Which of the following should be included in a penetration test report to support the tester's detailed findings?
A. Methodologies
B. Screenshots
C. Vulnerabilities
D. Remediations
Show Answer
Correct Answer: B
Explanation: Screenshots provide supporting evidence for the detailed findings in a penetration test report by documenting successful exploitation, observed vulnerabilities, or proof of impact. Methodologies describe the approach, vulnerabilities list the issues found, and remediations recommend fixes, but screenshots are the primary evidence supporting the findings.
Question 152
A penetration tester is configuring a vulnerability management solution to perform credentialed scans of an Active Directory server. Which of the following account types should the tester provide to the scanner?
A. Read-only
B. Domain administrator
C. Local user
D. Root
Show Answer
Correct Answer: B
Explanation: A credentialed scan of a Windows Active Directory domain controller requires an account with sufficient privileges to inspect system configuration, registry, services, installed software, and security settings. A Domain Administrator account provides the necessary access for a comprehensive authenticated scan. A read-only or local user account is typically insufficient for full assessment, and root applies to Unix/Linux systems, not Windows Active Directory.
Question 153
During a penetration test, a junior tester uses Hunter.io for an assessment and plans to review the information that will be collected. Which of the following describes the information the junior tester will receive from the Hunter.io tool?
A. A collection of email addresses for the target domain that is available on multiple sources on the internet
B. DNS records for the target domain and subdomains that could be used to increase the external attack surface
C. Data breach information about the organization that could be used for additional enumeration
D. Information from the target's main web page that collects usernames, metadata, and possible data exposures
Show Answer
Correct Answer: A
Explanation: Hunter.io is an OSINT reconnaissance tool designed to discover and verify email addresses associated with a target domain by aggregating publicly available sources. It does not primarily enumerate DNS records, provide breach databases, or scrape webpage metadata for exposures.
Question 154
A penetration tester enters an invalid user ID on the login page of a web application. The tester receives a message indicating the user is not found. Then, the tester tries a valid user ID but an incorrect password, but the web application indicates the password is invalid. Which of the following should the tester attempt next?
A. Error log analysis
B. DoS attack
C. Enumeration
D. Password dictionary attack
Show Answer
Correct Answer: C
Explanation: The application reveals different responses for invalid usernames versus invalid passwords, allowing username enumeration. The appropriate next step is to enumerate valid user IDs before attempting password attacks. Error log analysis is not applicable from an external tester's perspective, and a DoS attack is unrelated to this finding.
Question 155
A penetration tester is getting ready to conduct a vulnerability scan to evaluate an environment that consists of a container orchestration cluster. Which of the following tools would be best to use for this purpose?
A. NSE
B. Nessus
C. CME
D. Trivy
Show Answer
Correct Answer: D
Explanation: Trivy is purpose-built for cloud-native environments, including container images, Kubernetes/container orchestration clusters, filesystems, and IaC. It performs vulnerability scanning well suited to evaluating a container orchestration environment. Nessus is a general-purpose vulnerability scanner, NSE extends Nmap, and CME focuses on post-exploitation/network enumeration rather than container cluster vulnerability scanning.
Question 156
A penetration tester successfully gains access to a Linux system and then uses the following command:
find / -type f -ls > /tmp/recon.txt
Which of the following best describes the tester's goal?
A. Permission enumeration
B. Secrets enumeration
C. User enumeration
D. Service enumeration
Show Answer
Correct Answer: A
Explanation: The command recursively finds all regular files from the filesystem root and uses -ls to output detailed metadata for each file, including permissions, ownership, size, inode, and timestamps, redirecting the results to a reconnaissance file. This is primarily enumerating file permissions and ownership across the system, not specifically searching for secrets, users, or services.
Question 157
Which of the following can an access control vestibule help deter?
A. USB drops
B. Badge cloning
C. Lock picking
D. Tailgating
Show Answer
Correct Answer: D
Explanation: An access control vestibule (mantrap) is designed to control entry so that only one authenticated person passes through at a time, making it effective at deterring tailgating. It does not primarily prevent USB drops, badge cloning, or lock picking.
Question 158
During an engagement, a penetration tester wants to enumerate users from Linux systems by using finger and rwho commands. However, the tester realizes these commands alone will not achieve the desired result. Which of the following is the best tool to use for this task?
A. Nikto
B. Burp Suite
C. smbclient
D. theHarvester
Show Answer
Correct Answer: D
Explanation: finger and rwho depend on legacy services that are often unavailable. Among the options, theHarvester is the best supplementary tool for enumerating potential users by harvesting usernames and email addresses from public sources during reconnaissance. Nikto is a web server scanner, Burp Suite is a web proxy/testing suite, and smbclient is for interacting with SMB/CIFS services rather than general Linux user enumeration.
Question 159
A penetration tester obtained a shell on a Windows system. Which of the following would the tester use to gather more information about the host?
A. mmc.exe
B. icacls.exe
C. nltest.exe
D. winver.exe
Show Answer
Correct Answer: C
Explanation: nltest.exe is a built-in Windows command-line utility used to enumerate Active Directory and domain-related information such as domain controllers, trusts, and domain membership, making it valuable for post-compromise host and environment enumeration. mmc.exe launches the Microsoft Management Console, icacls.exe manages file and directory ACLs, and winver.exe only displays the Windows version dialog.
Question 160
A penetration tester creates the following Python script that can be used to enumerate information about email accounts on a target mail server:
Which of the following logic constructs would permit the script to continue despite failure?
A. Add a do/while loop.
B. Add an iterator.
C. Add a try/except block.
D. Add an if/else conditional.
Show Answer
Correct Answer: C
Explanation: A try/except block catches runtime exceptions so the script can handle failures (such as connection or authentication errors) and continue processing. Python does not have a native do/while loop, an iterator only controls iteration, and an if/else conditional does not catch exceptions.
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.