A penetration tester is using OSINT to identify client email addresses found on the web for a phishing campaign. Which of the following is the best search operator for the tester to use?
A. site:
B. intitle:
C. intext:
D. inurl:
Show Answer
Correct Answer: C
Explanation: The `intext:` operator searches the body text of indexed web pages, making it the most appropriate operator for locating email addresses that appear in page content. While `site:` restricts results to a specific domain and can be combined with other operators, by itself it does not specifically search for email addresses. `intitle:` searches page titles, and `inurl:` searches URLs, neither of which is well suited to finding email addresses.
Question 32
During an engagement, a penetration tester decides to use social engineering to capture MFA. Which of the following tools or configuration commands should the tester use?
A. Evilginx
B. use phish/domains/o365 set SOURCE portal.office.com run
C. wget portal.office.com export MFA=' '
D. Recon-ng
Show Answer
Correct Answer: A
Explanation: Evilginx is a reverse-proxy phishing framework used in authorized penetration tests to capture credentials and authenticated session cookies/tokens, including those associated with MFA flows. The other options are not appropriate tools or valid commands for capturing MFA in this context.
Question 33
A penetration tester searches for an entry point into a client’s network. The tester focuses on publicly available devices that may have exploitable weaknesses. Which of the following should the penetration tester use?
A. Shodan
B. Hunter.io
C. WiGLE.net
D. theHarvester
Show Answer
Correct Answer: A
Explanation: Shodan is a search engine for internet-facing devices and services, allowing penetration testers to identify publicly accessible hosts that may have exploitable vulnerabilities or misconfigurations. Hunter.io finds email addresses, WiGLE maps wireless networks, and theHarvester gathers OSINT such as emails, domains, and hosts but is not specifically focused on discovering exposed internet-connected devices.
Question 34
A penetration tester was able to capture the credentials for multiple employees by posting a QR code that navigates users to a malicious domain in the client's cafeteria. Which of the following attack techniques did the penetration tester most likely use?
A. Tailgating
B. Watering hole
C. Vishing
D. Shoulder surfing
Show Answer
Correct Answer: B
Explanation: The attack relied on placing a malicious QR code in a location frequently visited by employees, enticing them to browse to a malicious website and submit credentials. This aligns most closely with a watering hole-style technique, where attackers target users through a location or resource they commonly use. It is not tailgating (physical access), vishing (voice phishing), or shoulder surfing (observing someone enter credentials).
Question 35
Which of the following is necessary during preengagement activities to proceed with an engagement?
A. Client acceptance
B. Statement of work
C. Risk scoring
D. Peer review
Show Answer
Correct Answer: B
Explanation: A Statement of Work (SOW) is a required preengagement document that defines the scope, objectives, rules of engagement, timeline, deliverables, and provides the authorization and agreement needed before the engagement proceeds. Client acceptance is part of the business relationship, but the specific preengagement artifact required to proceed with the engagement is the SOW.
Question 36
A penetration tester reviews a scan report and identifies a deserialization vulnerability. The vulnerability is due to the way a function from a Python library has been used in code. The scan does not consider input data being used in the function's serialization. Which of the following scan types most likely provided this finding?
A. DAST
B. SAST
C. IAST
D. SCA
Show Answer
Correct Answer: B
Explanation: SAST analyzes source code and can identify insecure use of library functions, such as unsafe deserialization patterns, without executing the application or relying on runtime input. The clue that the finding is based on how a Python library function is used in code, and that input data flow into the serialization is not considered, points to static analysis rather than DAST, IAST, or SCA.
Question 37
A penetration tester wants to laterally move and escalate privileges. The tester uses BloodHound to obtain the following information:
regular.user → AdminTo → WS-MAINT-02
Domain Admin has active session on WS-MAINT-02
Before executing any attack, the tester observes the following:
• There are no tickets in memory.
• An existing Group Policy blocks the token manipulation tool.
Which of the following attacks is the best way to achieve the tester's goal?
A. Pass-the-hash
B. Pass-the-token
C. Kerberoasting
D. Pass-the-ticket
Show Answer
Correct Answer: A
Explanation: BloodHound indicates the user has administrative access to WS-MAINT-02, where a Domain Admin has an active session. Pass-the-ticket is not viable because there are no Kerberos tickets in memory, and pass-the-token is blocked because token manipulation is prevented by Group Policy. Kerberoasting targets service account ticket extraction and does not directly leverage the active admin session for lateral movement. With administrative access to the workstation, obtaining and using an NTLM hash for pass-the-hash is the best fit to laterally move and escalate privileges.
Question 38
A penetration tester establishes a remote session to a host and receives the following prompt:
rpcclient $>
Which of the following is the tester most likely be able to do?
A. Query local users on the system.
B. Obtain SAM database password hashes.
C. Enumerate session tokens.
D. Change the Resultant Set of Group Policy applied in A
Show Answer
Correct Answer: A
Explanation: The rpcclient prompt indicates a connection to Windows RPC services over SMB. A common use of rpcclient is enumerating information such as local users, groups, shares, and other SAMR/LSA data (subject to permissions). It does not directly dump SAM password hashes, enumerate session tokens, or modify Group Policy Resultant Set.
Question 39
Which of the following are the most important considerations when using generative AI to assist in writing a penetration testing report? (Choose two.)
A. Specify which large language model and version is being used.
B. Verify the training data that the model is using is relevant
C. Ensure a human reviews the accuracy of summaries.
D. Protect client data from being ingested into a model.
E. Review the model's output for potential bias.
F. Compare the model's output to another large language model's output.
Show Answer
Correct Answer: C, D
Explanation: The key considerations when using generative AI for penetration testing reports are ensuring a human validates the accuracy of AI-generated summaries, since models can produce errors or omissions, and protecting sensitive client data from being exposed or ingested by AI systems. Other options may be useful in some contexts but are not the primary security and quality concerns.
Question 40
During an internal penetration test, the tester uses the following command:
C:\ Invoke-mimikatz.ps1 "kerberos::golden /domain:test.local /sid:S-1-5-21-3234... /target: dc01.test.local /service:CIFS /RC4:237749d82.... /user:support.test.local /ptt"
Which of the following best describes the tester's goal when executing this command?
A. Bypassing normal authentication
B. Enumerating shares
C. Obtaining current user credentials
D. Using password spraying
Show Answer
Correct Answer: A
Explanation: The command uses Mimikatz' kerberos::golden module to forge a Kerberos Golden Ticket using the domain SID and KRBTGT RC4 hash, then injects it into the current session with /ptt (Pass-the-Ticket). This allows authentication to services such as CIFS without legitimate credentials, effectively bypassing normal Kerberos authentication.
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.