During a security assessment of an e-commerce website, a penetration tester wants to exploit a vulnerability in the web server’s input validation that will allow unauthorized transactions on behalf of the user. Which of the following techniques would most likely be used for that purpose?
A. Privilege escalation
B. DOM injection
C. Session hijacking
D. Cross-site scripting
Show Answer
Correct Answer: D
Explanation: The key clue is a vulnerability in the web server's input validation. Improper input validation commonly enables cross-site scripting (XSS), allowing injected scripts to execute in a victim's browser and perform authenticated actions on the user's behalf, including initiating unauthorized transactions. Session hijacking can be a consequence of XSS, but the vulnerability described is input validation leading to XSS.
Question 162
A penetration tester uses a pair of crutches to access a client's physical location. Which of the following is the tester most likely trying to do?
A. Tailgating
B. Impersonation
C. Badge cloning
D. Lock picking
Show Answer
Correct Answer: A
Explanation: The most likely objective is tailgating. Using crutches is a social engineering prop to encourage someone to hold a secured door open, allowing the tester to enter without presenting credentials. Impersonation typically involves posing as a specific person or role (such as an employee, contractor, or delivery person), whereas the crutches primarily facilitate unauthorized entry by exploiting courtesy. The other options do not match the described scenario.
Question 163
With one day left to complete the testing phase of an engagement, a penetration tester obtains the following results from an Nmap scan:
Which of the following tools should the tester use to quickly identify a potential attack path?
A. msfvenom
B. SearchSploit
C. sqlmap
D. BeEF
Show Answer
Correct Answer: B
Explanation: SearchSploit is the quickest tool among the options for mapping discovered service versions from an Nmap scan to known public exploits, helping identify likely attack paths. msfvenom generates payloads, sqlmap targets SQL injection specifically, and BeEF focuses on browser exploitation after client-side compromise.
Question 164
A penetration tester observes the following output from an Nmap command while attempting to troubleshoot connectivity to a Linux server.
Which of the following is the most likely reason for the connectivity issue?
A. The SSH service is running on a different port.
B. The SSH service is blocked by a firewall.
C. The SSH service requires certificate authentication.
D. The SSH service is not active.
Show Answer
Correct Answer: A
Explanation: If the Nmap output shows the SSH service listening on TCP port 2222 and open, then the service is running but on a non-default port. Connectivity attempts to the default SSH port (22) would fail, while a firewall block or inactive service would not produce an open SSH port. Authentication method affects login, not port reachability.
Question 165
During a penetration test, the tester identifies several unused services that are listening on all targeted internal laptops:
Which of the following technical controls should the tester recommend to reduce the risk of compromise?
A. Multifactor authentication
B. Patch management
C. System hardening
D. Network segmentation
Show Answer
Correct Answer: C
Explanation: Unused services listening on internal laptops increase the attack surface. System hardening includes disabling unnecessary services, closing unused ports, and securely configuring hosts to reduce exposure. Patch management addresses software vulnerabilities but does not remove unnecessary services, MFA protects authentication, and network segmentation limits communication rather than eliminating exposed services.
Question 166
A penetration tester needs to evaluate the security of example.com and gather stealthy information using DNS. Which of the following is the best tool for the tester to use?
A. Nikto
B. InSSIDer
C. masscan
D. Recon-ng
Show Answer
Correct Answer: D
Explanation: Recon-ng is a reconnaissance and OSINT framework that supports DNS enumeration, WHOIS lookups, subdomain discovery, and other stealthier information-gathering techniques. Nikto is a web vulnerability scanner, InSSIDer is a Wi-Fi analysis tool, and masscan is a high-speed port scanner rather than a DNS reconnaissance tool.
Question 167
A penetration tester identifies an exposed corporate directory containing first and last names and phone number for employees. Which of the following attack techniques would be the most effective to pursue if the penetration tester wants to compromise user accounts?
A. Smishing
B. Impersonation
C. Tailgating
D. Whaling
Show Answer
Correct Answer: A
Explanation: The exposed directory provides employee names and phone numbers, which are ideal for SMS-based phishing (smishing) campaigns that direct users to fake login pages or prompt credential disclosure. Impersonation is a broader social engineering technique but is less specifically enabled by the available data. Tailgating is a physical attack unrelated to the directory, and whaling targets high-profile executives rather than the general employee population.
Question 168
During a penetration testing engagement, a tester targets the internet-facing services used by the client. Which of the following describes the type of assessment that should be considered in this scope of work?
A. Segmentation
B. Mobile
C. External
D. Web
Show Answer
Correct Answer: C
Explanation: An external penetration test targets internet-facing systems and services from the perspective of an outside attacker. This includes publicly exposed services such as web servers, VPNs, email, SSH, and other internet-accessible assets. A web assessment is limited to web applications, segmentation focuses on internal network isolation, and mobile targets mobile applications/devices.
Question 169
A penetration tester is conducting a vulnerability scan. The tester wants to see any vulnerabilities that may be visible from outside of the organization. Which of the following scans should the penetration tester perform?
A. SAST
B. Sidecar
C. Unauthenticated
D. Host-based
Show Answer
Correct Answer: C
Explanation: An unauthenticated vulnerability scan shows what is visible to an external attacker without valid credentials. It identifies externally exposed services and vulnerabilities from an outside perspective. SAST analyzes source code, a sidecar is a deployment pattern, and a host-based scan provides an internal host view rather than an external attacker’s perspective.
Question 170
A tester needs to begin capturing WLAN credentials for cracking during an on-site engagement. Which of the following is the best command to capture handshakes?
A. tcpdump -n -s0 -w -i
B. airserv-ng -d
C. aireplay-ng -0 1000 -a
D. airodump-ng -c 6 --bssid
Show Answer
Correct Answer: D
Explanation: airodump-ng is the Aircrack-ng suite component used to monitor wireless networks and capture WPA/WPA2 handshakes for later offline cracking. The command with channel and BSSID targets the desired access point. tcpdump is a general packet capture tool, airserv-ng shares wireless interfaces over the network, and aireplay-ng with -0 performs deauthentication to induce clients to reconnect rather than capturing handshakes itself.
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.