A penetration tester creates the following Python script that can be used to enumerate information about email accounts on a target mail server:
Which of the following logic constructs would permit the script to continue despite failure?
A. Add a do/while loop.
B. Add an iterator.
C. Add a try/except block.
D. Add an if/else conditional.
Show Answer
Correct Answer: C
Explanation: In Python, failures such as connection errors or authentication errors raise exceptions. Wrapping the risky operations in a try/except block allows the script to catch those exceptions, handle them, and continue executing instead of terminating. An if/else cannot handle exceptions, an iterator only controls looping, and Python has no native do/while construct.
Question 42
During a security assessment of an e-commerce website, a penetration tester wants to exploit a vulnerability in the web server’s input validation that will allow unauthorized transactions on behalf of the user. Which of the following techniques would most likely be used for that purpose?
A. Privilege escalation
B. DOM injection
C. Session hijacking
D. Cross-site scripting
Show Answer
Correct Answer: D
Explanation: The question specifies a vulnerability in the web server’s input validation that allows unauthorized transactions on behalf of a user. Poor input validation most directly leads to cross-site scripting (XSS), where attacker-supplied input is executed as script in the victim’s browser. XSS can trigger actions such as submitting forms or making purchases using the victim’s active session, effectively performing transactions as that user. Session hijacking is often a consequence of XSS, not the underlying technique tied to input validation.
Question 43
A penetration tester uses a pair of crutches to access a client's physical location. Which of the following is the tester most likely trying to do?
A. Tailgating
B. Impersonation
C. Badge cloning
D. Lock picking
Show Answer
Correct Answer: A
Explanation: Using crutches is a social‑engineering prop to exploit courtesy so that someone else opens or holds a secured door. The tester is not assuming a specific identity or role, but relying on human kindness to be let through, which aligns with tailgating rather than impersonation.
Question 44
With one day left to complete the testing phase of an engagement, a penetration tester obtains the following results from an Nmap scan:
Which of the following tools should the tester use to quickly identify a potential attack path?
A. msfvenom
B. SearchSploit
C. sqlmap
D. BeEF
Show Answer
Correct Answer: B
Explanation: With limited time remaining, the tester needs a fast way to turn Nmap service and version information into likely attack paths. SearchSploit directly maps discovered services and versions to known public exploits, quickly highlighting viable attack vectors. The other tools focus on payload generation (msfvenom), specific attack types like SQL injection (sqlmap), or client-side browser exploitation (BeEF), and are not suited for rapid attack path identification from scan results.
Question 45
A penetration tester observes the following output from an Nmap command while attempting to troubleshoot connectivity to a Linux server.
Which of the following is the most likely reason for the connectivity issue?
A. The SSH service is running on a different port.
B. The SSH service is blocked by a firewall.
C. The SSH service requires certificate authentication.
D. The SSH service is not active.
Show Answer
Correct Answer: A
Explanation: The Nmap output indicates that SSH is listening on a non-default port (e.g., 2222/tcp). Attempting to connect on the default port 22 would fail even though the service is running and reachable, making a different SSH port the most likely cause.
Question 46
During a penetration test, the tester identifies several unused services that are listening on all targeted internal laptops:
Which of the following technical controls should the tester recommend to reduce the risk of compromise?
A. Multifactor authentication
B. Patch management
C. System hardening
D. Network segmentation
Show Answer
Correct Answer: C
Explanation: The risk comes from unnecessary services listening on hosts, which increases the attack surface. System hardening specifically involves disabling unused services, closing unnecessary ports, and securely configuring systems. MFA, patch management, and network segmentation do not directly address the presence of unnecessary listening services on individual laptops.
Question 47
A penetration tester needs to evaluate the security of example.com and gather stealthy information using DNS. Which of the following is the best tool for the tester to use?
A. Nikto
B. InSSIDer
C. masscan
D. Recon-ng
Show Answer
Correct Answer: D
Explanation: The goal is stealthy information gathering using DNS. Recon-ng is a reconnaissance and OSINT framework that includes DNS enumeration, WHOIS lookups, and other passive techniques suitable for stealth. Nikto focuses on web vulnerability scanning, InSSIDer on Wi‑Fi analysis, and masscan on fast port scanning, none of which are DNS-focused or stealthy recon tools.
Question 48
A penetration tester identifies an exposed corporate directory containing first and last names and phone number for employees. Which of the following attack techniques would be the most effective to pursue if the penetration tester wants to compromise user accounts?
A. Smishing
B. Impersonation
C. Tailgating
D. Whaling
Show Answer
Correct Answer: A
Explanation: The exposed directory provides employees’ phone numbers, which are directly exploitable via SMS-based social engineering. Smishing allows an attacker to send convincing text messages containing malicious links or fake credential prompts to compromise user accounts. Impersonation is a broader technique but less specific, tailgating is a physical attack, and whaling targets executives specifically, which is not indicated here.
Question 49
During a penetration testing engagement, a tester targets the internet-facing services used by the client. Which of the following describes the type of assessment that should be considered in this scope of work?
A. Segmentation
B. Mobile
C. External
D. Web
Show Answer
Correct Answer: C
Explanation: The scope targets internet-facing services from outside the client’s network, which defines an external penetration test. This focuses on assets exposed to the public internet (e.g., web servers, VPNs, mail, remote access) and is broader than just web applications.
Question 50
A penetration tester is conducting a vulnerability scan. The tester wants to see any vulnerabilities that may be visible from outside of the organization. Which of the following scans should the penetration tester perform?
A. SAST
B. Sidecar
C. Unauthenticated
D. Host-based
Show Answer
Correct Answer: C
Explanation: The tester wants to identify vulnerabilities visible from outside the organization, which means scanning without any credentials or internal access. An unauthenticated scan shows what an external attacker can see. SAST is source code analysis, sidecar relates to container architectures, and host-based scans require internal agents, so they do not fit this scenario.
$19
Get all 220 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.