Which of the following would most likely reduce the possibility of a client rejecting the final deliverable for a penetration test?
A. Goal reprioritization
B. Stakeholder alignment
C. Non-disclosure agreement
D. Business impact analysis
Show Answer
Correct Answer: B
Explanation: Stakeholder alignment during planning and scoping ensures agreement on objectives, scope, rules of engagement, deliverables, and acceptance criteria. Clear shared expectations are the most effective way to reduce the likelihood that a client will reject the final penetration test deliverable.
Question 92
A penetration tester is evaluating a company's cybersecurity preparedness. The tester wants to acquire valid credentials using a social engineering campaign. Which of the following tools and techniques are most applicable in this scenario? (Choose two.)
A. TruffleHog for collecting credentials
B. Shodan for identifying potential targets
C. Gophish for sending phishing emails
D. Maltego for organizing targets
E. theHarvester for discovering additional targets
F. Evilginx for handling legitimate authentication requests through a proxy
Show Answer
Correct Answer: C, F
Explanation: Gophish is purpose-built for running phishing campaigns as part of authorized social engineering assessments, making it appropriate for credential harvesting exercises. Evilginx is an adversary-in-the-middle reverse proxy that relays legitimate authentication requests and can capture credentials and authenticated session tokens during authorized testing. The other tools are primarily for reconnaissance, OSINT, or secret discovery rather than directly conducting a credential-focused social engineering campaign.
Question 93
A penetration tester observes an employee logging in to their laptop. The penetration tester wants to gain access to information with the least intervention. Which of the following actions should the penetration tester take?
A. Send a smishing message.
B. Utilize a USB hardware keylogger.
C. Send a phishing email to the employee.
D. Engage in shoulder surfing.
Show Answer
Correct Answer: D
Explanation: Shoulder surfing is the least intrusive option because the tester is already observing the employee logging in. It requires no interaction with the target, no installation of hardware, and no delivery of phishing or smishing messages. Simply observing the credentials as they are entered can provide access with the least intervention.
Question 94
A penetration tester must gain entry to a client's office building without raising attention. Which of the following should be the tester's first step?
A. Interacting with security employees to clone a badge
B. Trying to enter the back door after hours on a weekend
C. Collecting building blueprints to run a site survey
D. Conducting surveillance of the office to understand foot traffic
Show Answer
Correct Answer: D
Explanation: The first step in a physical penetration test aimed at entering a building without attracting attention is reconnaissance. Observing the location and understanding employee movement, guard routines, entry points, and foot traffic allows the tester to choose the safest and least conspicuous approach before attempting access. The other options involve active intrusion or preparation that comes after initial surveillance.
Question 95
Which of the following components of a penetration test report most directly contributes to prioritizing remediations?
A. Proof of concept
B. Risk scoring
C. Attack narrative
D. Executive summary
Show Answer
Correct Answer: B
Explanation: Risk scoring most directly supports remediation prioritization by ranking findings based on severity, likelihood of exploitation, and business impact, allowing organizations to address the highest-risk vulnerabilities first. Proof of concept demonstrates exploitability, the attack narrative describes the engagement, and the executive summary provides a high-level overview but does not directly prioritize fixes.
Question 96
A penetration tester performs the following scan:
The tester then manually uses snmpwalk against port 161 and receives valid SNMP responses. Which of the following best explains the scan result for port 161?
A. The SNMP daemon delayed its response beyond Nmap's UDP scan timeout.
B. Nmap marked the port as open|filtered because no response was received.
C. The scanned host applied rate limiting to its responses to prevent UDP fingerprinting.
D. The Nmap scan lacked root privileges, which reduced packet inspection accuracy.
Show Answer
Correct Answer: B
Explanation: In an Nmap UDP scan, if no UDP response and no ICMP Port Unreachable message is received, Nmap reports the port as open|filtered because it cannot distinguish between an open service that silently ignores the probe and packet filtering. SNMP can still be reachable with a valid SNMP request, as demonstrated by snmpwalk receiving valid responses.
Question 97
A tester obtains access to an application server via a Java vulnerability and must maintain persistence. The server has a file integrity monitoring control enabled, and the tester cannot disable it. Which of the following actions should the tester take to establish persistence?
A. Deploy a rootkit.
B. Drop a beacon.
C. Start a web shell.
D. Schedule a task.
Show Answer
Correct Answer: D
Explanation: A scheduled task provides persistence by leveraging operating system scheduling mechanisms rather than modifying monitored application files. A web shell or beacon typically requires placing or altering files that file integrity monitoring can detect, and a rootkit is unnecessarily intrusive and not the best fit for this scenario.
Question 98
During a penetration test, the tester wants to obtain public information that could be used to compromise the organization's cloud infrastructure. Which of the following is the most effective resource for the tester to use for this purpose?
A. Sensitive documents on a public cloud
B. Open ports on the cloud infrastructure
C. Repositories with secret keys
D. SSL certificates on websites
Show Answer
Correct Answer: C
Explanation: Repositories that publicly expose secret keys, API tokens, or cloud credentials are one of the most effective OSINT sources for compromising cloud infrastructure because they can provide direct authenticated access. Public documents, open ports, and SSL certificates may reveal useful information, but exposed credentials have the highest immediate impact.
Question 99
A penetration tester poses as a member of a company's human resources department. The tester wants to obtain credentials by sending an email containing a link that redirects to a fake website. Which of the following commands is the best way to determine whether the email is flagged as malicious?
A. Resolve-DnsName -Name company.com -Type A
B. dig axfr company.com @spf.company.com
C. nslookup -q=txt _dmarc.company.com
D. dig MX company.com
Show Answer
Correct Answer: C
Explanation: DMARC is published as a TXT record at _dmarc.<domain> and specifies how receiving mail systems should handle messages that fail SPF/DKIM alignment (none, quarantine, reject). Querying the DMARC TXT record is the best way to determine whether a phishing email is likely to be flagged or rejected. The other commands retrieve A, MX, or attempt a zone transfer, which do not answer this question.
Question 100
A penetration tester conducts a scan on an exposed Linux web server and gathers the following data:
Additional notes:
• Directory listing enabled on /admin
• Apache mod_cgi enabled
• No authentication required to access /cgi-bin/debug.sh
• X-Powered-By: PHP/5.6.40-0+deb8u12
Which of the following is the most effective action to take?
A. Launch a payload using msfvenom and upload it to the /admin directory.
B. Review the contents of /cgi-bin/debug.sh.
C. Use NFS client tools against exposed rpcbind.
D. Attempt a brute-force attack against OpenSSH 7.2p2.
Show Answer
Correct Answer: B
Explanation: The exposed, unauthenticated CGI script is the highest-value finding because CGI programs can execute server-side code and misconfigurations or insecure scripts may allow command execution or disclose sensitive information. Reviewing the contents or behavior of /cgi-bin/debug.sh is the most effective next action. The other options are either premature (uploading a payload), depend on services not indicated as exposed (NFS/rpcbind), or are lower-value and potentially noisy (SSH brute force).
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.