During an assessment, a penetration tester runs the following command from a Linux machine:
GetUsersSPNs.py -dc-ip 172.16.1.1 DOMAIN.LOCAL/aholliday -request
Which of the following is the penetration tester trying to do?
A. Crack the user password for aholliday.
B. Download all TGS tickets for offline processing.
C. Perform a pass-the-hash attack using the hash for aholliday.
D. Perform password spraying.
Show Answer
Correct Answer: B
Explanation: GetUserSPNs.py with the -request option performs Kerberoasting by enumerating accounts with Service Principal Names (SPNs) and requesting their Kerberos TGS service tickets. Those tickets are then saved for offline password cracking of the associated service account credentials. It is not pass-the-hash, password spraying, or directly cracking the specified user's password.
Question 122
During a security assessment of a network device, a penetration tester performs the following:
Which of the following actions should the tester take to correct the vulnerability scan attempt?
A. Enable promiscuous mode
B. Modify -Tuning to 1
C. Verify the ports used
D. Remove the -evasion flag
Show Answer
Correct Answer: C
Explanation: A result of '0 hosts scanned' with a Nikto scan typically indicates the target web service was not successfully identified or reached. The appropriate corrective action is to verify that the correct web server port (such as 80 or 443, or a custom port) is being targeted. Promiscuous mode is unrelated, changing Tuning only changes test categories, and removing the evasion flag would not explain zero hosts scanned.
Question 123
During an assessment, a penetration tester obtains access to a Microsoft SQL server using sqlmap and runs the following command:
SQL> xp_cmdshell whoami /all -
Which of the following is the tester trying to do?
A. List database tables
B. Show logged-in database users
C. Enumerate privileges
D. Display available SQL commands
Show Answer
Correct Answer: C
Explanation: The SQL Server extended stored procedure xp_cmdshell executes operating system commands. Running `whoami /all` displays the current Windows security context, including group memberships, SIDs, and assigned privileges, which is used to enumerate the privileges available to the compromised SQL Server process or account.
Question 124
A Chief Information Security Officer wants to automate adversarial activities from penetration tests that are relevant to the organization. Which of the following should a penetration tester do first to accomplish this task?
A. Deploy a command-and-control server with custom profiles to facilitate execution.
B. Use Python 3 with added testing libraries and script the relevant action to test.
C. Utilize the PowerShell PowerView tool with custom scripting additions based on test results.
D. Implement Atomic Red Team to chain critical TTPs and perform the test.
Show Answer
Correct Answer: D
Explanation: Atomic Red Team is purpose-built to automate and repeatedly execute adversary techniques (TTPs) mapped to the MITRE ATT&CK framework. It is designed to emulate relevant attacker behaviors in a standardized way, making it the appropriate first choice for automating penetration-test-derived adversarial activities. The other options focus on specific tooling or custom scripting rather than a framework intended for automated adversary emulation.
Question 125
A penetration tester is ready to add shellcode for a specific remote executable exploit. The tester is trying to prevent the payload from being blocked by anti-malware that is running on the target.
Which of the following commands should the tester use to obtain shell access?
A. msfvenom --arch x86-64 --platform windows --encoder x86-64/shikata_ga_nai --payload windows/bind_tcp LPORT=443
B. msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.10.100 LPORT=8000
C. msfvenom --arch x86-64 --platform windows --payload windows/shell_reverse_tcp LHOST-10.10.10.100 LPORT-4444 EXITFUNC=none
D. net user add /administrator | hexdump > payload
Show Answer
Correct Answer: A
Explanation: The key requirement is reducing the likelihood that the payload is blocked by anti-malware. Among the options, only A uses an encoder (shikata_ga_nai), which is intended to obfuscate the payload and help evade simple signature-based detection. The other options either generate standard payloads without encoding, contain incorrect syntax, or are unrelated to generating shellcode.
Question 126
A company that uses an insecure corporate wireless network is concerned about security. Which of the following is the most likely tool a penetration tester could use to obtain initial access?
A. Responder
B. Metasploit
C. Netcat
D. Nmap
Show Answer
Correct Answer: A
Explanation: Responder is commonly used on insecure local networks to perform LLMNR/NBT-NS/mDNS poisoning and capture or relay credentials, making it a likely tool for obtaining initial access on an insecure corporate wireless network. Metasploit is an exploitation framework used after identifying a vulnerability, while Netcat is a networking utility and Nmap is primarily for reconnaissance.
Question 127
A penetration testing company is defining the rules of engagement with a client. Which of the following should the company include?
A. Non-disclosure agreement
B. Escalation process
C. URL list
D. Authorization letter
Show Answer
Correct Answer: B
Explanation: The Rules of Engagement (RoE) define how the penetration test will be conducted, including communications, incident handling, and decision-making during the engagement. An escalation process is a core RoE element because it specifies who to contact and what actions to take if critical vulnerabilities, outages, or unexpected events occur. A non-disclosure agreement and authorization letter are pre-engagement legal documents, while a URL list is part of scoping rather than the RoE.
Question 128
A penetration tester wants to verify whether passwords from a leaked password list can be used to access an SSH server as a legitimate user.
Which of the following is the most appropriate tool for this task?
A. BloodHound
B. Responder
C. Burp Suite
D. Hydra
Show Answer
Correct Answer: D
Explanation: Hydra is a password auditing and login testing tool that supports SSH and can test username/password combinations from a leaked password list against an SSH service. BloodHound maps Active Directory attack paths, Responder performs LLMNR/NBT-NS/mDNS poisoning and credential capture, and Burp Suite focuses on web application testing rather than SSH authentication.
Question 129
A penetration tester completes an authenticated vulnerability scan of a host and receives the following results:
Which of the following is most likely to cause stability when a session is created on a target machine?
A. Running Responder with default settings and using Impacket
B. Running Nmap with safe scripts enabled and targeting RDP
C. Running Metasploit utilizing the EternalBlue module
D. Running Hydra on the local user at one attempt per second
Show Answer
Correct Answer: C
Explanation: The question is almost certainly missing the word 'issues' and intends to ask which action is most likely to cause stability problems when establishing a session on a target. The Metasploit EternalBlue (MS17-010) exploit is well known for causing crashes or BSODs on vulnerable systems during exploitation, making sessions unreliable. The other options are reconnaissance, credential attacks, or relay tooling that are not typically associated with destabilizing the target simply by creating a session.
Question 130
A penetration tester obtains a regular domain user’s set of credentials. The tester wants to attempt a dictionary attack by creating a custom word list based on the Active Directory password policy.
Which of the following tools should the penetration tester use to retrieve the password policy?
A. Responder
B. CrackMapExec
C. Hydra
D. msfvenom
Show Answer
Correct Answer: B
Explanation: CrackMapExec can enumerate Active Directory information, including the domain password policy, using valid domain credentials. Those policy details (such as minimum length, complexity, and lockout settings) are useful for building a targeted dictionary. Responder captures credentials, Hydra performs online password attacks, and msfvenom generates payloads rather than retrieving AD password policies.
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.