A penetration tester tries to perform an active reconnaissance on a client's IP with Nmap and receives the following results:
Which of the following is the best port for the penetration tester to investigate further without valid credentials?
A. 22
B. 80
C. 123
D. 6000
Show Answer
Correct Answer: B
Explanation: Port 80 (HTTP) is typically accessible without authentication and commonly exposes web applications that can be enumerated and tested during active reconnaissance. Port 22 (SSH) generally requires credentials, port 123 (NTP) has a narrower attack surface, and port 6000 (X11) is uncommon and often filtered or requires specific configurations.
Question 102
A penetration tester exports the following CSV data from a scanner. The tester wants to parse the data using Bash and input it into another tool.
Which of the following will provide the intended output?
A. cat data.csv | grep -v "IP" | cut -d"," -f 3,4 | sed -e 's/,//'
Explanation: Option A skips the CSV header with grep -v "IP", selects the third and fourth comma-separated fields (Username and Password) using cut, and removes the separating comma with sed to produce the desired concatenated output. The other options either misuse commands or perform unrelated filtering.
Question 103
A penetration tester wants to automatically enumerate all ciphers permitted on TLS/SSL configurations across a client's internet-facing and internal web servers. Which of the following tools or frameworks best supports this objective?
A. Nmap Scripting Engine
B. Shodan
C. Impacket
D. Netcat
E. Burp Suite
Show Answer
Correct Answer: A
Explanation: Nmap Scripting Engine (NSE) includes the ssl-enum-ciphers script, which automatically enumerates supported SSL/TLS protocols and cipher suites across many hosts. It is well suited for scalable assessment of internet-facing and internal web servers. Shodan is a search engine for exposed services, Impacket focuses on network protocol interactions, Netcat is a general networking utility, and Burp Suite is primarily a web application testing proxy rather than a fleet-wide cipher enumeration tool.
Question 104
A penetration tester accesses and enumerates a host and then runs the following commands:
$ runlevel
$ ls -l /etc/rc5.d
$ vi /etc/rc5.d/S01ssh.dd
Which of the following is the tester most likely attempting to do?
A. Find credentials within the SSH daemon
B. Establish persistence on the host
C. Add a key to the host for SSH.
D. Harvest users' private keys.
Show Answer
Correct Answer: B
Explanation: The commands inspect the current runlevel, list the startup scripts for runlevel 5, and then edit a startup script in /etc/rc5.d. Modifying init startup scripts is a classic persistence technique because the code will execute automatically when the system enters that runlevel. The other options involve SSH credentials or keys, which are not indicated by these commands.
Question 105
A penetration tester obtains network-level access to a hardened subnet that has no Windows-based hosts and needs to find credentials. The client mentioned that the SOC is only monitoring user endpoints and not servers. Which of the following commands should the tester use?
A. pwinspector -i -o -m 8 -M 16 -1 -u -n -p
B. responder -I eth0
C. nmap -sV -n -T3 -p 22 --reason
D. hydra -L root -P /path/to/wordlist -t 3 -M
Show Answer
Correct Answer: D
Explanation: Hydra is the appropriate choice because the environment has no Windows hosts, making Responder ineffective for LLMNR/NBT-NS poisoning. The objective is to obtain credentials from a hardened, server-focused subnet where server activity is not being monitored, making an online password attack against services such as SSH the most suitable option. The other options generate passwords (pwinspector), perform service enumeration (nmap), or target Windows name resolution behavior (Responder).
Question 106
A penetration tester needs to quickly transfer an exploit from a Linux system to a Windows 10 system within the network. Which of the following is the best way to accomplish this task?
A. nc -lvp 8080
B. nc -lnvp 443
C. python3 -m http.server 80
D. neat -lvp 8080
Show Answer
Correct Answer: C
Explanation: The quickest and most straightforward method is to start a simple HTTP server on the Linux host with `python3 -m http.server 80`, allowing the Windows 10 system to download the exploit using a browser, PowerShell (`Invoke-WebRequest`), or `curl`. The `nc` listener options create raw TCP listeners rather than an easy file-hosting service, and `neat` is not the appropriate command.
Question 107
A penetration tester gained a foothold within a network. The penetration tester needs to enumerate all users within the domain. Which of the following is the best way to accomplish this task?
A. pwd.exe
B. net.exe
C. sc.ехе
D. msconfig.exe
Show Answer
Correct Answer: B
Explanation: The correct choice is net.exe. In a Windows domain, the built-in net utility can enumerate domain users using commands such as 'net user /domain'. The other options do not enumerate domain user accounts: pwd.exe displays the current directory (or is not a standard Windows enumeration tool), sc.exe manages/services, and msconfig.exe is a system configuration utility.
Question 108
A company's incident response team determines that a breach occurred because a penetration tester left a web shell. Which of the following should the penetration tester have done after the engagement?
A. Enable a host-based firewall on the machine
B. Remove utilized persistence mechanisms on client systems
C. Revert configuration changes made during the engagement
D. Turn off command-and-control infrastructure
Show Answer
Correct Answer: B
Explanation: A web shell is a persistence mechanism left on a target system. After a penetration test, the tester should remove any persistence mechanisms and artifacts they deployed to restore the environment and prevent unintended access. While reverting configuration changes is also good practice, the specific cause of the breach was the leftover web shell, making removal of persistence mechanisms the best answer.
Question 109
Which of the following differentiates MITRE ATT&CK from PTES?
A. MITRE ATT&CK emphasizes real-world adversary behavior patterns, while PTES outlines structured test phases
B. MITRE ATT&CK defines risk scoring models for vulnerabilities, while PTES focuses on defensive controls.
C. MITRE ATT&CK organizes asset inventories, while PTES provides data breach response procedures
D. MITRE ATT&CK provides detailed exploit code samples, while PTES focuses on threat actor profiles
Show Answer
Correct Answer: A
Explanation: MITRE ATT&CK is a knowledge base that catalogs real-world adversary tactics, techniques, and procedures (TTPs) based on observed behavior. PTES (Penetration Testing Execution Standard) defines a structured methodology and phases for conducting penetration tests, from pre-engagement through reporting. The other options incorrectly describe the purpose of either framework.
Question 110
After obtaining a reverse shell, a penetration tester identifies a locally cloned Git repository that contains thousands of files and directories on a Windows machine. The tester suspects there could be sensitive information related to "ProjectX." Which of the following commands should the tester use in a script to identify potential files to produce the best results?
A. gc * | select "ProjectX"
B. dir /R | findstr "ProjectX"
C. Get-ChildItem * | Select-String "ProjectX"
D. gci -Path . -Recurse | Select-String -Pattern "ProjectX"
Show Answer
Correct Answer: D
Explanation: The goal is to search a large directory tree recursively for occurrences of the string "ProjectX." `gci -Path . -Recurse` (alias for `Get-ChildItem`) enumerates files and directories under the current path recursively, and piping to `Select-String -Pattern "ProjectX"` searches file contents for the pattern. The other options are either non-recursive, search directory listings or alternate data streams rather than contents, or misuse cmdlets for this task.
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.