While conducting a reconnaissance activity, a penetration tester extracts the following information:
Emails:
-
-
-
Which of the following risks should the tester use to leverage an attack as the next step in the security assessment?
A. Unauthorized access to the network
B. Exposure of sensitive servers to the internet
C. Likelihood of SQL injection attacks
D. Indication of a data breach in the company
Show Answer
Correct Answer: A
Explanation: Enumerated email addresses obtained during reconnaissance are commonly leveraged for phishing, password spraying, and other social engineering or credential-based attacks. These attack paths aim to gain initial or expanded access to internal systems, making unauthorized access to the network the most relevant risk. The other options are unrelated to email enumeration or require different evidence.
Question 92
A company hires a penetration tester to test the security implementation of its wireless networks. The main goal for this assessment is to intercept and get access to sensitive data from the company's employees. Which of the following tools should the security professional use to best accomplish this task?
A. Metasploit
B. WiFi-Pumpkin
C. SET
D. theHarvester
E. WiGLnet
Show Answer
Correct Answer: B
Explanation: The goal is to intercept and access sensitive data over wireless networks by targeting employees. WiFi-Pumpkin is specifically designed to create rogue access points and perform man-in-the-middle attacks on Wi‑Fi, enabling traffic interception and credential capture. The other options focus on exploitation frameworks, social engineering, OSINT, or Wi‑Fi mapping and are not suited for direct wireless traffic interception.
Question 93
A penetration tester completes a scan and sees the following output on a host:
Nmap scan report for victim (10.10.10.10)
Host is up (0.0001s latency)
PORT STATE SERVICE -
161/udp open|filtered snmp
445/tcp open microsoft-ds
3389/tcp open microsoft-ds
Running Microsoft Windows 7 -
OS CPE: cpe./o.microsoft.windows_7_sp0
The tester wants to obtain shell access. Which of the following related exploits should the tester try first?
A. exploit/windows/smb/psexec
B. exploit/windows/smb/ms08_067_netapi
C. exploit/windows/smb/ms17_010_eternalblue
D. auxillary/scanner/snmp/snmp_login
Show Answer
Correct Answer: C
Explanation: The host is identified as Windows 7 with SMB (445/tcp) exposed and no credentials mentioned. PsExec requires valid credentials, so it is not suitable for an initial compromise. MS08-067 targets much older Windows versions (2000/XP) and is not applicable to Windows 7. The SNMP module only performs credential enumeration and does not yield a shell. MS17-010 (EternalBlue) targets SMBv1 on unpatched Windows 7 systems and can provide unauthenticated remote code execution, making it the best first exploit to try.
Question 94
A penetration tester gains access to a chrooted environment and runs service --status-all on a target host. The tester reviews the following output:
[ + ] cron
[ + ] dhcp
[ - ] tomcat
[ - ] xserver
[ + ] ssh
The only other commands that the tester can execute are ps, nc, tcpdump, and crontab. Which of the following is the best method to maintain persistence?
A. Validate write access to crontab and add a reverse shell.
B. Capture credentials to use with tcpdump.
C. Scan the X11 server from the outside for unauthenticated connectivity.
D. Check access to the tomcat default manager page and use an LFI payload.
Show Answer
Correct Answer: A
Explanation: Cron is running and the crontab command is available inside the chroot, making scheduled tasks the most reliable persistence mechanism. If write access is possible, adding a cron job that executes a reverse shell maintains access even after reboots. The other options either rely on stopped services (Tomcat, X server) or do not provide persistence (packet capture).
Question 95
An external legal firm is conducting a penetration test of a large corporation. Which of the following would be most appropriate for the legal firm to use in the subject line of a weekly email update?
A. Privileged & Confidential Status Update
B. Action Required Status Update
C. Important Weekly Status Update
D. Urgent Status Update
Show Answer
Correct Answer: A
Explanation: A weekly penetration testing update from an external legal firm should emphasize confidentiality and legal privilege rather than urgency or required action. "Privileged & Confidential Status Update" appropriately signals that the contents are sensitive and protected, aligns with legal and consulting norms, and avoids creating unnecessary alarm. The other options either imply urgency, required action, or are too generic to convey the sensitive nature of the information.
Question 96
During an assessment, a penetration tester obtains an NTLM hash from a legacy Windows machine. Which of the following tools should the penetration tester use to continue the attack?
A. Responder
B. Hydra
C. BloodHound
D. CrackMapExec
Show Answer
Correct Answer: D
Explanation: After obtaining an NTLM hash, the next step is to leverage it for authentication and lateral movement (pass-the-hash). CrackMapExec is designed for this purpose, allowing authentication with NTLM hashes, command execution, and pivoting across Windows networks. The other tools either capture hashes, brute-force passwords, or analyze AD relationships rather than using NTLM hashes directly.
Question 97
During a penetration test, a tester compromises a Windows computer. The tester executes the following command and receives the following output:
mimikatz # privilege::debug
mimikatz # lsadump::cache
-Output---
lapsUser
27dh9128361tsg264592101387541j
--OutputEnd--
Which of the following best describes what the tester plans to do by executing the command?
A. The tester plans to perform the first step to execute a Golden Ticket attack to compromise the Active Directory domain.
B. The tester plans to collect application passwords or hashes to compromise confidential information within the local computer.
C. The tester plans to use the hash collected to perform lateral movement to other computers using a local administrator hash.
D. The tester plans to collect the ticket information from the user to perform a Kerberoasting attack on the domain controller.
Show Answer
Correct Answer: C
Explanation: The Mimikatz commands `privilege::debug` and `lsadump::cache` are used to dump cached credentials (LSA cached logon data), which can include password hashes such as those for local or domain accounts that have logged on to the system. An attacker or tester typically uses these hashes for pass-the-hash attacks to move laterally to other systems where the same local administrator credentials are reused. The command is not related to Golden Ticket attacks, Kerberoasting, or generic application password collection.
Question 98
A penetration tester wants to check the security awareness of specific workers in the company with targeted attacks. Which of the following attacks should the penetration tester perform?
A. Phishing
B. Tailgating
C. Whailing
D. Spear phising
Show Answer
Correct Answer: D
Explanation: The goal is to test security awareness of specific workers using targeted attacks. Spear phishing is explicitly designed for this purpose, as it involves customized, targeted messages aimed at particular individuals. Standard phishing is broad and generic, whaling is limited to high-level executives only, and tailgating is a physical attack rather than an online awareness test.
Question 99
Which of the following are valid reasons for including base, temporal, and environmental CVSS metrics in the findings section of a penetration testing report? (Choose two.)
A. Providing details on how to remediate vulnerabilities
B. Helping to prioritize remediation based on threat context
C. Including links to the proof-of-concept exploit itself
D. Providing information on attack complexity and vector
E. Prioritizing compliance information needed for an audit
F. Adding risk levels to each asset
Show Answer
Correct Answer: B, D
Explanation: Including base, temporal, and environmental CVSS metrics helps readers understand both how severe and how exploitable a vulnerability is and how that risk changes based on real-world context. Temporal and environmental metrics adjust severity based on exploit availability and asset criticality, which supports prioritizing remediation based on threat context (B). Base metrics such as Attack Vector and Attack Complexity explain how an attack is carried out and how difficult exploitation is, providing clear information on attack complexity and vector (D).
Question 100
During an engagement, a penetration tester runs the following command against the host system:
host -t axfr domain.com dnsl.domain.com
Which of the following techniques best describes what the tester is doing?
A. Zone transfer
B. Host enumeration
C. DNS poisoning
D. DNS query
Show Answer
Correct Answer: A
Explanation: The command uses the AXFR record type, which is specifically for DNS zone transfers. It attempts to retrieve the entire DNS zone from the specified DNS server, revealing all records in the domain. This is not generic querying, host enumeration, or DNS poisoning.
$19
Get all 220 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.