- All Exams Instant Download
Which of the following types of intrusion techniques is the use of an “under-the-door tool” during a physical security assessment an example of?
Which of the following types of intrusion techniques is the use of an “under-the-door tool” during a physical security assessment an example of?A . LockpickingB . Egress sensor triggeringC . Lock bumpingD . Lock bypassView AnswerAnswer: D Explanation: Reference: https://www.triaxiomsecurity.com/2018/08/16/physical-penetration-test-examples/
Which of the following would be the most logical steps to follow NEXT?
A penetration tester is performing an annual security assessment for a repeat client. The tester finds indicators of previous compromise. Which of the following would be the most logical steps to follow NEXT?A . Report the incident to the tester's immediate manager and follow up with the client immediatelyB ....
Which of the following is the MOST likely cause?
After an Nmap NSE scan, a security consultant is seeing inconsistent results while scanning a host. Which of the following is the MOST likely cause?A . Services are not listeningB . The network administrator shut down servicesC . The host was not reachableD . A firewall/IPS blocked the scanView AnswerAnswer:...
Prior to conducting testing, in which of the following solutions should the penetration tester’s IP address be whitelisted?
A company has engaged a penetration tester to perform an assessment for an application that resides in the company’s DMZ. Prior to conducting testing, in which of the following solutions should the penetration tester’s IP address be whitelisted?A . WAFB . HIDSC . NIDSD . DLPView AnswerAnswer: C
Which of the following controls would BEST mitigate the vulnerability?
A penetration tester is testing a web application and is logged in as a lower-privileged user. The tester runs arbitrary JavaScript within an application, which sends an XMLHttpRequest, resulting in exploiting features to which only an administrator should have access. Which of the following controls would BEST mitigate the vulnerability?A...
Under such circumstances, which of the following would be the BEST suggestion for the client?
A penetration tester has performed a security assessment for a startup firm. The report lists a total of ten vulnerabilities, with five identified as critical. The client does not have the resources to immediately remediate all vulnerabilities. Under such circumstances, which of the following would be the BEST suggestion for...
Which of the following CVSS vulnerability scores would automatically bring the client out of compliance standards such as PCI 3.x?
A client needs to be PCI compliant and has external-facing web servers. Which of the following CVSS vulnerability scores would automatically bring the client out of compliance standards such as PCI 3.x?A . 2.9B . 3.0C . 4.0D . 5.9View AnswerAnswer: C Explanation: Reference: https://qualysguard.qg2.apps.qualys.com/qwebhelp/fo_portal/knowledgebase/pci_exceptio ns.htm
Which of the following attacks can be performed to leverage this vulnerability?
A tester has determined that null sessions are enabled on a domain controller. Which of the following attacks can be performed to leverage this vulnerability?A . RID cycling to enumerate users and groupsB . Pass the hash to relay credentialsC . Password brute forcing to log into the hostD ....
Which of the following should be performed to escalate the privileges?
A penetration tester has successfully exploited a Windows host with low privileges and found directories with the following permissions: Which of the following should be performed to escalate the privileges?A . KerberoastingB . Retrieval of the SAM databaseC . Migration of the shell to another processD . Writable servicesView AnswerAnswer:...
Which of the following tools could be used to impersonate network resources and collect authentication requests?
During an internal penetration test, several multicast and broadcast name resolution requests are observed traversing the network. Which of the following tools could be used to impersonate network resources and collect authentication requests?A . EttercapB . TcpdumpC . ResponderD . MedusaView AnswerAnswer: C
