During a penetration test, the tester configures a backdoor to maintain access to a compromised system. In addition, the tester keeps a time card on the desktop of the compromised host. Which of the following is the most important activity for the tester to perform after the engagement concludes?
A. Revert configuration changes.
B. Preserve artifacts.
C. Remove persistence mechanisms.
D. Secure the data destruction.
Show Answer
Correct Answer: C
Explanation: The highest-priority post-engagement cleanup activity is removing any persistence mechanisms (such as backdoors) that were installed during testing. Leaving persistence in place creates an ongoing security risk. While reverting configuration changes and cleaning up artifacts are also part of proper teardown, eliminating unauthorized persistent access is the most critical action. No web search results were provided, so there are no supporting URLs.
Question 82
During an engagement, a penetration tester discovers a web application vulnerability that affects multiple devices. The tester creates and runs the following script:
Which of the following best describes what the tester is attempting to do?
A. Staging payloads to make bind shells
B. Creating a backdoor on several weak targets
C. Adding a password for the root user on the targets
D. Generating SSH keys to decrypt data on each target
Show Answer
Correct Answer: B
Explanation: Appending an attacker's public SSH key to the root user's authorized_keys file across multiple vulnerable systems establishes persistent remote access without needing the original password. This is creating a backdoor on multiple targets, not staging bind shells, changing the root password, or generating keys to decrypt data.
Question 83
A penetration tester would like to collect permission details for objects within the domain. The tester has a valid AD user and access to an internal PC. Which of the following sets of steps is the best way for the tester to accomplish the desired outcome?
A. 1. Escalate privileges. 2. Execute Rubeus. 3. Run a Cypher query on Rubeus to get the results.
B. 1. Run SharpHound. 2. Install CrackMapExec. 3. Perform a CrackMapExec database query on CME to get the results.
C. 1. Run SharpHound 2. Install BloodHound. 3. Perform a Cypher query on BloodHound to get the results.
D. 1. Escalate privileges. 2. Get Windows Registry data. 3. Perform a query to get results.
Show Answer
Correct Answer: C
Explanation: SharpHound is the data collection component that gathers Active Directory objects, relationships, and ACL/permission information using a valid domain user. BloodHound ingests the collected data and uses Cypher queries to analyze and retrieve permission paths and object relationships. Rubeus focuses on Kerberos operations, CrackMapExec is not the primary tool for this graph analysis workflow, and privilege escalation is not required simply to enumerate AD permissions available to the authenticated user.
Question 84
A penetration tester attempts to access a domain-joined Windows file server that requires authentication for access. Which of the following will most likely assist in gaining access?
A. Intercept proxy chains with tcpdump.
B. Create a reverse shell payload with msfvenom.
C. Generate a silver ticket with Impacket.
D. Conduct a relay attack using Responder.
Show Answer
Correct Answer: D
Explanation: A relay attack using Responder can capture and relay NTLM authentication attempts to a target service, potentially allowing authenticated access to a domain-joined file server if protections such as SMB signing are not enforced. A silver ticket requires prior compromise of the service account key, so it is not the most likely initial access method. Tcpdump proxy chains are unrelated, and msfvenom reverse shells do not solve the authentication requirement.
Question 85
An internal penetration tester is on site assessing network access for company-owned mobile devices. Which of the following would be the best tool to identify the available networks?
A. Wireshark
B. theHarvester
C. Recon-ng
D. WiGLE.net
Show Answer
Correct Answer: D
Explanation: WiGLE.net is specifically designed to discover, map, and identify wireless networks and access points, making it the best choice for identifying available networks during an on-site assessment of company-owned mobile devices. Wireshark captures and analyzes traffic rather than discovering nearby wireless networks, while theHarvester and Recon-ng are OSINT reconnaissance tools, not wireless network discovery tools.
Question 86
During a web application assessment, a penetration tester accesses the site unauthenticated and receives the following Set-Cookie on the first response:
auth=yYKGORbrpabgr842ajbvrpbptaui42342
When the tester logs in, the server sends only one Set-Cookie header, and the value is exactly the same as shown above. Which of the following vulnerabilities has the tester discovered?
A. JWT manipulation
B. Cookie poisoning
C. Session fixation
D. Collision attack
Show Answer
Correct Answer: C
Explanation: The application issues a session cookie to an unauthenticated user and fails to generate a new session identifier after successful authentication. Reusing the same session ID across the authentication boundary is the classic condition that enables session fixation, where an attacker can pre-establish or predict a victim's session identifier and have it become authenticated.
Question 87
During an internal engagement, a penetration tester compromises a Linux server. The tester wants to maintain persistence without creating or modifying files on the disk or startup scripts, since these are monitored by integrity tools. Which of the following techniques best meets these requirements?
A. Installing a systemd service that connects back to the C2 server
B. Injecting a reverse shell payload into an existing running process
C. Creating a new cron job that launches a shell on reboot
D. Adding a new user account with sudo privileges for future access
Show Answer
Correct Answer: B
Explanation: Injecting a reverse shell payload into an existing running process is a fileless technique that operates in memory and does not require creating or modifying files, systemd services, cron jobs, or startup scripts. While it only persists for the lifetime of the compromised process or until reboot, it best matches the stated requirement of avoiding disk and startup modifications monitored by file integrity tools.
Question 88
Which of the following is the most likely LOLBin to be used to perform an exfiltration on a Microsoft Windows environment?
A. procdump.exe
B. msbuild.exe
C. bitsadmin.exe
D. cscript.exe
Show Answer
Correct Answer: C
Explanation: bitsadmin.exe is a legitimate Windows LOLBin that uses the Background Intelligent Transfer Service (BITS) to transfer files over HTTP/HTTPS or SMB, making it a common choice for stealthy file transfer and data exfiltration. The other options are commonly abused for different purposes: procdump.exe for memory dumps, msbuild.exe for proxy execution of code, and cscript.exe for executing scripts rather than primarily transferring data.
Question 89
A penetration tester wants to gather the names of potential phishing targets who have access to sensitive data. Which of the following would best meet this goal?
A. WHOIS
B. Censys.io
C. SpiderFoot
D. theHarvester
Show Answer
Correct Answer: D
Explanation: theHarvester is an OSINT reconnaissance tool specifically designed to collect email addresses, employee names, usernames, hosts, and subdomains from public sources, making it well suited for identifying potential phishing targets. WHOIS provides domain registration information, Censys.io focuses on internet-exposed assets, and SpiderFoot is a broader OSINT automation platform rather than the most targeted choice for gathering employee names and emails.
Question 90
A penetration tester is conducting an on-site review and wants to capture SSO credentials for staff in a specific department. Which of the following attack types would be most effective for this task?
A. Captive portal
B. Signal jamming
C. WPS PIN attack
D. Channel scanning
Show Answer
Correct Answer: A
Explanation: A captive portal is the most effective option for capturing SSO credentials during an on-site assessment because it can present a spoofed authentication page and collect users' login credentials. Signal jamming only disrupts wireless communications, a WPS PIN attack targets Wi-Fi network access rather than SSO credentials, and channel scanning is a reconnaissance technique that does not capture credentials.
$19
Get all 342 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.