A penetration tester is evaluating a company's cybersecurity preparedness. The tester wants to acquire valid credentials using a social engineering campaign. Which of the following tools and techniques are most applicable in this scenario? (Choose two.)
A. TruffleHog for collecting credentials
B. Shodan for identifying potential targets
C. Gophish for sending phishing emails
D. Maltego for organizing targets
E. theHarvester for discovering additional targets
F. Evilginx for handling legitimate authentication requests through a proxy
Show Answer
Correct Answer: C, F
Explanation: Gophish is purpose-built for running phishing campaigns as part of authorized social engineering assessments, making it appropriate for credential harvesting exercises. Evilginx is an adversary-in-the-middle reverse proxy that relays legitimate authentication requests and can capture credentials and authenticated session tokens during authorized testing. The other tools are primarily for reconnaissance, OSINT, or secret discovery rather than directly conducting a credential-focused social engineering campaign.
Question 93
A penetration tester observes an employee logging in to their laptop. The penetration tester wants to gain access to information with the least intervention. Which of the following actions should the penetration tester take?
A. Send a smishing message.
B. Utilize a USB hardware keylogger.
C. Send a phishing email to the employee.
D. Engage in shoulder surfing.
Show Answer
Correct Answer: D
Explanation: Shoulder surfing is the least intrusive option because the tester is already observing the employee logging in. It requires no interaction with the target, no installation of hardware, and no delivery of phishing or smishing messages. Simply observing the credentials as they are entered can provide access with the least intervention.
Question 94
A penetration tester must gain entry to a client's office building without raising attention. Which of the following should be the tester's first step?
A. Interacting with security employees to clone a badge
B. Trying to enter the back door after hours on a weekend
C. Collecting building blueprints to run a site survey
D. Conducting surveillance of the office to understand foot traffic
Show Answer
Correct Answer: D
Explanation: The first step in a physical penetration test aimed at entering a building without attracting attention is reconnaissance. Observing the location and understanding employee movement, guard routines, entry points, and foot traffic allows the tester to choose the safest and least conspicuous approach before attempting access. The other options involve active intrusion or preparation that comes after initial surveillance.
Question 95
Which of the following components of a penetration test report most directly contributes to prioritizing remediations?
A. Proof of concept
B. Risk scoring
C. Attack narrative
D. Executive summary
Show Answer
Correct Answer: B
Explanation: Risk scoring most directly supports remediation prioritization by ranking findings based on severity, likelihood of exploitation, and business impact, allowing organizations to address the highest-risk vulnerabilities first. Proof of concept demonstrates exploitability, the attack narrative describes the engagement, and the executive summary provides a high-level overview but does not directly prioritize fixes.
Question 97
A tester obtains access to an application server via a Java vulnerability and must maintain persistence. The server has a file integrity monitoring control enabled, and the tester cannot disable it. Which of the following actions should the tester take to establish persistence?
A. Deploy a rootkit.
B. Drop a beacon.
C. Start a web shell.
D. Schedule a task.
Show Answer
Correct Answer: D
Explanation: A scheduled task provides persistence by leveraging operating system scheduling mechanisms rather than modifying monitored application files. A web shell or beacon typically requires placing or altering files that file integrity monitoring can detect, and a rootkit is unnecessarily intrusive and not the best fit for this scenario.
Question 98
During a penetration test, the tester wants to obtain public information that could be used to compromise the organization's cloud infrastructure. Which of the following is the most effective resource for the tester to use for this purpose?
A. Sensitive documents on a public cloud
B. Open ports on the cloud infrastructure
C. Repositories with secret keys
D. SSL certificates on websites
Show Answer
Correct Answer: C
Explanation: Repositories that publicly expose secret keys, API tokens, or cloud credentials are one of the most effective OSINT sources for compromising cloud infrastructure because they can provide direct authenticated access. Public documents, open ports, and SSL certificates may reveal useful information, but exposed credentials have the highest immediate impact.
Question 99
A penetration tester poses as a member of a company's human resources department. The tester wants to obtain credentials by sending an email containing a link that redirects to a fake website. Which of the following commands is the best way to determine whether the email is flagged as malicious?
A. Resolve-DnsName -Name company.com -Type A
B. dig axfr company.com @spf.company.com
C. nslookup -q=txt _dmarc.company.com
D. dig MX company.com
Show Answer
Correct Answer: C
Explanation: DMARC is published as a TXT record at _dmarc.<domain> and specifies how receiving mail systems should handle messages that fail SPF/DKIM alignment (none, quarantine, reject). Querying the DMARC TXT record is the best way to determine whether a phishing email is likely to be flagged or rejected. The other commands retrieve A, MX, or attempt a zone transfer, which do not answer this question.
Question 103
A penetration tester wants to automatically enumerate all ciphers permitted on TLS/SSL configurations across a client's internet-facing and internal web servers. Which of the following tools or frameworks best supports this objective?
A. Nmap Scripting Engine
B. Shodan
C. Impacket
D. Netcat
E. Burp Suite
Show Answer
Correct Answer: A
Explanation: Nmap Scripting Engine (NSE) includes the ssl-enum-ciphers script, which automatically enumerates supported SSL/TLS protocols and cipher suites across many hosts. It is well suited for scalable assessment of internet-facing and internal web servers. Shodan is a search engine for exposed services, Impacket focuses on network protocol interactions, Netcat is a general networking utility, and Burp Suite is primarily a web application testing proxy rather than a fleet-wide cipher enumeration tool.
Question 104
A penetration tester accesses and enumerates a host and then runs the following commands:
$ runlevel
$ ls -l /etc/rc5.d
$ vi /etc/rc5.d/S01ssh.dd
Which of the following is the tester most likely attempting to do?
A. Find credentials within the SSH daemon
B. Establish persistence on the host
C. Add a key to the host for SSH.
D. Harvest users' private keys.
Show Answer
Correct Answer: B
Explanation: The commands inspect the current runlevel, list the startup scripts for runlevel 5, and then edit a startup script in /etc/rc5.d. Modifying init startup scripts is a classic persistence technique because the code will execute automatically when the system enters that runlevel. The other options involve SSH credentials or keys, which are not indicated by these commands.
Question 105
A penetration tester obtains network-level access to a hardened subnet that has no Windows-based hosts and needs to find credentials. The client mentioned that the SOC is only monitoring user endpoints and not servers. Which of the following commands should the tester use?
A. pwinspector -i -o -m 8 -M 16 -1 -u -n -p
B. responder -I eth0
C. nmap -sV -n -T3 -p 22 --reason
D. hydra -L root -P /path/to/wordlist -t 3 -M
Show Answer
Correct Answer: D
Explanation: Hydra is the appropriate choice because the environment has no Windows hosts, making Responder ineffective for LLMNR/NBT-NS poisoning. The objective is to obtain credentials from a hardened, server-focused subnet where server activity is not being monitored, making an online password attack against services such as SSH the most suitable option. The other options generate passwords (pwinspector), perform service enumeration (nmap), or target Windows name resolution behavior (Responder).
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.