Penetration Testing and Vulnerability Analysis Practice Exam

These questions are part of the practice quiz. Start practicing

• To perform VLAN hopping, which action should the tester take?
• Which statement best describes the role of Docker Bench in security testing?
• To confirm the application version reported by a vulnerability scan, which scripting approach is recommended?
• MD5 produces how many possible hash values?
• What is the role of a multihomed host in a network penetration test?
• As a penetration tester, you are tasked with conducting a social engineering assessment to evaluate the susceptibility of an organization to phishing attacks. You need to choose a tool that allows you to perform phishing campaigns and potentially bypass multi-factor authentication (MFA). Which of the following tools should you use?
• Which of the following steps ensures that the organization's senior management has formally approved the test, acknowledges the risks, and outlines responsible parties and legal considerations?
• When automating host discovery in a target subnet, which approach BEST enhances efficiency and accuracy?
• Which statement best captures the relationship between offline password cracking and hash exfiltration during a pentest?
• During the client acceptance phase of a penetration test, which action is MOST important?
• In Metasploit, which module type is used to perform additional tasks on a compromised host after exploitation?
• What action should be taken to preserve artifacts after a penetration test?
• Which method is MOST effective for identifying valid usernames in a Windows-based domain using Kerberos?
• Which tool is used to search a Git repository for secrets that could be committed accidentally?
• Which action is typically performed during post-engagement cleanup to ensure the environment returns to its pre-test state?
• To validate vulnerabilities effectively, which approach is recommended?
• What is the primary purpose of conducting a site survey in a physical security pentest?
• What does increasing the hash output size affect in the context of birthday attacks?
• Which of the following is the MOST important document to finalize first before proceeding with the penetration testing exercise?
• How should you evaluate the effectiveness of using scripts to validate scan results?
• Which statement best describes the vulnerability category most effectively mitigated by both proper security configurations and a Web Application Firewall?
• What is the best description of using Windows scheduled tasks for persistence during a pentest?
• During Open Source Intelligence Gathering, which of the following types of information on LinkedIn is particularly valuable for mapping networks?
• What is a key reason why a reverse shell is generally more effective at bypassing firewall restrictions than a bind shell?
• Which NTFS feature allows data to be hidden inside a file's additional streams?
• Which tool is MOST effective for visualizing and analyzing connections between data points collected during user enumeration?
• TCP SYN scans are often described as 'half-open.' Which statement best explains this descriptor?
• Which practice best supports improving organizational security through a penetration test?
• When prioritizing targets, if one machine is Windows 7 unpatched with EternalBlue and another is fully patched Windows 10, where should you focus?
• You are conducting a penetration test on a cloud environment and have identified the possibility of image and artifact tampering attacks. Which action would be the most appropriate way to mitigate these types of attacks during the testing phase?
• To increase the odds of cracking offline password hashes, which technique should you use?
• What does 2^256 represent in the context of SHA-256?
• During a security assessment, which characteristic of a browser extension most strongly suggests persistence and malicious activity?
• In OSINT, which artifact is most useful for inferring an organization's software and internal processes?
• Which statement best describes why CVSS scores are useful in a penetration test report?
• What is the benefit of exporting network scan results in multiple formats?
• Which tool is specifically designed to scan individual host devices for vulnerabilities and produce severity-ranked reports?
• Which example illustrates the use of a LOLbin to evade detection while moving laterally within a Windows environment?
• When prioritizing remediation after a vulnerability scan, which approach is supported by combining CVSS scores with EPSS estimates?
• For moving laterally from a low-priv Windows account, which tool category is the MOST appropriate to use while staying stealthy?
• In a USB drop key attack discussion, which technique is NOT a common way attackers disguise malicious files to entice users to run them?
• EPSS score provides information about what aspect of a vulnerability?
• What is the MOST important consideration when choosing an exploit in Metasploit?
• A penetration tester has gained access to a target Windows machine and wants to maintain persistence by creating a new user with administrative privileges. Which command sequence achieves this?
• What defense is most effective against kernel-level rootkits that intercept system calls?
• In scripting, what kind of component allows modular, reusable code to be invoked by name across a program?
• During a penetration test, a tester inadvertently scans the wrong network, potentially leading to legal ramifications. What is the MOST appropriate course of action?
• Why is it important to simulate real-world attack scenarios in a healthcare environment?
• An internal web application stores user passwords in cleartext. What is the MOST appropriate action to mitigate this risk?
• In the context of network penetration testing, which of the following BEST describes the purpose of pivoting?
• What practice reduces misunderstandings about testing outcomes during client acceptance?
• In the context of cryptographic hash functions, what is a collision?
• What is the primary purpose of a ping sweep in a network discovery task?
• Which scan type is MOST appropriate to bypass firewall rulesets and determine whether a firewall is stateful or not?
• What might a PenTester find using strategic search engine enumeration?
• To potentially enable a pass-the-hash attack on a Windows target, which action could be necessary within the engagement scope?
• Which method should the pentester use to covertly move data from target machines without detection?
• During a penetration test, new vulnerabilities were discovered that were not part of the original test plan. The team decides to shift their focus to address these findings immediately. What process is the team engaging in?
• A compromised host is being used to reach parts of the network not directly reachable from the initial position. Which description BEST captures this approach?
• To identify active hosts without performing a full port scan, which Nmap scan option should you use?
• Which combination describes passive OS fingerprinting and its main drawback in a stealthy assessment?
• EternalBlue exploits a vulnerability in which Windows component?
• Which mitigation is MOST appropriate to prevent or minimize the effects of wireless jamming on a network?
• In OT PLC risk, which action is most risky if an attacker gains access?
• What should be the primary focus area during a cloud security assessment?
• Salting passwords helps protect against which type of attack?
• Which tool is MOST likely used to find subdomains and their respective directories during an engagement?
• Which scanning technique would be MOST effective in identifying open ports and running services while minimizing detection during recon?
• Approximately how many inputs are required to find a collision in a hash function with an n‑bit output by the birthday bound?
• What does the line $my_str="Password" indicate in a Bash script, and what is the common cause of the error described by a senior tester?
• Why should asset criticality be considered when prioritizing remediation?
• What is the primary purpose of staging data in a data exfiltration workflow?
• In response to a USB drive found in the parking lot, what is the BEST immediate action for security?
• Which encryption method is no longer considered secure due to vulnerabilities that can be easily exploited?
• Which action best mitigates exposure of credentials in logs?
• Which combination of tools best covers scanning, exploitation, and traffic analysis?
• What is the primary goal of network vulnerability scans in penetration testing?
• If a load balancer misdirects your probes, what action should you take to continue testing?
• During enumeration and scanning phases, scripts BEST describe which of the following?
• When selecting an exploit, which action helps ensure you stay within the engagement boundaries?
• In an industrial facility, what is the MOST critical risk when ICS devices are not segmented from the main network?
• In a penetration test, what is the term for covertly following an authorized employee who is unaware that anyone is behind them?
• A penetration tester is assessing a network and identifies a multihomed host configured as a web server. The tester plans to exploit a vulnerability in the web server to gain access to the internal network. Which of the following actions should the tester take to effectively utilize the multihomed host for network penetration?
• A web application is vulnerable to file inclusion attacks, allowing users to upload files or submit input. Which statement correctly describes the types of file inclusion attacks and their potential impacts?
• Which statement about the relationship between hash output size and collision probability is true?
• What is the primary benefit of using modules, functions, and classes in Python for reconnaissance and enumeration tasks in penetration testing?
• When evaluating the qualifications of a PenTest team, which credentials and considerations are typically necessary?
• Which option best reflects third-party vendor obligations to avoid introducing vulnerabilities into a customer's environment?
• To mitigate the risk of third-party vulnerabilities in cloud integrations, which action is BEST?
• What feature of modern RFID technologies helps resist cloning by reducing exposure of full authentication data?
• A penetration tester has found several vulnerabilities in a scan that appear inconsistent with prior tests. What should be done to validate the results?
• During a penetration test, why is it important to carefully manage who is informed about the engagement and what information is shared?
• Which factor reduces the effectiveness of the birthday attack against SHA-256?
• What is the primary purpose of Breach and Attack Simulation (BAS) platforms?
• Which statement BEST describes differences between PowerShell and Python in the context of penetration testing?
• When testing an IDS, what is the goal of crafting and sending fragmented packets?
• Which statement best describes the difference in resource usage between Windows services and Unix-like daemons?
• In OSINT, which information category on LinkedIn is most useful for mapping professional networks and contacts?
• In a cloud service provider setup, under the shared responsibility model, which action should the company take to fulfill its responsibilities?
• In post-engagement cleanup, which action is best to address persistence mechanisms such as hidden shells?
• Which action best ensures secure destruction of sensitive data after a penetration test?
• A tester is attempting to gain access by trying every possible password and uses a tool that divides the attack space into chunks and targets them randomly. What type of attack is this?
• You are conducting a penetration test and have identified several services running on a target system using Nmap and OpenVAS. After identifying the service versions, you research potential vulnerabilities and use Metasploit to select appropriate exploits. Which of the following best evaluates the next step in exploiting the vulnerabilities?
• Which of the following is NOT essential for understanding network topology during a penetration test?
• Which CVSS metric group is primarily used to compute the initial risk score for a vulnerability?
• For a hash function with a 128‑bit output, the birthday bound indicates that a collision is likely after about how many evaluations?
• Which algorithm should be preferred to minimize collision risk in security‑sensitive contexts?
• Which statement best describes what network vulnerability scans accomplish during a penetration test?
• Which of the following describes the potential impacts of Local File Inclusion (LFI) and Remote File Inclusion (RFI) vulnerabilities?
• Which BEST describes the role of flow control in a penetration testing script used for network reconnaissance and port scanning?
• During enumeration, which action should be taken to create a complete network map and document results?
• To demonstrate how credentials could be captured on a public Wi‑Fi network that uses a captive portal, which step should you take?
• During post-engagement activities, which area is addressed?
• Which type of scan provides the MOST detailed information about internal system configurations, installed software, and user-specific settings?
• Why should you scan dependencies during a vulnerability assessment?
• In mobile security testing, which statement best reflects scope?
• Which practice best aligns with minimizing risk by following a security principle during cloud IAM?
• Which vulnerabilities can be mitigated by proper security configuration and a Web Application Firewall?
• How can a hidden text document within an NTFS Alternate Data Stream be accessed?
• Which practice most effectively ensures that data collected during testing is securely destroyed and cannot be recovered?
• In a pentest conducted for a New York company, which privacy law is most likely to apply, and what ethical considerations should guide the engagement?
• What does the following command sequence do: grep Administrator file | cut -f3,4 > admin-hash.txt?
• If a vulnerability is flagged by multiple scanners, what does that imply?
• Which feature is most critical when evaluating the effectiveness of network mapping tools for understanding a network's structure and vulnerabilities?
• When selecting an exploit in a penetration test, what is MOST crucial to stay within the contract's scope?
• When selecting the right capabilities for a penetration test, which step is MOST essential to ensure that a pentester can effectively identify vulnerabilities and provide valuable insights for improving security?
• A mid-sized technology company implementing job rotation in its finance department aims to mitigate fraud risk. Which outcome BEST demonstrates the success of this policy?
• During a pentest, the database containing customer information is described as what in terms of testing focus?
• What does CVSS base score represent in vulnerability scoring?
• What is the essential step to ensure the target environment is restored after a penetration test, according to standard best practices?
• Which of the following commands or tools would a penetration tester use to enumerate permissions on a local Windows machine in order to determine which user accounts have access to specific directories or files?
• When staging and exfiltrating data after gaining access, what is the MOST appropriate first step in the staging process?
• Which scenario BEST illustrates horizontal movement within a compromised network?
• An organization reviews a recommendations report after a successful PenTest exercise. The cost to mitigate the issue is costly. Which group is the report generated for?
• Which statement best describes the purpose of db_nmap -sV -sC in Metasploit?
• When defining the communication path for a PenTest engagement, what should the IT manager establish?
• Which document outlines acceptance criteria and deliverables for a penetration testing engagement?
• Which measure is least effective for detecting kernel-level rootkits?
• During a compromise, which method would MOST likely allow the attacker to maintain persistent access while staying undetected?
• Which hashing algorithm is generally considered insecure due to known collision vulnerabilities?
• In penetration testing terminology, what does data exfiltration refer to?
• Which action must a pentester take before beginning a penetration test to ensure the assessment is legally compliant?
• Before initiating a physical security breach as part of a penetration test, what step should be taken to ensure the test is effective and within scope?
• Which is a typical outcome of exploiting the EternalBlue vulnerability in a pentest?
• Which tool is used to search for internet-connected industrial control systems (ICS)?
• In penetration testing, what does prioritizing high-value assets mean?
• Which statement BEST defines LOLbins in the context of adversarial movement?
• Which of the following describes why Bluestrike is used in testing Bluetooth devices?
• After finding a CVE and reviewing NVD, which action helps estimate near-term exploitability and prioritize remediation?
• To mitigate IAM misconfigurations in cloud environments, which strategy should be prioritized?
• Which of the following best describes the typical use of Python in penetration testing?
• Strategic search engine enumeration, also known as Google Hacking, helps penetration testers by:
• Which statement BEST describes the primary purpose of the Internet Archive, also known as the Wayback Machine, in OSINT enumeration?
• For manual enumeration of outdated software or sensitive information previously hosted on a website, which resource is MOST appropriate?
• Which concept defines the agreed rules for testing activities, including allowed testing methods and timing?
• In a mobile security assessment, what is the primary focus for penetration testers?
• Which statement is MOST appropriate evaluation of using diagrams to plan and communicate penetration testing to the client?
• What is the primary purpose of documenting pre-engagement activities in a penetration test?
• Which action demonstrates the MOST effective use of a script during the enumeration phase of a penetration test?
• Which JWT implementation flaw could allow an attacker to forge a valid token with arbitrary claims?
• Which security standard simplifies the connection process for consumer devices but is vulnerable if the PIN feature is enabled or the access point isn't secured?
• Which OSINT tool allows customization using modules?
• Which method would be MOST effective to evaluate a firewall's weaknesses?
• Which statement best describes IAM misconfigurations and their security impact?
• Which statement BEST defines lateral movement in a penetration test?
• With a TLS certificate that has a wildcard SAN, what action is most likely for the tester?
• Which Nmap timing option is MOST appropriate for fast scans without significantly compromising network stability?
• In a healthcare scenario with HIPAA compliance and unknown internal environment, which assessment and strategy BEST meet the objectives?
• During a password spraying attack, which approach minimizes the risk of detection?
• Which action BEST reduces the risk of RFID badge cloning for 125kHz EM4100 systems?
• Which approach is recommended to determine the status and model of disk drives on a remote Windows system and is considered more future-proof?
• During enumeration to discover services on other machines, which action is most appropriate for service discovery?
• Which scenario MOST likely represents a container escape attack?
• Which IAM misconfiguration in cloud environments is most commonly seen and should be checked by a pentester?
• During a penetration test, what is the primary purpose of conducting a technical peer review?
• During enumeration, cross-checking the Nmap results against the defined scope helps achieve which outcome?
• A penetration tester identifies a vulnerable API in a cloud workload. Which action BEST helps the tester leverage this vulnerability?
• In a scenario with limited information about the internal environment, what should be the primary focus during vulnerability identification?
• 125kHz EM4100 RFID technology is vulnerable to cloning due to what security limitation?
• Two different inputs producing the same hash value is referred to as a
• What is the primary purpose of using Nmap and OpenVAS during a penetration test?
• A pentester discovers an unencrypted wireless access point in a public space and aims to capture the 4-way handshake. What is the most appropriate first step?
• To list all streams associated with report.txt, which command should you use?
• To enhance password security, which policy should be prioritized?
• In an OT environment with PLCs and SCADA, which action would be a significant risk if an attacker gains access?
• What is the purpose of an attack path map in planning a penetration test?
• What action should a tester recommend to address logging of sensitive data in a cloud system?
• Which of the following would you typically include in the scope of engagement?
• What is steganography in the context of data exfiltration?
• Which statement best describes the difference between a vulnerability assessment and a penetration test?
• Which PTES phase directly addresses client expectations and engagement boundaries before testing begins?
• In security practice, what are LOLbins commonly used for?
• Which elements are typically defined in pre-engagement documentation?
• Which statement best describes the meaning of a TCP SYN scan being 'half-open'?
• In the context of testing an FTP server, what is the first step in fuzzing to identify potential vulnerabilities?
• Which option describes a method to mitigate wireless impairment assessments?
• What is the primary function of Metasploit's 'Payload' modules?
• After a PenTest engagement, which area should be addressed during post-engagement cleanup?
• To access a sensitive database server located on a different subnet by using a compromised web server as a pivot, which technique should be used?
• Increasing the output length of a hash function primarily affects what aspect of security?
• A penetration tester wants to gather email information for a targeted phishing campaign. Which tool could they use?
• Which method allows querying Windows system information without an interactive shell?
• A social engineer is communicating, whether directly or indirectly, a lie or half-truth in order to get someone to believe a falsehood. What is this tactic called?
• What credential strategy is commonly used to assess a PenTest team's reliability?
• In a network where several machines run SMB, which action BEST exploits this service to gain access?
• Which statement best describes the effectiveness of Windows Remote Management (WinRM) for remote administration in a secure network environment?
• What statement about SHA-256 is supported by the concept of birthday attacks and hash output size?
• What is the primary objective of a port scan during a penetration test?
• During a penetration test, you encounter a vulnerability to SQL injection. Which technical control factor would be MOST effective in mitigating this vulnerability?
• To capture a WPA/WPA2 handshake during a wireless assessment, which sequence of steps is appropriate?
• What is the best description of the purpose of a penetration test?
• SHA-256 produces how many possible hash values?
• Which activity is typically part of a social engineering assessment in a penetration test?
• A tester suspects a rootkit hidden in a device driver; which type of rootkit is most likely involved?
• During secrets scanning, which approach is MOST appropriate for efficiently identifying credentials, API keys, and encryption keys?
• Which practice helps prevent tampering of container images before deployment in cloud environments?
• For SHA-256, the birthday bound suggests a collision is expected after about how many hash evaluations?
• Which step would you perform first to ensure the engagement follows the PTES methodology?
• During OSINT gathering, what is the MOST effective next step to build a comprehensive profile of the target organization?
• Which tool and approach is effective for testing IDS and firewall responses by crafting custom packets?
• Which risk is associated with using an unsecured wireless access point in a public setting during a penetration test?
• When finalizing a penetration test report before delivery to a client, a technician should consult which document to ensure that all acceptance criteria are satisfied?
• If a WPS brute-force attack using Reaver is thwarted by a lockout mechanism, which method improves success odds?
• Which tools are specifically used to scan container configurations in Docker and Kubernetes environments?
• When enumerating SMB shares, what is the most valuable objective?
• Which scenario describes the risk when a JWT signing key is weak or signing algorithm is insecure?
• Which tailgating tactic best describes the most effective approach for a penetration test?
• When a vulnerability has a high CVSS base score but a low EPSS, what should be considered to prioritize remediation?
• Which statement best describes the role of vulnerability scanners in a penetration test?
• In scripting, what is the component that uses if statements, else statements, and loops to control execution flow?
• To minimize the risk of password compromises after a data breach, which action is recommended?
• During host discovery, what does Nmap send to port 80?
• In cloud security testing, what should be the primary focus during IAM assessment?
• During a cloud security test, what is the primary reason for conducting exploits in a controlled environment rather than in production?
• What BEST describes the importance of Root Cause Analysis in a penetration test?
• Which tool would be most appropriate to disrupt the communication channel of targeted Bluetooth devices to assess vulnerability to disconnection attacks?
• What makes SysAdmin contacts a valuable target of OSINT?
• After compromising an initial host inside a network, which technique would best enable access to a sensitive database server not directly reachable?
• When scoring risks for a penetration test report, which step should be prioritized?