A penetration tester identifies the following vulnerability during a scan of the company's network:
An Nmap scan of the affected device produces the following results:
Which of the following best describes this scenario?
A. True negative
B. True positive
C. False negative
D. False positive
Show Answer
Correct Answer: D
Explanation: A false positive occurs when a scan reports a vulnerability that is not actually present. In this scenario, the scan output indicates an issue (e.g., related to HTTP/HTTPS), but the service is either closed or secured with TLS, meaning the reported vulnerability does not exist in reality. Therefore, the finding is a false positive.
Question 32
Which of the following should be included in a penetration test report to support the tester's detailed findings?
A. Methodologies
B. Screenshots
C. Vulnerabilities
D. Remediations
Show Answer
Correct Answer: B
Explanation: A penetration test report includes evidence that substantiates the tester’s findings. Screenshots provide concrete, visual proof of successful exploitation or observed issues, directly supporting detailed findings. Methodologies describe approach, vulnerabilities list issues, and remediations suggest fixes, but none of those alone serve as direct evidence.
Question 33
A penetration tester is configuring a vulnerability management solution to perform credentialed scans of an Active Directory server. Which of the following account types should the tester provide to the scanner?
A. Read-only
B. Domain administrator
C. Local user
D. Root
Show Answer
Correct Answer: B
Explanation: For a credentialed vulnerability scan of an Active Directory server, the scanner must be able to access system configuration, registry, services, patches, and domain-level settings. A Domain Administrator account provides the necessary privileges across the domain and on the AD server itself. A read-only or local user account lacks sufficient permissions, and root is not applicable to Windows environments.
Question 34
During a penetration test, a junior tester uses Hunter.io for an assessment and plans to review the information that will be collected. Which of the following describes the information the junior tester will receive from the Hunter.io tool?
A. A collection of email addresses for the target domain that is available on multiple sources on the internet
B. DNS records for the target domain and subdomains that could be used to increase the external attack surface
C. Data breach information about the organization that could be used for additional enumeration
D. Information from the target's main web page that collects usernames, metadata, and possible data exposures
Show Answer
Correct Answer: A
Explanation: Hunter.io is an OSINT email enumeration platform. It discovers and verifies email addresses associated with a target domain by aggregating data from publicly available sources on the internet. It does not primarily provide DNS records, breach data, or webpage scraping details.
Question 35
A penetration tester enters an invalid user ID on the login page of a web application. The tester receives a message indicating the user is not found. Then, the tester tries a valid user ID but an incorrect password, but the web application indicates the password is invalid. Which of the following should the tester attempt next?
A. Error log analysis
B. DoS attack
C. Enumeration
D. Password dictionary attack
Show Answer
Correct Answer: C
Explanation: The application returns different error messages for an invalid username versus an invalid password, which discloses whether a user ID exists. This indicates a username enumeration vulnerability. The appropriate next step is to perform enumeration to identify valid user accounts before attempting further attacks.
Question 36
A penetration tester is getting ready to conduct a vulnerability scan to evaluate an environment that consists of a container orchestration cluster. Which of the following tools would be best to use for this purpose?
A. NSE
B. Nessus
C. CME
D. Trivy
Show Answer
Correct Answer: D
Explanation: The environment is a container orchestration cluster, which requires tooling that understands container images, Kubernetes components, and cloud‑native configurations. Trivy is purpose‑built for this use case, providing vulnerability scanning for container images, Kubernetes clusters, manifests, and related infrastructure. Nessus is a general network vulnerability scanner, NSE is a scripting engine for Nmap, and CME targets Active Directory environments, making them less suitable here.
Question 37
A penetration tester successfully gains access to a Linux system and then uses the following command:
find / -type f -ls > /tmp/recon.txt
Which of the following best describes the tester's goal?
A. Permission enumeration
B. Secrets enumeration
C. User enumeration
D. Service enumeration
Show Answer
Correct Answer: A
Explanation: The command `find / -type f -ls` recursively lists every regular file on the system with detailed metadata similar to `ls -l`, including permissions, ownership, and inode information, and saves it to a file. This is primarily used to enumerate file permissions and ownership across the system, which is permission enumeration—not secrets, users, or services.
Question 38
Which of the following can an access control vestibule help deter?
A. USB drops
B. Badge cloning
C. Lock picking
D. Tailgating
Show Answer
Correct Answer: D
Explanation: An access control vestibule (mantrap) enforces one-person-at-a-time entry and requires authentication before proceeding, which specifically deters tailgating. It does not meaningfully address USB drops, badge cloning, or lock picking.
Question 39
During an engagement, a penetration tester wants to enumerate users from Linux systems by using finger and rwho commands. However, the tester realizes these commands alone will not achieve the desired result. Which of the following is the best tool to use for this task?
A. Nikto
B. Burp Suite
C. smbclient
D. theHarvester
Show Answer
Correct Answer: C
Explanation: finger and rwho provide limited local/legacy user information and require services to be exposed. To enumerate users across Linux systems, querying network services is more effective. smbclient can connect to Samba (SMB/CIFS) services commonly running on Linux hosts and enumerate shares and user/account information. Nikto and Burp Suite are web-focused tools, and theHarvester is an OSINT tool, not suitable for direct Linux user enumeration.
Question 40
A penetration tester obtained a shell on a Windows system. Which of the following would the tester use to gather more information about the host?
A. mmc.exe
B. icacls.exe
C. nltest.exe
D. winver.exe
Show Answer
Correct Answer: C
Explanation: After obtaining a Windows shell, a tester wants quick host and domain enumeration. nltest.exe is a built-in command-line tool that reveals Active Directory–related information such as domain membership, domain controllers, trusts, and secure channel status, which is highly valuable for situational awareness and further lateral movement. mmc.exe is a GUI console, icacls.exe focuses narrowly on file permissions, and winver.exe only shows basic OS version info.
$19
Get all 220 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.