Question 1

During an assessment, a penetration tester compromises some machines but finds that none of the accounts have sufficient access to the target HR database server. In order to enumerate accounts with sufficient permissions, the tester wants to model an attack path before taking further action. Which of the following tools should the tester use to meet this objective? 

A.Responder
B.Mimikatz
C.Hydra
D.BloodHound
E.TruffleHog

Question 2

A penetration tester needs to collect information transmitted over the network for further steps in an internal assessment. Which of the following would most likely accomplish this goal? 

A. ntlmrelayx.py -t 192.168.1.0 -1 1234
B. nc -tulpn 1234 192.168.1.2
C. responder.py -I eth0 -wP
D. crackmapexec smb 192.168.1.0 -u "user" -p "pass123"

Question 3

A penetration tester completed a report for a new client. Prior to sharing the report with the client, which of the following should the penetration tester request to complete a review?

A.A generative AI assistant
B.The customer's designated contact
C.A cybersecurity industry peer
D.A team member

Question 4

A company hires a penetration tester to test the security implementation of its wireless networks. The main goal for this assessment is to intercept and get access to sensitive data from the company's employees. Which of the following tools should the security professional use to best accomplish this task? 

A.Metasploit
B.WiFi-Pumpkin
C.SET
D.theHarvester
E.WiGLE.net

Question 5

A penetration tester writes the following script to enumerate a network:1#!/bin/bash2for i in {1..254}3ping -c1 192.168.1.$i4doneThe tester executes the script, but it fails with the following error:-bash: syntax error near unexpected token 'ping'Which of the following should the tester do to fix the error?

A. Add do after line 2
B. Replace {1..254} with $(seq 1 254)
C. Replace bash with zsh
D. Replace $i with ${i}

Question 6

During an assessment, a penetration tester runs the following command from a Linux machine: GetUsersSPNs.py -dc-ip 172.16.1.1 DOMAIN.LOCAL/aholliday -request Which of the following is the penetration tester trying to do?

A.Crack the user password for aholliday
B.Download all TGS tickets for offline processing
C.Perform a pass-the-hash attack using the hash for aholliday
D.Perform password spraying

Question 7

During an assessment, a penetration tester obtains access to a Microsoft SQL server using sqlmapand runs the following command:sql> xp_cmdshell whoami /allWhich of the following is the tester trying to do?

A.List database tables
B.Show logged-in database users
C.Enumerate privileges
D.Display available SQL commands

Question 8

A penetration tester enters an invalid user ID on the login page of a web application. The tester receives a message indicating the user is not found. Then, the tester tries a valid user ID but an incorrect password, but the web application indicates the password is invalid. Which of the following should the tester attempt next? 

A.Error log analysis
B.DoS attack
C.Enumeration
D.Password dictionary attack

Question 9

During a pre-engagement activity with a new customer, a penetration tester looks for assets to test. Which of the following is an example of a target that can be used for testing?

A.API
B.HTTP
C.IPA
D.ICMP

Question 10

A tester needs to begin capturing WLAN credentials for cracking during an on-site engagement. Which of the following is the best command to capture handshakes? 

A.tcpdump -n -s0 -w <pcapname> -i <iface>
B.airserv-ng -d <iface>
C.aireplay-ng -0 1000 -a <target_mac>
D.airodump-ng -c 6 --bssid <target_mac> <iface>