Which of the following elements of a penetration test report can be used to most effectively prioritize the remediation efforts for all the findings?
A. Methodology
B. Detailed findings list
C. Risk score
D. Executive summary
Show Answer
Correct Answer: C
Explanation: The risk score directly ranks findings by severity and likelihood, often using standardized frameworks like CVSS, making it the most effective element for prioritizing remediation efforts. Other sections provide context or detail but do not clearly indicate which issues should be addressed first.
Question 82
During an assessment, a penetration tester sends the following request:
POST /services/v1/users/create HTTP/1.1
Host: target-application.com -
Content-Type: application/json -
Content-Length: [dynamic]
Authorization: Bearer [FUZZE]
Which of the following attacks is the penetration tester performing?
A. Directory traversal
B. API abuse
C. Server-side request forgery
D. Privilege escalation
Show Answer
Correct Answer: B
Explanation: The tester is sending a POST request to an API endpoint and fuzzing the Authorization Bearer token to observe whether improper authentication or authorization handling allows unintended actions (such as creating users). This behavior is characteristic of API abuse testing. It is not directory traversal (no file paths), not SSRF (no attempt to make the server issue outbound requests), and not privilege escalation itself—though privilege escalation could be a possible outcome of successful API abuse.
Question 83
Which of the following frameworks can be used to classify threats?
A. PTES
B. STRIDE
C. OSSTMM
D. OCTAVE
Show Answer
Correct Answer: B
Explanation: STRIDE is a threat modeling framework specifically designed to classify threats into categories (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege). PTES, OSSTMM, and OCTAVE are security testing or risk assessment methodologies rather than threat classification frameworks.
Question 84
A penetration tester successfully gained access to manage resources and services within the company’s cloud environment. This was achieved by exploiting poorly secured administrative credentials that had extensive permissions across the network. Which of the following credentials was the tester able to obtain?
A. IAM credentials
B. SSH key for cloud instance
C. Cloud storage credentials
D. Temporary security credentials (STS)
Show Answer
Correct Answer: A
Explanation: The scenario describes compromised administrative credentials with extensive permissions to manage cloud resources and services. That level of broad control is characteristic of IAM credentials, which define identities and permissions across the cloud environment. SSH keys are limited to individual instances, storage credentials are scoped to data access, and STS credentials are temporary and typically delegated rather than long-lived administrative access.
Question 85
While performing reconnaissance, a penetration tester attempts to identify publicly accessible ICS and IoT systems. Which of the following tools is most effective for this task?
A. theHarvester
B. Shodan
C. Amass
D. Nmap
Show Answer
Correct Answer: B
Explanation: Shodan is specifically designed to discover and index internet-connected devices, including ICS and IoT systems. It allows searching and filtering by device type, service, port, and location across the public internet, making it far more effective for identifying exposed control systems than domain enumerators (theHarvester, Amass) or active scanners like Nmap.
Question 86
A penetration tester needs to obtain sensitive data from several executives who regularly work while commuting by train. Which of the following methods should the tester use for this task?
A. Shoulder surfing
B. Credential harvesting
C. Bluetooth spamming
D. MFA fatigue
Show Answer
Correct Answer: A
Explanation: Executives working on laptops or mobile devices in a public setting like a train can have sensitive information visually observed. Shoulder surfing involves directly observing screens, keystrokes, or documents in public spaces, making it the most appropriate method. The other options are technical or remote attacks that do not rely on physical proximity.
Question 87
Which of the following will reduce the possibility of introducing errors or bias in a penetration test report?
A. Secure distribution
B. Peer review
C. Use AI
D. Goal reprioritization
Show Answer
Correct Answer: B
Explanation: Peer review directly reduces errors and bias by having another qualified professional examine the report for inaccuracies, omissions, unclear reasoning, and subjective bias. Secure distribution protects confidentiality, AI is only an assistive tool and cannot reliably judge context or bias, and goal reprioritization affects scope rather than report accuracy.
Question 88
During a testing engagement, a penetration tester compromises a host and locates data for exfiltration. Which of the following are the best options to move the data without triggering a data loss prevention tool? (Choose two.)
A. Move the data using a USB flash drive.
B. Compress and encrypt the data.
C. Rename the file name extensions.
D. Use FTP for exfiltration.
E. Encode the data as Base64.
F. Send the data to a commonly trusted service.
Show Answer
Correct Answer: B, F
Explanation: Data loss prevention tools primarily rely on content inspection and policy-based trust of destinations. Compressing and encrypting the data prevents the DLP from inspecting sensitive content and signatures, significantly reducing detection. Exfiltrating data via a commonly trusted service blends the transfer into normal, allowed traffic (e.g., sanctioned cloud or SaaS platforms), which is less likely to raise alerts compared to uncommon protocols or obvious channels.
Question 89
During a penetration testing exercise, a team decides to use a watering hole strategy. Which of the following is the most effective approach for executing this attack?
A. Compromise a website frequently visited by the organization's employees.
B. Launch a DDoS attack on the organization's website.
C. Create fake social media profiles to befriend employees.
D. Send phishing emails to the organization's employees.
Show Answer
Correct Answer: A
Explanation: A watering hole attack involves compromising a legitimate website that the target organization’s employees frequently visit, so that when they access it they are unknowingly infected. Option A directly matches this definition. The other options describe different attack types such as DDoS, social engineering, or phishing.
Question 90
A penetration tester is preparing a password-spraying attack against a known list of users for the company "example." The tester is using the following list of commands:
1. pw-inspector -i $allwords | tee $pass
2. spray365.py spray -ep $plan
3. users="~/user.txt"; allwords="~/words.txt"; pass="~/passwords.txt"; plan="~/spray.plan"
4. spray365.py generate --password_file $pass --user file $user --domain "example.com" --execution_plan $plan
5. cewl -m 5 "http://www.example.com" -w $allwords
Which of the following is the correct order for the list of the commands?
A. 3, 4, 1, 2, 5
B. 3, 1, 2, 5, 4
C. 2, 3, 1, 4, 5
D. 3, 5, 1, 4, 2
Show Answer
Correct Answer: D
Explanation: First define shell variables (3). Then gather candidate words from the target site using cewl into $allwords (5). Next, process and filter those words with pw-inspector to produce a password list (1). Use that password list and the known users to generate the spray execution plan (4). Finally, execute the password-spraying attack using the generated plan (2).
$19
Get all 220 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.