During a red-team exercise, a penetration tester obtains an employee's access badge. The tester uses the badge's information to create a duplicate for unauthorized entry. Which of the following best describes this action?
A. Smurfing
B. Credential stuffing
C. RFID cloning
D. Card skimming
Show Answer
Correct Answer: C
Explanation: The action described involves copying the data from an employee access badge to create a duplicate for unauthorized entry. Modern access badges typically use RFID or NFC technology, and duplicating them by copying their stored data is known as RFID cloning. The other options describe unrelated attacks such as DDoS (smurfing), automated password attacks (credential stuffing), or theft of magnetic stripe payment card data (card skimming).
Question 62
A penetration tester is attempting to discover vulnerabilities in a company's web application. Which of the following tools would most likely assist with testing the security of the web application?
A. OpenVAS
B. Nessus
C. sqlmap
D. Nikto
Show Answer
Correct Answer: D
Explanation: Nikto is a dedicated web server and web application security scanner that checks for common vulnerabilities, misconfigurations, outdated components, and insecure files. While sqlmap is excellent for exploiting SQL injection specifically, Nikto is the more general-purpose tool for testing overall web application security, which best fits the question.
Question 63
A penetration tester writes the following script to enumerate a /24 network:
The tester executes the script, but it fails with the following error:
-bash: syntax error near unexpected token ‘ping’
Which of the following should the tester do to fix the error?
A. Add do after line 2.
B. Replace {1..254} with $(seq 1 254).
C. Replace bash with zsh.
D. Replace $i with $[i].
Show Answer
Correct Answer: A
Explanation: The error occurs because a Bash for-loop requires the keyword `do` to begin the loop body. Without `do`, Bash encounters `ping` unexpectedly and throws a syntax error. Adding `do` after the loop declaration fixes the syntax.
Question 64
Which of the following components should a penetration tester include in an assessment report?
A. User activities
B. Customer remediation plan
C. Key management
D. Attack narrative
Show Answer
Correct Answer: D
Explanation: A penetration testing report should clearly describe how the tester achieved access and demonstrated impact. An attack narrative documents the step-by-step attack path, including exploitation, privilege escalation, and lateral movement. User activities, key management, or a full customer remediation plan are not core components of a pentest report.
Question 65
Which of the following could be used to enhance the quality and reliability of a vulnerability scan report?
A. Risk analysis
B. Peer review
C. Root cause analysis
D. Client acceptance
Show Answer
Correct Answer: B
Explanation: Peer review directly enhances the quality and reliability of a vulnerability scan report by validating findings, reducing false positives/negatives, and improving clarity and consistency. The other options relate to prioritization, remediation, or post-report acceptance rather than improving the report itself.
Question 66
A penetration tester is performing a cloud-based penetration test against a company. Stakeholders have indicated the priority is to see if the tester can get into privileged systems that are not directly accessible from the internet. Given the following scanner information:
Server-side request forgery vulnerability in test.comptia.org
Reflected cross-site scripting vulnerability in test2.comptia.org
Publicly accessible storage system named static_comptia_assets
SSH port 22 open to the intemet on test3.comptia.org
Open redirect vulnerability in test4.comptia.org
Which of the following of the attack paths should the tester prioritize first?
A. Synchronize all the information from the public bucket and scan it with Trufflehog.
B. Run Pacu to enumerate permissions and roles within the cloud-based systems.
C. Perform a full dictionary brute-force attack against the open SSH service using Hydra.
D. Use the reflected cross-site scripting attack within a phishing campaign to attack administrators.
E. Leverage the SSRF to gain access to credentials from the metadata service.
Show Answer
Correct Answer: E
Explanation: The goal is to access privileged, non-internet-facing systems. A server-side request forgery vulnerability can be leveraged to query the cloud provider’s instance metadata service, which often exposes temporary IAM credentials or tokens. Those credentials can then be used to pivot into internal and privileged cloud resources. The other options are noisier, indirect, or require credentials first, making SSRF-to-metadata the highest-priority attack path.
Question 67
A penetration tester discovers data to stage and exfiltrate. The client has authorized movement to the tester’s attacking hosts only. Which of the following would be most appropriate to avoid alerting the SOC?
A. Apply UTF-8 to the data and send over a tunnel to TCP port 25.
B. Apply Base64 to the data and send over a tunnel to TCP port 80.
C. Apply 3DES to the data and send over a tunnel UDP port 53.
D. Apply AES-256 to the data and send over a tunnel to TCP port 443.
Show Answer
Correct Answer: D
Explanation: To avoid alerting the SOC, the exfiltration method should blend into normal, authorized traffic while protecting the data. AES-256 provides strong, modern encryption, ensuring confidentiality of the staged data. TCP port 443 carries HTTPS traffic, which is ubiquitous, encrypted by default, and commonly allowed outbound, making it far less suspicious than SMTP, HTTP, or DNS tunneling. The other options rely on simple encodings (UTF-8, Base64) or use protocols/ports that are more likely to be inspected or flagged. Therefore, AES-256 over TCP 443 is the most appropriate choice.
Question 68
During a discussion of a penetration test final report, the consultant shows the following payload used to attack a system:
?/<sCRitP>aLeRt("pwned")</ScriPt>
Based on the code, which of the following options represents the attack executed by the tester and the associated countermeasure?
A. Arbitrary code execution; the affected computer should be placed on a perimeter network
B. SQL injection attack; should be detected and prevented by a web application firewall
C. Cross-site request forgery; should be detected and prevented by a firewall
D. XSS obfuscated; should be prevented by input sanitization
Show Answer
Correct Answer: D
Explanation: The payload is a mixed‑case <script>alert("pwned")</script>, which is a classic reflected/stored XSS attempt using simple obfuscation to bypass filters. It executes JavaScript in the victim’s browser, not on the server (so not arbitrary code execution), involves no SQL (not SQLi), and does not force authenticated actions (not CSRF). Proper countermeasures include input sanitization and output encoding (often complemented by CSP).
Question 69
A penetration tester wants to attack a server, exhausting its resources and making it unavailable to legitimate users. Which of the following attacks would be best to achieve this result?
A. IP spoofing
B. TCP hijacking
C. Port redirection
D. SYN flooding
Show Answer
Correct Answer: D
Explanation: The objective is to exhaust server resources and deny service. A SYN flooding attack overwhelms the target with half-open TCP connections by sending many SYN requests without completing the handshake, consuming connection tables and resources until legitimate users cannot connect. The other options do not directly cause resource exhaustion.
Question 70
While conducting an assessment, a penetration tester identifies the details for several unreleased products announced at a company-wide meeting. Which of the following attacks did the tester most likely use to discover this information?
A. Eavesdropping
B. Bluesnarfing
C. Credential harvesting
D. SQL injection attack
Show Answer
Correct Answer: A
Explanation: Unreleased product details discussed during a company-wide meeting would most likely be obtained by listening in on private conversations or communications. This aligns with eavesdropping. The other options involve Bluetooth device attacks, stealing credentials, or exploiting databases, none of which fit the scenario.
$19
Get all 220 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.