PenTest Plus
Read questions, check verified answers and discuss the reasoning. Use reading options to shape your revision, or switch to the simulator for timed practice.
96 questions in this view
A penetration tester wants to identify misconfigured permissions in Active Directory and enumerate user privileges. Which of the following is the most efficient way to automate this task?
Select an answer above, then submit your vote. Reading or practicing does not cast a vote.
During a web application assessment, a penetration tester accesses the site unauthenticated and receives the following Set-Cookie on the first response:
auth=yYKGORbrpabgr842ajbvrpbptaui42342
When the tester logs in, the server sends only one Set-Cookie header, and the value is exactly the same as shown above. Which of the following vulnerabilities has the tester discovered?
Select an answer above, then submit your vote. Reading or practicing does not cast a vote.
As part of a penetration test, a tester needs to discover systems in the OT-segmented network. The tester should not disrupt OT services and must minimize device interaction. Which of the following should the penetration tester do?
Select an answer above, then submit your vote. Reading or practicing does not cast a vote.
A penetration tester is assessing a manufacturing system that restricts console access to a single workstation in the customer's on-premises data center. The terminal requires each user to use unique, hardware-based MFA to gain access. Given the following reports:
Server one:
john@localhost:~$ sudo who
john pts/1 2024-08-28 14:06
john@localhost:~$ sudo last
john seat0 login screen Fri Aug 26 15:48 - crash (00:03)
sarah seat0 login screen Thu Aug 25 12:47 - crash (00:03)
jose seat0 login screen Tue Aug 23 15:25 - down (00:06)
frank seat0 login screen Sat Aug 20 15:40 - down (00:06)
wtmp begins Aug 2 15:39:53 2024
Badge reader logs:
Date: Fri Aug 26 15:47 User: john
Date: Thu Aug 25 12:46 User: john
Date: Tue Aug 23 15:24 User: john
Date: Sat Aug 20 15:39 User: frank
Which of the following solutions would the penetration tester most likely recommend?
Select an answer above, then submit your vote. Reading or practicing does not cast a vote.
During the reconnaissance phase, a penetration tester uses theHarvester to gather the following information:
Subdomains:
- mail.acme.com
- vpn.acme.com
- intranet.acme.com
Which of the following describes the tool's output and is used to leverage an attack?
Select an answer above, then submit your vote. Reading or practicing does not cast a vote.
A penetration tester has discovered sensitive files on a system. Assuming exfiltration of the files is part of the scope of the test, which of the following is most likely to evade DLP systems?
Select an answer above, then submit your vote. Reading or practicing does not cast a vote.