Question 1

Which of the following BEST describe the OWASP Top 10? (Choose two.)

Accepted Answer

A)  The most critical risks of web applications 
B)  A list of all the risks of web applications 
C)  The risks defined in order of importance 
D)  A web-application security standard 
E)  A risk-governance and compliance framework
F) A checklist of Apache vulnerabilities 
A)  The most critical risks of web applications 
B)  A list of all the risks of web applications 
C)  The risks defined in order of importance 
D)  A web-application security standard 
E)  A risk-governance and compliance framework
F) A checklist of Apache vulnerabilities

Question 2

A company is concerned that its cloud service provider is not adequately protecting the VMs housing its software development. The VMs are housed in a datacenter with other companies sharing physical resources. Which of the following attack types is MOST concerning to the company?

Accepted Answer

A)  Data flooding 
B)  Session riding 
C)  Cybersquatting 
D)  Side channel 
A)  Data flooding 
B)  Session riding 
C)  Cybersquatting 
D)  Side channel

Question 3

Which of the following expressions in Python increase a variable val by one (Choose two.)

Accepted Answer

A)  val++ 
B)  +val 
C)  val=(val+1) 
D)  ++val 
E)  val=val++
F) val+=1 
A)  val++ 
B)  +val 
C)  val=(val+1) 
D)  ++val 
E)  val=val++
F) val+=1

Question 4

A penetration tester was conducting a penetration test and discovered the network traffic was no longer reaching the client's IP address. The tester later discovered the SOC had used sinkholing on the penetration tester's IP address. Which of the following BEST describes what happened?

Accepted Answer

A)  The penetration tester was testing the wrong assets 
B)  The planning process failed to ensure all teams were notified 
C)  The client was not ready for the assessment to start 
D)  The penetration tester had incorrect contact information 
A)  The penetration tester was testing the wrong assets 
B)  The planning process failed to ensure all teams were notified 
C)  The client was not ready for the assessment to start 
D)  The penetration tester had incorrect contact information

Question 5

A penetration tester wants to scan a target network without being detected by the client's IDS. Which of the following scans is MOST likely to avoid detection?

Accepted Answer

A)  nmap -p0 -T0 -sS 192.168.1.10 
B)  nmap -sA -sV --host-timeout 60 192.168.1.10 
C)  nmap -f --badsum 192.168.1.10 
D)  nmap -A -n 192.168.1.10 
A)  nmap -p0 -T0 -sS 192.168.1.10 
B)  nmap -sA -sV --host-timeout 60 192.168.1.10 
C)  nmap -f --badsum 192.168.1.10 
D)  nmap -A -n 192.168.1.10

Question 6

A penetration tester logs in as a user in the cloud environment of a company. Which of the following Pacu modules will enable the tester to determine the level of access of the existing user?

Accepted Answer

A)  iam_enum_permissions 
B)  iam_privesc_scan 
C)  iam_backdoor_assume_role 
D)  iam_bruteforce_permissions 
A)  iam_enum_permissions 
B)  iam_privesc_scan 
C)  iam_backdoor_assume_role 
D)  iam_bruteforce_permissions

Question 7

During a penetration-testing engagement, a consultant performs reconnaissance of a client to identify potential targets for a phishing campaign. Which of the following would allow the consultant to retrieve email addresses for technical and billing contacts quickly, without triggering any of the client's cybersecurity tools? (Choose two.)

Accepted Answer

A)  Scraping social media sites 
B)  Using the WHOIS lookup tool 
C)  Crawling the client's website 
D)  Phishing company employees 
E)  Utilizing DNS lookup tools
F) Conducting wardriving near the client facility 
A)  Scraping social media sites 
B)  Using the WHOIS lookup tool 
C)  Crawling the client's website 
D)  Phishing company employees 
E)  Utilizing DNS lookup tools
F) Conducting wardriving near the client facility

Question 8

A penetration tester was able to gain access successfully to a Windows workstation on a mobile client's laptop. Which of the following can be used to ensure the tester is able to maintain access to the system?

Accepted Answer

A)  schtasks /create /sc /ONSTART /tr C:\Temp\WindowsUpdate.exe 
B)  wmic startup get caption,command 
C)  crontab -l; echo "@reboot sleep 200 && ncat -lvp 4242 -e /bin/bash") | crontab 2>/dev/null 
D)  sudo useradd -ou 0 -g 0 user 
A)  schtasks /create /sc /ONSTART /tr C:\Temp\WindowsUpdate.exe 
B)  wmic startup get caption,command 
C)  crontab -l; echo "@reboot sleep 200 && ncat -lvp 4242 -e /bin/bash") | crontab 2>/dev/null 
D)  sudo useradd -ou 0 -g 0 user

Question 9

A penetration tester discovered a vulnerability that provides the ability to upload to a path via directory traversal. Some of the files that were discovered through this vulnerability are:   Which of the following is the BEST method to help an attacker gain internal access to the affected machine?

Accepted Answer

A)  Edit the discovered file with one line of code for remote callback 
B)  Download .pl files and look for usernames and passwords 
C)  Edit the smb.conf file and upload it to the server 
D)  Download the smb.conf file and look at configurations 
A)  Edit the discovered file with one line of code for remote callback 
B)  Download .pl files and look for usernames and passwords 
C)  Edit the smb.conf file and upload it to the server 
D)  Download the smb.conf file and look at configurations

Question 10

A penetration tester is exploring a client's website. The tester performs a curl command and obtains the following: * Connected to 10.2.11.144 (::1) port 80 (#0) > GET /readmine.html HTTP/1.1 > Host: 10.2.11.144 > User-Agent: curl/7.67.0 > Accept: */* > * Mark bundle as not supporting multiuse < HTTP/1.1 200 < Date: Tue, 02 Feb 2021 21:46:47 GMT < Server: Apache/2.4.41 (Debian) < Content-Length: 317 < Content-Type: text/html; charset=iso-8859-1 <

 <!DOCTYPE html >
 <html lang="en"> >
 <meta name="viewport" content="width=device-width" / > 
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" / >
 <title >WordPress › ReadMe</title>
 <link rel="stylesheet" href="wp-admin/css/install.css?ver=20100228" type="text/css" /> </head>

Which of the following tools would be BEST for the penetration tester to use to explore this site further?

Accepted Answer

A)  Burp Suite 
B)  DirBuster 
C)  WPScan 
D)  OWASP ZAP 
A)  Burp Suite 
B)  DirBuster 
C)  WPScan 
D)  OWASP ZAP

Question 11

A penetration tester has identified several newly released CVEs on a VoIP call manager. The scanning tool the tester used determined the possible presence of the CVEs based off the version number of the service. Which of the following methods would BEST support validation of the possible findings?

Accepted Answer

A)  Manually check the version number of the VoIP service against the CVE release 
B)  Test with proof-of-concept code from an exploit database 
C)  Review SIP traffic from an on-path position to look for indicators of compromise 
D)  Utilize an nmap -sV scan against the service Utilize an nmap -sV scan against the service 
A)  Manually check the version number of the VoIP service against the CVE release 
B)  Test with proof-of-concept code from an exploit database 
C)  Review SIP traffic from an on-path position to look for indicators of compromise 
D)  Utilize an nmap -sV scan against the service Utilize an nmap -sV scan against the service

Question 12

A new security firm is onboarding its first client. The client only allowed testing over the weekend and needed the results Monday morning. However, the assessment team was not able to access the environment as expected until Monday. Which of the following should the security company have acquired BEFORE the start of the assessment?

Accepted Answer

A)  A signed statement of work 
B)  The correct user accounts and associated passwords 
C)  The expected time frame of the assessment 
D)  The proper emergency contacts for the client 
A)  A signed statement of work 
B)  The correct user accounts and associated passwords 
C)  The expected time frame of the assessment 
D)  The proper emergency contacts for the client

Question 13

A penetration tester conducted a vulnerability scan against a client's critical servers and found the following:   Which of the following would be a recommendation for remediation?

Accepted Answer

A)  Deploy a user training program 
B)  Implement a patch management plan 
C)  Utilize the secure software development life cycle 
D)  Configure access controls on each of the servers 
A)  Deploy a user training program 
B)  Implement a patch management plan 
C)  Utilize the secure software development life cycle 
D)  Configure access controls on each of the servers

Question 14

A large client wants a penetration tester to scan for devices within its network that are Internet facing. The client is specifically looking for Cisco devices with no authentication requirements. Which of the following settings in Shodan would meet the client's requirements?

Accepted Answer

A)  "cisco-ios" "admin+1234" 
B)  "cisco-ios" "no-password" 
C)  "cisco-ios" "default-passwords" 
D)  "cisco-ios" "last-modified" 
A)  "cisco-ios" "admin+1234" 
B)  "cisco-ios" "no-password" 
C)  "cisco-ios" "default-passwords" 
D)  "cisco-ios" "last-modified"

Question 15

A penetration tester wants to identify CVEs that can be leveraged to gain execution on a Linux server that has an SSHD running. Which of the following would BEST support this task?

Accepted Answer

A)  Run nmap with the -o , -p22 , and -sC options set against the target Run nmap with the -o , -p22 , and -sC options set against the target 
B)  Run nmap with the -sV and -p22 options set against the target -sV and -p22 
C)  Run nmap with the --script vulners option set against the target --script vulners option set against the target 
D)  Run nmap with the -sA option set against the target -sA 
A)  Run nmap with the -o , -p22 , and -sC options set against the target Run nmap with the -o , -p22 , and -sC options set against the target 
B)  Run nmap with the -sV and -p22 options set against the target -sV and -p22 
C)  Run nmap with the --script vulners option set against the target --script vulners option set against the target 
D)  Run nmap with the -sA option set against the target -sA

Question 16

The results of an Nmap scan are as follows: Starting Nmap 7.80 ( https://nmap.org ) at 2021-01-24 01:10 EST Nmap scan report for ( 10.2.1.22 ) Host is up (0.0102s latency). Not shown: 998 filtered ports Port    State    Service 80/tcp  open     http |_http-title: 80F 22% RH 1009.1MB (text/html) |_http-slowloris-check: | VULNERABLE: | Slowloris DoS Attack |  Device type: bridge|general purpose Running (JUST GUESSING) : QEMU (95%) OS CPE: cpe:/a:qemu:qemu No exact OS matches found for host (test conditions non-ideal). OS detection performed. Please report any incorrect results at https://nmap.org/submit/. Nmap done: 1 IP address (1 host up) scanned in 107.45 seconds Which of the following device types will MOST likely have a similar response? (Choose two.)

Accepted Answer

A)  Network device 
B)  Public-facing web server 
C)  Active Directory domain controller 
D)  IoT/embedded device 
E)  Exposed RDP
F) Print queue 
A)  Network device 
B)  Public-facing web server 
C)  Active Directory domain controller 
D)  IoT/embedded device 
E)  Exposed RDP
F) Print queue

Question 17

A company conducted a simulated phishing attack by sending its employees emails that included a link to a site that mimicked the corporate SSO portal. Eighty percent of the employees who received the email clicked the link and provided their corporate credentials on the fake site. Which of the following recommendations would BEST address this situation?

Accepted Answer

A)  Implement a recurring cybersecurity awareness education program for all users. 
B)  Implement multifactor authentication on all corporate applications. 
C)  Restrict employees from web navigation by defining a list of unapproved sites in the corporate proxy. 
D)  Implement an email security gateway to block spam and malware from email communications. 
A)  Implement a recurring cybersecurity awareness education program for all users. 
B)  Implement multifactor authentication on all corporate applications. 
C)  Restrict employees from web navigation by defining a list of unapproved sites in the corporate proxy. 
D)  Implement an email security gateway to block spam and malware from email communications.

Question 18

Appending string values onto another string is called:

Accepted Answer

A)  compilation 
B)  connection 
C)  concatenation 
D)  conjunction 
A)  compilation 
B)  connection 
C)  concatenation 
D)  conjunction

Question 19

A tester who is performing a penetration test on a website receives the following output: Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in /var/www/search.php on line 62 Which of the following commands can be used to further attack the website?

Accepted Answer

A) B) ../../../../../../../../../../etc/passwd C) /var/www/html/index.php;whoami D) 1 UNION SELECT 1, DATABASE(),3-- A) B) ../../../../../../../../../../etc/passwd C) /var/www/html/index.php;whoami D) 1 UNION SELECT 1, DATABASE(),3--

Question 20

A penetration tester who is conducting a web-application test discovers a clickjacking vulnerability associated with a login page to financial data. Which of the following should the tester do with this information to make this a successful exploit?

Accepted Answer

A)  Perform XSS. 
B)  Conduct a watering-hole attack. 
C)  Use BeEF. 
D)  Use browser autopwn. 
A)  Perform XSS. 
B)  Conduct a watering-hole attack. 
C)  Use BeEF. 
D)  Use browser autopwn.

Which of the following BEST describe the OWASP Top 10? (Choose two.)

A company is concerned that its cloud service provider is not adequately protecting the VMs housing its software development. The VMs are housed in a datacenter with other companies sharing physical resources. Which of the following attack types is MOST concerning to the company?

Which of the following expressions in Python increase a variable val by one (Choose two.)

A penetration tester was conducting a penetration test and discovered the network traffic was no longer reaching the client's IP address. The tester later discovered the SOC had used sinkholing on the penetration tester's IP address. Which of the following BEST describes what happened?

A penetration tester wants to scan a target network without being detected by the client's IDS. Which of the following scans is MOST likely to avoid detection?

A penetration tester logs in as a user in the cloud environment of a company. Which of the following Pacu modules will enable the tester to determine the level of access of the existing user?

A penetration tester was able to gain access successfully to a Windows workstation on a mobile client's laptop. Which of the following can be used to ensure the tester is able to maintain access to the system?

A penetration tester discovered a vulnerability that provides the ability to upload to a path via directory traversal. Some of the files that were discovered through this vulnerability are: Which of the following is the BEST method to help an attacker gain internal access to the affected machine?

A penetration tester has identified several newly released CVEs on a VoIP call manager. The scanning tool the tester used determined the possible presence of the CVEs based off the version number of the service. Which of the following methods would BEST support validation of the possible findings?

A penetration tester conducted a vulnerability scan against a client's critical servers and found the following: Which of the following would be a recommendation for remediation?

A large client wants a penetration tester to scan for devices within its network that are Internet facing. The client is specifically looking for Cisco devices with no authentication requirements. Which of the following settings in Shodan would meet the client's requirements?

A penetration tester wants to identify CVEs that can be leveraged to gain execution on a Linux server that has an SSHD running. Which of the following would BEST support this task?

Appending string values onto another string is called:

A tester who is performing a penetration test on a website receives the following output: Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in /var/www/search.php on line 62 Which of the following commands can be used to further attack the website?

A penetration tester who is conducting a web-application test discovers a clickjacking vulnerability associated with a login page to financial data. Which of the following should the tester do with this information to make this a successful exploit?

CompTIA A+ Certification Exam: Core 1

CompTIA A+ Certification Exam: Core 2

CompTIA Advanced Security Practitioner (CASP+) CAS-003

CompTIA Advanced Security Practitioner (CASP+) CAS-004

CompTIA Cloud Essentials+

CompTIA CySA+ Certification Exam (CS0-002)

CompTIA Cloud+ (CV0-002)

CompTIA Cloud+

CompTIA IT Fundamentals

CompTIA Network+

CompTIA Project+

CompTIA PenTest+ Certification Exam

CompTIA Server+ Certification Exam

CompTIA Security+

CompTIA Security+ 2021

CompTIA CTT+ Essentials

CompTIA Linux+

Filters

Exam 13: CompTIA Server+

Which of the following BEST describe the OWASP Top 10? (Choose two.)

A company is concerned that its cloud service provider is not adequately protecting the VMs housing its software development. The VMs are housed in a datacenter with other companies sharing physical resources. Which of the following attack types is MOST concerning to the company?

Which of the following expressions in Python increase a variable val by one (Choose two.)

A penetration tester was conducting a penetration test and discovered the network traffic was no longer reaching the client's IP address. The tester later discovered the SOC had used sinkholing on the penetration tester's IP address. Which of the following BEST describes what happened?

A penetration tester wants to scan a target network without being detected by the client's IDS. Which of the following scans is MOST likely to avoid detection?

A penetration tester logs in as a user in the cloud environment of a company. Which of the following Pacu modules will enable the tester to determine the level of access of the existing user?

A penetration tester was able to gain access successfully to a Windows workstation on a mobile client's laptop. Which of the following can be used to ensure the tester is able to maintain access to the system?

A penetration tester discovered a vulnerability that provides the ability to upload to a path via directory traversal. Some of the files that were discovered through this vulnerability are: Which of the following is the BEST method to help an attacker gain internal access to the affected machine?

A penetration tester has identified several newly released CVEs on a VoIP call manager. The scanning tool the tester used determined the possible presence of the CVEs based off the version number of the service. Which of the following methods would BEST support validation of the possible findings?

A penetration tester conducted a vulnerability scan against a client's critical servers and found the following: Which of the following would be a recommendation for remediation?

A large client wants a penetration tester to scan for devices within its network that are Internet facing. The client is specifically looking for Cisco devices with no authentication requirements. Which of the following settings in Shodan would meet the client's requirements?

A penetration tester wants to identify CVEs that can be leveraged to gain execution on a Linux server that has an SSHD running. Which of the following would BEST support this task?

Appending string values onto another string is called:

A tester who is performing a penetration test on a website receives the following output: Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in /var/www/search.php on line 62 Which of the following commands can be used to further attack the website?

A penetration tester who is conducting a web-application test discovers a clickjacking vulnerability associated with a login page to financial data. Which of the following should the tester do with this information to make this a successful exploit?

CompTIA A+ Certification Exam: Core 1

CompTIA A+ Certification Exam: Core 2

CompTIA Advanced Security Practitioner (CASP+) CAS-003

CompTIA Advanced Security Practitioner (CASP+) CAS-004

CompTIA Cloud Essentials+

CompTIA CySA+ Certification Exam (CS0-002)

CompTIA Cloud+ (CV0-002)

CompTIA Cloud+

CompTIA IT Fundamentals

CompTIA Network+

CompTIA Project+

CompTIA PenTest+ Certification Exam

CompTIA Server+ Certification Exam

CompTIA Security+

CompTIA Security+ 2021

CompTIA CTT+ Essentials

CompTIA Linux+

Filters