FFF

A Certified Ethical Hacker (CEH) is auditing a company’s web server that employs virtual hosting. The server hosts multiple domains and uses a web proxy to maintain anonymity and prevent IP blocking. The CEH discovers that the server’s document root directory, which stores critical HTML files, is named “certroot” and is stored in the directory /admin/web. The server root, which stores the server’s configuration, error, executable, and log files, is also identified. The CEH also notes that the server uses a virtual document tree for additional storage. Given this scenario which of the following actions would most likely increase the security of the web server?. Regularly updating and patching the server software. Moving the document root directory to a different disk. Changing the server’s IP address regularly. Implementing an open-source web server architecture such as LAMP.

During a red team engagement simulating a targeted attack on a smart office environment, an ethical hacker identifies a thermostat used for regulating temperature across multiple floors. While analyzing its firmware management process, the tester discovers that the device accepts older versions without verifying their integrity or authenticity. The attacker successfully loads a previously deprecated firmware that contains known vulnerabilities and gains unauthorized access to the broader network by exploiting reintroduced flaws. No mechanisms are in place to prevent version rollback or verify firmware trustworthiness. Which IoT security issue is most accurately demonstrated in this scenario?. Lack of secure update mechanisms. Denial-of-service through physical tampering. Use of insecure third-party components. Insecure network service exposure.

A penetration tester discovers that a web application uses unsanitized user input to dynamically generate file paths. The tester identifies that the application is vulnerable to Remote File Inclusion (RFI). Which action should the tester take to exploit this vulnerability?. Provide a URL pointing to a remote malicious script to include it in the web application. Upload a malicious shell to the server and execute commands remotely. Inject a SQL query into the input field to perform SQL injection. Use directory traversal to access sensitive system files on the server.

A penetration tester evaluates a company’s susceptibility to advanced social engineering attacks targeting its executive team. Using detailed knowledge of recent financial audits and ongoing projects, the tester crafts a highly credible pretext to deceive executives into revealing their network credentials. What is the most effective social engineering technique the tester should employ to obtain the necessary credentials without raising suspicion?. Develop a spear-phishing email that references specific financial audit details and requests login confirmation. Create a convincing fake email from the CFO asking for immediate credential verification. Conduct a phone call posing as an external auditor requesting access to financial systems. Send a mass phishing email with a link to a fake financial report.

An attacker places a malicious VM on the same physical server as a target VM in a multi-tenant cloud environment. The attacker then extracts cryptographic keys using CPU timing analysis. What type of attack was conducted?. Side-channel attack. Metadata spoofing. Cloud cryptojacking. Cache poisoned denial of service (CPDoS).

During a physical penetration test simulating a social engineering attack, a threat actor walks into the lobby of a target organization dressed as a field technician from a known external vendor. Carrying a fake ID badge and referencing a known company name, the attacker confidently claims they’ve been dispatched to perform a routine server room upgrade. Using internal- sounding terminology and referencing real employee names gathered via OSINT, the individual conveys urgency. The receptionist, recognizing the vendor name and the convincing language, allows access without verifying the credentials. Perceived authority and reliance on third-party familiarity. Misconfigured network segmentation allowing unauthorized access. Leaked credentials on public networks and forums. Trust in physical security logs used by security teams.

In a high-stakes cybersecurity exercise in Boston, Emily, an ethical hacker, is tasked with tracing a mock phishing email sent to a healthcare provider’s staff. Using the email header, she identifies a series of IP addresses and server details, including multiple timestamps and server names. Her objective is to pinpoint the exact moment the email was processed by the sender’s system. As part of her reconnaissance, what specific detail from the email header should Emily examine to determine this information?. Date and time received by the originator’s email servers. Authentication system used by sender’s mail server. Sender’s mail server. Date and time of message sent.

A penetration tester is tasked with scanning a network protected by an IDS and firewall that actively blocks connection attempts on non-standard ports. The tester needs to gather information on the target system without triggering alarms. Which technique should the tester use to evade detection?. Execute a TCP ACK scan to map firewall rules and bypass the IDS. Use a low-and-slow scan to reduce detection by the IDS. Perform a SYN flood attack to overwhelm the firewall. Conduct a full TCP Connect scan to confirm open ports.

During an internal red team engagement at Orion Tech Labs, a leading software firm in Austin, Texas, ethical hacker Emily Carter was tasked with evaluating the resilience of the organization’s software deployment processes. Knowing that the finance team frequently downloaded utility tools for generating PDFs, she repackaged a trusted PDF converter installer with a secondary payload. When an employee executed the installer, the converter installed and functioned normally, but in the background, a hidden executable silently initiated outbound network communication. The user remained unaware of any suspicious activity. Which technique did Emily most likely use to ensure the malware executed alongside the legitimate application?. Wrapper. Dropper. Packer. Downloader.

During a security assessment of a metropolitan public transportation terminal, a penetration tester examines a network-connected IoT surveillance camera system that is used for 24/7 video monitoring of high-traffic areas. Upon analyzing the camera’s network traffic, the tester observes that it uses an outdated encryption protocol (SSLv2) to transmit video data to the control center. The tester uses a network packet sniffer to intercept this traffic and easily decrypts the stream, successfully reconstructing full video footage in real time without authentication. Further analysis reveals that the camera does not enforce TLS or any modern encryption standard and lacks support for mutual authentication or secure key exchange. Additionally, no integrity checks are performed, leaving the data open to manipulation. What IoT vulnerability is most likely being exploited in this scenario?. Insecure data transfer and storage. Replay attack on wireless signals. Jamming attack on RF communication. Credential theft via web application.

You’ve recently joined an international software firm as part of the cybersecurity governance team. While preparing for an internal compliance review, your supervisor asks you to identify the ISO/IEC standard that serves as a comprehensive framework for managing an organization’s information security. You examine several standards, including those focusing on risk management, cybersecurity, and control implementation. However, you need to select the one that defines the overarching structure for managing information security programs across the organization. Which of the following standards should you choose?. ISO/IEC 27001:2022. ISO/IEC 27005:2022. ISO/IEC 27701:2019. ISO/IEC 27002:2022.

In Boston, Massachusetts, network administrator Daniel Carter is monitoring the IT infrastructure of New England Insurance, a prominent firm, after receiving alerts about sluggish system performance. While reviewing traffic patterns, Daniel observes an unusual volume of concurrent requests overwhelming critical servers. To validate his suspicion of a session hijacking attempt, he begins capturing and reviewing live network traffic to identify unauthorized session behaviors before escalating to the security team. What detection method should Daniel use to confirm the session hijacking attack in this scenario?. Monitor for ACK storms. Check for predictable session tokens. Perform manual packet analysis using packet sniffing tools. Use an intrusion detection system (IDS).

John, a penetration tester at a Los Angeles-based online gaming company, is analyzing the company’s cloud infrastructure after a recent security breach caused unexpected downtime and delayed alerts. His investigation reveals that the attackers remained undetected, due to the absence of mechanisms that track function-level activity and capture anomalous events. The backend architecture for matchmaking and in-game purchases is serverless, increasing the importance of robust security measures. So, which cloud computing threat should John prioritize to prevent similar breaches?. Insufficient logging and monitoring. Loss of governance. Side-channel attacks. Privilege escalation.

A penetration tester is tasked with assessing the security of an Android mobile application that stores sensitive user data. The tester finds that the application does not use proper encryption to secure data at rest. What is the most effective way to exploit this vulnerability?. Access the local storage to retrieve sensitive data directly from the device. Execute a Cross-Site Scripting (XSS) attack to steal session cookies. Use SQL injection to retrieve sensitive data from the backend server. Perform a brute-force attack on the application’s login credentials.

During a penetration test against a network defended by a signature-based Intrusion Detection System (IDS), the tester initiates a port scan but notices that traditional scanning methods like full SYN or TCP Connect scans are being flagged and blocked. To evade detection, the tester modifies their approach: they split the TCP headers into multiple smaller IP segments before sending them across the network. This ensures that the IDS sees only incomplete segments of the packet. Once these segments reach the target, the destination host reassembles them and processes the scan as a normal SYN request. No alerts are raised on the IDS, yet the scan reveals open ports on the target. Which evasion technique has the tester most likely employed to avoid triggering IDS alerts?. Packet fragmentation to bypass filtering logic. SYN scan with spoofed MAC address. Packet crafting with randomized window size. IP decoying with randomized address positions.

A penetration tester needs to map open ports on a target network without triggering the organization’s intrusion detection systems (IDS), which are configured to detect standard scanning patterns and abnormal traffic volumes. To achieve this, the tester decides to use a method that leverages a third-party host to obscure the origin of the scan. Which scanning technique should be employed to accomplish this stealthily?. Use an Idle scan by exploiting a “zombie” host. Execute a UDP scan with packet fragmentation. Conduct a TCP FIN scan with randomized port sequences. Perform a TCP SYN scan using slow-timing options.

During a red team assessment, an ethical hacker is assigned the task of mapping a large multinational enterprise’s external attack surfaces. The target organization operates multiple regional websites and cloud-hosted environments under different subdomains. Due to strict rules of engagement, the hacker must avoid any active scans or probes that could alert the organization’s security monitoring systems. The goal is to uncover as many publicly exposed subdomains as possible to identify potential unpatched or misconfigured services that may exist under obscure or forgotten subdomains. Which method should the ethical hacker use to passively enumerate the organization’s subdomains?. Leverage tools like Netcraft or DNSdumpster to gather subdomain information. Attempt to guess admin credentials and access the company’s DNS portal. Request internal DNS records using spoofed credentials. Conduct a brute-force DNS subdomain enumeration.

In the bustling tech hub of Silicon Valley, cybersecurity investigator Elena Martinez found herself deep into a late-night investigation at Horizon Tech Solutions on July 7.2025. The company had reported sporadic network disruptions affecting their research team’s access to critical project files. Elena, working under the cover of a maintenance window from midnight to 3 AM PDT, began monitoring the internal network, focusing on a subnet reserved for the R&D department. She noticed a pattern of failed connection attempts logged just before each disruption, with multiple hosts reporting temporary IP address conflicts. Suspecting foul play, Elena deployed a discreet test to simulate an internal threat scenario. Shortly afterward, several workstations began showing unfamiliar gateway settings and redirected users to misleading login portals during routine access attempts. Despite these anomalies, no security alerts were triggered. What type of attack technique did Elena most likely simulate?. Rogue DHCP Server Attack. MAC Flooding. Packet Sniffing. DHCP Starvation Attack.

A penetration tester discovers that a web application is vulnerable to Local File Inclusion (LFI) due to improper input validation in a URL parameter. Which approach should the tester take to exploit this vulnerability?. Use directory traversal to access sensitive files on the server, such as/etc/passwd. Conduct a brute-force attack on the admin login page to gain access. Perform a Cross-Site Scripting (XSS) attack by injecting malicious scripts into the URL. Inject SQL commands into the URL parameter to test for database vulnerabilities.

Joe, a cybersecurity analyst at XYZ-FinTech, has been assigned to perform a quarterly vulnerability assessment across the organization’s Windows-based servers and employee workstations. His objective is to detect issues such as software configuration errors, incorrect registry or file permissions, native configuration table problems, and other system-level misconfigurations. He is instructed to log into each system using valid credentials to ensure comprehensive data collection. Based on this assignment, which type of vulnerability scanning should Joe perform?. Host-based Scanning. External Scanning. Network-based Scanning. Application Scanning.

During an internal red team engagement, a penetration tester is tasked with mapping the network topology of an organization with multiple segmented subnets. The tester initiates a series of traceroutes from a compromised host to various internal devices across these segments. Upon analyzing the output, the tester observes that a specific IP address, 10.10.10.1, consistently appears as the second-to-last hop before reaching several target systems located in different IP ranges. Despite varying final destination IPs, this intermediate address remains constant. No signs of DNS spoofing, ICMP anomalies, or host-level misconfigurations are present. What does this repeated hop pattern most likely indicate in the context of network architecture?. A core router facilitating communication across multiple internal subnets. DNS poisoning at the local resolver used by the compromised host. Presence of a transparent proxy device acting as a forwarder. Loopback misconfiguration at the destination endpoints.

During a red team assessment of a multinational financial firm, you’re tasked with identifying key personnel across various departments and correlating their digital footprints to evaluate exposure risk. Your objective includes mapping user aliases across platforms, identifying geotagged media, and pinpointing potential insider threats based on social posting behavior. The team has shortlisted multiple tools for the task. Considering the technical capabilities and limitations described in the approved reconnaissance toolkit, which tool provides cross platform username correlation by scanning hundreds of social networking sites, but does not natively support geolocation tracking or visualizing identity relationships?. Sherlock. Creepy. Maltego. Social Searcher.

As an IT technician in a small software development company, you are tasked with providing security against different kinds of cyber threats. You learn about various methods hackers might use to bypass your company’s firewalls. Which of the following is a common technique used by attackers to evade firewall detection?. Changing the source IP address of packets to appear as if the traffic is coming from a trusted source. Utilizing social engineering techniques to trick employees into revealing sensitive information. Implementing an open-source operating system to bypass proprietary software restrictions. Using encrypted communication channels to evade network monitoring tools.

You are an ethical hacker at CyberShield Analytics, hired by Coastal Education Services, a tutoring platform in Miami, Florida, to test the security of their student portal. While probing the portal’s course enrollment page, you input a crafted value into the course ID field, appending a condition that checks if the first character of the database name is a specific value. The application does not display error messages or additional data, but the page takes significantly longer to load when the condition evaluates to true, indicating a deliberate delay. Based on the observed behavior, which SQL injection technique are you employing?. Time-based blind SQL injection. Error-based SQL injection. UNION SQL injection. Boolean exploitation.

A penetration tester finds that a web application does not properly validate user input and is vulnerable to reflected Cross-Site Scripting (XSS). What is the most appropriate approach to exploit this vulnerability?. Embed a malicious script in a URL and tricked a user into clicking the link. Perform a brute-force attack on the user login form to steal credentials. Inject a SQL query into the search form to attempt SQL injection. Use directory traversal to access sensitive files on the server.

In downtown Chicago, Illinois, security analyst Mia Torres investigates a breach at Windy City Enterprises, a logistics firm running an Apache HTTP Server. The attacker exploited a known vulnerability in an outdated version, gaining unauthorized access to customer shipment data. Mia’s analysis reveals the server lacked recent security updates, leaving it susceptible to remote code execution. Determined to prevent future incidents, Mia recommends a strategy to the IT team to address this exposure. Which approach should Mia recommend to secure Windy City Enterprises’ Apache HTTP Server against such vulnerabilities?. Conduct an extensive risk assessment to determine which segments of the network are most vulnerable or at high risk that need to be patched first. Use a dedicated machine as a web server. Block all unnecessary ports, ICMP traffic, and unnecessary protocols such as NetBIOS and SMB. Eliminate unnecessary flies within the jar files.

During a security assessment, an attacker identifies a flaw in a multi-user file system. The system first verifies access rights to a temporary file created by a user. However, immediately after this verification, and before the file is processed, the attacker manages to swap the original file with a malicious version. This manipulation happens in the brief interval between the system's access verification and the moment it handles the file, resulting in the malicious file being treated as legitimate. Which vulnerability is the attacker exploiting?. Time-of-validation/time-of-execution issue in resource management logic. Improper certificate validation in trusted communication channels. Null pointer dereference leading to unexpected application behavior. Integer overflow during arithmetic computations with limited memory bounds.

Under the neon glow of Seattle’s skyline, ethical hacker Elena Vasquez slips into her role as a cybersecurity consultant for Cascade Financial’s online banking platform. Tasked with probing the web server’s defenses, Elena simulates a series of rapid login attempts to the admin portal. She notes that the system allows unlimited tries without locking the account, exposing a gap that could invite relentless password guessing attacks. Determined to shield the bank’s assets, Elena drafts a recommendation to fortify the server’s authentication process against such threats. What countermeasure should Elena recommend to strengthen Cascade Financial’s web server against the vulnerability she identified?. Use CAPTCHA challenges on login and registration pages. Implement 2FA or MFA. Force users to periodically change passwords. Use strong, one-way hashing algorithms such as bcrypt, scrypt, or Argon2.

In the rainy streets of Portland, Oregon, ethical hacker Ethan Brooks delves into the security layers of ShopSwift, a US-based e-commerce platform reeling from a recent data breach. Tasked with uncovering the method behind unauthorized account takeovers, Ethan examines login patterns across the platform’s user base. His investigation reveals a surge of automated login activity across multiple accounts, with a suspiciously high success rate. Determined to trace the root cause, Ethan compiles a detailed log to assist ShopSwift’s security team in restoring trust. Which attack method is Ethan most likely uncovering in ShopSwift’s authentication system?. Credential Stuffing. Password Spraying. Phishing Attacks. Brute Force Attack.

During a red team engagement for a client in the financial sector, ethical hacker Tyler Brooks conducts a phishing campaign using a crafted internal web page disguised as a company VPN login. After several users enter their credentials, Tyler confirms that the payload successfully recorded input without triggering antivirus or requiring local installation privileges. The captured keystrokes came exclusively from a web-based form embedded in the fake login page. Based on the technique used, which type of keylogger did Tyler most likely deploy?. JavaScript-based Keylogger. Application Keylogger. Hypervisor-based Keylogger. Keylogger Keyboard.

After responding to an alert involving unauthorized access to payroll data, forensic analyst Jason Miller traces the breach to a Windows workstation previously used by a temporary staff member in Chicago. While analyzing the event timeline, Jason identifies a non-elevated process that launched a signed Microsoft binary – one of several auto-elevating executables such as fodhelper.exe, eventvwr.exe. or sdclt.exe – which resulted in execution of unauthorized code without prompting the user. Registry analysis reveals manipulation of shell-related keys under the current user hive, redirecting the trusted binary to invoke a malicious payload. Which technique most likely enabled the privilege escalation?. UAC Bypass. Kernel Exploitation. Scheduled Task. DLL Hijacking.

A penetration tester identifies that a web application’s login form is not using secure password hashing mechanisms, allowing attackers to steal passwords if the database is compromised. What is the best approach to exploit this vulnerability?. Perform a dictionary attack using a list of commonly used passwords against the stolen hash values. Input a SQL query to check for SQL injection vulnerabilities in the login form. Conduct a brute-force attack on the login form to guess weak passwords. Capture the login request using a proxy tool and attempt to decrypt the passwords.

A university’s online registration system is experiencing disruptions due to a DDoS attack that combines DNS reflection and HTTP slowloris techniques. Standard firewalls and load balancers are unable to mitigate the attack without impacting legitimate users. To ensure uninterrupted registration services, which advanced mitigation strategy should the university implement?. Utilize a hybrid DDoS mitigation service that offers both on-premises and cloud-based protection. Increase server bandwidth and implement basic rate limiting on all incoming traffic. Configure the firewall to block all incoming DNS and HTTP requests from external IPs. Deploy an Intrusion Prevention System (IPS) with deep packet inspection capabilities.

During an internal penetration test within a large corporate environment, the red team gains access to an unrestricted network port in a public-facing meeting room. Upon connecting a laptop, the tester deploys an automated tool configured to continuously send DHCPDISCOVER requests using thousands of randomly generated spoofed MAC addresses. Within minutes, several employees report that their devices are unable to access the internal network or obtain valid IP configurations. The IT team observes that the DHCP server’s IP lease pool is completely depleted, even though few devices are actually connected at the time. What type of attack did the penetration tester perform?. DHCP starvation. ARP spoofing. Rogue DHCP relay injection. DNS cache poisoning.

A global fintech company that processes millions of online payments daily begins receiving alarming emails from an unknown threat actor claiming to represent a notorious hacktivist group. The email includes a demand for 20 BTC in cryptocurrency, warning that a large-scale DDoS attack will cripple their infrastructure if the ransom is not paid within 72 hours. To prove their seriousness, the attacker initiates a short-lived HTTP flood targeting the company’s checkout service. Within minutes, legitimate users report long delays and service timeouts during payment processing. The incident response team observes a significant spike in POST requests with incomplete payloads, overwhelming the application layer and causing partial service disruptions. The attack ceases after 15 minutes, followed by a second email reinforcing the ransom demand and threatening a more severe attack. What type of DDoS attack is being carried out in this scenario?. DDoS attack combining threat and extortion. DRDoS attack using intermediaries. Recursive GET flood disguised as crawling. Pulse wave attack with burst patterns.

An ethical hacker needs to gather sensitive information about a company’s internal network without engaging directly with the organization's systems to avoid detection. Which method should be employed to obtain this information discreetly?. Exploit a public vulnerability in the company’s web server. Perform a WHOIS lookup on the company’s domain registrar. Use port scanning tools to probe the company’s firewall. Analyze the organization’s job postings for technical details.

A penetration tester submits altered ciphertexts to a web server and pays close attention to how the server responds. When the server produces different error messages for certain inputs, the tester starts to infer which inputs result in valid internal processing. Which cryptanalytic method is being used in this scenario?. Exploit padding error feedback to recover data. Compare traffic timing to deduce the key. Flip bits randomly to scramble the decryption. Inspect randomness across multiple sessions.

While conducting a covert penetration test on a UNIX-based infrastructure, the tester decides to bypass intrusion detection systems by sending specially crafted TCP packets with an unusual set of flags enabled. These packets do not initiate or complete any TCP handshake. During the scan, the tester notices that when certain ports are probed, there is no response from the target, but for others, a TCP RST (reset) packet is received. The tester notes that this behavior consistently aligns with open and closed ports, respectively, without triggering detection systems configured to monitor connection-based scans. Based on these observations, which scanning technique is most likely being used?. FIN scan using stealthy flag combinations. ACK flag scan to evaluate firewall behavior. Xmas scan leveraging RFC 793 quirks. TCP Connect scan to complete the three-way handshake.

A penetration tester is assessing a web application that employs secure, HTTP- only cookies, regenerates session IDs upon login and uses strict session timeout policies. To hijack a user’s session without triggering the application's security defenses, which advanced technique should the tester utilize?. Conduct a network-level man-in-the-middle attack to intercept and reuse session tokens. Perform a session token prediction by analyzing session ID entropy and patterns. Implement a session fixation strategy by pre-setting a session ID before user authentication. Execute a Cross-Site Request Forgery (CSRF) attack to manipulate session states.

A penetration tester is evaluating the security of a mobile application and discovers that it lacks proper input validation. The tester suspects that the application is vulnerable to a malicious code injection attack. What is the most effective way to confirm and exploit this vulnerability?. Perform a brute-force attack on the application’s login page to guess weak credentials. Use directory traversal to access sensitive files stored in the application’s internal storage. Inject a malicious JavaScript code into the input fields and observe the application’s behavior. Execute a dictionary attack on the mobile app’s encryption algorithm.

During an internal red team simulation at a global insurance provider, Joe, a senior SOC analyst, is assigned to verify if a surge in anomalous SYN packets targeting the perimeter firewall is the result of spoofed IP traffic. The organization has ruled out DNS poisoning and malformed header issues. Joe must now analyze packet behavior in real-time to determine authenticity without relying on host-level authentication. To identify spoofed traffic using techniques aligned with best practices taught in the organization, which approach should Joe take?. IP Identification Number (IPID) Monitoring. Direct TTL Probes. IP Address Decoy. TCP Flow Control Method.

A penetration tester is tasked with mapping an organization’s network while avoiding detection by sophisticated intrusion detection systems (IDS). The organization employs advanced IDS capable of recognizing common scanning patterns. Which scanning technique should the tester use to effectively discover live hosts and open ports without triggering the IDS?. Use an Idle scan leveraging a third-party zombie host. Execute a FIN scan by sending TCP packets with the FIN flag set. Perform an ICMP Echo scan to ping all network devices. Conduct a TCP Connect scan using randomized port sequences.

During an external assessment of a regional retail company’s digital infrastructure, security analyst Joe is assigned to map internal services without active intrusion. While testing the behavior of a publicly exposed resolution system, he discovers that a secondary system responds unusually to structured queries. When he issues a specific request format, the server replies with a full list of internal mappings, including subdomains, mall hosts, and system aliases without requiring credentials or triggering alerts. Which technique was most likely used to obtain this information?. DNS Zone Transfer Enumeration. DAP Enumeration. NetBIOS Enumeration. NTP Enumeration.

A penetration tester evaluates the security of an iOS mobile application that handles sensitive user information. The tester discovers that the application is vulnerable to insecure data transmission. What is the most effective method to exploit this vulnerability?. Perform a man-in-the-middle attack to intercept unencrypted data transmitted over the network. Use a Cross-Site Request Forgery (CSRF) attack to steal user session tokens. Execute a SQL injection attack to retrieve data from the backend server. Conduct a brute-force attack on the app’s authentication system.

During a routine software update at Horizon Solutions, a mid-sized IT firm in Raleigh, North Carolina, an employee downloads a free utility from a popular third-party site to streamline document processing. During the installation, the user is prompted to install an optional ‘productivity toolbar’ and a ‘system optimization tool,’ which are bundled with vague descriptions. Shortly after, the employee notices intermittent pop-up ads, an altered browser homepage, and sluggish PC performance, though network logs also show occasional unexplained data transfers during off-hours. A security scan flags the additional programs as potentially harmful, but a deeper analysis reveals no immediate file encryption or self-replicating code. What type of threat are these unwanted programs most likely classified as?. Potentially Unwanted Applications (PUAs). Botnet agents. Worms. Logic bombs.

A security researcher is analyzing a target organization’s publicly accessible cloud infrastructure. While reviewing the website’s HTML source code, the researcher discovers direct references to files hosted on Amazon S3. What is the most effective way to identify additional publicly accessible bucket URLs used by the target?. Use Google advanced search operators to enumerate S3 bucket URLs. Perform packet sniffing to intercept internal S3 bucket names. Exploit XSS to force the page to reveal the S3 links. Use SQL injection to extract internal file paths from the database.

During a security compliance audit at Nexus Tech Solutions in Boston, Massachusetts, the ethical hacking team launches a controlled social engineering exercise to assess help desk vulnerabilities. Ethical hacker Rachel Kim calls the company’s help desk, posing as a stressed employee named Laura Bennett from the marketing department. Rachel claims her laptop is running slowly and offers to share her login credentials if the help desk can provide a quick fix to meet a tight project deadline. The call is designed to test whether help desk staff follow proper verification protocols or fall for the offer of credentials in exchange for assistance. What social engineering technique is Rachel employing in this exercise?. Quid Pro Quo. Shoulder Surfing. Impersonation. Vishing.

Alice, a software developer, digitally signs an email contract and sends it to Bob. Later, a dispute arises and Alice claims she never sent the agreement. However, Bob produces the email with Alice’s unique digital signature, which unequivocally links the message to her. In information security terms, what principle is illustrated by Bob’s ability to prove Alice’s authorship of the email?. Non-Repudiation. Integrity. Confidentiality. Availability.

During a black-box internal penetration test, a security analyst is tasked with identifying potentially exploitable services running on an SNMP-enabled Linux server. The target organization uses SNMPv2, and the default community string “public” has not been changed. The analyst confirms that UDP port 161 is open and accessible. To gather service-related intelligence for privilege escalation or lateral movement, the analyst decides to enumerate all running processes on the host. Which Nmap command would most effectively retrieve the required information?. nmap -sU -p 161 --script snmp-processes. nmap -sU -p 161 --script snmp-sysdescr. nmap -sU -p 161 --script snmp-interfaces. nmap -sU -p l61 --script snmp-win32-services.

During a penetration test in Dallas, Texas, ethical hacker Jason is attempting to bypass MAC-based filtering rules enforced by a network firewall. To avoid having his real MAC address logged and to increase stealth while scanning the internal host at 10.10.1.11, he decides to randomize his MAC address. Which of the following Nmap commands should he use?. nmap -sT -Pn --spoof-mac 0 10.10.1.11. nmap -sT - Pn 10.10.1.11. nmap -sT - Pn --spoof-mac 00:01:02:25:56:AE 10.10.1.11. nmap -sT -Pn --spoof-mac Dell 10.10.1.11.

A penetration tester is tasked with uncovering historical content from a company’s website, including previously exposed login portals or sensitive internal pages. Direct interaction with the live site is prohibited due to strict monitoring policies. To stay undetected, the tester decides to explore previously indexed snapshots of the organization’s web content saved by external sources. Which approach would most effectively support this passive information- gathering objective?. Apply the cache: operator to view Google’s stored versions of target pages. Use the intitle: login operator to list current login pages. Use the link: operator to find backlinks to login portals. Search with intext: “login” site:target.com to retrieve login data.

Olivia, a cybersecurity architect at a Boston-based fintech company, is tasked with upgrading the organization’s cryptographic infrastructure in preparation for future quantum computing threats. A recent internal audit flagged that sensitive customer data stored in the company’s cloud environment could be vulnerable if quantum decryption methods become practically viable. To strengthen their post-quantum defense, Olivia must recommend a proactive cryptographic control that ensures long-term confidentiality of stored data, even against advanced quantum attackers. Which cryptographic defense should Olivia prioritize to mitigate the risk of future quantum-based decryption?. Encrypt stored data with quantum-resistant algorithms. Break data into fragments and distribute it across multiple locations. Include quantum-resistance checks in SDLC and code review processes. Use quantum-specific firewalls to protect quantum communication channels.

A penetration tester is investigating a web server that allows for unrestricted file uploads. The server accepts files without proper validation or sanitization of file types. Which technique should the tester use to exploit this vulnerability and gain potentially control of the server?. Upload a shell script disguised as an image file to execute commands on the server. Conduct a brute-force attack on the server’s FTP service to gain access. Use a Cross-Site Scripting (XSS) attack to steal user session cookies. Perform a SQL injection attack to extract sensitive database information.

In a bustling tech firm in Seattle, Michael, an ethical hacker, is conducting a security assessment to identify potential risks. During his evaluation, he notices that sensitive employee details and system configurations have been exposed through public forums, likely due to careless online behavior. His manager suspects this could lead to unauthorized access or data theft. As part of his testing, what type of threat should Michael focus on to simulate the adversary’s method of gathering this exposed information?. Information Leakage. System and Network Attacks. Social Engineering. Corporate Espionage.

Which of the following is the primary goal of ethical hacking?. To identify and fix security vulnerabilities in a system. To steal sensitive information from a company’s network. To spread malware to compromise multiple systems. To disrupt services by launching denial-of-service attacks.

A penetration tester has gained access to a target system using default credentials. What is the most effective next step to escalate privileges on the system?. Use a known local privilege escalation vulnerability to gain admin access. Use a dictionary attack to brute-force the root password. Execute a Cross-Site Scripting (XSS) attack on the system’s login page. Perform a denial-of-service (DoS) attack to crash the system.

A security analyst investigates unusual east-west traffic on a corporate network. A previously unknown MAC address is found actively communicating from a port connected to a trusted desktop. On closer inspection, a small computing device (Raspberry Pi) was physically inserted between the switch and the legitimate machine. This setup allows the rogue device to piggyback onto the network using the identity and privileges of the authenticated workstation without triggering any authentication processes or alarms. Which evasion technique is being used to blend unauthorized traffic with legitimate access?. NAC bypass using a pre-authenticated device for network bridging. Spoofing ARP responses from a dynamic IP allocation pool. VLAN double tagging to shift between network segments. Exploiting a wireless rogue access point to tunnel through the firewall.

A penetration tester finds malware that spreads across a network without user interaction, replicating itself from one machine to another. What type of malware is this?. Worm. Keylogger. Ransomware. Virus.

During a security penetration test at Sterling Manufacturing in Cleveland, Ohio, the ethical hacking team evaluates the company’s physical security controls. On a chilly evening in July 2025, ethical hacker Priya Desai, posing as a facilities contractor, accesses the company’s loading dock area after regular business hours. Behind the employee entrance, she comes across an unsecured maintenance container with discarded packaging, shipping labels, and shredded office material. Among the clutter, Priya retrieves a crumpled document listing temporary access codes for the employee break room, along with a partially shredded memo referencing an upcoming audit. The exercise tests whether sensitive information discarded improperly can be exploited. The next day, Priya uses the recovered access codes to enter the break room undetected during a shift change, logging her entry on a controlled test system to simulate a breach. What social engineering technique is Priya’s exercise primarily simulating?. Dumpster Diving. Tailgating. Shoulder Surfing. Eavesdropping.

During a penetration testing engagement at First Union Bank in Chicago, ethical hacker Rachel Morgan is assigned to assess the internal network for potential sniffing activity that could compromise sensitive customer data. While inspecting traffic in the loan processing department, Rachel observes that a workstation is receiving packets not addressed to it, raising suspicion of a sniffing tool operating in promiscuous mode. To validate her hypothesis, she prepares to conduct an active verification using a classic detection approach. Which detection technique should Rachel use to confirm the presence of a sniffer in this case?. ARP method by sending non-broadcast ARP requests. Ping method by sending packets with an incorrect MAC address. Sniffer detection using an NSE script to check for promiscuous mode. DNS method by monitoring reverse DNS lookup traffic.

In the bustling digital marketplace of Miami’s tech corridor, ethical hacker Sofia Alvarez probes the virtual defenses of RetailRush, a US-based online retailer hosting thousands of daily transactions. Tasked with exposing weaknesses in the web server’s URL processing, Sofia submits crafted requests to manipulate resource paths. Her tests uncover a severe flaw: the server grants access to restricted system files, exposing sensitive configuration data. Further scrutiny reveals the issue stems from the server’s failure to validate input paths, not from header manipulation, cached content tampering, or credential compromise. Committed to hardening the platform, Sofia drafts a precise report to direct the security team toward immediate fixes. Which web server attack type is Sofia most likely exploiting in Retail Rush’s web server?. Directory Traversal Attackk. Password Cracking Attac. FTTP Response Splitting Attack. Web Cache Poisoning Attack.

In Denver, Colorado, ethical hacker Sophia Nguyen is hired by Rocky Mountain Insurance to assess the effectiveness of their network security controls. During her penetration test, she attempts to evade the company’s firewall by fragmenting malicious packets to avoid detection. The IT team, aware of such techniques, has implemented a security measure to analyze packet contents beyond standard headers. Sophia’s efforts are thwarted as the system identifies and blocks her fragmented packets. Which security measure is the IT team most likely using to counter Sophia’s firewall evasion attempt?. Deep Packet Inspection. Stateful Packet Inspection. Signature-Based Detection. Anomaly-Based Detection.

During a security assessment of a company’s internal web application, a penetration tester examines how the application processes input values passed in the web address query string. The application includes a feature that dynamically fetches documents based on a filename value provided in the web address (e.g., https://intranet.example.com/view?file=report.txt). By altering this input to include sequences like ../../../../etc/passwd, the tester successfully navigates beyond the intended storage location and accesses restricted files. Further manipulation reveals access to sensitive configuration files, source code, and internal scripts, confirming that the application lacks proper input sanitization and isolation of file access paths. Which attack method does this scenario illustrate?. Use directory traversal sequences in URL parameters to retrieve unauthorized system content. Inject malicious scripts into web pages to manipulate content via XSS vulnerabilities. Exploit buffer overflow issues by injecting oversized data in HTTP request headers. Conduct a brute-force attack to obtain administrative credentials.

A cybersecurity team at a regional healthcare provider is conducting an internal red team exercise to assess their exposure to service enumeration attacks. Amanda, a senior penetration tester, is assigned to probe the internal network for services that may reveal usernames, group information, or system details without requiring prior authentication. She decides to target common services running on specific ports that are often misconfigured or loosely monitored. During her reconnaissance, Amanda identifies several open ports across various hosts and must now prioritize which ones to probe first for maximum information gain related to enumeration. Which of the following services should Amanda target as a priority to enumerate usernames and group information without authentication?. TCP 139 and UDP 137, 138. TCP 21 and UDP 137. TCP 25 and UDP 138. TCP 23 and UDP 137, 138.

During a high-stakes engagement on a secure corporate network, a penetration tester discovers an opportunity to attack the domain controller. By abusing an API call from Microsoft’s Encrypting File System Remote Protocol (MS-EFSRPC), the tester forces the domain controller to initiate NTLM authentication to a server controlled by the tester. The tester then captures the resulting NTLM hash and relays it to the Active Directory Certificate Services (AD CS), ultimately obtaining a certificate that confers administrative privileges over the network. This sophisticated method allows the tester to compromise the network without requiring direct access to the domain controller. Which network-level hijacking technique is illustrated in this scenario?. Hijacking sessions using a PetitPotam relay attack. Stealing session tokens using browser-based exploits. Employing a session donation method to transfer tokens. Exploiting vulnerabilities in TLS compression via a CRIME attack.

A penetration tester is conducting a security assessment for a client and needs to capture sensitive information transmitted across multiple VLANs without being detected by the organization's security monitoring systems. The network employs strict VLAN segmentation and port security measures to restrict unauthorized access. Which advanced sniffing technique should the tester use to discreetly intercept and analyze traffic across all VLANs?. Exploit a VLAN hopping vulnerability to access multiple VLANs. Deploy a rogue DHCP server to redirect network traffic. Implement switch port mirroring on all VLANs. Use ARP poisoning to perform a man-in-the-middle attack.

Emma, an ethical hacker at a Chicago-based healthcare provider, is performing a penetration test on the organization’s patient record system following a recent data breach. During her investigation, she discovers that attackers gained access to a large volume of encrypted patient records but had no knowledge of the original data or encryption keys. Emma observes that the system uses a block cipher and suspects the attackers may have applied a cryptanalytic method that examines encrypted outputs in bulk to detect structural or statistical patterns in the encrypted data. Which cryptanalysis technique should Emma investigate to assess the system’s vulnerability in this scenario?. Ciphertext-only attack. Chosen-ciphertext attack. Known plaintext attack. Chosen-plaintext attack.

A cyber adversary is performing external reconnaissance on a large enterprise network with multiple perimeter defenses in place, including packet-filtering firewalls and intrusion detection systems (IDS). The goal is to enumerate the firewall's rule set to identify which TCP and UDP ports are permitted for inbound traffic to internal systems. To minimize noise and avoid immediate detection, the attacker wants to use a method that mimics normal traffic flows while providing insight into how the firewall handles packets based on port and protocol combinations. Which reconnaissance technique should the attacker choose to effectively map the firewall’s filtering behavior without raising alerts?. Firewalking with manipulated TTL values to analyze ACL responses. Passive DNS monitoring to observe domain-to-IP relationships. Sending ICMP Echo requests to the network’s broadcast address. Conducting full SYN scans on all ports for each discovered IP.

During a security assessment, a consultant investigates how the application handles requests from authenticated users. They discover that once a user logs in, the application does not verify the origin of subsequent requests. To exploit this, the consultant creates a web page containing a malicious form that submits a funds transfer request to the application. A logged-in user, believing the page is part of a promotional campaign, fills out the form and submits it. The application processes the request successfully without any reauthentication or user confirmation, completing the transaction under the victim’s session. Which session hijacking technique is being used in this scenario?. Hijacking a user session using a cross-site request forgery attack. Hijacking a user session using a session replay attack. Hijacking a user session using a cross-site script attack. Hijacking a user session using a session fixation attack.

While assessing a web server’s behavior, a tester sends malformed HTTP GET requests using unusual methods like “DELETE” and “OPTIONS” combined with long URI strings and observes varying status codes and response headers. The tester uses a tool that matches these responses against known patterns to deduce the server’s software and version. Which technique is the tester employing?. Fingerprinting server identity using banner-grabbing techniques. Conducting session fixation using malformed cookie headers targeting the web server. Sending phishing emails to extract web server login credentials. Injecting scripts into headers for persistent XSS attacks on the server-side.

During a security assessment at Apex Technologies in Austin, Texas, the cybersecurity team identifies a high risk of social engineering attacks. Including phishing, vishing, and baiting, targeting employees across departments. To strengthen defenses, the team plans to implement a countermeasure to reduce the likelihood of employees disclosing sensitive information. Which of the following countermeasures should Apex Technologies prioritize to mitigate the risk of social engineering attacks?. Use two-factor authentication. Employees must verify identity of individuals requesting information. Establish policies and procedures for handling sensitive information. Conduct security awareness and training programs.

A penetration tester performs a vulnerability scan on a company’s web server and identifies several medium-risk vulnerabilities related to misconfigured settings. What should the tester do to verify the vulnerabilities?. Use publicly available tools to exploit the vulnerabilities and confirm their impact. Perform a brute-force attack on the web server’s login page. Ignore the vulnerabilities since they are medium-risk. Conduct a denial-of-service (DoS) attack to test the server’s resilience.

In the bustling financial hub of Charlotte, North Carolina, ethical hacker Raj Patel is contracted by TrustBank, a regional US bank, to evaluate their online loan application portal. On April 22, 2025, Raj tests a feature allowing customers to upload structured financial documents for loan processing. By submitting a specially crafted document, he triggers a response that exposes internal server file paths and sensitive configuration data, including database connection strings. The issue arises from the portal’s handling of external references in document parsing, not from response manipulation, authentication weaknesses, or undetected attack attempts. Raj compiles a detailed report to assist TrustBank’s security team in mitigating the vulnerability. Which type of vulnerability is Raj most likely exploiting in TrustBank’s online loan application portal?. XML External Entity (XXE) Injection. Security Legg ng and Monitoring Failures. HTTP Response Splitting. Identification and Authentication Failures.

An attacker extracts the initial bytes from an encrypted file container and uses a tool to iterate through numeric combinations. What type of cryptanalytic technique is being utilized?. Test every possible password through automation. Seek identical digests across hash outputs. Analyze output length to spot anomalies. Force encryption key through quantum solving.

You are Ethan Brooks, an ethical hacker at Vanguard Security Solutions, hired to perform a wireless penetration test for Pacific Logistics, a shipping company in Seattle, Washington. Your task is to identify all Wi-Fi networks in range without alerting the network administrators. Using a laptop with a Wi-Fi card, you monitor radio channels to detect access points and their BSSiDs without sending any probe requests or injecting data packets. Based on the described method, which Wi-Fi discovery technique are you employing?. Passive Footprinting. Network Discovery Software. Wash Command. Active Footprinting.

A penetration tester is assessing a company’s vulnerability to advanced social engineering attacks targeting its legal department. Using comprehensive knowledge of recent mergers and internal legal proceedings, the tester crafts a highly credible pretext to deceive legal employees into sharing confidential case documents. What is the most effective social engineering technique the tester should employ to obtain confidential documents without raising suspicion?. Send a spear-phishing email referencing specific merger details and requesting document access. Conduct a mass phishing campaign with generic legal templates attached. Create a fake LinkedIn profile to connect with legal employees and request document sharing. Visit the office in person posing as a new legal intern to request document access.

In Dallas, Texas, Alex, a cloud security specialist at a logistics company, is designing a cloud infrastructure to deploy containerized web applications for real-time shipment tracking. To ensure the applications remain accessible even if one node fails, with minimal downtime, Alex plans to run several nodes as a group so that, if one node goes down, another node in the cluster can automatically continue handling its workload. This setup will leverage cloud clustering for enhanced scalability by distributing container instances across nodes in different zones. Which type of cluster computing should Alex implement to achieve these capabilities in the cloud environment?. Highly Available [HA] or Fail-over. Load Balancing. High-Performance Computing. Resource Pooling.

A penetration tester is assessing an IoT thermostat used in a smart home system. The device communicates with a cloud server for updates and commands. The tester discovers that communication between the device and the cloud server is not encrypted. What is the most effective way to exploit this vulnerability?. Use a man-in-the-middle (MitM) attack to intercept and manipulate unencrypted communication. Perform a brute-force attack on the thermostat’s local admin login. Execute a SQL injection attack on the cloud server’s login page. Conduct a Cross-Site Scripting (XSS) attack on the thermostat’s web interface.

In a vertical privilege escalation scenario, the attacker attempts to gain access to a user account with higher privileges than their current level. Which of the following examples describes vertical privilege escalation?\. An attacker escalates from a regular user to an administrator by exploiting administrative functions. An attacker exploits weak access controls to access and steal sensitive information from another user’s account with alike privileges. An attacker leverages a lack of session management controls to switch accounts and access resources assigned to another user with the same permissions. An attacker uses an unquoted service path vulnerability to gain unauthorized access to another user’s data with equivalent privileges.

A penetration tester is testing a web application’s product search feature, which takes user input and queries the database. The tester suspects the input is not properly sanitized. What is the best approach to confirm the presence of SQL injection?. Enter 1’ OR ‘1’=‘1 to check if all products are returned. Inject a script like to test for Cross-Site Scripting (XSS). Use directory traversal syntax to access restricted files on the server. Input ‘; DROP TABLE products; -- to see if the table is deleted.

At a cybersecurity consultancy firm in Boston, senior analyst Amanda Liu is called in to assess a malware outbreak affecting a regional healthcare provider. Despite using updated antivirus tools, the security team notices inconsistent detection across infected endpoints. Amanda discovers that while the malicious behavior is consistent system file tampering and suspicious outbound traffic each malware sample has a slightly different code structure and fails traditional hash-based comparison. Static analysis reveals that the underlying logic remains unchanged, but the code patterns vary unpredictably across infections. What type of virus is most likely responsible for this behavior?. Polymorphic virus. Macro virus. Cavity virus. Stealth virus.

During a post-exploitation phase in a network compromise simulation, ethical hacker Devon Hughes gains a Meterpreter session on a manager’s Windows 10 workstation. To maintain stealth, he avoids actions that generate obvious signs of tampering such as privilege escalation or file system changes. Instead, he wants to monitor the user’s live activity over time without their knowledge, focusing specifically on input patterns and active sessions. Which Meterpreter command should he use to achieve this objective with minimal visibility?. keyscan_start. hashdump. getsystem. persistence.

A penetration tester evaluates a company’s secure web application, which uses HTTPS, secure cookie flags, and strict session management to prevent session hijacking. To bypass these protections and hijack a legitimate user’s session without detection, which advanced technique should the tester employ?. Perform a Cross-Site Scripting (XSS) attack to steal the session token. Exploit a timing side-channel vulnerability to predict session tokens. Implement a Man-in-the-Middle (MitM) attack by compromising a trusted certificate authority. Utilize a session fixation attack by forcing a known session ID during login.

A penetration tester runs a vulnerability scan and identifies an outdated version of a web application running on the company’s server. The scan flags this as a medium-risk vulnerability. What is the best next step for the tester?. Perform a denial-of-service (DoS) attack to crash the web application. Research the vulnerability to check for any available patches or known exploits. Brute-force the admin login page to gain unauthorized access. Ignore the vulnerability since it is only flagged as medium-risk.

While evaluating a smart card implementation, a security analyst observes that an attacker is measuring fluctuations in power consumption and timing variations during encryption operations on the chip. The attacker uses this information to infer secret keys used within the device. What type of exploitation is being carried out?. Observe hardware signals to deduce secrets. Disrupt control flow to modify instructions. Crack hashes using statistical collisions. Force session resets through input flooding.

In the sunlit tech oasis of Phoenix, Arizona, ethical hacker Nadia Patel explores the inner workings of LearnSphere, a US-based e-learning platform serving thousands of students. Tasked with evaluating the application’s resource- sharing mechanisms, Nadia crafts HTTP requests to interact with the platform’s content delivery endpoint. Her tests uncover a serious flaw: improperly configured access-control headers permit cross-origin requests from unauthorized domains, allowing access to protected course materials. Determined to strengthen the platform, Nadia documents her findings to provide LearnSphere’s security team with clear, actionable guidance. Which vulnerability is Nadia most likely exploiting in LearnSphere’s web application?. CORS Misconfiguration. Default Credential Exposure. Verbose Error Messages. Directory Listing.

During an internal red team engagement, an operator discovers that TCP port 389 is open on a target system identified as a domain controller. To assess the extent of LDAP exposure, the operator runs the command ldapsearch -h -x -s base namingcontexts and receives a response revealing the base distinguished name (DN): DC=internal,DC=corp. This naming context indicates the root of the LDAP directory structure used by the organization’s Active Directory. With this discovery, the operator plans the next step to continue LDAP enumeration and expand visibility into users and objects in the domain. What is the most logical next action?. Use the base DN in a filter to enumerate directory objects. Conduct an ARP scan on the local subnet. Launch a brute-force attack against user passwords via SMB. Attempt an RDP login to the domain controller.

An AWS security operations team receives an alert regarding abnormal outbound traffic from an EC2 instance. The instance, which previously handled backend microservices, begins transmitting encrypted data packets to an external domain. Upon deeper investigation, it is discovered that the external domain resolves to a Dropbox account not associated with the organization. Network flow logs confirm a consistent pattern of data transfers to this destination during off-peak hours. Further forensic analysis reveals that a malicious executable was silently installed on the instance, which modifies the sync configuration of the Dropbox client to use the attacker's access token. This enables the compromised EC2 instance to automatically sync selected data folders with the attacker’s Dropbox storage, bypassing traditional perimeter defenses. What type of attack has likely occurred?. Man-in-the-Cloud (MITC) attack. Side-channel attack exploiting CPU cache. Cloud Snooper attack leveraging port masquerading. Cryptojacking using CoinHive scripts.

You are part of the red team assigned to evaluate the physical and social vulnerabilities of a government contractor’s office located in a metropolitan business hub. During your pretexting phase, you decide to simulate the role of a third-party IT technician. Upon arrival, the receptionist allows you entry without verification, assuming you’re there for scheduled printer maintenance. While moving through the workspace, you casually observe open terminals, unattended printouts, and discarded sticky notes at workstations. You later report several user credentials and partial access details acquired during this visit. Which social engineering technique does this scenario best illustrate?. Impersonation. Eavesdropping. Shoulder Surfing. Dumpster Diving.

In Seattle, Washington, ethical hacker Mia Chen is tasked with testing the network defenses of Pacific Shipping Co., a major logistics firm. During her penetration test, Mia targets the company’s external-facing web server, which handles customer tracking requests. She observes that the security system filtering traffic to this server analyzes incoming SSH and DNS requests to block unauthorized access attempts. Mia plans to craft specific payloads to bypass this system to expose vulnerabilities to the IT department. Which security system is Mia attempting to bypass during her penetration test of Pacific Shipping Co.’s web server?. Application-Level Firewall. Stateful Multilayer Inspection Firewall. Packet Filtering Firewall. Circuit-Level Gateway Firewall.

Sarah, an ethical hacker at a San Francisco-based financial firm, is testing the security of their customer database after a recent data exposure incident. Her analysis reveals that the sensitive client information is safeguarded using a symmetric encryption algorithm. She observes that the algorithm processes data in 64-bit blocks and supports a variable key size from 32 to 448 bits. During her penetration test, Sarah intercepts a ciphertext transmission and notes that the encryption was developed as a replacement for DES, an older algorithm. She aims to determine if the algorithm’s flexible key size could be susceptible to brute-force attacks. The algorithm is also noted for its use in secure storage, a critical application for the firm’s data protection. Which symmetric encryption algorithm should Sarah identify as the one used by the firm?. Blowfish. Twofish. AES. RC4.

During a security assessment of an organization’s internal network, a penetration tester discovers that UDP port 123 is open on a critical host, indicating that the Network Time Protocol (NTP) service is active. The tester suspects the NTP server could reveal insights into how the internal network synchronizes time, which could assist in lateral movement or correlating timestamps in logs. To gather more information, the tester decides to enumerate the list of NTP peers and determine their synchronization status, offset, and stratum levels to understand the hierarchy and redundancy in the time synchronization infrastructure. Which command should the tester use to retrieve this specific information?. ntpq. ntpdc. ntptrace. ntpdate.

Dr. Evelyn Reed, a cybersecurity expert, was called in to investigate a series of unusual activities at “Global Innovations Inc.” The first red flag was a surge in spear-phishing emails targeting senior management, disguised as urgent internal memos. Soon after, the company’s web server showed unexpected outbound traffic to unfamiliar IP addresses. A network audit revealed that multiple underutilized printers and routers had unauthorized firmware installed. Further review uncovered inconsistencies in file access logs linked to the R&D department, including unusually large data transfers occurring during non-business hours. Dr. Reed also noted the attackers appeared to have intimate knowledge of the organization’s internal data structure. Which phase of the Advanced Persistent Threat (APT) lifecycle is Global Innovations Inc. most likely experiencing, given the combination of these incidents?. Search and Exfiltration. Persistence. Expansion. Initial Intrusion.

A penetration tester is assessing a company’s executive team for vulnerability to sophisticated social engineering attacks by impersonating a trusted vendor and leveraging internal communications. What is the most effective social engineering technique to obtain sensitive executive credentials without being detected?. Create a targeted spear-phishing email that references recent internal projects and requests credential verification. Develop a fake social media profile to connect with executives and request private information. Conduct a phone call posing as the CEO to request immediate password changes from executives. Send a mass phishing email with a malicious link disguised as a company-wide update.

During a stealth assessment of a corporate internal network, an attacker gains access to a subnet where host communications are switched and protected against common ARP poisoning techniques. While passively sniffing traffic, the attacker observes that the target system (Host B) intermittently delays its response to ARP requests. Recognizing a potential opportunity, the attacker crafts and injects a fake ARP reply that maps the target’s IP address to their own MAC address and sends it before the legitimate reply arrives. Over time, the attacker notices that packets originally intended for Host B occasionally arrive at their own system, especially during these ARP response delays. The switch’s CAM table seems to temporarily associate the target's IP with the attacker’s MAC and port, before reverting back once the legitimate host reasserts itself. What type of sniffing attack is the attacker performing?. Switch port stealing via timing-based ARP spoofing. ARP poisoning for MiTM interception. Passive sniffing on a switched network. Duplicate IP conflict resolution attack.

Amid the vibrant buzz of Miami’s digital scene, ethical hacker Sofia Alvarez embarks on a mission to fortify the web server of Sunshine Media’s streaming platform. Diving into her security assessment, Sofia sends a meticulously crafted GET / HTTP/1.0 request to the server, scrutinizing its response. The server obligingly returns headers exposing its software version and operating system, a revelation that could empower malicious actors to tailor their attacks. Committed to bolstering the platform’s defenses, Sofia documents her findings to urge the security team to address this exposure. What approach is Sofia using to expose the vulnerability in Sunshine Media’s web server?. Web Server Footprinting/Banner Grabbing. Directory Brute Forcing. Vulnerability Scanning. Informal on Gathering from Robots.txt File.

A penetration tester is evaluating a web application that does not properly validate the authenticity of HTTP requests. The tester suspects the application is vulnerable to Cross-Site Request Forgery (CSRF). Which approach should the tester use to exploit this vulnerability?. Create a malicious website that sends a crafted request on behalf of the user when visited. Perform a brute-force attack on the application’s login page to guess weak credentials. Inject a SQL query into the input fields to perform SQL injection. Execute a directory traversal attack to access restricted server files.

A penetration tester is tasked with compromising a company's wireless network, which uses WPA2-PSK encryption. The tester wants to capture the WPA2 handshake and crack the pre-shared key. What is the most appropriate approach to achieve this?. Use a de-authentication attack to force a client to reconnect, capturing the WPA2 handshake. Conduct a Man-in-the-Middle attack by spoofing the router’s MAC address. Execute a Cross-Site Scripting (XSS) attack on the router’s admin panel. Perform a brute-force attack directly on the WPA2 encryption.

During a late-night shift at IronWave Logistics in Seattle, cybersecurity analyst Marcus Chen notices a pattern of high-port outbound traffic from over a dozen internal machines to a previously unseen external IP. Each system had recently received a disguised shipping report, which, when opened, initiated a process that spread autonomously to other workstations using shared folders and stolen credentials. Upon investigation, Marcus discovers that the machines now contain hidden executables that silently accept remote instructions and occasionally trigger coordinated background tasks. The compromised endpoints are behaving like zombies, and malware analysts confirm that the payload used worm-like propagation to deliver a backdoor component across the network. Which is the most likely objective behind this attack?. To establish a botnet for remote command and control. To deploy a Remote Access Trojan (RAT) for stealthy surveillance. To execute a ransomware payload and encrypt all data. To exfiltrate sensitive information and tracking data.