A penetration tester obtains local administrator access on a Windows system and wants to attempt lateral movement. The system exists within a Windows Workgroup environment. Which of the following actions should the tester take?
A. Create a malicious certificate.
B. Dump credentials from memory.
C. Craft Kerberos tickets.
D. List potential privilege escalation paths.
Show Answer
Correct Answer: B
Explanation: In a Windows Workgroup there is no Active Directory domain or Kerberos infrastructure, so crafting Kerberos tickets is not applicable. With local administrator access, dumping credentials from memory (e.g., cached plaintext credentials or NTLM hashes) can provide reusable credentials for lateral movement to other systems, especially where local administrator passwords are reused. Creating a malicious certificate is unrelated here, and listing privilege escalation paths is unnecessary since local administrator access has already been obtained.
Question 83
A penetration tester would like to collect permission details for objects within the domain. The tester has a valid AD user and access to an internal PC. Which of the following sets of steps is the best way for the tester to accomplish the desired outcome?
A. 1. Escalate privileges. 2. Execute Rubeus. 3. Run a Cypher query on Rubeus to get the results.
B. 1. Run SharpHound. 2. Install CrackMapExec. 3. Perform a CrackMapExec database query on CME to get the results.
C. 1. Run SharpHound 2. Install BloodHound. 3. Perform a Cypher query on BloodHound to get the results.
D. 1. Escalate privileges. 2. Get Windows Registry data. 3. Perform a query to get results.
Show Answer
Correct Answer: C
Explanation: SharpHound is the data collection component that gathers Active Directory objects, relationships, and ACL/permission information using a valid domain user. BloodHound ingests the collected data and uses Cypher queries to analyze and retrieve permission paths and object relationships. Rubeus focuses on Kerberos operations, CrackMapExec is not the primary tool for this graph analysis workflow, and privilege escalation is not required simply to enumerate AD permissions available to the authenticated user.
Question 84
A penetration tester attempts to access a domain-joined Windows file server that requires authentication for access. Which of the following will most likely assist in gaining access?
A. Intercept proxy chains with tcpdump.
B. Create a reverse shell payload with msfvenom.
C. Generate a silver ticket with Impacket.
D. Conduct a relay attack using Responder.
Show Answer
Correct Answer: D
Explanation: A relay attack using Responder can capture and relay NTLM authentication attempts to a target service, potentially allowing authenticated access to a domain-joined file server if protections such as SMB signing are not enforced. A silver ticket requires prior compromise of the service account key, so it is not the most likely initial access method. Tcpdump proxy chains are unrelated, and msfvenom reverse shells do not solve the authentication requirement.
Question 85
An internal penetration tester is on site assessing network access for company-owned mobile devices. Which of the following would be the best tool to identify the available networks?
A. Wireshark
B. theHarvester
C. Recon-ng
D. WiGLE.net
Show Answer
Correct Answer: D
Explanation: WiGLE.net is specifically designed to discover, map, and identify wireless networks and access points, making it the best choice for identifying available networks during an on-site assessment of company-owned mobile devices. Wireshark captures and analyzes traffic rather than discovering nearby wireless networks, while theHarvester and Recon-ng are OSINT reconnaissance tools, not wireless network discovery tools.
Question 86
During a web application assessment, a penetration tester accesses the site unauthenticated and receives the following Set-Cookie on the first response:
auth=yYKGORbrpabgr842ajbvrpbptaui42342
When the tester logs in, the server sends only one Set-Cookie header, and the value is exactly the same as shown above. Which of the following vulnerabilities has the tester discovered?
A. JWT manipulation
B. Cookie poisoning
C. Session fixation
D. Collision attack
Show Answer
Correct Answer: C
Explanation: The application issues a session cookie to an unauthenticated user and fails to generate a new session identifier after successful authentication. Reusing the same session ID across the authentication boundary is the classic condition that enables session fixation, where an attacker can pre-establish or predict a victim's session identifier and have it become authenticated.
Question 87
During an internal engagement, a penetration tester compromises a Linux server. The tester wants to maintain persistence without creating or modifying files on the disk or startup scripts, since these are monitored by integrity tools. Which of the following techniques best meets these requirements?
A. Installing a systemd service that connects back to the C2 server
B. Injecting a reverse shell payload into an existing running process
C. Creating a new cron job that launches a shell on reboot
D. Adding a new user account with sudo privileges for future access
Show Answer
Correct Answer: B
Explanation: Injecting a reverse shell payload into an existing running process is a fileless technique that operates in memory and does not require creating or modifying files, systemd services, cron jobs, or startup scripts. While it only persists for the lifetime of the compromised process or until reboot, it best matches the stated requirement of avoiding disk and startup modifications monitored by file integrity tools.
Question 88
Which of the following is the most likely LOLBin to be used to perform an exfiltration on a Microsoft Windows environment?
A. procdump.exe
B. msbuild.exe
C. bitsadmin.exe
D. cscript.exe
Show Answer
Correct Answer: C
Explanation: bitsadmin.exe is a legitimate Windows LOLBin that uses the Background Intelligent Transfer Service (BITS) to transfer files over HTTP/HTTPS or SMB, making it a common choice for stealthy file transfer and data exfiltration. The other options are commonly abused for different purposes: procdump.exe for memory dumps, msbuild.exe for proxy execution of code, and cscript.exe for executing scripts rather than primarily transferring data.
Question 89
A penetration tester wants to gather the names of potential phishing targets who have access to sensitive data. Which of the following would best meet this goal?
A. WHOIS
B. Censys.io
C. SpiderFoot
D. theHarvester
Show Answer
Correct Answer: D
Explanation: theHarvester is an OSINT reconnaissance tool specifically designed to collect email addresses, employee names, usernames, hosts, and subdomains from public sources, making it well suited for identifying potential phishing targets. WHOIS provides domain registration information, Censys.io focuses on internet-exposed assets, and SpiderFoot is a broader OSINT automation platform rather than the most targeted choice for gathering employee names and emails.
Question 90
A penetration tester is conducting an on-site review and wants to capture SSO credentials for staff in a specific department. Which of the following attack types would be most effective for this task?
A. Captive portal
B. Signal jamming
C. WPS PIN attack
D. Channel scanning
Show Answer
Correct Answer: A
Explanation: A captive portal is the most effective option for capturing SSO credentials during an on-site assessment because it can present a spoofed authentication page and collect users' login credentials. Signal jamming only disrupts wireless communications, a WPS PIN attack targets Wi-Fi network access rather than SSO credentials, and channel scanning is a reconnaissance technique that does not capture credentials.
Question 91
Which of the following would most likely reduce the possibility of a client rejecting the final deliverable for a penetration test?
A. Goal reprioritization
B. Stakeholder alignment
C. Non-disclosure agreement
D. Business impact analysis
Show Answer
Correct Answer: B
Explanation: Stakeholder alignment during planning and scoping ensures agreement on objectives, scope, rules of engagement, deliverables, and acceptance criteria. Clear shared expectations are the most effective way to reduce the likelihood that a client will reject the final penetration test deliverable.
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.