During an assessment, a penetration tester runs the following command: setspn.exe -Q */*
Which of the following attacks is the penetration tester preparing for?
A. LDAP injection
B. Pass-the-hash
C. Kerberoasting
D. Dictionary
Show Answer
Correct Answer: C
Explanation: The command `setspn.exe -Q */*` enumerates all Service Principal Names (SPNs) in Active Directory. This enumeration is a prerequisite for Kerberoasting, where the tester requests Kerberos service tickets (TGS) for SPNs and cracks them offline to recover service account passwords.
Question 72
A penetration tester attempts to run an automated web-application scanner against a target URL. The tester validates that the web page is accessible from a different device. The tester analyzes the following HTTP request header logging output:
Which of the following actions should the tester take to get the scans to work properly?
A. Modify the scanner to slow down the scan.
B. Change the source IP with a VPN.
C. Modify the scanner to only use HTTP GET requests.
D. Modify the scanner user agent.
Show Answer
Correct Answer: D
Explanation: The HTTP logs indicate the application responds normally when requests use a standard browser User-Agent (e.g., Mozilla/5.0) but blocks or ignores requests from automated tools (curl/python). This points to simple bot or User-Agent filtering. Modifying the scanner’s User-Agent to mimic a real browser will allow the requests to be accepted and the scan to run properly.
Question 73
A penetration tester runs a vulnerability scan that identifies several issues across numerous customer hosts. The executive report outlines the following information:
The client is concerned about the availabilty of its consumer-facing production application. Which of the following hosts should the penetration tester select for additional manual testing?
A. Server 1
B. Server 2
C. Server 3
D. Server 4
Show Answer
Correct Answer: C
Explanation: The client is concerned with availability of the consumer-facing production application. The perimeter network web server (Server 3) is most likely hosting the production application exposed to customers. Even with fewer vulnerabilities than non-production systems, issues on this host directly impact customer availability and therefore warrant additional manual testing.
Question 74
Which of the following describes the process of determining why a vulnerability scanner is not providing results?
A. Root cause analysis
B. Secure distribution
C. Peer review
D. Goal reprioritization
Show Answer
Correct Answer: A
Explanation: Determining why a vulnerability scanner is not providing results involves identifying the underlying cause of a problem, which is the purpose of root cause analysis. The other options relate to distribution, review, or changing priorities rather than troubleshooting.
Question 75
A penetration tester is authorized to perform a DoS attack against a host on a network. Given the following input:
Which of the following attack types is most likely being used in the test?
A. MDK4
B. Smurf attack
C. FragAttack
D. SYN flood
Show Answer
Correct Answer: D
Explanation: The attack sends a continuous stream of TCP packets with the SYN flag set and random source ports without completing the TCP three-way handshake. This behavior is characteristic of a SYN flood DoS attack, which exhausts the target’s connection resources. The other options relate to Wi‑Fi–specific attacks or ICMP-based amplification, which do not match the TCP SYN traffic described.
Question 76
A tester obtains access to an endpoint subnet and wants to move laterally in the network. Given the following output:
Which of the following command and attack methods is the most appropriate for reducing the chances of being detected?
A. responder -I eth0 -dwv ntlmrelayx.py -smb2support -tf <target>
B. msf > use exploit/windows/smb/ms17_010_psexec msf > <set options> msf > run
C. hydra -L administrator -P /path/topasswdlist smb: //<target>
D. nmap --script smb-brute.nse -p 445 <target>
Show Answer
Correct Answer: A
Explanation: The scan indicates SMB is accessible with message signing disabled, which enables NTLM relay attacks. Using Responder with ntlmrelayx captures and relays NTLM authentication without brute forcing or exploiting vulnerabilities, making it significantly quieter and less detectable than password attacks or MS17-010 exploitation.
Question 77
A penetration tester is developing the rules of engagement for a potential client. Which of the following would most likely be specified in the rules of engagement?
A. Testing window
B. Terms of service
C. Authorization letter
D. Shared responsibilities
Show Answer
Correct Answer: A
Explanation: Rules of engagement define the scope and conduct of a penetration test, including when testing is allowed to occur. A testing window (dates and times) is a core RoE element. An authorization letter is a separate legal document, terms of service apply to product use, and shared responsibilities relate to cloud service models, not pentesting RoE.
Question 78
A penetration tester wants to identify all the TLS versions used in a web service in order to determine potentially insecure versions. Which of the following commands should the tester use?
A. nmap --script ssl-enum-ciphers
B. curl --tls-max 3
C. wget --server-response
D. openssl version
Show Answer
Correct Answer: A
Explanation: The goal is to enumerate all TLS versions supported by a web service. The Nmap NSE script ssl-enum-ciphers actively probes the target and reports supported SSL/TLS protocol versions and cipher suites, including weak or deprecated ones. The other options do not enumerate server-supported TLS versions: curl --tls-max only sets a client limit, wget shows HTTP headers, and openssl version reports the local OpenSSL library version.
Question 79
A penetration tester needs to confirm the version number of a client’s web-application server. Which of the following techniques should the penetration tester use?
A. SSL certificate inspection
B. URL spidering
C. Banner grabbing
D. Directory brute forcing
Show Answer
Correct Answer: C
Explanation: To confirm the version number of a web-application server, the tester should use banner grabbing. Service banners returned during HTTP/HTTPS connections often disclose the server software name and version, making this a standard reconnaissance technique. URL spidering and directory brute forcing enumerate content, not versions, and SSL certificate inspection does not reliably reveal server version details.
Question 80
Which of the following methods should a physical penetration tester employ to access a rarely used door that has electronic locking mechanisms?
A. Lock picking
B. Impersonating
C. Jamming
D. Tailgating
E. Bypassing
Show Answer
Correct Answer: E
Explanation: A rarely used door with electronic locking is best accessed by bypassing the control or locking mechanism itself (e.g., exploiting wiring, panels, or design flaws). Other methods rely on people being present (impersonation, tailgating), mechanical locks (lock picking), or merely disrupting signals without unlocking (jamming).
$19
Get all 220 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.