A penetration tester is investigating a buffer overflow on the myfile binary. The tester wants to send a payload to help identify the exact offset to inject the memory address to take control of the buffer.
Which of the following would allow the penetration tester to quickly identify the offset?
A. ./myfile < $(printf ‘A%.0s’ {1.1000}
B. echo ‘A’ |head -n 1000 |tr -d ‘\n’ | ./myfile
C. python -c ‘print(“A”*1000)’ > test.txt; cat test.txt >./myfile
D. ./pattern_create.rb 1000 > test.txt; ./myfile < test.txt
Show Answer
Correct Answer: D
Explanation: A cyclic (non-repeating) pattern generated by pattern_create.rb is specifically designed to determine the exact overwrite offset in a buffer overflow. After the program crashes, the overwritten instruction pointer value can be matched back to the unique pattern to calculate the precise offset. Filling the input with only 'A' characters can trigger a crash but cannot identify the exact offset.
Question 142
A penetration tester is ready to add shellcode for a specific remote executable exploit. The tester is trying to prevent the payload from being blocked by anti-malware that is running on the target.
Which of the following commands should the tester use to obtain shell access?
A. msfvenom --arch x86-64 --platform windows --encoder x86-64/shikata_ga_nai --payload windows/bind_tcp LPORT=443
B. msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.10.100 LPORT=8000
C. msfvenom --arch x86-64 --platform windows --payload windows/shell_reverse_tcp LHOST-10.10.10.100 LPORT-4444 EXITFUNC=none
D. net user add /administrator | hexdump > payload
Show Answer
Correct Answer: A
Explanation: The requirement is to generate shellcode while reducing the likelihood of signature-based anti-malware detection. Among the options, only A uses an msfvenom encoder (shikata_ga_nai) to encode/obfuscate the payload before delivery. The other options either generate an unencoded payload, contain incorrect syntax, or are unrelated to obtaining shell access.
Question 143
A penetration tester uses a Python script to enumerate open ports across a list of IP addresses. The current script runs sequentially, which slows it down during larger engagements. The tester wants to improve the script’s performance so it can handle multiple targets simultaneously.
Which of the following changes is the best way to achieve this goal?
A. Using the time.sleep() function to throttle the scanning rate
B. Importing a library that allows use of workers
C. Replacing the range() function with a while loop
D. Changing the port list from a tuple to a dictionary for better lookup speed
Show Answer
Correct Answer: B
Explanation: Using a concurrency mechanism such as a thread pool or process pool allows the scanner to execute port scans against multiple targets simultaneously, significantly improving throughput over sequential execution. The other options do not introduce concurrency: time.sleep() slows execution, replacing range() with a while loop provides no performance benefit, and changing a tuple to a dictionary is irrelevant to scanning multiple targets concurrently.
Question 144
After completing vulnerability scans for a given test, a penetration tester needs to prioritize which potential assets are in scope and should be exploited first. Given the following scanner output:
Which of the following findings should the tester prioritize first based upon a consideration of risk to the organization?
A. 1
B. 2
C. 3
D. 4
Show Answer
Correct Answer: B
Explanation: The scanner output referenced in the question is missing, so the answer cannot be determined definitively. Based on the available information alone, B is the strongest tentative choice, but the missing scan details are required to assess organizational risk properly.
Question 145
A penetration tester is conducting an IoT assessment and dumps the device firmware to a Linux machine.
Which of the following Bash scripts would locate secrets in a custom binary executable downloaded from the device?
A. cat initializedevice | strings | grep -i “password\|shadow\|token”
B. cat initializedevice | dos2unix | grep -i “password\|shadow\|token”
C. cat initializedevice | base64 -d | grep -i “password\|shadow\|token”
D. cat initializedevice | grep -i “password\|shadow\|token”
Show Answer
Correct Answer: A
Explanation: The `strings` utility extracts printable ASCII/Unicode strings from a binary executable, making embedded secrets such as passwords, tokens, or shadow-related text visible. Piping the output to `grep -i "password\|shadow\|token"` searches those extracted strings case-insensitively. The other options either assume an incorrect encoding/format (`dos2unix`, `base64 -d`) or run `grep` directly on a binary, which is unreliable for locating embedded text.
Question 146
A penetration tester has just started a new engagement. The tester is using a framework that breaks the life cycle into 14 components. Which of the following frameworks is the tester using?
A. OWASP MASVS
B. OSSTMM
C. MITRE ATT&CK
D. CREST
Show Answer
Correct Answer: B
Explanation: The correct answer is OSSTMM. OSSTMM (Open Source Security Testing Methodology Manual) is a penetration testing methodology/framework that structures security testing across a defined set of components used throughout an engagement. The other options do not fit: OWASP MASVS is a mobile application security verification standard, MITRE ATT&CK is a knowledge base of adversary tactics and techniques rather than a penetration testing lifecycle methodology, and CREST is a certification/accreditation body.
Question 147
As part of an engagement, a penetration tester needs to scan several hundred public-facing URLs for dangerous files or outdated web server versions. Which of the following should the tester use?
A. Nmap
B. ZAP
C. BloodHound
D. Nikto
Show Answer
Correct Answer: D
Explanation: Nikto is a web server vulnerability scanner designed to identify dangerous files, outdated web server versions, default files, insecure configurations, and known web server issues across web servers. Nmap focuses on network/service discovery, ZAP targets web application security testing, and BloodHound maps Active Directory attack paths.
Question 148
A penetration tester wants to download sensitive files stored on the client's file server and runs the following scan:
Which of the following TCP ports should the penetration tester target as a next step?
A. 21
B. 22
C. 80
D. 990
Show Answer
Correct Answer: D
Explanation: To download sensitive files from a file server, the next step is to target an open file-transfer service. Among the listed options, TCP 990 corresponds to implicit FTPS. If the scan shows 990 is open while 21 and 22 are closed, 990 is the appropriate target. Port 80 is a web service rather than the primary file-transfer service in this context.
Question 149
Which of the following protocols would a penetration tester most likely utilize to exfiltrate data covertly and evade detection?
A. FTP
B. HTTP
C. SMTP
D. DNS
Show Answer
Correct Answer: D
Explanation: DNS is the protocol most commonly associated with covert data exfiltration via DNS tunneling. Because DNS traffic is typically permitted through firewalls and may receive less scrutiny than other protocols, attackers can encode data within DNS queries and responses to evade detection. FTP, HTTP, and SMTP can all be used for exfiltration, but they are generally more obvious or more heavily monitored in enterprise environments.
Question 150
A penetration tester identifies the following vulnerability during a scan of the company's network:
An Nmap scan of the affected device produces the following results:
Which of the following best describes this scenario?
A. True negative
B. True positive
C. False negative
D. False positive
Show Answer
Correct Answer: D
Explanation: A false positive occurs when a scanner reports a vulnerability that is not actually applicable. If the scan reports a TLS/HTTPS vulnerability but the Nmap results show port 443 is closed, the service is not exposed on that port, so the reported TLS vulnerability is most likely an incorrect finding.
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.