A customer permits connections from inside its network to all IPs that belong to a publicly available cloud-hosting company. Which of the following unauthorized occurrence is most likely based on this description?
A. Direct access to the client’s systems
B. Data exfiltration to another tenant
C. Access to the cloud management plane
D. Disclosure of supply chain partners
Show Answer
Correct Answer: B
Explanation: Permitting outbound connections to all IP ranges owned by a public cloud provider creates an easy channel for an attacker to send stolen data to infrastructure they control within that provider. Because public clouds are multi-tenant environments, the attacker can host a VM, storage account, or service as another tenant and exfiltrate data over traffic that appears to be going to an allowed destination.
Question 72
A penetration tester creates a Netcat listener on a compromised server. The tester wants to establish persistence in case the server is restarted. Which of the following will best achieve this goal?
A. python3 -m http.server
B. nc -l 22
C. crontab -e
D. ssh user@targethost
Show Answer
Correct Answer: C
Explanation: The best way to achieve persistence for a Netcat listener across system reboots is to configure it to start automatically. Editing the user's crontab with `crontab -e` allows creation of an `@reboot` job that launches the Netcat listener whenever the system starts. The other options either start unrelated services, launch a non-persistent listener, or initiate an SSH session without providing persistence.
Question 73
A penetration tester wants to perform static analysis of Android Package Kits. Which of the following is one step the penetration tester must take to enable this type of analysis?
A. Load the package file into a binary reverse-engineering tool.
B. Port the application from ARM to x86-64.
C. Re-sign the application using 256-bit RSA.
D. Convert Dalvik executables to Java class files.
Show Answer
Correct Answer: D
Explanation: Static analysis of Android APKs typically involves extracting the Dalvik Executable (.dex) bytecode and converting it into Java-compatible form (commonly via dex2jar or decompilers like JADX) so the application's code can be inspected. The other options are not required steps for enabling static APK analysis.
Question 74
A penetration tester wants to bypass multifactor authentication by intercepting traffic between the client and a web server. Which of the following is the most appropriate tool for this task?
A. Gophish
B. Recon-ng
C. BeEF
D. Evilginx
E. Yersinia
Show Answer
Correct Answer: D
Explanation: Evilginx is an adversary-in-the-middle (AiTM) reverse proxy framework designed to proxy authentication traffic, capture credentials and authenticated session cookies/tokens, enabling assessment of MFA bypass via session hijacking. The other tools serve different purposes: Gophish is for phishing campaigns, Recon-ng for reconnaissance, BeEF for browser exploitation after compromise, and Yersinia targets Layer 2 network protocols.
Question 75
A penetration tester is assessing the security of a web application. When the tester attempts to access the application, the tester receives an HTTP 403 response. Which of the following should the penetration tester do to overcome this issue?
A. Reset file and folder permissions on the web server.
B. Obtain a valid X.509 certificate.
C. Spoof the server's MAC address.
D. Use a legacy browser to access the page.
Show Answer
Correct Answer: B
Explanation: An HTTP 403 Forbidden response means the server understood the request but refuses to authorize it. In secure web applications, this can occur when client certificate authentication (mutual TLS) is required. Presenting a valid X.509 client certificate can satisfy that requirement. The other options do not address a client-side authorization refusal: resetting server permissions is an administrative server task, spoofing a server MAC address is irrelevant to HTTP access, and using a legacy browser does not bypass a 403.
Question 76
A penetration tester conducts OSINT for a client and discovers the robots.txt file explicitly blocks a major search engine. Which of the following would most likely help the penetration tester achieve the objective?
A. Modifying the WAF
B. Utilizing a CSRF attack
C. Changing the robots.txt file
D. Leveraging a competing provider
Show Answer
Correct Answer: D
Explanation: The robots.txt file only provides voluntary crawling directives to search engines and does not prevent access to content. If one major search engine is explicitly blocked, a penetration tester performing OSINT can often use another search provider that may have indexed the site or is not subject to the same restriction. Modifying the WAF or robots.txt is outside the scope of passive OSINT, and a CSRF attack is unrelated.
Question 77
A penetration tester attempts to obtain the preshared key for a client's wireless network. Which of the following actions will most likely aid the tester?
A. Deploying an evil twin with a WiFi Pineapple
B. Performing a password spraying attack with Hydra
C. Setting up a captive portal using SET
D. Deauthenticating clients using aireplay-ng
Show Answer
Correct Answer: D
Explanation: Deauthenticating clients with aireplay-ng forces connected WPA/WPA2-PSK clients to disconnect and reconnect, generating the 4-way handshake. Capturing this handshake enables an offline password-cracking attempt against the preshared key. The other options target credential phishing or online password attacks rather than obtaining a WPA/WPA2-PSK handshake for PSK recovery.
Question 78
During an assessment, a penetration tester manages to get RDP access via a low-privilege user. The tester attempts to escalate privileges by running the following commands:
Import-Module .\PrintNightmare.psi
Invoke-Nightmare -NewUser "hacker" -NewPassword "Password123!" -DriverName "Print"
The tester attempts to further enumerate the host with the new administrative privileges by using the runas command. However, the access level is still low. Which of the following actions should the penetration tester take next?
A. Log off and log on with the hacker account.
B. Attempt to add another user.
C. Bypass the execution policy.
D. Add a malicious printer driver.
Show Answer
Correct Answer: A
Explanation: Invoke-Nightmare creates a new local administrator account, but administrative group membership is applied to a new logon token. Using runas within the existing context may not provide the expected elevated administrative token. The appropriate next step is to start a new logon session by logging off and logging back on as the newly created account.
Question 79
A penetration tester obtains local administrator access on a Windows system and wants to attempt lateral movement. The system exists within a Windows Workgroup environment. Which of the following actions should the tester take?
A. Create a malicious certificate.
B. Dump credentials from memory.
C. Craft Kerberos tickets.
D. List potential privilege escalation paths.
Show Answer
Correct Answer: B
Explanation: In a Windows Workgroup there is no Active Directory domain or Kerberos infrastructure, so crafting Kerberos tickets is not applicable. With local administrator access, dumping credentials from memory (e.g., cached plaintext credentials or NTLM hashes) can provide reusable credentials for lateral movement to other systems, especially where local administrator passwords are reused. Creating a malicious certificate is unrelated here, and listing privilege escalation paths is unnecessary since local administrator access has already been obtained.
Question 80
A penetration tester gains access to a host with many applications that load at startup and run as SYSTEM. The penetration tester runs a command and receives the following output:
Which of the following attacks will most likely allow the penetration tester to escalate privileges?
A. Credential dumping
B. Local file inclusion
C. Unquoted service path injection
D. Process hijacking
Show Answer
Correct Answer: C
Explanation: An unquoted service path vulnerability occurs when a Windows service running with high privileges (such as SYSTEM) has an executable path containing spaces that is not enclosed in quotation marks. Windows may search for executables along the truncated path, allowing an attacker who can write to one of those locations to place a malicious executable that will be run with SYSTEM privileges when the service starts. The other options do not specifically match the described startup service misconfiguration.
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.