Question 1

An attacker launches an SQL injection attack on a web application by trying to force the application requesting the back-end database to perform multiple SELECT queries. Which technique exploits the SQL injection vulnerability on the web application?

Accepted Answer

Union operator

Question 2

Match the elements in the URL ftp://xyz-company.com:2457/support/file;id=65?name=intro&r=true to the description.

Accepted Answer

xyz-company.com → ✅ host
2457 → ✅ port
support/file → ✅ path
ftp → ✅ scheme
name=intro&r=true → ✅ query-string
id=65 → ✅ path-segment-params

Question 3

A web application configures client cookies with the HTTPOnly flag. What is the effect of this flag?

Accepted Answer

It forces the web browser to have the cookies processed only by the server.

Question 4

What is the best practice to mitigate the vulnerabilities from a lack of proper error handling in an application?

Accepted Answer

Use a well-thought-out scheme to provide meaningful error messages to the users but no useful information to an attacker.

Question 5

Which type of SQL query is in the SQL statement select * from users where user = “admin”;?

Accepted Answer

static query

Question 6

An organization has developed a network security policy stating that newly purchased routers and switches must be configured with advanced security measures before deploying them to the production network. Which threat does this policy mitigate?

Accepted Answer

Default credential attack

Question 7

According to OWASP, which three statements are rules to prevent XSS attacks? (Choose three.)

Accepted Answer

✅ Use HTML escape before inserting untrusted data into HTML element content.
✅ Use attribute escape before inserting untrusted data into HTML common attributes.
✅ Use JavaScript escape before inserting untrusted data into JavaScript data values.

Question 8

Which component in the statement below is most likely user input on a web form? SELECT * FROM group WHERE attack = ‘network’ AND a-type LIKE ‘ping%’;

Accepted Answer

ping

Question 9

After some reconnaissance efforts, an attacker identified a web server hosted on a Linux system. The attacker then entered the URL shown below,

Accepted Answer

directory traversal

Question 10

Which cloud technology attack method could generate crafted packets to cause a cloud application to crash?

Accepted Answer

resource exhaustion attack

Question 11

Which mobile device vulnerability is targeted when a threat actor reverse engineers a mobile app to see how it creates and stores keys in the iOS Keychain?

Accepted Answer

insecure storage

Question 12

Which term is an essential characteristic of cloud computing as defined in NIST SP 800-145?

Accepted Answer

resource pooling

Question 13

Which cloud technology attack method could exploit a bug in a software application to gain access to resources that normally would not be accessible to a user?

Accepted Answer

privilege escalation

Question 14

Which option is a security vulnerability that affects IoT implementations?

Accepted Answer

plaintext communication and data leakage

Question 15

Which option is a collection of compute interface specifications designed to offer management and monitoring capabilities independently of the CPU, firmware, and operating system of the host?

Accepted Answer

Intelligent Platform Management Interface (IPMI)

Question 16

Which two IoT systems should never be exposed to the Internet? (Choose two.)

Accepted Answer

✅ turbines in a power plant
✅ robots in a factory

Question 17

Which tool is an open-source framework used to test the security of iOS applications? Group of answer choices

Accepted Answer

Needle

Question 18

Which credential harvesting tool could be used to send a spear phishing email with a link to a malicious site to a target victim?

Accepted Answer

Social-Engineer Toolkit (SET)

Question 19

Which term describes when a lower-privileged user accesses functions reserved for higher-privileged users?

Accepted Answer

vertical privilege escalation

Question 20

Which utility can be used to write scripts or applications to automate administrative tasks on remote computers and can also be used by malware to perform different activities in a compromised system?

Accepted Answer

Empire

Question 21

Which resource is a lightweight and portable tool that allows the creation of bind and reverse shells from a compromised host?

Accepted Answer

Netcat

Question 22

An attacking system has a listener (port open), and the victim initiates a connection back to the attacking system. What type of vulnerability does this situation describe?

Accepted Answer

reverse shell

Question 23

After compromising a system during a penetration testing engagement, all penetration work should be cleaned up, including extra files, system changes, and modified logs. The media sanitation methodology should be discussed with the client and the owner

Accepted Answer

NIST SP 800-88

Question 24

Which living-off-the-land post-exploitation technique can get directory listings, copy and move files, get a list of running processes, and perform administrative tasks?

Accepted Answer

PowerShell

Question 25

Which Sysinternals tool is used by penetration testers to modify Windows registry values and connect a compromised system to another system?

Accepted Answer

PsExec

Question 26

What is the main advantage of Remote Desktop over Sysinternals?

Accepted Answer

It gives a full, interactive GUI of the remote compromised computer.

Question 27

Which two commands are the same in Meterpreter and Linux or Unix-based systems? (Choose two.)

Accepted Answer

✅ cat
✅ pwd

Question 28

Which Meterpreter command is used to execute Meterpreter commands that are listed inside a text file and also to help accelerate the actions taken on the victim system?

Accepted Answer

resource

Question 29

An attacker opens a port or a listener on the compromised system and waits for a connection. The goal is to connect to the victim from any system, execute commands, and further manipulate the victim. What type of malicious activity is being performed?

Accepted Answer

bind shell

Question 30

Which function is provided by HTTP 2.0 to improve performance over HTTP 1.1?

Accepted Answer

HTTP 2.0 provides HTTP message multiplexing and requires fewer messages to download web content.

Question 31

An attacker enters the following URL to exploit vulnerabilities in a web application:

 type of vulnerability did the attacker try to exploit?

Accepted Answer

remote file inclusion

Question 32

Which cloud technology attack method would require the threat actor to create a malicious application and install it into a SaaS, PaaS, or IaaS environment?

Accepted Answer

cloud malware injection attack

Question 33

A threat actor has compromised a VM in a cloud environment that shares the same physical hardware as non-compromised VMs.

Accepted Answer

side-channel attack

Question 34

Which tool is a set of open-source analysis tools that uses the ClamAV antivirus engine to help detect vulnerabilities, Trojans, backdoors, and malware in Docker images and containers?

Accepted Answer

Dagda

Question 35

What is a common cause of data breaches in attacks against misconfigured cloud assets?

Accepted Answer

Using insecure permission configurations for cloud object storage services

Question 36

Which cloud technology attack method involves breaching the infrastructure to gather and steal information such as valid usernames, passwords, tokens, and PINs?

Accepted Answer

credential harvesting

Question 37

Which two resources are C2 utilities? (Choose two.)

Accepted Answer

Empire
Netcat

Question 38

After the exploitation phase, it is necessary to maintain a foothold in a compromised system to perform additional tasks. Which way could maintain persistence?

Accepted Answer

creating a bind or reverse shell

Question 39

A cybersecurity student is learning about Netcat commands that could be used in a penetration testing engagement. The student wants to use Netcat as a port scanner. What command should be used?

Accepted Answer

nc -z

Question 40

Which resource is an open-source framework that allows rapid deployment of post-exploitation modules, including keyloggers, bind and reverse shells, and adaptable communication to evade detection?

Accepted Answer

Empire

Question 41

What task can be accomplished with the steghide tool?

Accepted Answer

to obfuscate, to evade and to cover the attacker tracks

Question 42

What kind of malicious activity is performed by a lower-privileged user who accesses functions reserved for higher-privileged users?

Accepted Answer

Vertical privilege escalation

Question 43

An attacker wants to allow further connections to a compromised system and maintain persistent access. The attacker uses the Windows system command Enable-PSRemoting -SkipNetworkProfileCheck – Force. What tool is being enabled using this command?

Accepted Answer

WinRM

Question 44

What kind of channel is created by a C2 with a system that has been compromised?

Accepted Answer

covert channel

Question 45

Which three tools are living-off-the-land post-exploitation techniques? (Choose three.)

Accepted Answer

WinRM
PowerSploit
WMImplant

Question 46

A user is using an online shopping website to order laptop computers. Which mechanism is used by the shopping site to securely maintain user authentication during shopping?

Accepted Answer

session ID

Question 47

A threat actor launches an SQL injection attack against a web site by sending multiple specific statements to the web site and reconstructing the key information the threat actor seeks. What type of SQL injection attack is the threat actor using?

Accepted Answer

blind

Question 48

What is a potentially dangerous web session management practice?

Accepted Answer

including the session ID in the URL

Question 49

Which two functions are provided by a web proxy device? (Choose two.)

Accepted Answer

caching of HTTP messages
enabling HTTP transfers across a firewall

Question 50

A company has hired a cybersecurity firm to assess web server security posture. To test for cross-site scripting vulnerabilities, the tester will use the string. Where would the tester use the string?

Accepted Answer

in a user input field in a web form

Question 51

Match the Bluetooth Low Energy (BLEMatch the Bluetooth Low Energy (BLE) phase to the description.) phase to the description.

Accepted Answer

Phase 1 → ✅ Pairing feature exchange
Phase 2 → ✅ Short-term key generation
Phase 3 → ✅ Transport-specific key distribution

Question 52

A threat actor uploaded a VM with malicious software to the VMware Marketplace. When an organization deploys the VM, the threat actor can manipulate the systems, applications, and user data. What type of VM vulnerability has been enabled?

Accepted Answer

VM repository vulnerability

Question 53

What procedure should be deployed to protect the network against lateral movement?

Accepted Answer

VLANs

Question 54

A cybersecurity student is learning about Netcat commands that could be used in a penetration testing engagement. Which Netcat command is used to connect to a TCP port?

Accepted Answer

nc -nv

Question 55

Which resource is a Windows utility that combines the old CMD functionality with a new scripting/cmdlet instruction set with built-in system administration functionality?

Accepted Answer

PowerShell

Question 56

Which C2 utility is a PowerShell-based tool that leverages WMI to create a C2 channel?

Accepted Answer

WMImplant

Question 57

Which two C2 utilities are Python-based? (Choose two.)

Accepted Answer

Trevor
wsc2

Question 58

Which statement describes an example of an out-of-band SQL injection attack?

Accepted Answer

An attacker launches the attack on a web site and forces the web application to send the query results via an email.

Question 59

Why should application developers change the session ID names used by common web application development frameworks?

Accepted Answer

These session ID names can be used to fingerprint the application framework employed.

Question 60

A company uses the Microsoft Active Directory service to manage the authentication and authorization of employee workstations. The company hires a cybersecurity professional to perform compliance penetration testing.

Accepted Answer

LDAP injection

Question 61

Which tool could be used to find vulnerabilities that could lead to metadata service attacks?

Accepted Answer

Nimbostratus

Question 62

Which tool helps software developers and cloud consumers deploy applications in the cloud and use the resources that the cloud provider offers?

Accepted Answer

Software development kits (SDKs)

Question 63

Which example of administrative controls enables administrators to control what users can do at both broad and granular levels?

Accepted Answer

RBAC

Question 64

A document entitled “Building an Information Technology Security Awareness and Training Program” succinctly defines why security education and training are so important for users. The document defines ways to improve the security operations

Accepted Answer

NIST SP 800-50

Ethical Hacking FA3

Hacking

"Know" box contains:
Time elapsed:
Retries: