A penetration tester is attempting to capture a handshake between a client and an access point by monitoring a WPA2-PSK secured wireless network. The tester is monitoring the correct channel for the identified network, but has been unsuccessful in capturing a
handshake. Given the scenario, which of the following attacks would BEST assist the tester in obtaining this handshake? A. Karma attack B. Deauthentication attack C. Fragmentation attack D. SSDI broadcast flood
A vulnerability scan identifies that an SSL certificate does not match the hostname; however, the client disputes the finding. Which of the following techniques can the penetration tester perform to adjudicate the validity of the findings? A. Ensure the scanner can make outbound DNS requests. B. Ensure the scanner is configured to perform ARP resolution. C. Ensure the scanner is configured to analyze IP hosts. D. Ensure the scanner has the proper plug -ins loaded.
A penetration tester runs the following from a compromised python -c
import pty;pty.spawn (/bin/bash) . Which of the following actions are the tester taking? A. Removing the Bash history B. Upgrading the shell C. Creating a sandbox D. Capturing credentials
A client is asking a penetration tester to evaluate a new web application for availability. Which of the following types of attacks should the tester use? A. TCP SYN flood B. SQL injection C. XSS D. XMAS scan
A tester has determined that null sessions are enabled on a domain controller. Which of the following attacks can be performed to leverage this vulnerability? A. RID cycling to enumerate users and groups B. Pass the hash to relay credentials C. Password brute forcing to log into the host D. Session hijacking to impersonate a system account
Joe, a penetration tester, has received basic account credentials and logged into a Windows system. To escalate his privilege, from which of the following places is he using Mimikatz to pull credentials? A. LSASS B. SAM database C. Active Directory D. Registry
For which of the following reasons does a penetration tester need to have a customers point-of-contact information available at all times? (Choose three.) A. To report indicators of compromise B. To report findings that cannot be exploited C. To report critical findings D. To report the latest published exploits E. To update payment information F. To report a server that becomes unresponsive G. To update the statement of work H. To report a cracked password
A penetration tester, who is not on the clients network. is using Nmap to scan the network for hosts that are in scope. The penetration tester is not receiving any response on the command:
Which of the following commands would be BEST to return results? A. nmap -Pn -sT 100.100.1.0-125 B. nmap -sF -p 100.100.1.0-125 C. nmap -sV -oA output 100.100.10-125 D. nmap 100.100.1.0-125 -T4
A recently concluded penetration test revealed that a legacy web application is vulnerable to SQL injection. Research indicates that completely remediating the vulnerability would require an architectural change, and the stakeholders are not in a position to risk the availability on the application. Under such circumstances, which of the following controls are low-effort, short-term solutions to minimize the SQL injection risk? (Choose two.) A. Identity and eliminate inline SQL statements from the code. B. Identify and eliminate dynamic SQL from stored procedures. C. Identify and sanitize all user inputs. D. Use a whitelist approach for SQL statements. E. Use a blacklist approach for SQL statements. F. Identify the source of malicious input and block the IP address.
A penetration tester is performing an assessment when the network administrator shows the tester a packet sample that is causing trouble on the network. Which of the following types of attacks should the tester stop? A. SNMP brute forcing B. ARP spoofing C. DNS cache poisoning D. SMTP relay
Correct Answer: A
Please disable your adblocker or whitelist this site!