EEE

An ethical hacker is conducting a penetration test on a company’s network with full knowledge and permission from the organization. What is this type of hacking called?. White Hat Hacking. Grey Hat Hacking. Black Hat Hacking. Blue Hat Hacking.

A critical infrastructure facility has an extensive network of IoT devices integrated with its OT systems. Following a recent surge in cyberattacks on similar facilities globally, the security team received an anonymous email detailing a possible attack on their systems. The attacker allegedly plans to compromise the IoT devices and use them as a gateway to the OT systems. What should be the immediate action of the security team to mitigate this threat?. Initiate a full-scale penetration testing exercise on IoT devices to identify and patch vulnerabilities. Employ an intrusion prevention system (IPS) on the network to detect and block any malicious activities. Establish a secure communication protocol between IoT and OT systems with proper encryption and authentication. Deploy a machine-learning-based security solution to monitor and predict potential threats.

A penetration tester detects malware on a system that secretly records all keystrokes entered by the user. What type of malware is this?. Keylogger. Worm. Ransomware. Rootkit.

A penetration tester suspects that a web application’s user profile page is vulnerable to SQL injection, as it uses the userID parameter in SQL queries without proper sanitization. Which technique should the tester use to confirm the vulnerability?. Attempt a directory traversal attack using the userID parameter. Modify the userID parameter in the URL to ‘ OR ‘1’=’1 and check if it returns multiple profiles. Use the userID parameter to perform a brute-force attack on the admin login page. Inject HTML code into the userID parameter to test for Cross-Site Scripting (XSS).

During a covert red team engagement, a penetration tester is tasked with identifying live hosts in a target organization’s internal subnet (10.0.0.0/24) without triggering intrusion detection systems (IDS). To remain undetected, the tester opts to use the command nmap -sn -PE 10.0.0.0/24, which results in several “Host is up” responses, even though the organization’s IDS is tuned to detect high-volume scans. After the engagement, the client reviews the logs and is surprised that the scan was not flagged. What allowed the scan to complete without triggering alerts?. It performed an ICMP Echo ping sweep without port probing. It used TCP ACK packets that were allowed through. It scanned only the ports open in the firewall whitelist. It used UDP packets that bypassed ICMP inspection.

A penetration tester is evaluating a web application that uses HTTPS, secure cookies, and implements multi factor authentication to prevent session hijacking. To hijack a legitimate user’s session without triggering security alerts, which advanced technique should the tester employ?. Exploit a browser zero-day vulnerability to inject malicious scripts. Implement a man-in-the-middle attack by compromising a trusted network device. Utilize a session token replay attack by capturing encrypted tokens. Perform a Cross-Site Request Forgery (CSRF) attack to manipulate session tokens.

A penetration tester discovers that a web application is using outdated SSL/TLS protocols (TLS 1.0) to secure communication. What is the most effective way to exploit this vulnerability?. Use a man-in-the-middle (MitM) attack to intercept and decrypt traffic. Conduct a Cross-Site Scripting (XSS) attack on the application. Execute a SQL injection attack on the application’s backend. Perform a brute-force attack on the SSL/TLS handshake.

A multinational corporation recently survived a severe Distributed Denial-of- Service (DDoS) attack, which caused significant downtime and resulted in substantial financial losses. After implementing enhanced security measures, the company contracted you as a cybersecurity consultant to assess their new infrastructure. During the audit, you discovered that the organization uses both hardware and cloud-based solutions to distribute incoming traffic. The primary purpose of these solutions is to absorb and mitigate the effects of a DDoS attack, ensuring that legitimate requests are not affected during such an event. What type of DDoS mitigation strategy is the company utilizing?. Load Balancing: This approach distributes network or application traffic across many resources to optimize resource use, minimize latency, and maximize throughput. This is consistent with the company’s strategy of distributing incoming traffic. Sinkholing: This technique reroutes traffic to a “sinkhole”, a designated IP address where traffic can be analyzed. However, this doesn’t align with the company’s strategy of distributing incoming traffic. Black Hole Routing: This approach directs all traffic into a non-existent interface (the “black hole”), which wouldn’t distribute traffic but would drop it, making it inconsistent with the company’s strategy. Rate Limiting: This technique controls the traffic rate using bandwidth management. It doesn’t distribute the traffic but rather restricts it, making it inconsistent with the company’s strategy.

A large media-streaming company begins receiving complaints from users that their web application is timing out or failing to load. The security team observes that the web server is overwhelmed with a high number of open HTTP connections, most of which appear to be legitimate but are transmitting data at an abnormally slow rate. These connections are never fully completed, causing the server’s resources to remain occupied and unable to process new incoming client requests. The incident response team rules out bandwidth exhaustion and malformed packet-based attacks and suspects an application-layer DoS technique is responsible. Given the scenario, which specific type of attack is most likely being executed on the company’s web application?. The attacker uses a Slowloris attack to keep many open connections alive, slowly exhausting the server’s connection pool. The attacker sends fragmented packets with overlapping offset values to destabilize the target system. The attacker uses a flooding attack on the server with random UDP packets to random ports to consume available bandwidth. The attacker floods the server with continuous ICMP Echo Request packets, overwhelming its network stack.

A penetration tester suspects that a web application’s login form is vulnerable to SQL injection due to improper sanitization of user input. What is the most appropriate approach to test for SQL injection in the login form?. Enter ‘ OR ‘1’=’1 in the username and password fields to bypass authentication. Inject JavaScript into the input fields to test for Cross-Site Scripting (XSS). Use a brute-force attack on the login page to guess valid credentials. Perform a directory traversal attack to access sensitive files.

A red team member uses an access token obtained from an Azure function to authenticate with Azure PowerShell and retrieve storage account keys. What kind of abuse does this scenario demonstrate?. Exploiting managed identities for unauthorized access. Gathering NSG rule information. Lateral movement via Stormspotter. Enumeration of user groups with AzureGraph.

You have recently been hired as an entry-level IT technician in a large corporation. In a meeting with the IT team, the terms “ethical hacking” and “penetration testing” are mentioned frequently. Later, a colleague explains to you that the main difference between the two is based on their goals. What is the primary goal of an ethical hacker in comparison to a penetration tester?. An ethical hacker is primarily focused on securing the system, while a penetration tester tries to exploit the system's vulnerabilities. An ethical hacker seeks to bring the system down, while a penetration tester is focused on improving system security. An ethical hacker aims to improve system security, while a penetration tester seeks to bring the system down. An ethical hacker is focused on exploiting system vulnerabilities, while a penetration tester aims to secure the system.

A financial services firm is experiencing a sophisticated DoS attack on their DNS servers with DNS amplification and their web servers with HTTP floods. Traditional firewall rules and IDS are failing to mitigate the attack effectively. To protect their infrastructure without impacting legitimate users, which advanced mitigation strategy should the firm implement?. Increase server capacity and implement simple rate limiting. Deploy a Web Application Firewall (WAF) to filter HTTP traffic. Block all incoming traffic from suspicious IP ranges using access control lists. Utilize a cloud-based DDoS protection service with traffic scrubbing capabilities.

As a security analyst, you are testing your company’s network for potential vulnerabilities. During your investigation, you suspect that an attacker might be using MAC flooding to compromise the switches and sniff network traffic. Which of the following indicators would most likely confirm your suspicions. Numerous MAC addresses that correspond to a single switch port. An increased number of ARP requests in the network traffic. The presence of multiple IP addresses assigned to a single MAC address. The existence of multiple MAC addresses assigned to a single IP address.

A penetration tester identifies malware that monitors the activities of a user and secretly collects personal information, such as login credentials and browsing habits. What type of malware is this?. Spyware. Worm. Ransomware. Rootkit.

A penetration tester performs a vulnerability scan on a company’s network and identifies a critical vulnerability related to an outdated version of a database server. What should the tester prioritize as the next step?. Attempt to exploit the vulnerability using publicly available tools or exploits. Perform a denial-of-service (DoS) attack on the database server. Ignore the vulnerability and move on to testing other systems. Conduct a brute-force attack on the database login page.

A cybersecurity research team identifies suspicious behavior on a user’s Android device. Upon investigation, they discover that a seemingly harmless app, downloaded from a third-party app store, has silently overwritten several legitimate applications such as WhatsApp and SHAREit. These fake replicas maintain the original icon and user interface but serve intrusive advertisements and covertly harvest credentials and personal data in the background. The attackers achieved this by embedding malicious code in utility apps like video editors and photo filters, which users were tricked into installing. The replacement occurred without user consent, and the malicious code communicates with a command-and-control (C&C) server to execute further instructions. What type of attack is being carried out in this scenario?. Agent Smith attack. Camfecting attack. Man-in-the-Disk attack. Simjacker attack.

During a comprehensive internal penetration test, a tester attempts to enumerate open services using a UDP scan across a wide range of ports on a target system. After transmitting multiple UDP probes, the tester observes that some ports generate immediate ICMP “Destination Unreachable – Port Unreachable” (Type 3, Code 3) responses. However, the majority of the ports remain silent, providing no reply or error message. No firewall rules or IDS alerts have been triggered at this stage. The tester suspects that the scan results are inconclusive for several of the probed ports. Based on the observed behavior, what can the tester reasonably conclude about the non-responsive ports?. They may be open or filtered, requiring retransmission. The system blocked all probes after rate-limiting was detected. The ports are likely closed because no ICMP response was received. They may correspond to some services requiring three-way handshakes.

A penetration tester has completed a vulnerability scan on a company’s internal network. The scan reveals multiple low-risk vulnerabilities, but one high-risk vulnerability is associated with outdated server software. What should the tester prioritize as the next step?. Verify if the high-risk vulnerability is exploitable by checking for known exploits. Ignore the high-risk vulnerability and proceed with testing other systems. Focus on exploiting the low-risk vulnerabilities first. Perform a brute-force attack on the server to gain access.

A penetration tester is attempting to gain access to a wireless network that is secured with WPA2 encryption. The tester successfully captures the WPA2 handshake but now needs to crack the pre-shared key. What is the most effective method to proceed?. Use a dictionary attack against the captured WPA2 handshake to crack the key. Conduct a de-authentication attack to disconnect all clients from the network. Execute a SQL injection attack on the router’s login page. Perform a brute-force attack using common passwords against the captured handshake.

A penetration tester is hired by a company to assess its vulnerability to social engineering attacks targeting its IT department. The tester decides to use a sophisticated pretext involving technical jargon and insider information to deceive employees into revealing their network credentials. What is the most effective social engineering technique the tester should employ to maximize the chances of obtaining valid credentials without raising suspicion?. Conduct a phone call posing as a high-level executive requesting urgent password resets. Visit the office in person as a maintenance worker to gain physical access to terminals. Send a generic phishing email with a malicious attachment to multiple employees. Create a convincing fake IT support portal that mimics the company’s internal systems.

You are a security consultant who has been hired to conduct security awareness training at a mid-sized organization. During the session on social engineering, you emphasize the importance of being vigilant against different types of social engineering attacks. Which of the following scenarios best describes a tailgating social engineering attack?. A person gains access to the building by following an employee through a secure door before it closes. An attacker leaves a USB labelled “Employee Bonus List” in the restroom, hoping someone will insert it into their computer. An attacker calls a company’s customer service representative, claiming they lost their account details and need assistance in recovering them. An email is sent to a company's employees claiming there is an urgent system update and they need to enter their login credentials to complete the process.

An ethical hacker needs to gather detailed information about a company’s internal network without initiating any direct interaction that could be logged or raise suspicion. Which approach should be used to obtain this information covertly?. Examine email headers from past communications with the company. Analyze the company’s SSL certificates for internal details. Inspect public WHOIS records for hidden network data. Utilize network scanning tools to map the company’s IP range.

What is the main difference between ethical hacking and malicious hacking?. Ethical hackers use different tools than malicious hackers. Ethical hacking is performed with permission, while malicious hacking is unauthorized. Ethical hacking is illegal, while malicious hacking is legal. Ethical hackers always work alone, while malicious hackers work in teams.

A penetration tester is tasked with assessing the security of a smart home IoT device that communicates with a mobile app over an unencrypted connection. The tester wants to intercept the communication and extract sensitive information. What is the most effective approach to exploit this vulnerability?. Use a man-in-the-middle (MitM) attack to intercept and analyze the unencrypted traffic. Execute a SQL injection attack on the IoT device’s cloud management portal. Use a dictionary attack to guess the admin login credentials of the device. Perform a brute-force attack on the device’s Wi-Fi credentials.

A penetration tester is targeting a wireless network secured with WPA2-PSK. The tester captures the handshake but wants to speed up the process of cracking the pre-shared key. Which approach would be most effective?. Use a dictionary attack with a large wordlist to crack the WPA2 key. Conduct a Cross-Site Scripting (XSS) attack on the router’s login page. Perform a SQL injection attack to bypass the WPA2 authentication. Use a brute-force attack to crack the pre-shared key manually.

A penetration tester is tasked with enumerating user accounts and network resources in a highly secured Windows environment where standard methods like SMB null sessions are blocked. The network employs strict firewall rules and intrusion detection systems to prevent unauthorized access. Which technique should the tester use to discreetly gather the required information without triggering security alarms?. Exploit a misconfigured LDAP service to perform anonymous searches. Leverage Active Directory Web Services for unauthorized queries. Utilize NetBIOS over TCP/IP to list shared resources anonymously. Conduct a zone transfer by querying the organization’s DNS servers.

During a black-box security assessment of a large enterprise network, the penetration tester scans the internal environment and identifies that TCP port 389 is open on a domain controller. Upon further investigation, the tester runs the ldapsearch utility without providing any authentication credentials and successfully retrieves a list of usernames, email addresses, and departmental affiliations from the LDAP directory. The tester notes that this sensitive information was disclosed without triggering any access control mechanisms or requiring login credentials. Based on this behavior, what type of LDAP access mechanism is most likely being exploited?. Anonymous LDAP binding. LDAP via RADIUS relay. Authenticated LDAP with Kerberos. LDAP over SSL (LDAPS).

A company’s online service is under a multi-vector DoS attack using both SYN floods and HTTP GET floods from a botnet. Standard firewalls and IDS are unable to prevent the outages. To mitigate the attack without disrupting legitimate traffic, which advanced defense should the company implement?. Use DDoS mitigation services that offer multi-layer protection. Deploy a Web Application Firewall (WAF) with anomaly detection. Configure the firewall to block all incoming SYN packets from external IPs. Increase server bandwidth and apply basic rate limiting.

As a certified ethical hacker, you have been engaged to evaluate the security protocols of a smart city project. This cutting-edge venture incorporates an interconnected system featuring intelligent traffic lights, public Wi-Fi points, and advanced water management facilities. Upon evaluating the IoT network’s logs, you stumble upon anomalous traffic patterns, signifying a high volume of data exchange between a particular traffic light and an external IP address. Your further investigation reveals that this traffic light has an inexplicably open port. Given the gravity of these revelations, what would be your subsequent course of action?. Isolate the implicated traffic light from the overarching network for a detailed investigation into its firmware to identify any possible security breaches. Attempt to orchestrate a reverse connection from the traffic light to the external IP, aiming to comprehend the type and purpose of the data being transferred. Conduct an exhaustive penetration test across the network infrastructure to uncover any concealed vulnerabilities. Thoroughly analyze and amend the IoT network’s firewall rules to prevent any further interaction with the suspicious external IP.

You are a security administrator for a medium-sized company. Your manager has asked you to conduct an audit of the organization’s security infrastructure. While reviewing the logs from the Intrusion Detection System (IDS), you notice that there have been several instances of alerts being triggered by regular user activities. Which of the following is the most likely reason for this?. The IDS is configured with very high sensitivity settings, leading to many false positives. The IDS is outdated and needs to be updated with the latest patches. Regular users are unintentionally triggering security protocols. The company’s firewall is failing to filter out malicious traffic.

During an internal assessment, a penetration tester gains access to a hash dump containing NTLM password hashes from a compromised Windows system. To crack the passwords efficiently, the tester uses a high-performance CPU setup with the hashcat tool, configuring it to attempt millions of password combinations per second using a known hash algorithm. This setup drastically reduces the time required for password recovery compared to CPU-based cracking methods. Which technique is being optimized in this scenario?. Leverage hardware acceleration for cracking speed. Exploit dictionary rules with appended symbols. Spoof NetBIOS to impersonate a file server. Dump SAM contents for offline password retrieval.

A penetration tester discovers malware on a system that disguises itself as legitimate software but performs malicious actions in the background. What type of malware is this?. Trojan. Worm. Spyware. Rootkit.

During a penetration test, a security analyst encounters a web page that returns identical generic error messages regardless of input. To test for SQL injection, they submit a query that includes AND 1=1 and later AND 1=2, observing a change in the page content. What type of injection is being tested?. The analyst is using conditional logic to infer database behavior from page responses. The analyst is triggering visible database errors to gain structural insights. The analyst is appending a UNION clause to extract data from additional tables. The analyst is measuring response delays to infer true/false outcomes.

An attacker is analyzing traffic from a mobile app and finds that sensitive data like session tokens are being transmitted over HTTP instead of HTTPS. The attacker plans to intercept and manipulate the data during transmission. Which vulnerability is the attacker exploiting?. Insecure Communication. Insufficient Input Validation. Security Misconfiguration. Improper SSL Pinning.

A penetration tester is assessing the security of a corporate wireless network that uses WPA2-Enterprise encryption with RADIUS authentication. The tester wants to perform a man-in-the-middle attack by tricking wireless clients into connecting to a rogue access point. What is the most effective method to achieve this?. Set up a fake access point with the same SSID and use a de-authentication attack. Use a brute-force attack to crack the WPA2 encryption directly. Execute a Cross-Site Scripting (XSS) attack on the wireless controller’s login page. Perform a dictionary attack on the RADIUS server to retrieve credentials.

In an enterprise environment, the network security team is alerted to unusual network behavior suggestive of advanced sniffing techniques being employed by a potential attacker. Upon closer examination, it is discovered that the adversary is exploiting vulnerabilities in legacy protocols to intercept sensitive communications. The security team must identify the specific sniffing technique being utilized and deploy effective countermeasures to protect critical assets. Amidst the advanced sniffing activities observed in the enterprise network, which intricate technique poses the most formidable challenge for the security team to detect and neutralize effectively, potentially compromising the confidentiality of proprietary information?. Covert Channel Establishment through Modbus Protocol Manipulation. Steganographic Payload Embedding within SMTP Email Headers. Covert Data Interception via X.25 Packet Fragmentation. Encrypted Data Extraction via HTTP Header Field Overflows.

You are a cybersecurity consultant at a large healthcare organization. As part of your responsibilities, you are tasked with making sure the company’s systems are secure from various attacks. Recently, you’ve noticed some unusual traffic patterns that suggest someone might be trying to evade the company’s Intrusion Detection System (IDS). Which of the following techniques would most likely be used by an attacker in an attempt to evade detection by the IDS?. The attacker splits malicious data packets into smaller segments to avoid detection. The attacker sends phishing emails to employees, hoping to trick them into revealing their login credentials. The attacker uses advanced malware that can self-replicate and spread throughout the network. The attacker repeatedly pings the IDS to overwhelm it with traffic and cause a denial of service.

A penetration tester is running a vulnerability scan on a company’s network. The scan identifies an open port with a high-severity vulnerability linked to outdated software. What is the most appropriate next step for the tester?. Research the vulnerability and determine if it has a publicly available exploit. Ignore the vulnerability and focus on finding more vulnerabilities. Execute a denial-of-service (DoS) attack on the open port. Perform a brute-force attack on the service running on the open port.

A penetration tester is assessing a company’s HR department for vulnerability to social engineering attacks using knowledge of recruitment and onboarding processes. What is the most effective technique to obtain network access credentials without raising suspicion?. Create a convincing fake onboarding portal that mimics the company’s internal systems. Conduct a phone call posing as a new employee to request password resets. Develop a fake social media profile to connect with HR employees and request sensitive information. Send a generic phishing email with a link to a fake HR policy document.

A penetration tester gains access to a target system through a vulnerability in a third-party software application. What is the most effective next step to take to gain full control over the system?. Use a privilege escalation exploit to gain administrative privileges on the system. Perform a brute-force attack on the system’s root password. Conduct a denial-of-service (DoS) attack to disrupt the system’s services. Execute a Cross-Site Request Forgery (CSRF) attack to steal session data.

You are a Certified Ethical Hacker and have been hired by a financial institution to assess the security of its newly developed web application. The application employs a multifaceted authentication system with JavaScript-based client-side controls. During your testing, you discover that client-side controls enforce password strength and ensure CAPTCHA validation. The application also uses a proprietary encryption algorithm for client-side data. Your goal is to bypass these client-side controls to assess how robust they really are. What method would be the most effective for bypassing these controls without triggering server-side alarms?. Disable JavaScript in the browser and proceed to submit weaker passwords and invalid CAPTCHAs. Reverse-engineer the proprietary encryption algorithm and manipulate the encrypted data before submission. Utilize a proxy tool to intercept and modify the client-side controls before they reach the server. Inject malicious JavaScript code into the login form to overwrite the client-side validation rules.

A red team operator wants to obtain credentials from a Windows machine without touching the LSASS process memory, as security controls and Credential Guard are active. Instead, they leverage a method that uses the Security Support Provider Interface (SSPI) to generate NetNTLM responses within the context of the logged-in user and collect those responses for offline cracking. Which attack technique is being used in this scenario?. Internal Monologue attack technique executed through OS authentication protocol manipulations. Pass-the-ticket attack method involving forged tickets for network access. Hash injection approach using credential hashes for authentication purposes. Replay attack attempt by reusing captured authentication traffic sequences.

A penetration tester needs to identify open ports and services on a target network without triggering the organization’s intrusion detection systems, which are configured to detect high-volume traffic and common scanning techniques. To achieve stealth, the tester decides to use a method that spreads out the scan over an extended period. Which scanning technique should the tester employ to minimize the risk of detection?. Use a Stealth scan by adjusting the scan timing options to be slow and random. Execute a UDP scan targeting all ports simultaneously. Perform a TCP SYN scan using a fast scan rate. Conduct a TCP Xmas scan sending packets with all flags set.

A system administrator observes that several machines in the network are repeatedly sending out traffic to unknown IP addresses. Upon inspection, these machines were part of a coordinated spam campaign. What is the most probable cause?. Devices were enslaved into a botnet network. Browsers were redirected to adware-injected sites. Worms exploited zero-day vulnerabilities. Keyloggers were harvesting user credentials.

A government agency trains a group of cybersecurity experts to carry out covert cyber missions against foreign threats and gather intelligence without being detected. These experts work exclusively for national interests. What classification best describes them?. State-sponsored hackers. Organized hackers. Gray hat hackers. Hacktivists.

During routine network monitoring, the blue team notices several LLMNR and NBT-NS broadcasts originating from a workstation attempting to resolve an internal hostname. They also observe suspicious responses coming from a non- corporate IP address that claims to be the requested host. Upon further inspection, the security team suspects that an attacker is impersonating network resources to capture authentication attempts. What type of password-cracking setup is likely being staged?. Exploit name resolution to capture password hashes. Use CPU resources to guess passphrases quickly. Match captured credentials with rainbow tables. Decrypt login tokens from wireless networks.

A penetration tester is conducting an external assessment of a corporate web server. They start by accessing https://www.targetcorp.com/robots.txt and observe multiple Disallow entries that reference directories such as /admin- panel/, /backup/, and /confidential_docs/. When the tester directly visits these paths via browser, they find that access is not restricted by authentication and gain access to sensitive files, including server configuration and unprotected credentials. Which stage of the web server attack methodology is demonstrated in this scenario?. Gathering information through exposed indexing instructions. Leveraging the directory traversal flaw to access critical server files. Injecting malicious SQL queries to access sensitive database records. Performing a cross-site request forgery (CSRF) attack to manipulate user actions.

A multinational organization is implementing a security upgrade for its corporate wireless infrastructure. The current WPA2-Personal configuration relies on a shared passphrase, which the IT team finds difficult to rotate and manage securely across hundreds of employee devices. To enhance security and scalability, the organization decides to migrate to WPA2-Enterprise. The new setup must allow for centralized control of user authentication, support certificate-based identity verification, and ensure that each authenticated client is assigned a unique session encryption key to prevent key reuse and limit the blast radius of potential breaches. Which component is essential for enabling this centralized, certificate-based authentication with unique key generation per session in a WPA2-Enterprise environment?. RADIUS with Extensible Authentication Protocol (EAP). Pre-Shared Key (PSK). Opportunistic Wireless Encryption (OWE). Temporal Key Integrity Protocol (TKIP).

A penetration tester is assessing a web application that does not properly sanitize user input in the search field. The tester suspects the application is vulnerable to a SQL injection attack. Which approach should the tester take to confirm the vulnerability?. Input a SQL query such as ‘ OR 1=1 -- into the search field to check for SQL injection. Inject JavaScript into the search field to perform a Cross-Site Scripting (XSS) attack. Use directory traversal in the search field to access sensitive files on the server. Perform a brute-force attack on the login page to identify weak passwords.

As a newly appointed network security analyst at a mid-tier company, you have been tasked with assessing the security of the network. As part of this, you need to ensure that your company’s network can detect and prevent evasion techniques. You know that one popular evasion technique used by attackers is using ‘packet fragmentation’. Which of the following IDS configurations should you implement to counteract this particular technique?. Implementing an anomaly-based IDS that can recognize the irregular traffic patterns caused by packet fragmentation. Employing a signature-based IDS that recognizes the specific signature of fragmented packets. Configuring the IDS to reject all fragmented packets to eliminate the risk. Adjusting the IDS to recognize the regular intervals at which fragmented packets are sent.

You have recently joined as a cybersecurity analyst at a multinational corporation. Your role includes regular vulnerability assessments of the company’s wide-ranging IT infrastructure. During one of these assessments, you employ the Nessus scanner. The scanner flags a severe vulnerability marked as CVE-2023-12456. This vulnerability specifically targets the SSH (Secure Shell) service running on one of the company’s Linux servers. With a CVSS (Common Vulnerability Scoring System) score of 9.0, the vulnerability poses a substantial risk. Most concerning is its ability to allow potential remote code execution. Given the high-risk nature of the vulnerability, as depicted by the CVSS score, and its potential impact, what course of action should be immediately prioritized from the following choices?. Without delay, apply the patch recommended by the vendor. Subsequently, initiate a system-wide reboot during the next downtime scheduled for system maintenance. Establish a backup SSH service on an unaffected server and reroute all SSH traffic to this server until the vulnerability on the original server is completely resolved. Temporarily isolate the affected server from the broader network, perform an in-depth system audit, and then apply patches as required based on the findings. Commence a manual inspection of the discovered SSH service vulnerability. If it cannot be verified, mark it as a false positive and move on to the next task.

A penetration tester is assessing an organization’s cloud infrastructure and discovers that the cloud storage buckets are not publicly accessible but have misconfigured Identity and Access Management (IAM) policies. The IAM policies unintentionally grant read and write permissions to any authenticated user. What is the most effective way to exploit this misconfiguration?. Create a personal cloud account to authenticate and access the misconfigured storage buckets. Execute a SQL injection attack on the organization’s website to retrieve sensitive information. Perform a Cross-Site Scripting (XSS) attack on the cloud management portal to gain access. Use leaked API keys to access the cloud storage buckets and exfiltrate data.

An ethical hacker needs to enumerate user accounts and shared resources within a company’s internal network without raising any security alerts. The network consists of Windows servers running default configurations. Which method should the hacker use to gather this information covertly?. Exploit null sessions to connect anonymously to the IPC$ share. Perform a DNS zone transfer to obtain internal domain details. Deploy a packet sniffer to capture and analyze network traffic. Utilize SNMP queries to extract user information from network devices.

A cloud provider faced a situation where one customer’s malicious activity affected the organization’s reputation and service delivery. Which security control would have most effectively prevented this issue?. Assessing multi-tenant isolation techniques. Implementing secure log management. Using strong encryption algorithms. Enforcing robust authentication methods.

A penetration tester is mapping a Windows-based internal network. The tester notices that TCP port 139 and UDP port 137 are open on multiple systems. File and printer sharing is enabled. To retrieve hostnames, user details, and domain roles without triggering alerts, which tool and method would be most effective?. Run nbtstat -A to query the NetBIOS name table. Perform LDAP enumeration via anonymous bind. Use psloggedon to retrieve remote login sessions. Use pspasswd to change remote passwords.

During a network analysis at a mid-sized enterprise, a security engineer detects irregular DHCP behavior. Multiple endpoints are being assigned incorrect gateway and DNS settings, causing loss of connectivity and redirection to unauthorized servers. Packet captures show that clients are receiving IP address offers from more than one DHCP source. Upon further investigation, the logs confirm that the access switch is forwarding DHCP responses from all connected ports without filtering. This indicates that an unauthorized (rogue) DHCP server has been introduced into the network, impersonating the legitimate server and responding to client DHCPDISCOVER messages. To prevent this type of attack from occurring in the future, what security feature should the administrator enable?. DHCP snooping on trusted interfaces. Port security on all trunk ports. ARP inspection across VLANs. Static DHCP reservations for clients.

During a comprehensive security audit of a financial institution’s online infrastructure, a penetration tester observes abnormal traffic redirection patterns affecting the institution’s primary domain. Customers who attempt to access the legitimate website are seamlessly redirected to a visually identical phishing page, hosted on a suspicious IP address. After tracing the DNS resolution path, the tester discovers that the authoritative DNS server has been compromised, and its records have been altered to point to the attacker’s server. The redirection affects all DNS queries for the domain, indicating unauthorized control over name resolution infrastructure, rather than local cache poisoning or client-side manipulation. The tester confirms that this redirection was achieved by tampering with the DNS zone records themselves. Which technique is being used in this scenario?. Carry out DNS server hijacking by tampering with the legitimate name resolution infrastructure. Initiate a DNS amplification attack by leveraging recursive servers to flood the target. Establish covert communication using DNS tunneling over standard DNS queries. Perform DNS rebinding in the import functionality to manipulate browser-origin interactions.

A penetration tester suspects that the web application’s “Order History” page is vulnerable to SQL injection because it displays user orders based on an unprotected user ID parameter in the URL. What is the most appropriate approach to test this?. Modify the URL parameter to userlD=l OR 1=1 and observe if all orders are displayed. Inject JavaScript into the URL parameter to test for Cross-Site Scripting (XSS). Use a brute-force attack on the login form to identify valid user credentials. Perform a directory traversal attack to access sensitive system files.

A malware analyst is tasked with evaluating a suspicious PDF file suspected of launching attacks through embedded JavaScript. Initial scans using pdfid show the presence of JavaScript and /OpenAction keywords. What should the analyst do next to understand the potential impact?. Extract and analyze stream objects using PDFStreamDumper. Upload the file to VirusTotal and rely on engine consensus. Disassemble the PDF using PE Explorer. Compute file hashes using HashMyFiles for signature matching.

You are a new member of your company’s IT team, and you've been assigned to understand and implement ethical hacking principles to improve the company’s cybersecurity posture. Your supervisor highlights the importance of following the five phases of ethical hacking. What is the correct order of these phases?. Reconnaissance, Scanning, Gaining Access, Maintaining Access, Covering Tracks. Gaining Access, Maintaining Access, Covering Tracks, Reconnaissance, Scanning. Scanning, Reconnaissance, Gaining Access, Covering Tracks, Maintaining Access. Maintaining Access, Covering Tracks, Reconnaissance, Scanning, Gaining Access.

You’ve been hired as a Certified Ethical Hacker (CEH) by a large multinational corporation to investigate the unauthorized access of sensitive data from their web application. You discover that the web application uses a custom authorization scheme involving token-based authentication. The system issues tokens, which expire after 30 minutes. In the server logs, you notice multiple failed login attempts using expired tokens within a 3-minute window, followed by successful access with a valid token. You suspect that an attacker exploited the authorization scheme. What could be the most likely attack scenario?. The attacker captured a valid token before its expiry and used it to gain access. The attacker utilized a token replay attack, confusing the server to accept an expired token. The attacker brute-forced the token generation algorithm to produce a valid token. The attacker took advantage of a race condition, where the system validates expired tokens.

A penetration tester is trying to attack a wireless network that uses WPA3 encryption. The tester wants to exploit the handshake to obtain the password but realizes WPA3 has stronger protections. What would be the most effective approach to compromise the network?. Downgrade the connection to WPA2 and capture the handshake to crack the key. Perform a SQL injection attack on the router’s login page. Execute a dictionary attack on the WPA3 handshake using common passwords. Perform a brute-force attack directly on the WPA3 handshake.

During a red team simulation, an attacker attempts to deliver a payload to a web server hosted within a segmented enterprise network. The target environment uses a Network-based Intrusion Detection System (NIDS) that performs deep packet inspection and pattern matching against known attack signatures. To avoid triggering alarms, the attacker decides to manipulate the structure of the packets rather than the actual attack code. The approach involves crafting packets with intentionally malformed checksums and modifying specific fields so that the packets are accepted by the IDS but discarded by the destination system. This leads the IDS to process and log a different set of data than what the actual target receives, effectively bypassing signature detection. Which evasion technique is the attacker employing to deceive the IDS into misinterpreting the attack traffic while the payload remains unchanged on the target system?. Insertion attack. Fragmentation attack. Session splicing. Polymorphic shellcode.

A hacker is analyzing a system that uses two rounds of symmetric encryption with different keys. To speed up key recovery, the attacker encrypts the known plaintext with all possible values of the first key and stores the intermediate ciphertexts. Then, they decrypt the final ciphertext using all possible values of the second key and compare the results to the stored values. Which cryptanalytic method does this approach represent?. Use midpoint collision to identify key pair. Scrape electromagnetic leakage for bits. Reverse permutations to bypass encryption. Flood memory with brute-forced credentials.

Which of the following best describes the role of a penetration tester?. A security professional hired to identify and exploit vulnerabilities with permission. A hacker who gains unauthorized access to systems for malicious purposes. A hacker who spreads malware to compromise systems. A developer who writes malicious code for cyberattacks.

During an internal security assessment of a medium-sized enterprise network, a security analyst notices an unusual spike in ARP traffic. Closer inspection reveals that one particular MAC address is associated with multiple IP addresses across different subnets. The ARP packets were unsolicited replies rather than requests, and several employees from different departments have reported intermittent connection drops, failed logins, and broken intranet sessions. The analyst suspects an intentional interference on the local network segment. What is the most likely cause of this abnormal behavior?. ARP poisoning causing routing inconsistencies. DHCP snooping improperly configured. Legitimate ARP table refresh on all clients. Port security restricting all outbound MAC responses.

During a security assessment of a cloud-hosted application using SOAP-based web services, a red team operator intercepts a legitimate SOAP request sent by a user. The operator duplicates the body of the message along with its digital signature, inserts the duplicate into the same SOAP envelope, and forwards it to the server. Due to improper validation of the message structure, the server accepts the duplicated body as authentic and processes it, resulting in unauthorized code execution. This behavior reveals a vulnerability in how the server handles signed SOAP messages. What type of attack does this scenario illustrate?. Wrapping attack. Cloud snooper attack. IMDS abuse. Cryptanalysis attack.

Your role as a network administrator in a mid-sized company involves protecting the company's web servers from potential security threats. Recently, your company’s web server experienced a Distributed Denial of Service (DDoS) attack. In explaining the situation to your team, you mention the attack specifically targeted the web server's application layer. Which type of DDoS attack was most likely used against your company’s web server?. HTTP flood attack. ICMP flood attack. SYN flood attack. UDP flood attack.

A penetration tester is assessing a web application that uses dynamic SQL queries for searching users in the database. The tester suspects the search input field is vulnerable to SQL injection. What is the best approach to confirm this vulnerability?. Input ‘; DROP TABLE users; -- into the search field to test if the database query can be altered. Perform a brute-force attack on the user login page to guess weak passwords. Inject JavaScript into the search field to test for Cross-Site Scripting (XSS). Use a directory traversal attack to access server configuration files.

A penetration tester suspects that a web application’s product search feature is vulnerable to SQL injection. The tester needs to confirm this by manipulating the SQL query. What is the best technique to test for SQL injection?. Input 1 OR 1=1 in the search field to retrieve all products from the database. Insert admin ‘-- in the search field to attempt bypassing authentication. Use directory traversal syntax in the search field to access server files. Inject a malicious script into the search field to test for Cross-Site Scripting (XSS).

A large chemical plant uses operational technology (OT) networks to control its industrial processes. Recently, security personnel noticed abnormal behavior from critical Programmable Logic Controllers (PLCs), suspecting a stealthy compromise via malicious firmware. Which action should the team take first to effectively verify and neutralize this issue?. Perform detailed inspections of device software for hidden, unauthorized modifications. Implement enhanced intrusion detection rules to flag unusual traffic patterns. Restrict remote administrative access to essential industrial equipment. Immediately isolate suspicious devices within separate network segments.

A cybersecurity team identifies suspicious outbound network traffic. Investigation reveals malware utilizing Background Intelligent Transfer Service (BITS) to evade firewall detection. Why would attackers use this particular service to hide malicious activities?. Because BITS packets appear identical to normal Windows update traffic. Because BITS operates exclusively through HTTP tunneling. Because BITS utilizes IP fragmentation to evade IDS. Because BITS traffic uses encrypted DNS packets.

During a cryptographic audit of a legacy system, a security analyst observes that an outdated block cipher is leaking key-related information when analyzing large sets of plaintext-ciphertext pairs. What approach might an attacker exploit here?. Use linear approximations to infer secret bits. Modify the padding to obtain plaintext. Attack the hash algorithm for collisions. Launch a key replay through IV duplication.

During a red team operation on a segmented enterprise network, the testers discover that the organization’s perimeter devices are configured to deeply inspect only connection initiation packets, especially TCP SYNs and HTTP requests. However, response traffic and acknowledgment packets within ongoing sessions are allowed with minimal inspection. The red team needs to covertly transmit payloads to an internal compromised host using a method that blends into existing session traffic and avoids detection. Which approach should they take to bypass these defensive mechanisms?. ACK tunneling. Port knocking. SYN scanning. ICMP flooding.

As a cybersecurity professional in XYZ Corporation, you’ve been assigned to investigate an anomaly in the system logs that suggest possible unauthorized activities. The system administrators detected repeated failed login attempts on a critical server, followed by a sudden surge in outbound data traffic. These events, while discrete, are raising concerns that the system may have been compromised. Given the high stakes and sophisticated nature of this potential security breach, what should be your initial course of action to manage this situation effectively?. Conduct real-time monitoring of the server, scrutinize the logs for unusual patterns, and identify the nature of the activities to devise an immediate countermeasure. Conduct a thorough audit of all outbound traffic and scrutinize the destination IPs to gain insights into the attacker’s network. Immediately alter the credentials of the server and notify all users to change their passwords. Immediately disconnect the suspicious server from the network to prevent further data exfiltration.

During a security evaluation of a smart agriculture setup, an analyst investigates a cloud-managed irrigation controller. The device is found to transmit operational commands and receive firmware updates over unencrypted HTTP. Additionally, it lacks mechanisms to verify the integrity or authenticity of those updates. This vulnerability could allow an adversary to intercept communications or inject malicious firmware, leading to unauthorized control over the device’s behavior or denial of essential functionality. Which IoT threat category does this situation best illustrate?. Insecure ecosystem interfaces. Insufficient privacy protection. Insecure default settings. Insecure network services.

During a targeted phishing campaign, an attacker gains access to a trusted internal system within a corporate network protected by advanced firewalls, IDS, and email security gateways. To maintain persistence and evade content inspection, the attacker crafts a malicious HTML email attachment containing obfuscated JavaScript code. When the user opens the attachment in a browser, a hidden JavaScript blob dynamically reconstructs a malware payload and triggers an automatic file download on the client side. No external connections are initiated during this process, making it difficult for network security tools to detect or block the attack. Which evasion technique is being employed to bypass the firewall and IDS protections?. HTML smuggling. HTTP header spoofing. Port forwarding. Cross-site scripting.

A penetration tester evaluates an industrial control system (ICS) that manages critical infrastructure. The tester discovers that the system uses weak default passwords for remote access. What is the most effective method to exploit this vulnerability?. Use the default passwords to gain unauthorized access to the ICS and control system operations. Execute a Cross-Site Request Forgery (CSRF) attack to manipulate system settings. Conduct a denial-of-service (DoS) attack to disrupt the system temporarily. Perform a brute-force attack to guess the system’s default passwords.

During a routine security audit, administrators found that cloud storage backups were illegally accessed and modified. What countermeasure would most directly mitigate such incidents in the future?. Adopting the 3-2-1 backup model. Regularly conducting SQL injection testing. Implementing resource auto-scaling. Deploying biometric entry systems.

You are a cybersecurity analyst at a tech startup that provides cloud-based services to its clients. Recently, your team detected suspicious activity on one of your critical servers. After further investigation, you discovered an unauthorized user gained escalated privileges and is attempting to perform malicious actions. Your task is to thwart the attack and secure the system from future exploits. Considering the potential consequences and complex nature of the situation, which of the following actions would you take first to immediately contain the threat without causing significant disruption to your services?. Analyze and document the activities of the unauthorized user in real-time, then use this data to implement immediate countermeasures and isolate the affected server from the network. Engage with a digital forensics team to collect all necessary evidence for legal proceedings. Power down the affected server immediately to stop all ongoing malicious activities, then isolate it from the network for further analysis. Initiate a comprehensive vulnerability scan on all servers to detect any possible exploits that the attacker might use.

A company’s customer data stored in a cloud environment has been exposed due to an unknown vulnerability. Which of the following types of attack most likely led to this incident?. Side-channel attack on the hypervisor. Brute force attack on user passwords. Exploitation of misconfigured security groups. Denial of Service (DoS) attack on cloud servers.

During a red team assessment of an enterprise LAN environment, the tester discovers an access switch that connects multiple internal workstations. The switch has no port security measures in place. To silently intercept communication between different hosts without deploying ARP poisoning or modifying the routing table, the tester launches a MAC flooding attack using the macof utility from the dsniff suite. This command sends thousands of Ethernet frames per minute, each with a random, spoofed source MAC addresses. Soon after the flooding begins, the tester puts their network interface into promiscuous mode and starts capturing packets. They observe unicast traffic between different internal machines appearing in their packet sniffer – traffic that should have only reached specific destinations on the network. What internal switch behavior is responsible for this sudden exposure of isolated traffic?. The switch entered hub-like behavior due to a full CAM table. The switch performed ARP spoofing to misroute packets. The switch disabled MAC filtering due to duplicate address conflicts. The interface performed DHCP starvation to capture broadcasts.

A penetration tester is hired to legally assess the security of a company’s network by identifying vulnerabilities and attempting to exploit them. What type of hacker is this?. White Hat. Grey Hat. Black Hat. Script Kiddie.

A penetration tester is assessing a mobile application and discovers that the app is vulnerable to improper session management. The session tokens are not invalidated upon logout, allowing the tokens to be reused. What is the most effective way to exploit this vulnerability?. Perform a replay attack by using the same session token after the user logs out. Execute a SQL injection attack to retrieve session tokens from the database. Use a Cross-Site Request Forgery (CSRF) attack to steal the session tokens. Use a brute-force attack to guess valid session tokens.

A penetration tester is evaluating a secure web application that uses HTTPS, secure cookie flags, and regenerates session IDs only during specific user actions. To hijack a legitimate user’s session without triggering security alerts, which advanced session hijacking technique should the tester employ?. Use a session fixation attack by setting a known session ID before the user logs in. Implement a Cross-Site Scripting (XSS) attack to steal session tokens. Conduct a session token prediction attack by analyzing session ID patterns. Perform a man-in-the-middle attack by exploiting certificate vulnerabilities.

A security analyst is tasked with gathering detailed information about an organization’s network infrastructure without making any direct contact that could be logged or trigger alarms. Which method should the analyst use to obtain this information covertly?. Examine leaked documents or data dumps related to the organization. Use network mapping tools to scan the organization’s IP range. Perform a DNS brute-force attack to discover subdomains. Initiate social engineering attacks to elicit information from employees.

In your role as a cybersecurity specialist for a growing tech company, you are tasked with performing a regular network scan to check for any potential vulnerabilities. Your manager has specifically asked you to use a NULL scan for this round. In the context of TCP NULL scanning, what response (or lack thereof) would indicate that a particular port on a target machine is closed?. The target machine responds with a TCP RST packet. The target machine responds with a TCP SYN/ACK packet. The target machine responds with an ICMP error message. The target machine does not send any response.

A cybersecurity company wants to prevent attackers from gaining information about its encrypted traffic patterns. Which of the following encryption algorithms should they utilize?. AES. RSA. HMAC. DES.

During a penetration test on a legacy Windows network, you use the nbtstat -A command on a target system and retrieve several NetBIOS names, including entries ending with <20> and <03>. However, attempts to list shared folders fail. Which of the following best explains this behavior?. File and printer sharing is disabled on the target system. The nbtstat utility cannot enumerate shares from NetBIOS names. The host is not part of any Active Directory domain. The target system’s NetBIOS service is bound to a non-standard port.

During an internal penetration test, a security analyst assesses a web application that interfaces with a backend Oracle database. Initial attempts using standard SQL injection payloads such as ‘ OR ‘1’=’l and UNION SELECT return no useful output and do not affect application behavior. Suspecting input sanitization and error suppression, the analyst crafts a new payload: 1 AND 1 < (SELECT COUNT(*) FROM all_users A, all_users B, all_users C) Upon submitting this payload, the page takes significantly longer to respond compared to previous inputs, even though no visible output is returned. What type of SQL injection technique is most likely being used here?. Heavy query-based SQL injection. Out-of-band SQL injection. Time-based SQL injection using WAITFOR DELAY. Union-based SQL injection.

A company hires a hacker to test its network security by simulating real-world attacks. The hacker has permission and operates within legal boundaries. What is this type of hacker called?. White Hat Hacker. Grey Hat Hacker. Script Kiddie. Black Hat Hacker.

During a red team engagement targeting a custom web application, a tester observes that the app takes a numeric id parameter from the URL and dynamically builds SQL queries. Suspecting SQL injection, the tester sends a crafted HTTP GET request like: http://vulnerableapp.local/view.php?id=l; DROP TABLE users; -- Shortly after, the application throws database errors, and the team confirms that the users table has been removed from the backend database. Based on this behavior, which SQL injection method was most likely used?. The attacker executed a second malicious query alongside the first. The attacker used Boolean logic to infer true/false responses. The attacker triggered errors to extract database information. The attacker appended a UNION clause to retrieve additional data.

A penetration tester discovers that a system is infected with malware that encrypts all the files and demands payment to decrypt them. What type of malware is this?. Ransomware. Worm. Keylogger. Spyware.

Upon analyzing anomalies in your network’s traffic, you discover traces of an insidious malware strain named “ShadowFlee”. This malware operates without writing files to disk, harnessing system utilities and scripts like PowerShell to stealthily execute tasks, effectively evading traditional detection mechanisms. Further, it exploits legitimate processes to propagate internally. Given “ShadowFlee’s” elusive attributes, which strategy would offer the most focused countermeasure?. Restrict and monitor the execution of scripts and system tools, especially those invoked by unsanctioned processes. Isolate affected systems, deploy deep packet inspection on network traffic, and block communications to blacklisted IPs. Schedule frequent system reboots to clear memory and apply patches to all networked devices. Regularly clean up temporary folders and enforce stricter permissions on system directories.

A financial institution’s online banking platform is experiencing intermittent downtime caused by a sophisticated DDoS attack that combines SYN floods and HTTP GET floods from a distributed botnet. Standard firewalls and load balancers are unable to mitigate the attack without affecting legitimate users. To protect their infrastructure and maintain service availability, which advanced mitigation strategy should the institution implement?. Utilize a cloud-based DDoS protection service that offers multi-layer traffic scrubbing and auto-scaling. Deploy an Intrusion Prevention System (IPS) with deep packet inspection capabilities. Increase server bandwidth and apply basic rate limiting on incoming traffic. Configure firewalls to block all incoming SYN and HTTP requests from external IPs.

During an ethical hacking exercise, a security analyst is testing a web application that manages confidential information. The analyst suspects the application may be susceptible to SQL injection attacks. Which of the following payloads will most likely reveal if the application is vulnerable to time-based blind SQL injection attacks?. ‘ AND BENCHMARK(5000000,ENCODE(‘test’,‘test’)); --. ‘ AND 1=0 UNION ALL SELECT ‘admin’,‘admin’; --. ‘ OR ‘1’=‘1’; --. ‘ UNION SELECT NULL, NULL, NULL; --.

A penetration tester identifies malware on a system that hides its presence and gives an attacker access to administrative functions without being detected. What type of malware is this?. Rootkit. Ransomware. Virus. Keylogger.

A penetration tester is tasked with identifying vulnerabilities on a web server running outdated software. The server hosts several web applications and is protected by a basic firewall. Which technique should the tester use to exploit potential server vulnerabilities?. Execute a buffer overflow attack targeting the web server software. Conduct a SQL injection attack on the web application’s login form. Use directory traversal to access sensitive configuration files. Perform a brute-force login attack on the admin panel.

A penetration tester targets a company’s executive assistants by referencing upcoming board meetings in an email requesting access to confidential agendas. What is the most effective social engineering technique to obtain the necessary credentials without raising suspicion?. Create a personalized email referencing specific meetings and request access. Call posing as a trusted IT support to verify credentials. Develop a fake LinkedIn profile to connect and request information. Send a mass phishing email with a fake meeting link.