During a red-team operation, a tester gains local administrator access to a Windows workstation. The tester's goal is to maintain long-term access without creating new services or modifying scheduled tasks because the blue team monitors both. The tester decides to automatically launch a payload upon each user login. Which of the following methods best supports this persistence goal?
A. Planting a reverse shell in a browser extension directory
B. Modifying the user's NTUSER.INI file
C. Adding an entry to the Run Registry key
D. Installing a Trojanized PowerShell in System32
Show Answer
Correct Answer: C
Explanation: Adding an entry to the Windows Run Registry key (such as HKCU or HKLM\Software\Microsoft\Windows\CurrentVersion\Run) causes the specified program to execute automatically when a user logs on. This is a common persistence mechanism that does not require creating services or scheduled tasks. The other options are not standard or reliable persistence mechanisms for automatic execution at user logon.
Question 12
A penetration tester obtains initial access as a standard user on a server in an AD environment. This server is the only one in the environment where the account is logged in. The tester needs to obtain the credentials for this account to further the attack but cannot elevate on this server. Which of the following tools should the tester use to obtain the password?
A. Evil-WinRM
B. BloodHound
C. Mimikatz
D. Rubeus
Show Answer
Correct Answer: D
Explanation: Rubeus can operate in the context of the current user to extract and abuse Kerberos tickets without requiring local administrator privileges. Mimikatz typically requires elevated privileges to dump credentials from LSASS. BloodHound is for AD relationship enumeration, and Evil-WinRM is a remote management shell, not a credential extraction tool.
Question 13
A penetration tester conducts a web application assessment and receives the following Set-Cookie upon logging in:
Set-Cookie auth=UGVudGVzdFVzZXI6OTE1MzYK
Upon analysis, the penetration tester determines this is a Base64-encoded string, which when decoded reads:
Pentestuser:91536 -
The penetration tester logs out, logs back in, and sees the decoded string now reads:
Pentestuser:91944 -
Which of the following attacks will the penetration tester most likely conduct based on this information?
A. Collision attack
B. JWT manipulation
C. Session hijacking
D. Insecure direct object reference
Show Answer
Correct Answer: D
Explanation: The cookie contains a Base64-encoded username and a changing numeric identifier. Base64 is only an encoding, not protection. A tester would likely modify the exposed identifier to determine whether it references another user's object or session and whether the application authorizes access properly. That is characteristic of testing for an insecure direct object reference (IDOR), not JWT manipulation, a collision attack, or simple session hijacking.
Question 14
Testing and reporting activities are complete. A penetration tester needs to verify that exploited systems have been restored to preengagement conditions. Which of the following would be most appropriate for the tester to do?
A. Terminate the running command-and-control payload.
B. Provide the customer with a list of the changes made.
C. Replace environment variables with their original values.
D. Put in a change request ticket to reimage the system.
Show Answer
Correct Answer: B
Explanation: The appropriate action to verify restoration to preengagement conditions is to provide the customer with a complete list of all changes made during the engagement. This enables verification that every modification (accounts, tools, configuration changes, persistence, etc.) has been removed or reverted. The other options address only specific cleanup tasks or delegate restoration rather than supporting verification.
Question 15
A penetration tester compromises a developer's workstation and believes the individual may have access to Amazon cloud compute resources. Which of the following commands is least likely to trigger SOC detections to confirm access?
A. aws sts get-caller-identity
B. aws connect describe-user
C. aws ec2 describe-instances --dry-run
D. aws cloud9 list-environments --max-items
Show Answer
Correct Answer: A
Explanation: `aws sts get-caller-identity` is the standard, low-impact API call used to verify that AWS credentials are valid and identify the current principal. It does not enumerate cloud resources or attempt privileged operations, making it generally less likely to trigger detections than querying specific services or probing EC2 permissions with a dry run.
Question 16
A penetration tester wants to perform static analysis of a Java application. The tester has a copy of the archive file. Which of the following must the tester do first to accomplish this goal?
A. Decompile the bytecode.
B. Perform a fuzz test the archive file.
C. Convert the archive file to a .so file.
D. Disassemble the Java Interpreter.
Show Answer
Correct Answer: A
Explanation: Java archive (JAR) files typically contain compiled Java bytecode (.class files). For static analysis at the source-code level, the first step is to decompile the bytecode into a human-readable representation. Fuzz testing is dynamic analysis, converting to a .so file is unrelated, and disassembling the Java interpreter is not required.
Question 17
A penetration tester achieves shell access. The tester tries to use the following command, but it fails:
netsh advfirewall set domainprofile state off
Which of the following should the tester do to help correct this issue?
A. Find other attack paths.
B. Perform privilege escalation.
C. Validate the target system's fingerprint.
D. Gather more data about the network.
Show Answer
Correct Answer: B
Explanation: The 'netsh advfirewall set domainprofile state off' command modifies Windows Firewall configuration and requires administrative privileges. If the tester has shell access but the command fails due to insufficient permissions, the appropriate next step is to perform privilege escalation to obtain elevated rights before retrying the command.
Question 18
After exploiting a vulnerability in an insecure service to gain access to a Linux system, a penetration tester executes the following commands:
sudo -l
route
netstat -a
last
who
Which of the following best describes the tester's purpose for running these commands?
A. To obtain information about other systems in the network
B. To enumerate users and services in order to identify additional targets
C. To prepare for establishing persistence on the system
D. To gather data to prepare for lateral movement
Show Answer
Correct Answer: D
Explanation: The commands are typical post-compromise reconnaissance used to assess opportunities for moving further through an environment. `sudo -l` checks privilege escalation possibilities, `route` identifies reachable networks, `netstat -a` reveals network connections and listening services, `last` shows historical logins, and `who` identifies currently logged-in users. Together, these provide information useful for identifying pivot paths and preparing for lateral movement rather than persistence alone or merely enumerating local users/services.
Question 19
Which of the following best describes the importance of including the attack steps in a penetration test report?
A. It easily provides the recommended mitigations.
B. It ensures results can be independently verified.
C. It proves the penetration tester's competency to the customer.
D. It demonstrates the difficulty of exploiting specific vulnerabilities in the kill chain.
Show Answer
Correct Answer: B
Explanation: Including detailed attack steps enables another tester or the customer to reproduce the exploit path, validate the findings, and confirm the reported results. Reproducibility is a key characteristic of a useful penetration test report. Attack steps are not primarily for listing mitigations, proving tester competence, or demonstrating kill chain difficulty.
Question 20
A penetration tester is conducting an assessment of offline systems that control a power plant. The tester is looking for vulnerabilities observable in the network stack. The rules of engagement state that the tester cannot interact with production systems. Which of the following tools or techniques should the tester use for the assessment?
A. Port mirroring
B. Storyboarding
C. Write blocker
D. SAST tool
Show Answer
Correct Answer: A
Explanation: Port mirroring (SPAN) passively copies network traffic to a monitoring port, allowing analysis of network-stack behavior and potential vulnerabilities without transmitting traffic to or interacting with production systems. Storyboarding is a planning/documentation technique, a write blocker is for forensic disk acquisition, and a SAST tool analyzes source code rather than live network traffic.
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.