- All Exams Instant Download
Which of the following should the tester attempt to do next to take advantage of this information?
In a file stored in an unprotected source code repository, a penetration tester discovers the following line of code: sshpass -p donotchange ssh [email protected] Which of the following should the tester attempt to do next to take advantage of this information? (Select two).A . Use Nmap to identify all the...
Which of the following actions would the tester most likely take?
A penetration tester wants to use multiple TTPs to assess the reactions (alerted, blocked, and others) by the client’s current security tools. The threat-modeling team indicates the TTPs in the list might affect their internal systems and servers. Which of the following actions would the tester most likely take?A ....
Which of the following commands should the tester run to successfully test for secrets exposure exploitability?
A penetration tester has found a web application that is running on a cloud virtual machine instance. Vulnerability scans show a potential SSRF for the same application URL path with an injectable parameter. Which of the following commands should the tester run to successfully test for secrets exposure exploitability?A ....
Which of the following is the tester trying to do based on the command they used?
During a penetration test, the tester uses a vulnerability scanner to collect information about any possible vulnerabilities that could be used to compromise the network. The tester receives the results and then executes the following command: snmpwalk -v 2c -c public 192.168.1.23 Which of the following is the tester trying...
Which of the following describes the tester's activities?
A penetration tester downloads a JAR file that is used in an organization's production environment. The tester evaluates the contents of the JAR file to identify potentially vulnerable components that can be targeted for exploit. Which of the following describes the tester's activities?A . SASTB . SBOMC . ICSD ....
Which of the following should the tester do to get access to these accounts?
A tester is performing an external phishing assessment on the top executives at a company. Two-factor authentication is enabled on the executives’ accounts that are in the scope of work. Which of the following should the tester do to get access to these accounts? A. Configure an external domain using...
Which of the following would most likely be a function of the rules of engagement?
A penetration tester is developing the rules of engagement for a potential client. Which of the following would most likely be a function of the rules of engagement?A . Testing windowB . Terms of serviceC . Authorization letterD . Shared responsibilitiesView AnswerAnswer: A Explanation: The rules of engagement define the...
Which of the following technical controls should the tester recommend to reduce the risk of compromise?
During a penetration test, the tester identifies several unused services that are listening on all targeted internal laptops. Which of the following technical controls should the tester recommend to reduce the risk of compromise? A . Multifactor authenticationB . Patch managementC . System hardeningD . Network segmentationView AnswerAnswer: C Explanation:...
Which of the following attack techniques would be the most effective to pursue if the penetration tester wants to compromise user accounts?
A penetration tester identifies an exposed corporate directory containing first and last names and phone numbers for employees. Which of the following attack techniques would be the most effective to pursue if the penetration tester wants to compromise user accounts?A . SmishingB . ImpersonationC . TailgatingD . WhalingView AnswerAnswer: A...
Which of the following attacks requires this information as a prerequisite to proceed?
During a penetration test, a tester captures information about an SPN account. Which of the following attacks requires this information as a prerequisite to proceed?A . Golden TicketB . KerberoastingC . DCShadowD . LSASS dumpingView AnswerAnswer: B Explanation: Kerberoasting is an attack that specifically targets Service Principal Name (SPN) accounts...
