Question 1

A security consultant is trying to attack a device with a previously identified user account.   Which of the following types of attacks is being executed?

Accepted Answer

A)  Credential dump attack 
B)  DLL injection attack 
C)  Reverse shell attack 
D)  Pass the hash attack 
A)  Credential dump attack 
B)  DLL injection attack 
C)  Reverse shell attack 
D)  Pass the hash attack

Question 2

A penetration tester has compromised a host. Which of the following would be the correct syntax to create a Netcat listener on the device?

Accepted Answer

A)  nc -l -p 4444 /bin/bash 
B)  nc -vp 4444 /bin/bash 
C)  nc -p 4444 /bin/bash 
D)  nc -lp 4444 /bin/bash 
A)  nc -l -p 4444 /bin/bash 
B)  nc -vp 4444 /bin/bash 
C)  nc -p 4444 /bin/bash 
D)  nc -lp 4444 /bin/bash

Question 3

A penetration tester has run multiple vulnerability scans against a target system. Which of the following would be unique to a credentialed scan?

Accepted Answer

A)  Exploits for vulnerabilities found 
B)  Detailed service configurations 
C)  Unpatched third-party software 
D)  Weak access control configurations 
A)  Exploits for vulnerabilities found 
B)  Detailed service configurations 
C)  Unpatched third-party software 
D)  Weak access control configurations

Question 4

Which of the following excerpts would come from a corporate policy?

Accepted Answer

A)  Employee passwords must contain a minimum of eight characters, with one being alphanumeric. 
B)  The help desk can be reached at 800-passwd1 to perform password resets. 
C)  Employees must use strong passwords for accessing corporate assets. 
D)  The corporate systems must store passwords using the MD5 hashing algorithm. 
A)  Employee passwords must contain a minimum of eight characters, with one being alphanumeric. 
B)  The help desk can be reached at 800-passwd1 to perform password resets. 
C)  Employees must use strong passwords for accessing corporate assets. 
D)  The corporate systems must store passwords using the MD5 hashing algorithm.

Question 5

A tester has captured a NetNTLMv2 hash using Responder. Which of the following commands will allow the tester to crack the hash using a mask attack?

Accepted Answer

A)  hashcat -m 5600 -r rules/bestG4.rule hash.txt wordlist.txt 
B)  hashcat -m 5600 hash.txt 
C)  hashcat -m 5600 -a 3 hash.txt ?a?a?a?a?a?a?a?a 
D)  hashcat -m 5600 -o results.text hash.txt wordlist.txt 
A)  hashcat -m 5600 -r rules/bestG4.rule hash.txt wordlist.txt 
B)  hashcat -m 5600 hash.txt 
C)  hashcat -m 5600 -a 3 hash.txt ?a?a?a?a?a?a?a?a 
D)  hashcat -m 5600 -o results.text hash.txt wordlist.txt

Question 6

A penetration tester is planning to conduct a distributed dictionary attack on a government domain against the login portal. The tester will leverage multiple proxies to mask the origin IPs of the attack. Which of the following threat actors will be emulated?

Accepted Answer

A)  APT 
B)  Hacktivist 
C)  Script kiddie 
D)  Insider threat 
A)  APT 
B)  Hacktivist 
C)  Script kiddie 
D)  Insider threat

Question 7

A penetration tester is in the process of writing a report that outlines the overall level of risk to operations. In which of the following areas of the report should the penetration tester put this?

Accepted Answer

A)  Appendices 
B)  Executive summary 
C)  Technical summary 
D)  Main body 
A)  Appendices 
B)  Executive summary 
C)  Technical summary 
D)  Main body

Question 8

A healthcare organization must abide by local regulations to protect and attest to the protection of personal health information of covered individuals. Which of the following conditions should a penetration tester specifically test for when performing an assessment? (Select TWO).

Accepted Answer

A)  Cleartext exposure of SNMP trap data 
B)  Software bugs resident in the IT ticketing system 
C)  S/MIME certificate templates defined by the CA 
D)  Health information communicated over HTTP 
E)  DAR encryption on records servers 
A)  Cleartext exposure of SNMP trap data 
B)  Software bugs resident in the IT ticketing system 
C)  S/MIME certificate templates defined by the CA 
D)  Health information communicated over HTTP 
E)  DAR encryption on records servers

Question 9

Which of the following is the reason why a penetration tester would run the chkconfig --del servicename command at the end of an engagement?

Accepted Answer

A)  To remove the persistence 
B)  To enable persistence 
C)  To report persistence 
D)  To check for persistence 
A)  To remove the persistence 
B)  To enable persistence 
C)  To report persistence 
D)  To check for persistence

Question 10

A penetration tester is testing a web application and is logged in as a lower-privileged user. The tester runs arbitrary JavaScript within an application, which sends an XMLHttpRequest, resulting in exploiting features to which only an administrator should have access. Which of the following controls would BEST mitigate the vulnerability?

Accepted Answer

A)  Implement authorization checks. 
B)  Sanitize all the user input. 
C)  Prevent directory traversal. 
D)  Add client-side security controls 
A)  Implement authorization checks. 
B)  Sanitize all the user input. 
C)  Prevent directory traversal. 
D)  Add client-side security controls

Question 11

A penetration tester is reviewing the following output from a wireless sniffer:   Which of the following can be extrapolated from the above information?

Accepted Answer

A)  Hardware vendor 
B)  Channel interference 
C)  Usernames 
D)  Key strength 
A)  Hardware vendor 
B)  Channel interference 
C)  Usernames 
D)  Key strength

Question 12

For which of the following reasons does a penetration tester need to have a customer's point-of-contact information available at all times? (Choose three.)

Accepted Answer

A)  To report indicators of compromise 
B)  To report findings that cannot be exploited 
C)  To report critical findings 
D)  To report the latest published exploits 
E)  To update payment information
F) To report a server that becomes unresponsive
G) To update the statement of work
H) To report a cracked password 
A)  To report indicators of compromise 
B)  To report findings that cannot be exploited 
C)  To report critical findings 
D)  To report the latest published exploits 
E)  To update payment information
F) To report a server that becomes unresponsive
G) To update the statement of work
H) To report a cracked password

Question 13

Black box penetration testing strategy provides the tester with:

Accepted Answer

A)  a target list 
B)  a network diagram 
C)  source code 
D)  privileged credentials 
A)  a target list 
B)  a network diagram 
C)  source code 
D)  privileged credentials

Question 14

A penetration tester is checking a script to determine why some basic math errors are persisting. The expected result was the program outputting "True".   Given the output from the console above, which of the following explains how to correct the errors in the script? (Choose two.)

Accepted Answer

A)  Change 'fi' to 'Endli'. 
B)  Remove the 'let' in front of 'dest=5+5'. 
C)  Change the '=' to '-eq'. 
D)  Change 'source' and 'dest' to "$source" and "$dest". 
E)  Change 'else' to 'elif'. 
A)  Change 'fi' to 'Endli'. 
B)  Remove the 'let' in front of 'dest=5+5'. 
C)  Change the '=' to '-eq'. 
D)  Change 'source' and 'dest' to "$source" and "$dest". 
E)  Change 'else' to 'elif'.

Question 15

Click the exhibit button.   Given the Nikto vulnerability, scan output shown in the exhibit, which of the following exploitation techniques might be used to exploit the target system? (Choose two.)

Accepted Answer

A)  Arbitrary code execution 
B)  Session hijacking 
C)  SQL injection 
D)  Login credential brute-forcing 
E)  Cross-site request forgery 
A)  Arbitrary code execution 
B)  Session hijacking 
C)  SQL injection 
D)  Login credential brute-forcing 
E)  Cross-site request forgery

Question 16

A penetration tester is able to move laterally throughout a domain with minimal roadblocks after compromising a single workstation. Which of the following mitigation strategies would be BEST to recommend in the report? (Select THREE).

Accepted Answer

A)  Randomize local administrator credentials for each machine. 
B)  Disable remote logons for local administrators. 
C)  Require multifactor authentication for all logins. 
D)  Increase minimum password complexity requirements. 
E)  Apply additional network access control.
F) Enable full-disk encryption on every workstation.
G) Segment each host into its own VLAN. 
A)  Randomize local administrator credentials for each machine. 
B)  Disable remote logons for local administrators. 
C)  Require multifactor authentication for all logins. 
D)  Increase minimum password complexity requirements. 
E)  Apply additional network access control.
F) Enable full-disk encryption on every workstation.
G) Segment each host into its own VLAN.

Question 17

If a security consultant comes across a password hash that resembles the following: b117525b345470c29ca3d8ae0b556ba8 Which of the following formats is the correct hash type?

Accepted Answer

A)  Kerberos 
B)  NetNTLMv1 
C)  NTLM 
D)  SHA-1 
A)  Kerberos 
B)  NetNTLMv1 
C)  NTLM 
D)  SHA-1

Question 18

While performing privilege escalation on a Windows 7 workstation, a penetration tester identifies a service that imports a DLL by name rather than an absolute path. To exploit this vulnerability, which of the following criteria must be met?

Accepted Answer

A)  Permissions not disabled in the DLL 
B)  Weak folder permissions of a directory in the DLL search path 
C)  Write permissions in the C:\Windows\System32\imports directory 
D)  DLL not cryptographically signed by the vendor 
A)  Permissions not disabled in the DLL 
B)  Weak folder permissions of a directory in the DLL search path 
C)  Write permissions in the C:\Windows\System32\imports directory 
D)  DLL not cryptographically signed by the vendor

Question 19

A penetration test was performed by an on-staff junior technician. During the test, the technician discovered the web application could disclose an SQL table with user account and password information. Which of the following is the MOST effective way to notify management of this finding and its importance?

Accepted Answer

A)  Document the findings with an executive summary, recommendations, and screenshots of the web application disclosure. 
B)  Connect to the SQL server using this information and change the password to one or two non-critical accounts to demonstrate a proof--of-concept to management. 
C)  Notify the development team of the discovery and suggest that input validation be implemented with a professional penetration testing company. 
D)  Request that management create an RFP to begin a formal engagement with a professional penetration testing company. 
A)  Document the findings with an executive summary, recommendations, and screenshots of the web application disclosure. 
B)  Connect to the SQL server using this information and change the password to one or two non-critical accounts to demonstrate a proof--of-concept to management. 
C)  Notify the development team of the discovery and suggest that input validation be implemented with a professional penetration testing company. 
D)  Request that management create an RFP to begin a formal engagement with a professional penetration testing company.

Question 20

Which of the following actions BEST matches a script kiddie's threat actor?

Accepted Answer

A)  Exfiltrate network diagrams to perform lateral movement. 
B)  Steal credit cards from the database and sell them in the deep web. 
C)  Install a rootkit to maintain access to the corporate network. 
D)  Deface the website of a company in search of retribution. 
A)  Exfiltrate network diagrams to perform lateral movement. 
B)  Steal credit cards from the database and sell them in the deep web. 
C)  Install a rootkit to maintain access to the corporate network. 
D)  Deface the website of a company in search of retribution.

A security consultant is trying to attack a device with a previously identified user account. Which of the following types of attacks is being executed?

A penetration tester has compromised a host. Which of the following would be the correct syntax to create a Netcat listener on the device?

A penetration tester has run multiple vulnerability scans against a target system. Which of the following would be unique to a credentialed scan?

Which of the following excerpts would come from a corporate policy?

A tester has captured a NetNTLMv2 hash using Responder. Which of the following commands will allow the tester to crack the hash using a mask attack?

A penetration tester is planning to conduct a distributed dictionary attack on a government domain against the login portal. The tester will leverage multiple proxies to mask the origin IPs of the attack. Which of the following threat actors will be emulated?

A penetration tester is in the process of writing a report that outlines the overall level of risk to operations. In which of the following areas of the report should the penetration tester put this?

A healthcare organization must abide by local regulations to protect and attest to the protection of personal health information of covered individuals. Which of the following conditions should a penetration tester specifically test for when performing an assessment? (Select TWO).

Which of the following is the reason why a penetration tester would run the chkconfig --del servicename command at the end of an engagement?

A penetration tester is reviewing the following output from a wireless sniffer: Which of the following can be extrapolated from the above information?

For which of the following reasons does a penetration tester need to have a customer's point-of-contact information available at all times? (Choose three.)

Black box penetration testing strategy provides the tester with:

A penetration tester is checking a script to determine why some basic math errors are persisting. The expected result was the program outputting "True". Given the output from the console above, which of the following explains how to correct the errors in the script? (Choose two.)

Click the exhibit button. Given the Nikto vulnerability, scan output shown in the exhibit, which of the following exploitation techniques might be used to exploit the target system? (Choose two.)

A penetration tester is able to move laterally throughout a domain with minimal roadblocks after compromising a single workstation. Which of the following mitigation strategies would be BEST to recommend in the report? (Select THREE).

If a security consultant comes across a password hash that resembles the following: b117525b345470c29ca3d8ae0b556ba8 Which of the following formats is the correct hash type?

While performing privilege escalation on a Windows 7 workstation, a penetration tester identifies a service that imports a DLL by name rather than an absolute path. To exploit this vulnerability, which of the following criteria must be met?

Which of the following actions BEST matches a script kiddie's threat actor?

CompTIA A+ Certification Exam: Core 1

CompTIA A+ Certification Exam: Core 2

CompTIA Advanced Security Practitioner (CASP+) CAS-003

CompTIA Advanced Security Practitioner (CASP+) CAS-004

CompTIA Cloud Essentials+

CompTIA CySA+ Certification Exam (CS0-002)

CompTIA Cloud+ (CV0-002)

CompTIA Cloud+

CompTIA IT Fundamentals

CompTIA Network+

CompTIA Project+

CompTIA Server+

CompTIA Server+ Certification Exam

CompTIA Security+

CompTIA Security+ 2021

CompTIA CTT+ Essentials

CompTIA Linux+

Filters

Exam 12: CompTIA PenTest+ Certification Exam

A security consultant is trying to attack a device with a previously identified user account. Which of the following types of attacks is being executed?

A penetration tester has compromised a host. Which of the following would be the correct syntax to create a Netcat listener on the device?

A penetration tester has run multiple vulnerability scans against a target system. Which of the following would be unique to a credentialed scan?

Which of the following excerpts would come from a corporate policy?

A tester has captured a NetNTLMv2 hash using Responder. Which of the following commands will allow the tester to crack the hash using a mask attack?

A penetration tester is planning to conduct a distributed dictionary attack on a government domain against the login portal. The tester will leverage multiple proxies to mask the origin IPs of the attack. Which of the following threat actors will be emulated?

A penetration tester is in the process of writing a report that outlines the overall level of risk to operations. In which of the following areas of the report should the penetration tester put this?

A healthcare organization must abide by local regulations to protect and attest to the protection of personal health information of covered individuals. Which of the following conditions should a penetration tester specifically test for when performing an assessment? (Select TWO).

Which of the following is the reason why a penetration tester would run the chkconfig --del servicename command at the end of an engagement?

A penetration tester is reviewing the following output from a wireless sniffer: Which of the following can be extrapolated from the above information?

For which of the following reasons does a penetration tester need to have a customer's point-of-contact information available at all times? (Choose three.)

Black box penetration testing strategy provides the tester with:

A penetration tester is checking a script to determine why some basic math errors are persisting. The expected result was the program outputting "True". Given the output from the console above, which of the following explains how to correct the errors in the script? (Choose two.)

Click the exhibit button. Given the Nikto vulnerability, scan output shown in the exhibit, which of the following exploitation techniques might be used to exploit the target system? (Choose two.)

A penetration tester is able to move laterally throughout a domain with minimal roadblocks after compromising a single workstation. Which of the following mitigation strategies would be BEST to recommend in the report? (Select THREE).

If a security consultant comes across a password hash that resembles the following: b117525b345470c29ca3d8ae0b556ba8 Which of the following formats is the correct hash type?

While performing privilege escalation on a Windows 7 workstation, a penetration tester identifies a service that imports a DLL by name rather than an absolute path. To exploit this vulnerability, which of the following criteria must be met?

Which of the following actions BEST matches a script kiddie's threat actor?

CompTIA A+ Certification Exam: Core 1

CompTIA A+ Certification Exam: Core 2

CompTIA Advanced Security Practitioner (CASP+) CAS-003

CompTIA Advanced Security Practitioner (CASP+) CAS-004

CompTIA Cloud Essentials+

CompTIA CySA+ Certification Exam (CS0-002)

CompTIA Cloud+ (CV0-002)

CompTIA Cloud+

CompTIA IT Fundamentals

CompTIA Network+

CompTIA Project+

CompTIA Server+

CompTIA Server+ Certification Exam

CompTIA Security+

CompTIA Security+ 2021

CompTIA CTT+ Essentials

CompTIA Linux+

Filters