Question 1

A penetration tester performs a service enumeration process and receives the following result after scanning a server using the Nmap tool:PORT STATE SERVICE22/tcp open ssh25/tcp filtered smtp111/tcp open rpcbind2049/tcp open nfsBased on the output, which of the following services provides the best target for launching an attack?

A. Database
B. Remote access
C. Email
D. File sharing

Show Answer

Question 2

During a wireless penetration assessment for a small business client, a tester attempts to capture wireless packets. However, whenever the tester sets the capture device to monitor mode, it fails to see the client's wireless network, as provided by the scope. Which of the following is the most likely reason for this issue?

A. The client's network uses 6GHz and not 5GHz/2.4GHz.
B. The tester misconfigured the capture device.
C. The client provided the wrong SSID for the network.
D. The tester is not using Aircrack-ng.

Show Answer

Question 3

A company hires a penetration tester to test the security of its wireless networks. The main goal is to intercept and access sensitive data.Which of the following tools should the security professional use to best accomplish this task?

A. Metasploit
B. WiFi-Pumpkin
C. SET
D. theHarvester
E. WiGLE.net

Show Answer

Question 4

During an assessment, a penetration tester plans to gather metadata from various online files, including pictures. Which of the following standards outlines the formats for pictures, audio, and additional tags that facilitate this type of reconnaissance?

A. EXIF
B. GIF
C. COFF
D. ELF

Show Answer

Question 5

A penetration tester discovers exposed cloud storage buckets and needs to access the contents. Which of the following should the tester do?

A. Protocol fingerprinting
B. Credential brute forcing
C. Service discovery
D. Secrets enumeration

Show Answer

Question 6

A client recently hired a penetration testing firm to conduct an assessment of their consumer-facing web application. Several days into the assessment, the client’s networking team observes a substantial increase in DNS traffic. Which of the following would most likely explain the increase in DNS traffic?

A. Covert data exfiltration
B. URL spidering
C. HTML scraping
D. DoS attack

Show Answer

Question 7

During an assessment, a penetration tester gains a low-privilege shell and then runs the following command:findstr /SIM /C:"pass" *.txt *.cfg *.xmlWhich of the following is the penetration tester trying to enumerate?

A. Configuration files
B. Permissions
C. Virtual hosts
D. Secrets

Show Answer

Question 8

A penetration tester discovers data to stage and exfiltrate. The client has authorized movement to the tester's attacking hosts only. Which of the following would be most appropriate to avoid alerting the SOC?

A. Apply UTF-8 to the data and send over a tunnel to TCP port 25.
B. Apply Base64 to the data and send over a tunnel to TCP port 80.
C. Apply 3DES to the data and send over a tunnel UDP port 53.
D. Apply AES-256 to the data and send over a tunnel to TCP port 443.

Show Answer

Question 9

A penetration tester enumerates a legacy Windows host on the same subnet. The tester needs to select exploit methods that will have the least impact on the host's operating stability. Which of the following commands should the tester try first?

A. responder -I eth0 john responder_output.txt <rdp to target>
B. hydra -L administrator -P /path/to/pwlist.txt -t 100 rdp://<target_host>
C. msf > use <module_name> msf > set <options> msf > set PAYLOADwindows/meterpreter/reverse_tcp msf > run
D. python3 ./buffer_overflow_with_shellcode.py <target> 445

Show Answer

Question 10

A penetration tester wants to check the security awareness of specific workers in the company with targeted attacks. Which of the following attacks should the penetration tester perform?

A. Phishing
B. Tailgating
C. Whaling
D. Spear phishing

Show Answer