they used to gain initial access. The tester develops the following script to scan a network range: The tester wants to modify the current script so multiple ports can be scanned. The tester enters a comma-separated list of ports in the port variable. Which of the following should the tester do next to provide the desired functionality?
The correct answer is B. Option B: Add a new Foreach loop directly beneath the other Foreach loop and enclose with {...}.
After obtaining a reverse shell, a penetration tester identifies a locally cloned Git repository that contains thousands of files and directories on a Windows machine. The tester suspects there could be sensitive information related to "ProjectX." Which of the following commands should the tester use in a script to identify potential files to produce the best results?
The correct answer is D. Option D: gci -Path . -Recurse | Select-String -Pattern "ProjectX"
During an engagement, a penetration tester receives a list of target systems and wants to enumerate them for possible vulnerabilities. The tester finds the following script on the internet: After running the script, the tester runs the following command: Which of the following should the tester do next?
The correct answer is B. Option B: Insert the following line before line 6target = target.split(" ")[0]
During a penetration test, the tester wants to obtain public information that could be used to compromise the organization's cloud infrastructure. Which of the following is the most effective resource for the tester to use for this purpose?
The correct answer is C. Option C: Repositories with secret keys
A tester obtains access to an application server via a Java vulnerability and must maintain persistence. The server has a file integrity monitoring control enabled, and the tester cannot disable it. Which of the following actions should the tester take to establish persistence?
The correct answer is D. Option D: Schedule a task.
A penetration tester performs the following scan: The tester then manually uses snmpwalk against port 161 and receives valid SNMP responses. Which of the following best explains the scan result for port 161?
The correct answer is B. Option B: Nmap marked the port as open|filtered because no response was received.
Which of the following components of a penetration test report most directly contributes to prioritizing remediations?
The correct answer is B. Option B: Risk scoring
A penetration tester must gain entry to a client's office building without raising attention. Which of the following should be the tester's first step?
The correct answer is D. Option D: Conducting surveillance of the office to understand foot traffic
A penetration tester poses as a member of a company's human resources department. The tester wants to obtain credentials by sending an email containing a link that redirects to a fake website. Which of the following commands is the best way to determine whether the email is flagged as malicious?
The correct answer is C. Option C: nslookup -q=txt _dmarc.company.com
Showing questions 221β240 of 334 Β· Page 12 of 17