Question 1

Because of an insecure code practice, an attacker can leverage and completely compromise an application or the underlying system. What insecure code practice enabled this catastrophic threat?

Accepted Answer

use of hard-coded credentials

Question 2

Which statement describes an example of an out-of-band SQL injection attack?

Accepted Answer

An attacker launches the attack on a web site and forces the web application to send the query results via an email.

Question 3

An attacker sends a request to an online university portal site with the information:

SELECT * FROM group WHERE attack = ‘network’ AND a-type LIKE ‘ping%’;

Which type of vulnerability does the attacker try to exploit?

Accepted Answer

HTTP parameter pollution

Question 4

What is the best mitigation approach against session fixation attacks?

Accepted Answer

Ensure that the session ID changes from the default session name used by the web application framework.

Question 5

Which function is provided by HTTP 2.0 to improve performance over HTTP 1.1?

Accepted Answer

HTTP 2.0 provides HTTP message multiplexing and requires fewer messages to download web content.

Question 6

Which two functions are provided by a web proxy device? (Choose two.)

Accepted Answer

Caching of HTTP messages
 Enabling HTTP transfers across a firewall

Question 7

After some reconnaissance efforts, an attacker identified a web server hosted on a Linux system. The attacker then entered the URL shown below,

Accepted Answer

directory traversal

Question 8

An attacker launches an SQL injection attack on a web application by trying to force the application requesting the back-end database to perform multiple SELECT queries. Which technique exploits the SQL injection vulnerability on the web application?

Accepted Answer

Union operator

Question 9

xyz-company.com

Accepted Answer

host

Question 10

2457

Accepted Answer

port

Question 11

support/file

Accepted Answer

path

Question 12

ftp

Accepted Answer

scheme

Question 13

name=intro&r=true

Accepted Answer

query-string

Question 14

id=65

Accepted Answer

path-segment-params

Question 15

A user is using an online shopping website to order laptop computers. Which mechanism is used by the shopping site to securely maintain user authentication during shopping?

Accepted Answer

session ID

Question 16

Which tool is an open-source framework used to test the security of iOS applications?

Accepted Answer

Needle

Question 17

Which two IoT systems should never be exposed to the Internet? (Choose two.)

Accepted Answer

robots in a factory
turbines in a power plant

Question 18

Which cloud technology attack method could a threat actor use to access a user or application account that allows access to more accounts and information?

Accepted Answer

account takeover

Question 19

What is a common cause of data breaches in attacks against misconfigured cloud assets?

Accepted Answer

using insecure permission configurations for cloud object storage services

Question 20

Which credential harvesting tool could be used to send a spear phishing email with a link to a malicious site to a target victim?

Accepted Answer

Social-Engineer Toolkit (SET)

Question 21

Which cloud technology attack method would require the threat actor to create a malicious application and install it into a SaaS, PaaS, or IaaS environment?

Accepted Answer

cloud malware injection attack

Question 22

Which cloud technology attack method involves breaching the infrastructure to gather and steal information such as valid usernames, passwords, tokens, and PINs?

Accepted Answer

credential harvesting

Question 23

Which mobile device vulnerability is targeted when a threat actor reverse engineers a mobile app to see how it creates and stores keys in the iOS Keychain?

Accepted Answer

insecure storage

Question 24

Which tool could be used to find vulnerabilities that could lead to metadata service attacks?

Accepted Answer

Nimbostratus

Question 25

A threat actor has compromised a VM in a cloud environment that shares the same physical hardware as non-compromised VMs. Which cloud technology attack method could now be used to exfiltrate credentials, cryptographic keys, and other sensitive information

Accepted Answer

side-channel attack

Question 26

After the exploitation phase, it is necessary to maintain a foothold in a compromised system to perform additional tasks. Which way could maintain persistence?

Accepted Answer

creating a bind or reverse shell

Question 27

Which resource is a Windows utility that combines the old CMD functionality with a new scripting/cmdlet instruction set with built-in system administration functionality?

Accepted Answer

PowerShell

Question 28

A cybersecurity student is learning about Netcat commands that could be used in a penetration testing engagement. The student wants to use Netcat as a port scanner. What command should be used?

Accepted Answer

nc -z

Question 29

What kind of channel is created by a C2 with a system that has been compromised?

Accepted Answer

command channel

Question 30

Which two commands are the same in Meterpreter and Linux or Unix-based systems? (Choose two.)

Accepted Answer

pwd
cat

Question 31

What is the main advantage of Remote Desktop over Sysinternals?

Accepted Answer

It gives a full, interactive GUI of the remote compromised computer.

Question 32

Which resource is a lightweight and portable tool that allows the creation of bind and reverse shells from a compromised host?

Accepted Answer

Netcat

Question 33

Which two resources are C2 utilities? (Choose two.)

Accepted Answer

Twittor
Empire

Question 34

What task can be accomplished with the steghide tool?

Accepted Answer

to obfuscate, to evade and to cover the attacker tracks

Question 35

Which Sysinternals tool is used by penetration testers to modify Windows registry values and connect a compromised system to another system?

Accepted Answer

PsExec

"Know" box contains:
Time elapsed:
Retries:

Ethical Hack M6,7,8