There is a low-level shell on a system, and a penetration tester has discovered a service with system-level privileges that is available in the following directory structure:
objectpath\imagepath=C:\Program Files\New Folder\bin\cutepanda.exe
Which of the following is the most likely attack the tester should perform on the host?
A. Unquoted service path injection
B. Process hollowing injection
C. Library injection
D. User-controlled access bypass
Show Answer
Correct Answer: A
Explanation: The service executable path contains spaces and is not enclosed in quotation marks. On Windows, an unquoted service path can cause the Service Control Manager to search for executables at truncated path segments (for example, `C:\Program.exe`), allowing an attacker who can write to one of those locations to place a malicious executable that may run with the service's SYSTEM privileges when the service starts. This is the classic unquoted service path vulnerability.
Question 52
During an assessment, a penetration tester wants to escalate privileges and run the following command:
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=
A. Create an ELF exploit.
B. Enumerate ports.
C. Create a listener.
D. Create a shell payload.
Show Answer
Correct Answer: D
Explanation: The msfvenom command with the payload linux/x86/meterpreter/reverse_tcp generates a reverse Meterpreter shell payload. The LHOST/LPORT parameters configure where the payload connects back, and additional options such as -f elf determine the output format. The command itself is for generating the payload, not enumerating ports or creating a listener.
Question 53
Which of the following agreement types best describes the methodology and duration conditions of a penetration testing service?
A. ToS
B. NDA
C. MSA
D. SoW
Show Answer
Correct Answer: D
Explanation: A Statement of Work (SoW) defines the specific details of a penetration testing engagement, including the scope, methodology, timeline/duration, deliverables, and rules of engagement. An MSA establishes the overarching business relationship, an NDA covers confidentiality, and Terms of Service define general service terms rather than engagement-specific testing methodology and duration.
Question 54
A penetration tester scans for services to exploit and finds that a web server is running on TCP port 443 on IP telephony devices. Which of the following attack techniques should the tester try first?
A. Forging cross-site requests
B. Injecting Session Initiation Protocol packets
C. Obtaining and using default credentials
D. Performing remote file inclusion
E. Executing a pass-the-hash attack
Show Answer
Correct Answer: C
Explanation: TCP port 443 on IP telephony devices typically indicates an HTTPS-based web administration interface. A common and effective initial attack is to test for vendor default credentials, as many VoIP phones, PBXs, and related appliances are deployed without changing the factory username/password. The other options are either specific to different protocols or require additional vulnerabilities or prior access.
Question 55
While running a social engineering campaign, a penetration tester gets a list of employees from social media and now wants to conduct a phishing exercise. Which of the following should the tester use first?
A. Wayback Machine
B. Hunter.io
C. SpiderFoot
D. Social Engineering Toolkit
Show Answer
Correct Answer: B
Explanation: The tester already has employee names from social media but needs corporate email addresses before conducting a phishing exercise. Hunter.io is designed to discover and verify company email addresses and email address patterns, making it the appropriate first step. The Social Engineering Toolkit is used to create and manage phishing campaigns after targets and addresses are identified. Wayback Machine and SpiderFoot are reconnaissance tools but are not the most direct next step here.
Question 56
Which of the following is the part of a penetration test report that contains an explanation about how testing is performed?
A. Scope of work
B. Methodology
C. Detailed findings
D. Executive summary
Show Answer
Correct Answer: B
Explanation: The methodology section describes how the penetration test was performed, including the testing approach, phases, tools, techniques, and any standards or frameworks followed. The scope of work defines what is in scope, detailed findings document discovered vulnerabilities, and the executive summary provides a high-level overview for stakeholders.
Question 57
A penetration tester identifies indicators that company employees might be using company product names in their passwords. Which of the following tools should the tester use to create the best word list for a further attack phase?
A. Webkiller
B. Crunch
C. CeWL
D. hashcat
Show Answer
Correct Answer: C
Explanation: CeWL (Custom Word List Generator) crawls a target website and builds a custom wordlist from discovered terms such as company names, product names, project names, and other organization-specific vocabulary. This makes it the best choice for generating a targeted password wordlist when employees may use company product names in their passwords. Crunch generates wordlists from specified patterns, hashcat is primarily a password cracking tool, and Webkiller is not the appropriate wordlist-generation tool for this purpose.
Question 58
Given the following output snippet that was generated during the reconnaissance phase of a penetration test:
Which of the following line numbers represent the most likely vulnerability to be used by the penetration tester? (Choose two.)
A. 09
B. 12
C. 13
D. 14
E. 15
F. 16
Show Answer
Correct Answer: C, D
Explanation: The most likely exploitable findings are the weak 3DES cipher suite (TLS_DH_RSA_WITH_3DES_SHA) and the use of 1024-bit Diffie-Hellman parameters, which are deprecated and associated with practical cryptographic weaknesses such as SWEET32 (3DES) and LOGJAM (weak DH). Client cipher preference is generally a configuration weakness rather than the primary vulnerability.
Question 59
A penetration tester gains access to a Linux system and creates the following script:
Which of the following is the objective of this script?
A. Share enumeration
B. Directory enumeration
C. DNS enumeration
D. Protocol enumeration
Show Answer
Correct Answer: A
Explanation: The referenced script appears to use the Linux `showmount -e` command, which lists NFS exports (shared directories) available from remote hosts. Enumerating exported NFS shares is network share enumeration, not DNS, protocol, or general directory enumeration.
Question 60
A penetration tester conducts reconnaissance and looks for ways to obtain administrator emails to use in a phishing campaign. Which of the following tools should the penetration tester use?
A. DIG
B. Nmap
C. WHOIS
D. Shodan
Show Answer
Correct Answer: C
Explanation: WHOIS is commonly used during reconnaissance to retrieve publicly available domain registration information, which may include administrative or technical contact email addresses (depending on registration privacy and data availability). DIG queries DNS records, Nmap scans hosts and services, and Shodan indexes internet-connected devices rather than providing domain contact information.
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.