A penetration tester completes an authenticated vulnerability scan of a host and receives the following results:
Which of the following is most likely to cause stability when a session is created on a target machine?
A. Running Responder with default settings and using Impacket
B. Running Nmap with safe scripts enabled and targeting RDP
C. Running Metasploit utilizing the EternalBlue module
D. Running Hydra on the local user at one attempt per second
Show Answer
Correct Answer: C
Explanation: The scan indicates a Windows 7 host with SMB signing disabled, making it a plausible target for EternalBlue (MS17-010). Exploiting it with Metasploit is the option most likely to cause system instability or a crash while establishing a session.
Question 20
A penetration tester is conducting an assessment of offline systems that control a power plant. The tester is looking for vulnerabilities observable in the network stack. The rules of engagement state that the tester cannot interact with production systems. Which of the following tools or techniques should the tester use for the assessment?
A. Port mirroring
B. Storyboarding
C. Write blocker
D. SAST tool
Show Answer
Correct Answer: A
Explanation: Port mirroring (SPAN) passively copies network traffic to a monitoring port, allowing analysis of network-stack behavior and potential vulnerabilities without transmitting traffic to or interacting with production systems. Storyboarding is a planning/documentation technique, a write blocker is for forensic disk acquisition, and a SAST tool analyzes source code rather than live network traffic.
Question 21
During a penetration test for a client that has a diverse infrastructure, the tester scans the network using Nmap and observes the following output:
Which of the following would most likely be the target device?
A. Switch
B. SCADA
C. IoT
D. Router
Show Answer
Correct Answer: C
Explanation: Port 1883 is commonly used by MQTT, a lightweight messaging protocol frequently used by IoT devices. The open SSH and HTTP ports are less specific, so an IoT device is the most likely target.
Question 21
A tester infiltrates the internal network 10.10.0.0/22 and wants to discover hosts for further engagement activities. The tester tries to use the ping command to discover hosts, but no hosts on the network reply. The tester then uses the following command to discover hosts:
nmap -Pn -sS -p161 10.10.0.0/22
Which of the following best describes what the tester is attempting to do?
A. Discover other hosts using a different tool.
B. Look for hosts with open SNMP services.
C. Look for hosts responding open or closed.
D. Look for hosts responding filtered.
E. Conduct a full port scan on the network.
Show Answer
Correct Answer: C
Explanation: The command uses -Pn to skip ICMP host discovery and treat all targets as up, then performs a TCP SYN scan (-sS) only against port 161. The objective is to identify hosts that respond with either SYN/ACK (open) or RST (closed), because either TCP response confirms the host is alive even when ping is blocked. While port 161 is commonly associated with SNMP, the technique is being used for host discovery via TCP responses rather than specifically to enumerate SNMP services.
Question 22
A penetration tester reviews the following output:
Which of the following most likely describes the function of this system?
A. Enterprise mail server
B. Honeypot
C. Stand-alone web server
D. Domain Controller
Show Answer
Correct Answer: B
Explanation: This is most likely a honeypot: the service mix is unusually broad and inconsistent, combining Windows domain-controller indicators (Kerberos, LDAP, SMB, IIS) with Debian OpenSSH and Squid proxy services. That combination suggests a system designed to attract and observe probing rather than a typical production server.
Question 22
A tester conducts a web application penetration test and discovers a hidden diagnostics page. The hidden diagnostics page allows a user to ping other systems and test connectivity. Which of the following payloads is best suited to test this function?
A. ; whoami ; ps aux
B. alert(l)
C. ' SELECT @@version --
D. ../../../../../../etc/passwd
Show Answer
Correct Answer: A
Explanation: A hidden diagnostics page that invokes a system utility such as ping is a classic target for OS command injection testing. The payload '; whoami ; ps aux' attempts to terminate the intended command and execute additional operating system commands, revealing whether unsanitized input is passed to the shell. The other options target different vulnerabilities: B tests XSS, C tests SQL injection, and D tests path traversal.
Question 23
After completing vulnerability scans for a given test, a penetration tester needs to prioritize which potential assets are in scope and should be exploited first. Given the following scanner output:
Which of the following findings should the tester prioritize first based upon a consideration of risk to the organization?
A. 1
B. 2
C. 3
D. 4
Show Answer
Correct Answer: B
Explanation: Finding 2 is the highest-priority risk: MS08-067 can enable remote code execution, and the affected payroll system likely contains highly sensitive business data. The other findings are either less severe or appear less firmly validated by the scanner evidence.
Question 23
While engaged in a penetration testing exercise, the tester needs to find all wireless access points that are near the principal building. Which of the following techniques could the penetration tester use to achieve this goal?
A. Wardriving
B. Rogue access point
C. Side-channel attack
D. Evil twin attack
Show Answer
Correct Answer: A
Explanation: Wardriving is the technique of moving through an area with wireless scanning equipment to discover and map nearby wireless access points and Wi-Fi networks. A rogue access point and an evil twin are attack setups, not discovery techniques, and a side-channel attack targets information leakage rather than identifying wireless infrastructure.
Question 24
A penetration tester wants to download sensitive files stored on the client's file server and runs the following scan:
Which of the following TCP ports should the penetration tester target as a next step?
A. 21
B. 22
C. 80
D. 990
Show Answer
Correct Answer: D
Explanation: Port 990 is open and identified as FTPS, a secure file-transfer service, making it the most relevant next target for downloading files. Port 21 (FTP) is closed; port 22 is open for SSH, but the scan does not identify it as a file-transfer service.
Question 24
A penetration tester needs to enumerate domains, subdomains, and ports that belong to comptia.org. Which of the following tools will provide the most comprehensive information?
A. nslookup/dig
B. theHarvester
C. Shodan
D. Aircrack-ng
Show Answer
Correct Answer: B
Explanation: theHarvester is purpose-built for OSINT reconnaissance and can enumerate domains, subdomains, hosts, email addresses, and other publicly available information about a target. While it is not a port scanner itself, it provides a more comprehensive reconnaissance capability for discovering a target's external footprint than nslookup/dig. Shodan indexes exposed services and ports but is not primarily a domain/subdomain enumeration tool. Aircrack-ng is for wireless security testing.
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
