A tester infiltrates the internal network 10.10.0.0/22 and wants to discover hosts for further engagement activities. The tester tries to use the ping command to discover hosts, but no hosts on the network reply. The tester then uses the following command to discover hosts:
nmap -Pn -sS -p161 10.10.0.0/22
Which of the following best describes what the tester is attempting to do?
A. Discover other hosts using a different tool.
B. Look for hosts with open SNMP services.
C. Look for hosts responding open or closed.
D. Look for hosts responding filtered.
E. Conduct a full port scan on the network.
Show Answer
Correct Answer: C
Explanation: The command uses -Pn to skip ICMP host discovery and treat all targets as up, then performs a TCP SYN scan (-sS) only against port 161. The objective is to identify hosts that respond with either SYN/ACK (open) or RST (closed), because either TCP response confirms the host is alive even when ping is blocked. While port 161 is commonly associated with SNMP, the technique is being used for host discovery via TCP responses rather than specifically to enumerate SNMP services.
Question 22
A tester conducts a web application penetration test and discovers a hidden diagnostics page. The hidden diagnostics page allows a user to ping other systems and test connectivity. Which of the following payloads is best suited to test this function?
A. ; whoami ; ps aux
B. alert(l)
C. ' SELECT @@version --
D. ../../../../../../etc/passwd
Show Answer
Correct Answer: A
Explanation: A hidden diagnostics page that invokes a system utility such as ping is a classic target for OS command injection testing. The payload '; whoami ; ps aux' attempts to terminate the intended command and execute additional operating system commands, revealing whether unsanitized input is passed to the shell. The other options target different vulnerabilities: B tests XSS, C tests SQL injection, and D tests path traversal.
Question 23
While engaged in a penetration testing exercise, the tester needs to find all wireless access points that are near the principal building. Which of the following techniques could the penetration tester use to achieve this goal?
A. Wardriving
B. Rogue access point
C. Side-channel attack
D. Evil twin attack
Show Answer
Correct Answer: A
Explanation: Wardriving is the technique of moving through an area with wireless scanning equipment to discover and map nearby wireless access points and Wi-Fi networks. A rogue access point and an evil twin are attack setups, not discovery techniques, and a side-channel attack targets information leakage rather than identifying wireless infrastructure.
Question 24
A penetration tester needs to enumerate domains, subdomains, and ports that belong to comptia.org. Which of the following tools will provide the most comprehensive information?
A. nslookup/dig
B. theHarvester
C. Shodan
D. Aircrack-ng
Show Answer
Correct Answer: B
Explanation: theHarvester is purpose-built for OSINT reconnaissance and can enumerate domains, subdomains, hosts, email addresses, and other publicly available information about a target. While it is not a port scanner itself, it provides a more comprehensive reconnaissance capability for discovering a target's external footprint than nslookup/dig. Shodan indexes exposed services and ports but is not primarily a domain/subdomain enumeration tool. Aircrack-ng is for wireless security testing.
Question 25
A penetration tester cannot use Nmap and must perform port discovery and banner grabbing for potential vulnerable SSH services. Given the following script:
Which of the following commands will best help the tester achieve this objective?
A. ping -с 22 "$ip_address$i"
B. nc "$ip_address$i" ":22"
C. arp "$ip_address$i" ":22"
D. curl scp://"$ip_address$i" ":22"
Show Answer
Correct Answer: B
Explanation: Netcat (nc) can establish a TCP connection to port 22, allowing the tester to determine whether the SSH service is listening and read the initial SSH banner (for example, an OpenSSH version string). The other options do not perform TCP port discovery and banner grabbing for SSH: ping uses ICMP, arp is for address resolution, and curl with an scp URL is not appropriate for generic SSH banner enumeration.
Question 26
During a vulnerability assessment, a penetration tester finds the following information:
KRBTGT account with more than 1250 days without password change.
Which of the following tools could an attacker use to exploit this vulnerability?
A. Mimikatz
B. John the Ripper
C. Hashcat
D. Hydra
Show Answer
Correct Answer: A
Explanation: A stale KRBTGT password enables Golden Ticket attacks if an attacker obtains the KRBTGT hash. Mimikatz is the well-known tool used to extract Kerberos secrets and forge Golden Tickets. John the Ripper and Hashcat are password cracking tools, and Hydra is an online login brute-force tool.
Question 27
A penetration tester identifies multiple connections to public LLMs. The client's IT team has not authorized the use of all of these LLMs. Which of the following best describes the risk to the client?
A. Accidental loss of internal data
B. Public disclosure of intellectual property
C. Exfiltration of employee credentials
D. Prompt injection vulnerability
Show Answer
Correct Answer: A
Explanation: Unauthorized use of public LLMs creates a data leakage risk because employees may submit sensitive internal information to external AI services that are not approved or governed by the organization. This is best described as accidental loss of internal data. The other options are either more specific or unrelated to merely detecting unauthorized LLM usage.
Question 28
A penetration tester gains access to a desktop within a corporate network and wants to move laterally within the network. Which of the following Metasploit plug-ins is best for this task?
A. exploit/windows/smb/smb_delivery
B. exploit/windows/smb/smb_shadow
C. exploit/windows/smb/ms03_049_netapi
D. exploit/windows/smb/psexec
Show Answer
Correct Answer: D
Explanation: The Metasploit exploit/windows/smb/psexec module is the standard choice for lateral movement on Windows networks because it uses SMB and valid credentials (or suitable authentication material) to execute payloads remotely on other hosts. The other options are either specialized, legacy vulnerability exploits, or not appropriate as a general lateral movement technique.
Question 29
A penetration tester discovers exposed cloud storage buckets and needs to access the contents. Which of the following should the tester do?
A. Protocol fingerprinting
B. Credential brute forcing
C. Service discovery
D. Secrets enumeration
Show Answer
Correct Answer: D
Explanation: The best answer is D. After identifying exposed cloud storage buckets, a penetration tester should perform secrets enumeration to identify exposed access keys, tokens, credentials, or other sensitive information that can enable access to the bucket contents or related cloud resources. Protocol fingerprinting and service discovery are reconnaissance techniques, and credential brute forcing is generally inappropriate and not the primary step in this scenario.
Question 30
During an assessment of a company, a penetration tester sends the following email to the company's Chief Financial Officer (CFO):
Dear CFO,
As we talked about during a recent meeting, please open the following attachment that contains the invoice for an existing vendor. If you do not pay this now, we will suspend the licenses for your billing system in three days.
GoPay CMS Systems Services -
Which of the following techniques is this attack an example of?
A. Whaling
B. Phishing
C. Spear phishing
D. Vishing
Show Answer
Correct Answer: A
Explanation: This is a whaling attack. Whaling is a specialized form of spear phishing that targets high-profile executives such as CEOs and CFOs. The email is specifically crafted for the CFO, uses contextual details to appear legitimate, and attempts to trick the executive into opening a malicious attachment under a sense of urgency.
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.