A tester compromises a target host and then wants to maintain persistent access. Which of the following is the best way for the attacker to accomplish the objective?
A. Configure and register a service
B. Install and run remote desktop software
C. Set up a script to be run when users log in.
D. Perform a kerberoasting attack on the host
Show Answer
Correct Answer: A
Explanation: Configuring and registering a service is a well-established persistence technique. Services can be configured to start automatically at boot, do not depend on a user logging in, and often run with elevated privileges, making them a reliable method for maintaining long-term access. Running remote desktop software is not inherently persistent or stealthy, a logon script only executes when a user logs in, and kerberoasting is a credential attack rather than a persistence mechanism.
Question 112
During an engagement, a penetration tester receives a list of target systems and wants to enumerate them for possible vulnerabilities. The tester finds the following script on the internet:
After running the script, the tester runs the following command:
Which of the following should the tester do next?
A. Replace line 4 with the following: api = "/api/v2/getToken/data/id/None"
B. Insert the following line before line 6 target = target.split(" ")[0]
C. Insert the following line before line 7: url = url.lstrip('http://')
D. Replace line 7 with the following response = requests.posts(url, api)
Show Answer
Correct Answer: B
Explanation: The most likely issue is that each input line contains additional data (such as a label or description) alongside the target URL. Splitting the line on a space and keeping only the first element extracts the actual URL before constructing and sending the request. The other options either introduce incorrect API changes, manipulate the URL inappropriately, or use an invalid requests method (`posts` instead of `post`).
Question 113
A penetration tester gains initial access to a system and gets ready to perform additional reconnaissance. The tester cannot use Nmap on the system they used to gain initial access. The tester develops the following script to scan a network range:
The tester wants to modify the current script so multiple ports can be scanned. The tester enters a comma-separated list of ports in the port variable. Which of the following should the tester do next to provide the desired functionality?
A. Duplicate the $socket code block and modify $port for each new port variable.
B. Add a new Foreach loop directly beneath the other Foreach loop and enclose with {...}.
C. Add $p in $port to the initial Foreach loop directly following the $range variable.
D. Add $(Each ($p in $port) on the line before $socket and enclose with {....}.
Show Answer
Correct Answer: B
Explanation: The script already iterates over the target IP range. To scan multiple ports supplied as a comma-separated list, it needs a nested Foreach loop that iterates through each port for every IP address, with the socket creation and connection logic inside that inner loop. This provides an IP × port iteration without duplicating code.
Question 114
A penetration tester identifies an exposed corporate directory containing first and last names and phone numbers for employees. Which of the following attack techniques would be the most effective to pursue if the penetration tester wants to compromise user accounts?
A. Smishing
B. Impersonation
C. Tailgating
D. Whaling
Show Answer
Correct Answer: A
Explanation: Smishing is the most effective choice because the exposed directory provides employees' names and phone numbers, enabling targeted SMS phishing messages that can trick users into revealing credentials or visiting credential-harvesting sites. Impersonation is a broader tactic rather than the best-matched attack vector here, tailgating targets physical access, and whaling focuses on high-profile executives rather than general user accounts.
Question 115
HOTSPOT
-
A penetration tester is performing an assessment for an application that allows users to follow other individuals, if those individuals accept.
The request is performed from a newly created account that is not actively following or being followed by any other users and is targeting a private user profile.
INSTRUCTIONS
-
Use the drop-down menus to select the most appropriate code segment for each of the first two lines in the API request.
Then identify the issue within the response and select the appropriate remediation to resolve the vulnerability.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Show Answer
Correct Answer: GET
api.example.com
Issue: Private profile information is publicly accessible.
Remediation: Enforce authorization for private profiles.
Explanation: The endpoint retrieves user profile details, so GET to the API host is appropriate. The response exposes details despite "is_profile_private": true and no follower relationship, indicating missing authorization checks on private profiles.
Question 116
During a wireless penetration assessment for a small business client, a tester attempts to capture wireless packets. However, whenever the tester sets the capture device to monitor mode, it fails to see the client's wireless network, as provided by the scope. Which of the following is the most likely reason for this issue?
A. The clients network uses 6GHz and not 5GHz/2.4GHz
B. The tester misconfigured the capture device
C. The client provided the wrong SSID for the network
D. The tester is not using Aircrack-ng
Show Answer
Correct Answer: A
Explanation: The most likely cause is that the target WLAN operates exclusively on the 6 GHz band (Wi-Fi 6E) while the tester's capture adapter supports monitor mode only for 2.4/5 GHz. In that case, monitor mode can be enabled successfully, but the network will not appear because the hardware cannot receive that band. The other options are less likely: misconfiguration is possible but not the best explanation, an incorrect SSID would not prevent seeing nearby beacon frames, and Aircrack-ng is not required to detect networks in monitor mode.
Question 117
A penetration tester downloads a JAR file that is used in an organization’s production environment. The tester evaluates the contents of the JAR file to identify potentially vulnerable components that can be targeted for exploit. Which of the following describes the tester's activities?
A. SAST
B. SBOM
C. ICS
D. SCA
Show Answer
Correct Answer: D
Explanation: Software Composition Analysis (SCA) examines packaged applications such as JAR files to identify included third-party/open-source components and their versions, then checks them against known vulnerability databases. SAST analyzes source code, SBOM is an inventory of components rather than the analysis activity, and ICS refers to industrial control systems.
Question 118
A penetration tester gains access to the target network and observes a running SSH server. Which of the following techniques should the penetration tester use to obtain the version of SSH running on the target server?
A. Network sniffing
B. IP scanning
C. Banner grabbing
D. DNS enumeration
Show Answer
Correct Answer: C
Explanation: Banner grabbing involves connecting to the SSH service and reading the server's identification string/banner, which typically discloses the SSH protocol and server software version (for example, OpenSSH_x.y). Network sniffing captures traffic, IP scanning identifies hosts or open ports, and DNS enumeration retrieves DNS-related information rather than service versions.
Question 119
A penetration tester successfully phishes a user and compromises a domain-joined endpoint. The tester enumerates the domain controller and discovers that Group Policy Preferences are in use. The tester also finds that the version of the domain controllers is Windows Server 2012. The tester wants to use the fastest possible method of pivoting successfully to multiple production servers joined to the domain. Which of the following is the best way to achieve this goal?
A. Scan the domain controller and locate an RCE using a Metasploit module with a reverse shell
B. Run Hydra to password spray any dumped credentials from the initial host across subnets
C. Use BloodHound to look for escalation paths against the AD environment
D. Find the SYSVOL share for hashes with findstr /i and decrypt using the published key
Show Answer
Correct Answer: D
Explanation: Group Policy Preferences on older Active Directory environments may leave cpassword values in XML files under the SYSVOL share. The cpassword can be decrypted because the AES key is publicly known, allowing rapid recovery of credentials that are often reused for local administrator or service accounts. This provides a fast path to lateral movement across multiple domain-joined production servers. The other options are slower, less reliable, or depend on additional vulnerabilities or attack paths.
Question 120
A penetration tester gains low-privilege shell access to a host and discovers a world-writable script that is run regularly as root. The tester runs the following command:
openssl passwd password
$l$OjxLvZ85$Fdr51vn/Z4zXWsQR/Xrj .
The tester then adds the following line to the world-writable script
echo 'root2:$l$OjxLvZ85$Fdr51vn/Z4zXWsQR/Xrj1001:1001:,,,: /root:/bin/bash" >> /etc/passwd
Which of the following should the penetration tester do to enable this exploit to work correctly?
A. Use only a single redirect to /etc/password.
B. Generate the password using md5sum.
C. Log in to the host using SSH
D. Change the 1001 entries to 0.
Show Answer
Correct Answer: D
Explanation: The exploit aims to create a new account with root-equivalent privileges by appending an entry to the system account file. In a traditional passwd entry, the third and fourth fields are the UID and GID. Using 1001:1001 creates an unprivileged user, whereas UID 0 (and typically GID 0) grants root-equivalent privileges. Therefore, changing the 1001 values to 0 is required for the privilege-escalation attempt to work as intended.
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
