Page 5 of 17 · 334 total questions.
A penetration tester conducts reconnaissance for a client's network and identifies the following system of interest: The tester notices numerous open ports on the system of interest. Which of the following best describes this system?
The correct answer is A. Option A: A honeypot
A penetration tester gains initial access to a target system by exploiting a recent RCE vulnerability. The patch for the vulnerability will be deployed at the end of the week. Which of the following utilities would allow the tester to reenter the system remotely after the patch has been deployed? (Choose two.)
The correct answer is A, E. Option A: schtasks.exe Option E: sc.exe
A tester runs an Nmap scan against a Windows server and receives the following results: Which of the following TCP ports should be prioritized for using hash-based relays?
The correct answer is C. Option C: 445
During an assessment, a penetration tester compromises some machines but finds that none of the accounts have sufficient access to the target HR database server. In order to enumerate accounts with sufficient permissions, the tester wants to model an attack path before taking further action. Which of the following tools should the tester use to meet this objective?
The correct answer is D. Option D: BloodHound
A penetration tester plans to conduct reconnaissance during an engagement using readily available resources. Which of the following resources would most likely identify hardware and software being utilized by the client?
The correct answer is D. Option D: Job boards
A company wants to perform a BAS to measure the efficiency of the corporate security controls. Which of the following would most likely help the tester with simple command examples?
The correct answer is C. Option C: Atomic Red Team This option keeps traffic private / properly secured as required.
A tester needs to begin capturing WLAN credentials for cracking during an on-site engagement. Which of the following is the best command to capture handshakes?
The correct answer is D. Option D: airodump-ng -c 6 --bssid
A penetration tester is conducting an assessment of a web application's log-in page. The tester needs to determine whether there are any hidden form fields of interest. Which of following is the most effective technique?
The correct answer is D. Option D: HTML scraping
A penetration tester finds it is possible to downgrade a web application's HTTPS connections to HTTP while performing on-path attacks on the local network. The tester reviews the output of the server response to curl -s -I https://internalapp/. HTTP/2 302 - date: Thu, 11 Jan 2024 15:56:24 GMT content-type: text/html; charset=iso-8859-l location: /login x-content-type-options: nosniff server: Prod Which of the following recommendations should the penetration tester include in the report?
The correct answer is A. Option A: Add the HSTS header to the server.
Which of the following can an access control vestibule help deter?
The correct answer is D. Option D: Tailgating
Which of the following is the most efficient way to exfiltrate a file containing data that could be sensitive?
The correct answer is D. Option D: Encrypt and send the file over HTTPS.
A penetration tester has discovered sensitive files on a system. Assuming exfiltration of the files is part of the scope of the test, which of the following is most likely to evade DLP systems?
The correct answer is A. Option A: Encoding the data and pushing through DNS to the tester's controlled server
Explanation
DNS resolves host names to records such as IP addresses and service locations.
A penetration tester is testing a power plant's network and needs to avoid disruption to the grid. Which of the following methods is most appropriate to identify vulnerabilities in the network?
The correct answer is C. Option C: Configure a port mirror and review the network traffic.
During a security audit, a penetration tester wants to run a process to gather information about a target network's domain structure and associated IP addresses. Which of the following tools should the tester use?
The correct answer is A. Option A: Dnsenum
Explanation
DNS resolves host names to records such as IP addresses and service locations. This option keeps traffic private / properly secured as required.
A penetration tester enumerates a legacy Windows host on the same subnet. The tester needs to select exploit methods that will have the least impact on the host's operating stability. Which of the following commands should the tester try first?
The correct answer is A. Option A: responder -I eth0john responder_output.txt
During an assessment, a penetration tester runs the following command: dnscmd.exe /config /serverlevelplugindll C:\users\netadm\Documents\addusr.dll Which of the following is the penetration tester trying to achieve?
The correct answer is B. Option B: Privilege escalation
A penetration tester wants to use multiple TTPs to assess the reactions (alerted, blocked, and others) by the client's current security tools. The threat-modeling team indicates the TTPs in the list might effect their internal systems and servers. Which of the following actions would the tester most likely take?
The correct answer is A. Option A: Use a BAS tool to test multiple TTPs based on the input from the threat-modeling team. This option keeps traffic private / properly secured as required.
A penetration tester is conducting a vulnerability scan. The tester wants to see any vulnerabilities that may be visible from outside of the organization. Which of the following scans should the penetration tester perform?
The correct answer is C. Option C: Unauthenticated
During a penetration testing engagement, a tester targets the internet-facing services used by the client. Which of the following describes the type of assessment that should be considered in this scope of work?
The correct answer is C. Option C: External
A tester wants to pivot from a compromised host to another network with encryption and the least amount of interaction with the compromised host. Which of the following is the best way to accomplish this objective?
The correct answer is A. Option A: Create a SSH tunnel using sshuttle to forward all the traffic to the compromised computer. This option keeps traffic private / properly secured as required.
Showing questions 81–100 of 334 · Page 5 of 17