Which of the following is most likely a function of the legal department?
A. Shared responsibility model
B. Third-party responsibilities
C. Authorization letters
D. Rules of engagement
Show Answer
Correct Answer: C
Explanation: The legal department commonly prepares, reviews, or approves authorization letters (letters of authorization) that provide formal permission and define the legal authorization for activities such as penetration testing. Rules of engagement are typically developed collaboratively with security and project stakeholders, while shared responsibility models and third-party responsibilities are broader governance or contractual concepts rather than core legal department functions.
Question 42
A penetration tester uses Burp Suite to send the following request:
Which of the following options best describes what the tester is executing?
A. SQL injection
B. Session hijack
C. Brute-force attack on usernames or/and password
D. Cross-site scripting
Show Answer
Correct Answer: A
Explanation: The described Burp Suite request uses a payload such as ' or ' in a login parameter to alter the backend SQL query and attempt to bypass authentication. That is a classic SQL injection technique, not session hijacking, brute-forcing, or cross-site scripting.
Question 43
Given the following output:
Which of the following did the penetration tester most likely execute?
A. Exploits on discovered hosts and services
B. A series of Nmap scans for host discovery
C. An automated script to confirm true positives
D. A ping sweep of the 10.0.10.0/24 network segment
Show Answer
Correct Answer: C
Explanation: The described output aligns with an automated validation script that checks previously identified findings (such as confirming anonymous FTP access) to reduce false positives, rather than initial host discovery, a ping sweep, or active exploitation.
Question 44
A penetration tester is struggling to gain access to a target system. The tester uses the Social-Engineer Toolkit to set up a deceptive email campaign that only targets the company's senior executives. Which of the following types of social engineering attacks is the tester leveraging?
A. Spear phishing
B. Vishing
C. Whaling
D. Watering hole
Show Answer
Correct Answer: C
Explanation: Whaling is a specialized form of spear phishing that targets senior executives or other high-value individuals within an organization. Because the email campaign is aimed only at the company's senior executives, it is a whaling attack. Vishing uses voice calls, and a watering hole attack compromises a site frequented by targets rather than sending deceptive emails.
Question 45
Which of the following implements the "five whys" methodology during the execution phase of a penetration testing engagement?
A. STRIDE
B. OCTAVE
C. Root cause analysis
D. Articulation of risk
Show Answer
Correct Answer: C
Explanation: The 'five whys' is a classic root cause analysis technique that repeatedly asks why an issue occurred to identify the underlying cause. STRIDE is a threat modeling framework, OCTAVE is a risk assessment methodology, and articulation of risk describes communicating risk rather than performing causal analysis.
Question 46
During a penetration test, the tester uses a vulnerability scanner to collect information about any possible vulnerabilities that could be used to compromise the network. The tester receives the results and then executes the following command:
snmpwalk -v 2c -c public 192.168.1.23
Which of the following is the tester trying to do based on the command they used?
A. Bypass defensive systems to collect more information.
B. Use an automation tool to perform the attacks.
C. Script exploits to gain access to the systems and host.
D. Validate the results and remove false positives.
Show Answer
Correct Answer: D
Explanation: The command 'snmpwalk -v 2c -c public 192.168.1.23' manually queries the target's SNMP service using the common community string 'public'. After a vulnerability scanner identifies a potential issue, this manual step is used to verify whether SNMP is actually accessible and exposing information, confirming the finding and helping eliminate false positives rather than exploiting the system or bypassing defenses.
Question 47
A security analyst reviews the following output while assessing server configurations for weaknesses:
Which of the following observations best represents the key takeaways from this data?
A. SSH is configured on a non-standard port.
B. HTTP is redirecting to HTTPS.
C. The chosen algorithms provide forward secrecy.
D. The preference should be changed to client.
Show Answer
Correct Answer: C
Explanation: The key takeaway from TLS cipher suite output showing ECDHE-based suites is that the configuration supports forward secrecy. ECDHE generates ephemeral session keys, so compromise of the server's long-term private key does not allow past captured sessions to be decrypted. The other options require evidence such as SSH port configuration, HTTP redirect behavior, or server/client cipher preference, which is not indicated by the described TLS algorithm output.
Question 48
A penetration tester runs a network scan and sees the following results:
Which of the following public exploits would most likely succeed against the target system?
A.
B.
C.
D.
Show Answer
Correct Answer: D
Explanation: The prompt indicates a network scan showing a Windows host with SMB open on TCP port 445. The well-known public exploit that targets vulnerable SMBv1 on port 445 is EternalBlue (MS17-010), making that the most likely successful exploit based on the described scan.
Question 49
A red team member is attempting to gain persistence on a Windows 10 target. Every time the red team member runs the script under the current user, the script fails to execute and renders the following:
C:\user\bbell\scheduledtasks.psl cannot be loaded because running scripts is disabled on this
Which of the following should the red team member do to most likely get the script to execute?
A. Review the script for proper syntax.
B. Ensure proper runtime libraries are installed.
C. Check for proper user permissions.
D. Use the -ExecutionPolicy Bypass flag.
Show Answer
Correct Answer: D
Explanation: The error message 'running scripts is disabled on this system' indicates PowerShell's execution policy is blocking the script. Launching PowerShell with the -ExecutionPolicy Bypass flag temporarily bypasses the execution policy for that process, allowing the script to execute. The other options do not address this specific execution policy error.
Question 50
A penetration tester observes that an employee repeatedly attempted to modify /etc/fstab on a client's file server without success. Which of the following is the most likely reason the employee targeted this file?
A. To escalate privileges
B. To execute an SSRF attack
C. To remove persistence mechanisms
D. To mount a new drive
Show Answer
Correct Answer: D
Explanation: The /etc/fstab (filesystem table) file defines filesystems and storage devices to be mounted, especially at boot. A user attempting to modify it is most likely trying to add or configure a mount for a new local or network drive. It is not primarily used for SSRF, privilege escalation, or removing persistence mechanisms.
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.