GGG

In the neon-lit sprawl of Las Vegas, Nevada, a luxury hotel’s smart room control system suffered a breach, allowing an intruder to manipulate guest room settings. The incident investigation revealed that the IoT devices lacked any mechanism to verify the integrity or authenticity of software prior to execution, allowing tampered instructions to run unchecked. As Emma Ruiz, a cybersecurity consultant brought in to assess the breach, you recommend a solution that ensures only authorized, validated code is executed on the devices. Which secure development practice are you advising the hotel to implement?. Secure firmware or software updates. Utilize secure communication protocols. Ensure secure boot. Allow code signing.

You are an ethical hacker at SecurePath Technologies, hired to conduct a penetration test for Horizon Financial, a U.S.-based credit union in Denver, Colorado. While testing their online banking portal, you enter a crafted input into the login form’s username field. The application unexpectedly returns a full list of customer account details, including names and account numbers, appended to the intended login response. The behavior suggests that your input was used to append a malicious query to the requested query, altering the original SQL statement to retrieve additional data beyond the expected result. Based on the observed behavior, which type of SQL injection attack are you exploiting?. UNION SQL Injection. Blind SQL Injection. Second-Order SQL Injection. Error-Based SQL Injection.

In a controlled testing environment in Houston, Sarah, an ethical hacker, is tasked with evaluating the security posture of a financial firm’s network using the cyber kill chain methodology. She begins by simulating an attack, starting with gathering publicly available data about the company’s employees and infrastructure. Next, she plans to craft a mock phishing email to test employee responses, followed by deploying a harmless payload to assess system vulnerabilities. As part of her authorized penetration test, what phase of the cyber kill chain should Sarah prioritize to simulate the adversary’s approach effectively?. Reconnaissance. Exploitation. Delivery. Weaponization.

In the humid air of Houston, Texas, a chemical plant is preparing to deploy a new production automation module. As part of a red team engagement, you Ethan Brooks, a cybersecurity specialist are tasked with identifying industrial control devices that communicate with SCADA systems. To proactively uncover devices that may expose critical functions, you launch a focused Nmap sweep targeting TCP port 102, known to be associated with industrial controllers used in critical infrastructure. Your scan detects specific PLC models used in the automation process. Which OT reconnaissance step are you performing?. Scanning Siemens SIMATIC S7 PLCs. Capturing Modbus/TCP traffic using Wireshark. Scanning Modbus devices. Scanning Omron PLC devices.

In the heart of Silicon Valley, ethical hacker Sophia Nguyen is hired by InnoVate Solutions, a San Francisco-based startup, to secure their cloud-based task management platform. On March 15, 2025, Sophia begins testing a feature that allows users to upload custom workflow templates to streamline project assignments. By carefully crafting a template file, she manipulates the platform’s data processing, triggering unexpected behavior that grants her administrative access to restricted project dashboards. The issue arises from the platform’s handling of user-supplied data during object reconstruction, not from database queries, client-side code execution, or session manipulation. Sophia documents her findings to help InnoVate’s developers strengthen their application. Which web application vulnerability is Sophia most likely exploiting in InnoVate Solutions’ task management platform?. Insecure Deserialization. Verbose Error Messages. Local File Inclusion. Session Hijacking.

During a scheduled security review in a high-tech lab in Austin, Texas, penetration tester Lucas Bennett was assessing a state government’s new payroll system hosted in a private cloud. One humid afternoon, while fuzz testing the input validation logic of the TaxCalcEngine.dll module, he triggered a buffer overflow by submitting malformed taxpayer ID strings. The crash led to unintended disclosure of payroll data due to unchecked data boundaries. Lucas traced the issue to a coding oversight in a core processing module. Applying a structured analysis approach, which category best describes the vulnerability he discovered?. Application Flaws. Design Flaws. Misconfigurations/Weak Configuration. Poor Patch Management.

During a penetration test at Rocky Mountain Insurance in Denver, ethical hacker Sophia Nguyen attempts to evade detection by fragmenting malicious traffic into smaller packets. The IT security team counters her strategy with a system that monitors traffic for deviations from established baselines, flagging behavior that does not match normal network activity. This allows them to stop Sophia’s evasion attempts in real time. Which detection technique is the IT team most likely using in this case?. Anomaly-Based Detection. Signature-Based Detection. Stateful Packet Inspection. Deep Packet Inspection.

During a network security audit at Jefferson National Bank in Richmond, Virginia, ethical hacker Thomas Reed is tasked with identifying vulnerabilities in employee login processes on VLAN 20, which connects client services workstations to the customer account database server. He sets up a Wireshark instance on a monitoring workstation configured in mirror mode behind a managed switch to capture traffic. His goal is to detect unencrypted authentication credentials transmitted over HTTP during login sessions. Which Wireshark feature should Thomas use to isolate and analyze these credentials in real time, and how does it assist him?. Use the “Follow TCP Stream” to reconstruct and read HTTP session data. Use the “Monitoring the Specific Ports” to generate a traffic summary and identify HTTP packets. Use the “Filtering by IP Address” to set a filter for HTTP traffic before capturing. Use the “Display Filtering by Protocol” to isolate HTTP traffic and view packet details.

During a penetration test at a telecom provider in Denver, Colorado, Maria, a senior ethical hacker, notices that her scans are immediately flagged by intrusion detection systems. She modifies her technique, and as a result, the IDS devices are unable to reassemble the packets correctly, allowing her probes to slip through without detection. Which scanning evasion technique is Maria applying in this case?. Packet Fragmentation. Decoy Scanning. Source Routing. IP Spoofing.

Lily, a network security analyst at a regional healthcare provider, is preparing defenses ahead of a scheduled external vulnerability assessment. During internal simulation drills, she observes that scanners are successfully identifying open ports and service banners across critical systems. Tasked with reducing exposure to such reconnaissance efforts, Lily is instructed to apply measures that specifically hinder port scanning activity without disrupting legitimate traffic. Which of the following actions should Lily implement?. Block inbound ICMP message types and all outbound ICMP type-3 unreachable messages. Configure firewall and IDS rules to detect and block probes. Use a custom rule set to lock down the network, block unwanted ports at the firewall, and filter specific ports. Block unwanted services running on the ports and update the service versions.

While conducting a security review for a public healthcare data center, Jason, a senior penetration tester, is asked to gather system descriptions, contact details, and interface metrics from a set of legacy network devices running SNMPv2. These devices respond on UDP port 161 and use default community strings. Jason must retrieve this structured SNMP data in a format that can be fed into a reporting script without requiring GUI-based tools or raw packet captures. Which of the following methods should Jason use?. Use SnmpWalk to query and retrieve structured SNMP data from the devices. Use Wireshark to inspect SNMP packets on the wire for useful fields. Use SoftPerfect Network Scanner to scan for SNMP-enabled systems. Use Nmap to identify SNMP ports and collect basic SNMP service banners.

During a penetration test at Horizon Tech in Austin, ethical hacker Michael sets up a man-in-the-middle attack to intercept traffic between employees and the company’s internal web applications. He uses a lightweight tool capable of performing ARP spoofing, DNS manipulation, and packet injection while providing an interactive interface for real-time monitoring. This allows him to capture and manipulate session tokens in transit, which he later presents to the security team as proof of risk. Which tool is Michael most likely using in this exercise?. Bettercap. Hetty. Caido. Wireshark.

During an internal red team engagement at a financial services firm, an ethical hacker named Anika tests persistence mechanisms after successfully gaining access to a junior employee’s workstation. As part of her assessment, she deploys a lightweight binary into a low-visibility system folder. To maintain long-term access, she configures it to launch automatically on every system reboot without requiring user interaction. Which of the following techniques has most likely been used to ensure the persistence of the attacker’s payload?. Creating scheduled tasks. Injecting into the startup folder. Modifying file attributes. Installing a keylogger.

You are Noah Kim, an ethical hacker at Quantum Cyber Solutions, hired to test the mobile device security of TechTrend Innovations, a tech firm in Austin, Texas. During a covert assessment, your objective is to simulate an attacker attempting to gain privileged access to an iPhone 12 running iOS 14.5 used for proprietary app development. You apply a jailbreaking technique that allows the device to fully restart without requiring a computer, maintaining a patched kernel and enabling access to sensitive app data in the file system. Based on this method, which iOS jailbreaking technique are you using?. Untethered Jailbreaking. Semi-tethered Jailbreaking. Tethered Jailbreaking. Semi-untethered Jailbreaking.

During a large-scale network assessment of a telecom provider in Dallas, Texas, a cybersecurity consultant uses Recon-ng and Nmap to enumerate legacy and infrastructure-level services across multiple nodes. The tools uncover open Telnet ports, FTP directories with anonymous login enabled, active TFTP services, and exposed SMB shares. The consultant also detects a service that responds to VRFY, EXPN, and RCPT commands – allowing the enumeration of user identities and delivery addresses due to weak input validation. IPv6 tunneling protocols are also detected. Concerned about information leakage, the consultant flags these services for immediate remediation. Which classification best describes this set of enumeration activities?. SMTP Enumeration. DNS Enumeration. VoIP Enumeration. LDAP Enumeration.

Noah Kim, an ethical hacker at Quantum Cyber Solutions in Austin, Texas, is assessing iPhones used for proprietary development. On one device, he demonstrates a technique that allows it to boot normally without a computer, but the elevated access is temporarily lost after restart until the user launches a special on-device app to reapply the modifications. Which jailbreaking method is this?. Semi-untethered Jailbreaking. Untethered Jailbreaking. Tethered Jailbreaking. Semi-tethered Jailbreaking.

In the bustling tech hub of Boston, Massachusetts, ethical hacker Zara Nguyen dives into the digital fortifications of CloudCrafter, a US-based platform hosting web applications for small businesses. Tasked with probing the application’s input processing, Zara submits specially crafted inputs to a server administration panel. Her tests uncover a severe vulnerability: the system performs unintended operations at the system level, enabling access to restricted server resources. Further scrutiny reveals the flaw lies in the application’s failure to sanitize user input passed to system-level execution, not in altering directory service queries, injecting newline characters, or targeting shell-specific environments. Dedicated to strengthening the platform, Zara drafts a precise report to guide CloudCrafter’s security team toward urgent fixes. Which injection attack type is Zara most likely exploiting in CloudCrafter’s web application?. Command Injection. LDAP Injection. CRLF Injection. Shell Injection.

During a penetration test at Pinnacle Bank in Chicago, ethical hacker Sarah injects crafted TCP packets into an active communication between a customer’s browser and the online banking server. The victim’s connection becomes unstable, allowing Sarah’s system to maintain communication with the server in place of the legitimate client. She later demonstrates to the IT team how attackers could forcibly take control of live sessions through this approach. Which type of session hijacking is Sarah performing in this scenario?. Active Session Hijacking. Blind Hijacking. Passive Session Hijacking. Man-in-the-Browser Attack.

Sarah, a cybersecurity analyst at a US-based e-commerce company in New York, is tasked with evaluating the company’s transition to a cloud-based infrastructure to support its growing online platform. The company aims to optimize resource allocation to handle fluctuating customer demand during peak shopping seasons, such as Black Friday. Sarah must recommend a key characteristic of cloud computing that ensures resources are efficiently shared across multiple users while maintaining scalability. Which cloud computing characteristic should Sarah recommend ensuring efficient resource sharing and scalability for the e-commerce platform?. Resource pooling. Broad network access. Measured service. On-demand self-service.

In the hushed offices of Pinecrest Solutions in Denver, network security analyst Lisa Nguyen began a covert review of a recent spike in network access issues reported by the sales team. The trouble surfaced during a low-traffic period when agents couldn’t reach their CRM system, prompting Lisa to examine the subnet logs. She spotted irregular IP assignment attempts linked to an unfamiliar device. Acting quickly, Lisa entered a series of commands on the Cisco switches and later confirmed that connectivity issues had ceased without any new devices appearing in the logs. Which command did Lisa most likely use to address the issue?. Switch(config)# ip dhcp snooping vlan 10. Switch(config-if)# switchport port-security. Switch(config)# ip dhcp snooping. Switch(config)# ip arp inspection vlan 10.

On a busy Monday morning at Horizon Financial Services in Chicago, accounts assistant Clara Nguyen receives an email that appears to come from the company’s IT department. The email, addressed specifically to Clara and mentioning her role in the accounts team, warns of a critical system vulnerability requiring immediate action. It includes a link to a login page resembling the company’s internal portal, urging her to update her credentials to prevent account suspension. The email’s sender address looks legitimate, but Clara notices a slight misspelling in the domain name. What social engineering technique is being attempted against Clara?. Spear Phishing. Quid Pro Quo. Vishing. Impersonation.

On July 9, 2025, during a security penetration test at MedSecure Health in Phoenix, Arizona, the ethical hacking team evaluates the resilience of the company’s patient portal system. Ethical hacker Aisha Khan initiates a controlled test that generates sustained traffic pressure against the web application servers. As system responsiveness declines, the IT operations team reallocates backend resources, suspending lower-priority modules such as system alerts and notification services, allowing high-priority functions like prescription refills and patient check-ins to remain accessible. Aisha’s controlled simulation is designed to assess the IT team’s ability to maintain critical functionality under partial resource exhaustion. What DoS/DDoS countermeasure strategies is Aisha’s exercise primarily simulating?. Degrading Services. Rate Limiting. Absorbing the Attack. Shutting Down Services.

Javier Ruiz from CyberFortress Solutions is tasked with auditing the mobile security practices of Apex Financial Services, a financial firm in Houston, Texas. During a covert penetration test, Javier targets employees’ personal smartphones used to access corporate financial systems. He exploits a vulnerability by installing a malicious app that bypasses access controls, granting him unauthorized entry to sensitive financial data because the devices lack a specific security measure to restrict app access. Based on this vulnerability, which BYOD security guideline is most likely missing in Apex Financial Services’ policy?. Set passwords for apps to restrict others from accessing them. Use encryption mechanisms to store data. Enforce automatic device locking or implement biometric authentication. Review permissions requested by apps before installing them.

You are Sameer Das, an ethical hacker hired by a national utilities provider to assess the resilience of its power grid infrastructure. During your red team operation, you conduct a phishing campaign targeting field engineers and successfully gain access to the internal OT network. From there, you identify unsecured access to the substation’s programmable controllers and replace one of the system’s firmware components with a custom payload. This payload silently processes your commands while maintaining access across reboots. Based on this action, which type of IoT/OT threat are you simulating?. Firmware update attack. Exploit kits. Remote access using backdoor. Forged malicious device.

You are Emma Rodriguez, an ethical hacker at SecurePath Solutions, hired to test the mobile application security of Sterling & Associates, a law firm in New York City. During a covert assessment, your objective is to simulate an attacker attempting to exploit vulnerabilities in the firm’s client case management app. You discover that the app stores user credentials in plain text on the device, enabling you to extract sensitive client login information using a rooted device. Based on this finding, which OWASP Top 10 Mobile Risk are you identifying in the app?. Insecure Data Storage. Inadequate Privacy Controls. Improper Credential Usage. Insecure Communication.

In Austin, Texas, ethical hacker Michael Reyes is conducting a red team exercise for Horizon Tech, a software development firm. During his assessment, Michael crafts a malicious link that appears to lead to the company’s internal project management portal. When an unsuspecting employee clicks the link, it redirects them to a login session that Michael has already initialized with the server. After the employee logs in, Michael uses that session to access the portal in a controlled test, demonstrating a vulnerability to the IT team. Which session hijacking technique is Michael using in this red team exercise?. Session fixation attack. Session sniffing. Session replay attack. Session donation attack.

During a red team engagement at Apex Biotech in Dallas, ethical hacker Rachel calls the company’s HR desk pretending to be Mark Stevens, a senior finance manager. She pressures the HR staffer by citing his “upcoming presentation for the CFO” and insists he urgently needs a copy of the updated employee benefits spreadsheet. The staffer feels compelled to help due to Rachel’s convincing manner and authoritative tone. Which social engineering technique is Rachel demonstrating in this exercise?. Impersonation. Reverse Social Engineering. Quid Pro Quo. Vishing.

You are Olivia Chen, an ethical hacker at CyberGuardians Inc., hired to test the wireless network of Skyline Media, a broadcasting company in Chicago, Illinois. Your mission is to breach their WPA2-protected Wi-Fi during a late-night penetration test. Using a laptop in monitor mode, you execute a command to transmit packets that force client devices to disconnect and reconnect, enabling you to capture a four-way handshake for cracking. Based on the described action, which tool are you using?. Aireplay-ng. Airodump-ng. Aircrack-ng. Airbase-ng.

As part of a passive reconnaissance engagement for a university research network, you’re asked to map potential administrative exposure points across .edu domains. You aim to identify pages that might allow privileged backend access such as misconfigured interfaces using only publicly indexed information. To ensure efficiency and compliance, you decide to use Google’s advanced search syntax. Your goal is to locate URLs across educational domains that may contain restricted backend functionality. Which of the following search strings would most effectively support this goal?. site:.edu inurl:admin. intitle:”admin login” site:.edu. inanchor:”backend access” site:.edu. site:.edu filetype:pdf intitle:”admin”.

In a recent cybersecurity incident, Google’s response team in the United States investigated a severe attack that briefly disrupted services and customer-facing platforms for approximately 2-3 minutes. Server logs recorded a sudden surge in traffic, peaking at 398 million requests per second, which caused active connections to drop unexpectedly. The attack was traced to numerous compromised devices, likely orchestrated through malicious tools promoted on social media. Based on this information, what type of attack was most likely executed against Google’s infrastructure?. HTTP GET/POST Attack. SYN Flood Attack. RST Attack. TCP SACK Panic Attack.

Emily, a security engineer at a Chicago-based healthcare provider, is auditing the organization’s new cloud environment after a breach where sensitive patient records were exposed. Her investigation reveals that the root cause was the lack of encryption during data transmission between end-user devices and cloud storage. To mitigate this issue and align with HIPAA compliance requirements, Emily must prioritize addressing the correct cloud computing security risk. Which cloud computing threat should Emily address to mitigate the risk of sensitive data being exposed during transmission?. Infrastructure Security. Service and Data Integration. Incidence Analysis and Forensic Support. Multi-Tenancy and Physical Security.

As the cybersecurity lead for an international news agency, you are alerted by your threat intelligence team that confidential communications between journalists and whistleblowers have been posted to an online activist forum. Further forensic analysis reveals that no financial transactions were tampered with, and no ransomware was deployed. However, the agency’s internal systems were accessed and selectively leaked emails were published alongside a manifesto accusing the organization of biased reporting. The attackers also posted on social media claiming responsibility and justifying their actions as a fight against misinformation. Based on this behavior, what category of hacker are you most likely dealing with?. Hacktivists. Script Kiddies. White Hat hackers. Black Hat hackers.

During a quarterly security audit at a multinational logistics firm, network security manager Priya initiates a scheduled vulnerability assessment across the organization’s hybrid infrastructure. Her team begins by identifying all active IT assets and assigning them risk scores based on business criticality. The following week, they deploy scanning tools to detect security weaknesses, validate the findings manually, and classify vulnerabilities based on severity and exploitability. After coordinating with the IT operations team, they develop a structured timeline to address the confirmed vulnerabilities, giving priority to high-risk findings affecting mission-critical systems. Finally, after the vulnerabilities are addressed, Priya ensures that the affected systems are rescanned to confirm resolution and generates a compliance report for executive review. Based on this workflow, which phase of the Vulnerability-Management Life Cycle is Priya executing?. Remediation. Risk Assessment. Verification. Vulnerability Analysis.

During a quarterly vulnerability management review at RedCore Motors, Priya finalizes the deployment of Nessus Essentials across the company’s IT infrastructure. The solution is selected for its ability to support diverse technologies including operating systems, databases, web servers, and virtual environments. While preparing a training session for junior analysts, Priya asks them to identify a capability that Nessus Essentials is specifically designed to provide as part of its scanning process. Checks for outdated versions of over 1250 servers. Patch management for operating systems and third-party applications. Agent-based detection. High-speed asset discovery.

At RedCore Motors, the IT security lead, Priya, is tasked with selecting a vulnerability management solution for their expanding hybrid infrastructure. During the evaluation, she prioritizes tools that support agent-based detection across endpoints, offer constant monitoring and alerting capabilities, and provide comprehensive visibility into both on-premises and cloud-based systems. After thorough testing, she selects a platform that promises to scan for vulnerabilities everywhere accurately and efficiently, aligning with her organization’s need for centralized visibility and real-time risk assessment. Which vulnerability assessment tool did Priya MOST LIKELY select?. Qualys VM. Nessus. OpenVAS. Nikto.

In Miami, Florida, cybersecurity analyst Laura Bennett is responding to a series of unauthorized access attempts targeting Sunshine Credit Union’s online banking platform. She observes unusual network activity that suggests attackers may be intercepting session IDs transmitted over unsecured connections to hijack active user sessions. To prevent further compromise, Laura works with the network team to apply a control that secures session- related communications throughout the entire portal, ensuring sensitive tokens are no longer exposed to interception during user interactions. What countermeasure should Laura implement to prevent session hijacking in this scenario?. Implement SSL to encrypt all information in transit via the network. Do not create sessions for unauthenticated users. Regenerate the session ID after a successful login. Use restrictive cache directives such as “Cache-Control: no-cache”.

During a cybersecurity awareness drill at Quantum Analytics in San Francisco, California, the ethical hacking team tests the company’s defenses against social media-based threats. Nadia creates a fake LinkedIn profile posing as a senior HR manager from Quantum Analytics, using a stolen company logo and publicly available employee details. Nadia sends connection requests to several employees, including data analyst Priya Sharma, inviting them to join a private group called “Quantum Analytics Innovation Hub.” The group’s page prompts members to share their work email and department role for “exclusive project updates.” What social engineering threat to corporate networks is Nadia’s exercise primarily simulating?. Involuntary Data Leakage. Loss of Productivity. Spam and Phishing. Network Vulnerability Exploitation.

During a penetration test at a financial services company in Denver, ethical hacker Jason demonstrates how employees could be tricked by a rogue DHCP server. To help the client prevent such attacks in the future, Jason shows the administrators how to configure their Cisco switches to reject DHCP responses from untrusted ports. He explains that this global setting must be activated before more granular controls can be applied. Which switch command should Jason recommend to implement this defense?. Switch(config)# ip dhcp snooping. Switch(config)# ip arp inspection vlan 10. Switch(config-if)# ip dhcp snooping trust. Switch(config)# ip dhcp snooping vlan 10.

As part of a penetration test for a financial firm’s smart headquarters in Denver, Colorado, ethical hacker Jordan Lee begins evaluating the IoT infrastructure responsible for lighting, HVAC, and badge-controlled access. Jordan documents details such as device models, manufacturer names, firmware versions, and supported protocols like Zigbee and BLE. This information is used to understand the device ecosystem. Which step of the IoT hacking methodology is being carried out in this phase?. Information gathering. Gain remote access. Vulnerability scanning. Launch attacks.

You are an ethical hacker at Nexus Cybersecurity, contracted to perform a penetration test for BlueRidge Retail, a U.S.-based e-commerce company in Atlanta, Georgia. While testing their online store’s product search page, you attempt to inject a malicious query into the URL to extract customer data. The application is protected by a web application firewall (WAF) that blocks standard SQL injection attempts. To bypass this, you modify your input to split the query into multiple parts, ensuring the malicious instructions are not detected as a single signature. For example, you craft the URL as /products.php? id=1+U+NION+SE+LECT+1,2, which successfully retrieves unauthorized data. Based on the observed behavior, which SQL injection evasion technique are you employing?. String Concatenation. Null Byte. In-line Comment. Hex Encoding.

You are Michael Rivera, a cybersecurity consultant at FortiSec Solutions, hired to strengthen the wireless network of DesertTech Innovations, a startup in Phoenix, Arizona. After a recent penetration test revealed vulnerabilities, the IT manager, Lisa Nguyen, asks you to recommend a defense mechanism to prevent unauthorized devices from connecting to the corporate Wi-Fi. You suggest a method that requires each connecting device to authenticate through a centralized server using a unique username and password. Based on the described approach, which wireless security countermeasure should DesertTech implement?. Use 802.1X Authentication. Upgrade to WPA3. MAC Address Filtering. Disable TKIP.

In Denver, Colorado, ethical hacker Rachel Nguyen is conducting a network security assessment for Apex Logistics, a transportation firm with a complex internal network. During her test, Rachel observes a client-server communication and injects specially crafted packets into the exchange, disrupting the client’s session. As a result, the server continues interacting with Rachel’s system while the legitimate client’s connection becomes unresponsive. She uses this setup in a controlled environment to demonstrate vulnerabilities to the company’s IT team. What network-level session hijacking technique is Rachel employing in this assessment?. TCP/IP hijacking. RST hijacking. UDP hijacking. Blind hijacking.

You are Liam Chen, an ethical hacker at CyberGuard Analytics, hired to test the social engineering defenses of Coastal Trends, a retail chain in Los Angeles, California. During a covert assessment, you craft a deceptive message sent to employees’ company phones, claiming a critical account update is needed and directing them to a link that installs monitoring software. Several employees interact with the link, exposing a vulnerability to a specific mobile attack vector. Based on this approach, which mobile attack type are you simulating?. SMS Phishing. OTP Hijacking. Call Spoofing. Bluebugging.

In Atlanta, Georgia, ethical hacker James Patel is hired by Southern Retail, a major e-commerce chain, to test the security of their online shopping platform. During his penetration test, James aims to simulate a session hijacking attack by setting up a proxy to intercept HTTP traffic between customers and the platform, log the requests, and perform advanced searches on the captured data to identify session tokens. He needs a lightweight tool specifically designed for security research that can handle these tasks in a controlled environment to demonstrate vulnerabilities to the company’s security team. Which tool should James use to perform this session hijacking simulation?. Hetty. Caido. Wireshark. Bettercap.

You are an ethical hacker at Vanguard Cyber Defense, hired by Sunrise Logistics, a freight management company in Houston, Texas, to evaluate the security of their shipment tracking portal. During your engagement, you analyze how the application handles user-submitted data. You observe the behavior of the shipment search feature and monitor the HTTP GET requests being sent to the server. Your objective is to determine how user input is processed by the backend system and whether those parameters can be used to manipulate SQL queries. Based on this activity, which step of the SQL injection methodology are you performing?. Identifying Data Entry Paths. Database Enumeration. Launching SQL Injection Attacks. Advanced SQL Injection.

Maya Patel from SecureHorizon Consulting is called to investigate a security breach at Dallas General Hospital in Dallas, Texas, where a lost employee smartphone was used to access sensitive patient records. During her analysis, Maya finds that the hospital’s mobile security policy failed to include a contingency to remotely secure compromised devices, allowing continued access to confidential data even after the device was lost. Based on this gap, which mobile security guideline should Maya recommend preventing similar incidents?. Register devices with a remote locate and wipe facility. Install device tracking software that allows the device to be located remotely. Utilize a secure VPN connection while accessing public Wi-Fi networks. Use anti-virus and data loss prevention (DLP) solutions.

You are leading an internal red team assessment for a multinational bank with a highly complex and distributed IT infrastructure. Your team is required to simulate attacks across cloud services, servers, and remote endpoints. Due to the sheer scale of the environment, you deploy an AI-based platform that automatically scans the entire network, flags anomalies based on prior breach data, and adjusts its threat detection models as new attack behaviors are encountered. What key benefit of AI-driven ethical hacking is most critical to your success in this scenario?. Scalability. Simulation and testing. Enhanced reporting. Predictive analysis.

On July 25, 2025, during a security assessment at Apex Technologies in Boston, Massachusetts, ethical hacker Sophia Patel conducts a penetration test to evaluate the company’s defenses against a simulated DDoS attack targeting their e-commerce platform. The simulated attack floods the platform with traffic from multiple sources, attempting to overwhelm server resources. The IT team activates a specific tool that successfully mitigates the attack by distributing traffic across multiple servers and filtering malicious requests. Sophia’s test aims to verify the effectiveness of this tool in maintaining service availability. Which DoS/DDoS protection tool is most likely being utilized by the IT team in this scenario?. Load Balancer. Web Application Firewall (WAF). Intrusion Prevention System (IPS). Firewall.

At Norwest Freight Services, a rotating audit team is asked to evaluate host exposure across multiple departments following a suspected misconfiguration incident. Simon, a junior analyst working from a trusted subnet, initiates a network-wide scan using the default configuration profile of his assessment tool. The tool completes quickly but returns only partial insights such as open service ports and version banners while deeper registry settings, user policies, and missing patches remain unreported. Midway through the report review, Simon notices that system login prompts were never triggered during scanning, and no credential failures were logged in the SIEM. Which type of vulnerability scan BEST explains the behavior observed in Simon’s assessment?. Unauthenticated Scanning. Credentialed Scanning. Authenticated Scanning. Internal Scan.

While auditing legacy network devices at a public hospital in Miami, Jason, a penetration tester, needs to verify what SNMP traffic is leaking across the internal segment. Instead of running structured queries, he decides to capture live network traffic and manually review the protocol fields. This method allows him to see SNMP requests and responses in transit but requires manual parsing of OIDs, community strings, and variable bindings. Which method should Jason use in this situation?. Wireshark. SnmpWalk. SoftPerfect Network Scanner. Nmap.

Michael, an ethical hacker at a San Francisco-based fintech startup, is conducting a security assessment of the company’s cloud-based payment processing platform, which uses Kubernetes, an open-source system for automating the deployment, scaling, and management of containerized applications. During his review, Michael identifies a feature that automatically replaces and reschedules containers from failed nodes to ensure high availability of services – a critical requirement for uninterrupted payment operations. Based on his study of cloud container technology principles, which Kubernetes feature should Michael highlight as responsible for this capability? Which Kubernetes feature should Michael highlight to ensure automatic restarting of failed containers for the payment processing platform?. Self-healing. Container orchestration. Kube-controller-manager. Container vulnerabilities.

During a penetration test at a regional bank in Richmond, ethical hacker Thomas is tasked with identifying weaknesses in how employee credentials are transmitted. He sets up Wireshark on a mirrored port and captures HTTP login sessions from the customer services VLAN. To quickly reconstruct entire conversations between browsers and the server, Thomas uses a feature that reassembles packet data into a readable stream, allowing him to view usernames and passwords directly in plain text. Which Wireshark feature is Thomas most likely using in this case?. Follow TCP Stream. Monitoring the Specific Ports. Filtering by IP Address. Display Filtering by Protocol.

Michael, an ethical hacker at a New York-based e-commerce company, is evaluating the security of their online payment system after a recent incident where fraudulent transactions went undetected. His investigation reveals that the system uses an asymmetric encryption algorithm to ensure the authenticity of payment confirmations. He finds that the algorithm employs a public-key cryptosystem, where the sender signs the transaction with a private key, and the recipient verifies it using a corresponding public key located in a directory. During his test, Michael intercepts a signed message and notices that the algorithm supports modular exponentiation for generating digital signatures, a process critical to verifying the identity of the signatory. He aims to assess if the algorithm’s configuration could be vulnerable to a meet-in-the-middle attack due to its key structure. Which asymmetric encryption algorithm should Michael identify as the one used by the payment system?. RSA. DSA. ElGamal. Diffie-Hellman.

You are Ava Mitchell, an ethical hacker at Sentinel Cyberworks, hired to test the wireless defenses of Horizon Financial, a bank in Boston, Massachusetts. During a covert nighttime assessment, your objective is to simulate an attacker attempting to breach the bank’s WPA-protected Wi-Fi network. You deploy a tool that allows you to capture wireless packets, send de-authentication packets to force client reconnections, and attempt to recover the encryption key, all within a single graphical interface. Based on the described functionality, which Wi-Fi security auditing tool are you using?. Fern WiFi Cracker. WatchGuard Wi-Fi Cloud WIPS. Cisco Adaptive Wireless IPS. RFProtect.

In the heart of Silicon Valley, California, network administrator Jake Henderson oversees the web infrastructure for TechTrend Innovations, a startup specializing in cloud solutions. During a routine architecture review, Jake evaluates the setup of their web server, which handles high-traffic API requests. He notes that the server’s primary module processes incoming requests and works with additional modules to manage encryption, URL rewriting, and authentication. Curious about the server’s design, Jake consults the documentation to ensure optimal performance and security. Which web server component is Jake analyzing as part of TechTrend Innovations’ architecture?. HTTP Server (Core). Document Root. Application Server. Virtual Document Tree.

In Austin, Texas, ethical hacker Liam Carter is hired by Lone Star Healthcare to probe the defenses of their patient data network. During his penetration test, Liam aims to bypass the hospital’s firewall protecting a medical records server. To do so, he uses a tool to craft custom network packets, carefully designing their headers to slip past the firewall’s filtering rules. His goal is to demonstrate how an attacker could infiltrate the system, exposing vulnerabilities for the security team to address. Which tool is Liam using to bypass Lone Star Healthcare’s firewall during his penetration test?. Colasoft Packet Builder. Traffic IQ Professional. Nmap. Metasploit.

In the industrial heart of Detroit, Michigan, a steel plant’s production line halts under mysterious circumstances, prompting an urgent cybersecurity investigation. As Marcus Reed, an ethical hacker, you audit the system and notice the plant’s control process uses a feedback mechanism to continuously adjust operations based on output conditions. Your review reveals that this self-regulating behavior is central to the plant’s automation design. Based on your findings, which OT system concept is being employed?. Closed loop. Manual loop. Open loop. Distributed Control System (DCS).

Liam, an ethical hacker at a Miami-based cryptocurrency exchange, is assessing the security of their blockchain network after a recent incident where users reported double-spending of digital assets. His investigation reveals that the attackers gained significant control over the network’s computational resources, allowing them to manipulate transaction validations. Liam notes that the blockchain is a public ledger, like Bitcoin, where anyone can access transaction data without permissions. During his analysis, he finds that the attackers likely controlled a dominant share of the network’s computing resources, enabling them to rewrite transaction history. Which blockchain attack should Liam identify to strengthen the exchange’s defenses?. 51% Attack. Finney Attack. DeFi Sandwich Attack. Eclipse Attack.

You are a penetration tester hired to evaluate the security posture of a regional manufacturing company’s network devices. During your assessment, you discover that one of the core routers allows external administrative access without requiring a password. Additionally, the router communicates with other devices using a protocol that does not provide encryption or validation. Based solely on these observations, which of the following network device vulnerabilities is most clearly present?. Lack of password protection. Lack of authentication. Insecure routing protocols. Firewall vulnerabilities.

At a Miami-based cryptocurrency exchange, investigator Jake uncovers that attackers exploited exposed API keys to issue unauthorized cloud commands, leading to resource abuse and lateral movement inside the cloud environment. Which cloud hacking technique is most directly demonstrated in this incident?. Compromising secrets. Enumerating S3 buckets. Wrapping attack. Cryptojacking.

You are Sofia Patel, an ethical hacker at Nexus Security Labs, hired to test the mobile device security of Bayview University in San Francisco, California. During your assessment, you are given an Android 11-based Samsung Galaxy Tab S6 with USB debugging disabled and OEM unlock restrictions in place. To simulate an attacker attempting to gain privileged access, you install a mobile application that exploits a system vulnerability to gain root access directly on the device – without requiring a PC. This allows you to bypass OS restrictions and retrieve sensitive research data. Based on this method, which Android rooting tool are you using?. KingoRoot. One Click Root. RootMaster. Magisk Manager.

At Pinnacle Financial Services in Chicago, Illinois, ethical hacker Sarah Thompson is conducting a penetration test to evaluate the security of the company’s online banking portal. During her assessment, Sarah positions herself on the internal network and uses a sniffer to capture traffic between a user’s browser and the banking server. She quietly collects session data, including user IDs and authentication tokens, without interfering with the ongoing communication. Later, she plans to use this information to impersonate a legitimate user in a controlled test environment to demonstrate potential risks to the bank’s IT team. What type of session hijacking is Sarah performing during this phase of her penetration test?. Passive Session Hijacking. Man-in-the-browser Attack. Active Session Hijacking. Session Fixation Attack.

At a government research lab, cybersecurity officer Nikhil is compiling a vulnerability assessment report after scanning the internal subnet. As part of his documentation, he lists the IP addresses of all scanned hosts and specifies which machines are affected. He includes tables categorizing discovered vulnerabilities by type – such as outdated software, default credentials, and open ports. Which section of the vulnerability assessment report is Nikhil working on?. Findings. Assessment Overview. Supporting Information. Risk Assessment.

During a post-exploitation phase on a compromised finance department workstation, ethical hacker Anika uses her Meterpreter session to extract sensitive credential data. After running a command, she receives a long list of alphanumeric strings representing LM and NTLM values. These outputs are later transferred to a cracking rig for offline password recovery, allowing the red team to simulate credential theft across multiple systems. Which Meterpreter command most likely produced these results?. hashdump. getsystem. keyscan_start. screenshot.

You are conducting a security audit at a government agency. During your walkthrough, you observe a temporary contractor sitting in an open office area using their smartphone to discreetly record employees as they enter passwords into their systems. Upon further investigation, you find discarded documents in a nearby trash bin containing sensitive project information. What type of attack is most likely being performed?. Passive attack. Distribution attack. Close-in attack. Insider attack.

Bob, a seasoned security analyst at XYZ Aerospace, was investigating a series of misaligned transaction timestamps coming from one of the data archival systems. Suspecting that the server might be syncing with an unstable time source, Bob decided to extract a detailed list of all peer servers associated with the target machine, including metrics such as delay, offset, and jitter, to determine whether the issue stemmed from time synchronization drift. Which of the following commands should Bob use to retrieve this information?. ntpq -p [host]. ntpq [-inp] [-c command] [host] [...]. ntpdc [-ilnps] [-c command] [host] [...]. ntptrace [-n] [-m maxhosts] [servername/IP_address].

While simulating a reconnaissance phase against a cloud-hosted retail application, your team attempts to gather DNS records to map the infrastructure. You avoid brute-forcing subdomains and instead aim to collect specific details such as the domain’s mail server, authoritative name servers, and potential administrative information like serial number and refresh interval. Given these goals, which DNS record type should you query to extract both administrative and technical metadata about the target zone?. SOA. NS. TXT. MX.

At Liberty Mutual’s cybersecurity operations center in Boston, network engineer Marcus is troubleshooting a critical issue during peak transaction hours. Multiple VLANs are experiencing intermittent access delays, and several endpoints including those on isolated VLANs are receiving network traffic not intended for them, raising concerns about data exposure. Marcus notices that the issue began after a newly imaged workstation, used by an intern named Lisa, was connected to a trunk port in the server room. Switch logs indicate abnormal traffic patterns overwhelming the network. Which sniffing technique is Lisa’s workstation most likely using to cause this behavior?. MAC Flooding. Switch Port Stealing. ARP Poisoning. DNS Cache Poisoning.

You are Sophia Bennett, an ethical hacker at Nexus Cyber Defense, tasked with evaluating the security of a smart retail store’s IoT network in San Francisco, California. During your assessment, you uncover a vulnerability in the store’s smart inventory sensors that could allow an attacker to gain unauthorized access. The flaw lies in a cloud-based communication process that lacks authentication and encryption and fails to properly validate data exchange between the sensors and the cloud management platform. Based on the described vulnerability, which IoT attack surface area are you addressing in your findings?. Insecure ecosystem interfaces. Insecure network services. Insecure default settings. Insecure data transfer and storage.

You are a security analyst at Sentinel IT Services, monitoring the web application of GreenValley Credit Union in Portland, Oregon. During a log analysis, you identify an SQL injection attempt on the customer login portal, where the attacker inputs a malicious string to manipulate the query logic. The application mitigates this by replacing special characters with their escaped equivalents to prevent query manipulation before the query is executed, ensuring the SQL statement remains unchanged. Based on the observed defense mechanism, which SQL injection countermeasure is the application employing?. Encoding the single quote. Perform user input validation. Use parameterized queries or prepared statements. Restrict database access.

As part of a quarterly security review at EvoTrans Logistics, a global freight optimization firm, you’ve been brought in as a senior cybersecurity analyst to audit perimeter firewall configurations across cloud-hosted application clusters. During your investigation, you notice that TCP port 1433 is open on a virtual machine tagged as svc-node-east-14, which was provisioned by a now- defunct third-party vendor. The node is not referenced in any current infrastructure diagrams, yet live traffic logs suggest it’s still handling requests during peak hours. No documentation exists regarding its service role, but you’re tasked with flagging misconfigurations that may violate policy or expose critical services unnecessarily. Based on your understanding of standardized port assignments, you must determine what service this port likely represents and whether its exposure warrants escalation. Which of the following services is most likely running on this port and requires immediate review?. ms-sql-s. sqlsrv. sql*net. ms-sql-m.

As part of an annual security awareness program at BrightPath Consulting in Denver, Colorado, the cybersecurity team conducts an ethical hacking experiment to test employee vigilance against physical social engineering threats. During a simulated attack, ethical hacker Liam Carter strategically places a USB drive labeled “Confidential 2025 Budget Plans” in the company’s parking lot, designed to look like it was accidentally dropped. The USB is programmed to install a harmless tracking script when plugged into a workstation, alerting the security team. Sarah, a project coordinator, finds the USB and considers plugging it into her office laptop to identify its owner. What social engineering technique is being tested in this experiment?. Baiting. Pretexting. Hoax. Phishing.

During a stealth penetration test for a multinational shipping company, ethical hacker Daniel Reyes gains local access to an engineering workstation and deploys a specialized payload that installs below the operating system. On subsequent reboots, the payload executes before any system-level drivers or services are active, giving Daniel covert control over the machine without triggering antivirus or endpoint detection tools. Weeks later, system administrators report suspicious network activity, but repeated forensic scans fail to locate any malicious processes or user-level traces. Which type of rootkit did Daniel most likely use to maintain this level of stealth and persistence?. Bootkit. Kernel-mode Rootkit. Firmware Rootkit. Hypervisor Rootkit.

Jake, a cybersecurity investigator at a Miami-based cryptocurrency exchange, uncovers a sinister plot during a late-night breach response. Attackers have infiltrated the company’s cloud environment, leveraging a technique to siphon computing power from misconfigured AWS instances. The breach, traced through compromised secrets and unauthorized API calls, has triggered a surge in resource consumption, threatening the platform’s integrity during a high- stakes trading surge. As Jake races against time to pinpoint the attack method, he must identify the primary cloud hacking technique at play. What cloud hacking technique should Jake identify as the primary method used by attackers to siphon computing power in the cloud environment?. Cryptojacking. Wrapping attack. Compromising secrets. Enumerating S3 buckets.

In Seattle, Washington, ethical hacker Mia Chen is hired by Pacific Trust Bank to test the security of their corporate network, which stores sensitive customer financial data. During her penetration test, Mia conducts a thorough reconnaissance, targeting a server that appears to host a critical database of transaction records. As she interacts with the server, she notices it responds promptly to her queries but occasionally returns error messages that seem inconsistent with a production system’s behavior, such as unexpected protocol responses. Suspicious that this server might be a decoy designed to monitor her actions, Mia applies a technique to detect inconsistencies that may reveal the system as a honeypot. Which technique is Mia most likely using to determine if the server at Pacific Trust Bank is a honeypot?. Fingerprinting the Running Service. Analyzing System Configuration and Metadata. Analyzing MAC Address. Analyzing Response Time.

In Miami, Florida, Sarah Thompson, a security analyst at Apex Cyber Defense, is tasked with monitoring the wireless infrastructure at Coastal Healthcare, a busy urban hospital. One morning, nurse Emily Carter reports that her tablet used for accessing patient records is unexpectedly connecting to an access point broadcasting a name and signal similar to the hospital’s secure Wi-Fi. Upon investigation, Sarah’s log analysis reveals an unauthorized device on the network capturing sensitive traffic from connected systems. Suspecting a breach, she identifies that the attacker has deployed an access point to mimic the hospital’s legitimate network. Based on this behavior, which wireless threat is the attacker executing?. Evil Twin AP. Honeypot AP. Rogue AP. Misconfigured AP.

In a security assessment conducted in New York, Sarah, an ethical hacker, is evaluating a corporate network to enhance its protection against potential threats. She aims to gather essential data about available access points to guide her analysis. Which scanning technique should Sarah apply to meet this objective while adhering to the organization’s ethical guidelines?. Network Scanning. Topology Mapping. Port Scanning. Vulnerability Scanning.

In a tense red team exercise at a mid-sized university in Austin, Texas, an ethical hacker named Jake targeted a legacy Linux server in the engineering department. Late one afternoon, he discovered TCP port 2049 was open during his port sweep, suggesting hidden file-sharing capabilities. Intrigued, Jake used a standard utility to request a list of remote file systems shared across the network, aiming to map accessible resources. Meanwhile, he idly checked for Telnet access and probed a time-sync service out of routine, but both proved fruitless on this host. Which enumeration method is actively demonstrated in this scenario?. NFS Enumeration. NTP Enumeration. NetBIOS Enumeration. SNMP Enumeration.

You are an ethical hacker at SecureNet Solutions, conducting a penetration test for BlueRidge Manufacturing in Denver, Colorado. While auditing their wireless network, you observe that the access point uses a security protocol that employs the RC4 algorithm with a 24-bit initialization vector (IV) to encrypt data between network clients. Based on the observed encryption characteristics, which wireless encryption protocol is the access point using?. WEP. WPA2. WPA3. WPA.

A multinational corporation deploys a major internal tool built on a PowerShell- based automation framework. Shortly after a scheduled rollout, the IT team notices intermittent system slowdowns and unexplained bandwidth spikes. Despite running updated endpoint protection and restrictive firewall rules, traditional scanning tools report no malicious files on disk. However, internal telemetry flags a trusted process repeatedly executing obfuscated PowerShell commands in memory. The anomalous activity vanishes upon reboot and appears to leave no footprint behind on the system. Which type of malware is most likely responsible for this behavior?. Fileless Malware. Rootkit. Trojan. Worm.

During a red team operation for XYZ Financial Services, security analyst Lily Jensen is assigned to scan a critical subnet that is protected by an IDS. Her initial scan attempt is immediately flagged and blocked. To evade detection while continuing reconnaissance, she adjusts the scanning configuration to include multiple spoofed IP addresses alongside her own. This makes it difficult for network defenses to isolate her real scanning activity, while still allowing her to receive accurate results. Which scanning technique is Lily using?. Decoy Scanning. IP Spoofing. Source Routing. SYN/FIN Scanning.

During a red team engagement at a healthcare provider in Miami, ethical hacker Rachel suspects that a compromised workstation is running a sniffer in promiscuous mode. To confirm her suspicion, she sends specially crafted ICMP packets with a mismatched MAC address but a correct IP destination. Minutes later, the suspected machine responds to the probe even though ordinary systems would ignore it. Which detection technique is Rachel most likely using to validate the presence of a sniffer?. Ping Method. ARP Method. Nmap sniffer-detect (NSE). DNS Method.

In Dallas, Texas, ethical hacker Ethan Brooks is hired by Lone Star Credit Union to assess the security of their online banking portal, which processes customer transactions. During his penetration test, Ethan probes the web server hosting the portal, experimenting with crafted URL requests. He notices that by altering the URL parameters in a specific way, the server returns data from areas of the system that should be restricted, revealing configuration files not intended for public access. Suspecting this behavior indicates a vulnerability, Ethan documents the issue to help the security team strengthen their defenses against potential unauthorized access. Which technique is Ethan most likely using to uncover the vulnerability in Lone Star Credit Union’s web server?. Directory Traversal. HTTP Response Splitting. Web Cache Poisoning. Password Cracking.

You are working as a threat intelligence analyst for a fintech startup that recently discovered a spike in credential stuffing attempts against its admin panel. The security team believes this may be due to leaked internal files circulating on underground forums. You’re tasked with investigating potential exposure on the dark web without directly interacting with any service or forum. You decide to use advanced search filters to identify documents hosted on hidden services that may contain sensitive access details. The team suspects these documents might include account-related keywords in their titles. Which of the following search queries would best support this investigation?. filetype:pdf intitle:”admin access” site:onion. filetype:docx intitle:”user accounts” site:onion. filetype:pdf intitle:”secure login” site:onion. filetype:docx intitle:”login credentials”.

You are an ethical hacker at Northpoint Assessments, engaged to map the wireless footprint around Harborview Plaza in San Francisco, California. To enumerate nearby networks and prompt devices to reveal SSIDs and capabilities, you actively send crafted management frames from your laptop and log each AP’s immediate responses (including probe responses and capability information), rather than only listening for broadcasts. Based on the described activity, which Wi-Fi discovery technique are you performing?. Active Footprinting. Passive Footprinting. Wash Command. Network Discovery Software.

Noah, a security analyst at a Seattle-based healthcare provider, is responding to a real-time data breach where attackers accessed patient records stored on a compromised server. During incident response, he must quickly secure sensitive files located on the system’s primary storage to prevent further exfiltration. The data resides in a mounted partition that needs full-volume encryption, but standard file encryption isn’t sufficient. Noah selects a solution that supports encrypted containers, strong key lengths like 256-bit AES, and can conceal secure volumes within standard ones to reduce detection. His goal is to ensure confidentiality while forensic operations continue without disrupting system functionality. Which disk encryption tool should Noah deploy to meet these objectives?. VeraCrypt. Rohos Disk Encryption. FileVault. BitLocker Drive Encryption.

You are an ethical hacker at HarborLine Assessments, engaged to audit the Wi- Fi at Portside Freight in Tacoma, Washington. During an overnight reconnaissance, you enable your wireless interface’s monitor mode and run a command that silently records beacon frames, probe responses and authentication frames from nearby APs and clients into a capture file for later offline analysis – you do not transmit any frames from your laptop. Based on the described activity, which Wi-Fi security auditing tool are you most likely using?. Airodump-ng. Aireplay-ng. Airbase-ng. Aircrack-ng.

In Raleigh, North Carolina, ethical hacker Ethan Brooks is conducting a penetration test for Triangle FinTech, a rising financial startup. During his assessment, Ethan aims to bypass the company’s network security to access a restricted internal server. He crafts network packets to disguise his traffic as legitimate, forcing some TCP header information into subsequent packets to evade the firewall’s checks. His aim is to demonstrate how an attacker could slip past the security perimeter undetected, alerting the IT team to potential weaknesses. Which technique is Ethan employing to bypass Triangle FinTech’s firewall during his penetration test?. Tiny Fragments. IP Address Spoofing. HTTP Tunneling. Source Routing.

In Portland, Oregon, ethical hacker Olivia Harper is hired by Cascade Biotech to test the security of their research network. During her penetration test, she simulates an attack by sending malicious packets to a server hosting sensitive genetic data. To evade detection, she needs to understand the monitoring system deployed near the network’s firewall, which analyzes incoming and outgoing traffic for suspicious patterns across the entire subnet. Olivia’s goal is to bypass this system to highlight vulnerabilities for the security team. Which security system is Olivia attempting to bypass during her penetration test of Cascade Biotech’s network?. Network-Based Intrusion Detection System. Host-Based Firewalls. Network-Based Firewalls. Host-Based Intrusion Detection System.

On 10th of July this year, during a security penetration test at IntelliCore Systems in Raleigh, North Carolina, the ethical hacking team evaluates the stability of the company’s file-sharing server. Sofia crafts and transmits a sequence of oversized, malformed packets designed to test how the server handles unexpected input. Shortly after, the system begins crashing intermittently due to processing failures triggered by these anomalous network requests. The security team onsite is tasked with identifying the root cause behind the packet-induced instability and attributing it to a known DoS tactic. Which of the following best explains the technique Sofia used to trigger the server crashes?. Ping of Death (PoD). ICMP Flood Attack. Smurf Attack. ACK Flood Attack.

In the crisp mountain air of Denver, Colorado, ethical hacker Lila Chen investigates the security framework of MediVault, a US-based healthcare platform used by regional clinics to manage patient data. During her assessment, Lila manipulates session parameters while navigating the patient portal’s dashboard. Her tests reveal a critical flaw: the system allows users to access sensitive medical records not associated with their own account, enabling unauthorized changes to private health data. Upon deeper inspection, Lila determines that the issue stems from the application allowing users to perform actions beyond their assigned roles – rather than failures in encryption, unsafe object handling, or server configuration. Which OWASP Top 10 2021 vulnerability is Lila most likely exploiting in MediVault’s web application?. Broken Access Control. Cryptographic Failures. Insecure Deserialization. Security Misconfiguration.

During a security assessment in San Francisco, an ethical hacker is tasked with evaluating a network’s resilience against stealthy reconnaissance attempts. The hacker needs to employ a scanning technique that leverages TCP flags to evade detection by intrusion detection systems, relying on the target’s response behavior to infer port states without completing a full connection. Which approach best aligns with this strategy, ensuring minimal visibility during the assessment?. FIN Scan. Network Scanning. NULL Scan. TCP Connect Scan.

During an internal audit at a financial services firm in Mumbai, ethical hacker Meera was tasked with assessing lateral movement risks within the Windows- based domain environment. While monitoring internal network traffic, she noticed a strange broadcast from a workstation trying to resolve a non-existent host. Suspecting protocol-level weakness, she responded swiftly using a pre- configured system. A few minutes later, she captured NTLMv2 hashes from several authenticated sessions across multiple departments. Later, her team successfully cracked one of the hashes offline and used the credentials to gain access to a sensitive internal reporting server. Which type of attack did Meera most likely execute?. LLMNR/NBT-NS Poisoning. Pass-the-Ticket Attack. Internal Monologue Attack. Kerberoasting.

As part of an insider threat simulation at a multinational insurance firm, lead red teamer John is asked to assess whether internal directory services are exposing sensitive user data. Gaining limited VPN access, he begins probing port 389 on a staging environment connected to the main domain infrastructure. After discovering that anonymous binds are accepted by the directory service, John launches a utility from his Kali machine that allows command-line interaction with directory entries. He structures his query to search for user objects with associated organizational units. Moments later, John reviews the output which includes usernames, group memberships, and departmental hierarchies – all retrieved without authentication. Which tool is John MOST likely using to perform this enumeration?. ldapsearch. dig AXFR. nbtstat -A. smtp-user-enum.

You are an ethical hacker at Apex Security Consulting, hired by Riverfront Media, a digital marketing firm in Boston, Massachusetts, to assess the security of their customer relationship management (CRM) web application. While evaluating the application’s search feature, you input a long string of single quote characters into the search bar. The application responds with an error suggesting that it cannot handle the length or structure of the input in the current SQL context. Based on the observed behavior, which SQL injection vulnerability detection technique are you employing?. Error Message Analysis. Function Testing. Fuzz Testing. Detecting SQL Modification.

During a security penetration test at ABC Financial Services in Miami, Florida, on July 9, 2025, ethical hacker Javier Morales targets the company’s online banking portal to assess its resilience. Over several hours, the portal’s web server begins to falter, with legitimate users reporting inability to log in or complete transactions. The IT team notices the server is struggling to accept new connections, as its maximum connection limit is nearly reached, despite no significant spike in overall network traffic. Javier’s controlled test, run from a secure system, logs interactions to simulate a real attack, aiming to evaluate the IT team’s ability to identify the threat. What DoS/DDoS attack technique is Javier’s exercise primarily simulating?. Slowloris Attack. Peer-to-Peer Attack. SYN Flood Attack. UDP Flood Attack.

On July 25, 2025, during a penetration test at Horizon Financial Services in Chicago, Illinois, cybersecurity specialist Laura Bennett is analyzing an attack simulation targeting the company’s online banking portal. The system logs reveal a coordinated barrage of traffic from multiple compromised systems, orchestrated through a central command-and-control server, flooding the portal and rendering it unavailable to legitimate users. The attack leverages a network of infected devices, likely recruited via malicious links on social media. What is the structure or concept most likely used to launch this coordinated attack?. Botnet. Distributed Reflection Denial-of-Service (DRDoS). Smurf Attack. Central Source Propagation.

Ethical hacker Ryan Brooks, a skilled penetration tester from Austin, Texas, was hired by Skyline Aeronautics, a leading aerospace firm in Denver, to conduct a security assessment. One sunny morning, Ryan noticed an unexpected lag in the routine system update process while running his tests, sparking his curiosity. During a late-night session, he observed a junior analyst, Chris Miller, cautiously modifying a legacy server’s configuration, including a scheduled task tied to a specific date. The lead developer, Jessica Hayes, casually mentioned receiving an odd email from an unfamiliar source, which she ignored as clutter. As Ryan probed deeper, he detected a faint increase in network activity only after the scheduled date passed, and a systems admin, Mark Thompson, quietly pointed out some unusual code traces on a dormant workstation. Which type of threat best characterizes this attack?. Logic Bomb. Ransomware. Advanced Persistent Threat (APT). Fileless Malware.

During a red team assessment at Alpine Manufacturing Corp., network security consultant Marcus Lee is instructed to evaluate the security of internal communications within their switched LAN environment. Without altering any switch configurations, Marcus manages to intercept credentials being transmitted between a payroll administrator’s workstation and the backend authentication server. His setup reroutes the communication path through his testing machine, though no proxy or VPN was involved. Analysis shows the redirection was achieved by injecting crafted messages that silently altered how the two hosts identified each other on the local network. Which sniffing technique did Marcus most likely use?. ARP Spoofing. MAC Flooding. Switch Port Stealing. DNS Spoofing.

During a quarterly security audit at a financial services company in Charlotte, North Carolina, you are tasked with reviewing exposed services on legacy servers inherited from a third-party vendor. While scanning, you discover that TCP port 1434 is open on a database node that is not listed in the company’s active inventory. The IT team has no records explaining why this service is running, and you are asked to determine whether the exposure of this port could indicate an unnecessary database-related risk. Based on standardized port assignments, which service is most likely running on this port and requires further review?. ms-sql-s. ms-sql-m. sqlsrv. sql*net.