Ethical Hacking v13 - Practice Test 2

A multinational organization is implementing a security upgrade for its corporate wireless infrastructure. The current WPA2-Personal configuration relies on a shared passphrase, which the IT team finds difficult to rotate and manage securely across hundreds of employee devices. To enhance security and scalability, the organization decides to migrate to WPA2-Enterprise. The new setup must allow for centralized control of user authentication, support certificate-based identity verification, and ensure that each authenticated client is assigned a unique session encryption key to prevent key reuse and limit the blast radius of potential breaches.

Which component is essential for enabling this centralized, certificate-based authentication with unique key generation per session in a WPA2-Enterprise environment?

A penetration tester is evaluating a secure web application that uses HTTPS, secure cookie flags, and regenerates session IDs only during specific user actions.

To hijack a legitimate user’s session without triggering security alerts, which advanced session hijacking technique should the tester employ?

During a red team engagement simulating a targeted attack on a smart office environment, an ethical hacker identifies a thermostat used for regulating temperature across multiple floors. While analyzing its firmware management process, the tester discovers that the device accepts older versions without verifying their integrity or authenticity. The attacker successfully loads a previously deprecated firmware that contains known vulnerabilities and gains unauthorized access to the broader network by exploiting reintroduced flaws. No mechanisms are in place to prevent version rollback or verify firmware trustworthiness.

Which IoT security issue is most accurately demonstrated in this scenario?

During a security assessment of a metropolitan public transportation terminal, a penetration tester examines a network-connected IoT surveillance camera system that is used for 24/7 video monitoring of high-traffic areas. Upon analyzing the camera’s network traffic, the tester observes that it uses an outdated encryption protocol (SSLv2) to transmit video data to the control center. The tester uses a network packet sniffer to intercept this traffic and easily decrypts the stream, successfully reconstructing full video footage in real time without authentication.

Further analysis reveals that the camera does not enforce TLS or any modern encryption standard and lacks support for mutual authentication or secure key exchange. Additionally, no integrity checks are performed, leaving the data open to manipulation.

What IoT vulnerability is most likely being exploited in this scenario?

A penetration tester is assessing a company’s executive team for vulnerability to sophisticated social engineering attacks by impersonating a trusted vendor and leveraging internal communications.

What is the most effective social engineering technique to obtain sensitive executive credentials without being detected?

Which of the following describes the characteristics of a Boot Sector Virus?

What is the main difference between ethical hacking and malicious hacking?

Which of the following best describes the role of a penetration tester?

During a security evaluation of a smart agriculture setup, an analyst investigates a cloud-managed irrigation controller. The device is found to transmit operational commands and receive firmware updates over unencrypted HTTP. Additionally, it lacks mechanisms to verify the integrity or authenticity of those updates. This vulnerability could allow an adversary to intercept communications or inject malicious firmware, leading to unauthorized control over the device’s behavior or denial of essential functionality.

Which IoT threat category does this situation best illustrate?

A cyber adversary is performing external reconnaissance on a large enterprise network with multiple perimeter defenses in place, including packet-filtering firewalls and intrusion detection systems (IDS). The goal is to enumerate the firewall's rule set to identify which TCP and UDP ports are permitted for inbound traffic to internal systems. To minimize noise and avoid immediate detection, the attacker wants to use a method that mimics normal traffic flows while providing insight into how the firewall handles packets based on port and protocol combinations.

Which reconnaissance technique should the attacker choose to effectively map the firewall’s filtering behavior without raising alerts?

A penetration tester is evaluating a web application that does not properly validate the authenticity of HTTP requests. The tester suspects the application is vulnerable to Cross-Site Request Forgery (CSRF).

Which approach should the tester use to exploit this vulnerability?

A penetration tester evaluates a company’s susceptibility to advanced social engineering attacks targeting its executive team. Using detailed knowledge of recent financial audits and ongoing projects, the tester crafts a highly credible pretext to deceive executives into revealing their network credentials.

What is the most effective social engineering technique the tester should employ to obtain the necessary credentials without raising suspicion?

An ethical hacker needs to gather detailed information about a company’s internal network without initiating any direct interaction that could be logged or raise suspicion.

Which approach should be used to obtain this information covertly?

A red team member uses an access token obtained from an Azure function to authenticate with Azure PowerShell and retrieve storage account keys.

What kind of abuse does this scenario demonstrate?

A penetration tester is assessing the security of a corporate wireless network that uses WPA2-Enterprise encryption with RADIUS authentication. The tester wants to perform a man-in-the-middle attack by tricking wireless clients into connecting to a rogue access point.

What is the most effective method to achieve this?

In an enterprise environment, the network security team is alerted to unusual network behavior suggestive of advanced sniffing techniques being employed by a potential attacker. Upon closer examination, it is discovered that the adversary is exploiting vulnerabilities in legacy protocols to intercept sensitive communications. The security team must identify the specific sniffing technique being utilized and deploy effective countermeasures to protect critical assets.

Amidst the advanced sniffing activities observed in the enterprise network, which intricate technique poses the most formidable challenge for the security team to detect and neutralize effectively, potentially compromising the confidentiality of proprietary information?

A penetration tester is tasked with enumerating user accounts and network resources in a highly secured Windows environment where standard methods like SMB null sessions are blocked. The network employs strict firewall rules and intrusion detection systems to prevent unauthorized access.

Which technique should the tester use to discreetly gather the required information without triggering security alarms?

During a black-box security assessment of a large enterprise network, the penetration tester scans the internal environment and identifies that TCP port 389 is open on a domain controller. Upon further investigation, the tester runs the ldapsearch utility without providing any authentication credentials and successfully retrieves a list of usernames, email addresses, and departmental affiliations from the LDAP directory. The tester notes that this sensitive information was disclosed without triggering any access control mechanisms or requiring login credentials.

Based on this behavior, what type of LDAP access mechanism is most likely being exploited?

During a stealth assessment of a corporate internal network, an attacker gains access to a subnet where host communications are switched and protected against common ARP poisoning techniques. While passively sniffing traffic, the attacker observes that the target system (Host B) intermittently delays its response to ARP requests. Recognizing a potential opportunity, the attacker crafts and injects a fake ARP reply that maps the target’s IP address to their own MAC address and sends it before the legitimate reply arrives. Over time, the attacker notices that packets originally intended for Host B occasionally arrive at their own system, especially during these ARP response delays. The switch’s CAM table seems to temporarily associate the target's IP with the attacker’s MAC and port, before reverting back once the legitimate host reasserts itself.

What type of sniffing attack is the attacker performing?

During a cryptographic audit of a legacy system, a security analyst observes that an outdated block cipher is leaking key-related information when analyzing large sets of plaintext-ciphertext pairs.

What approach might an attacker exploit here?

Which of the following scenarios best describes a tailgating social engineering attack?

A penetration tester is trying to attack a wireless network that uses WPA3 encryption. The tester wants to exploit the handshake to obtain the password but realizes WPA3 has stronger protections.

What would be the most effective approach to compromise the network?

An AWS security operations team receives an alert regarding abnormal outbound traffic from an EC2 instance. The instance, which previously handled backend microservices, begins transmitting encrypted data packets to an external domain. Upon deeper investigation, it is discovered that the external domain resolves to a Dropbox account not associated with the organization. Network flow logs confirm a consistent pattern of data transfers to this destination during off-peak hours. Further forensic analysis reveals that a malicious executable was silently installed on the instance, which modifies the sync configuration of the Dropbox client to use the attacker's access token. This enables the compromised EC2 instance to automatically sync selected data folders with the attacker’s Dropbox storage, bypassing traditional perimeter defenses.

What type of attack has likely occurred?

A security analyst is investigating a breach where an attacker gained access to sensitive data by exploiting a vulnerability in the organization's web application. The attacker manipulated the application to execute arbitrary commands on the underlying operating system.

Which type of vulnerability was most likely exploited?

A penetration tester is evaluating the security of a mobile application and discovers that it lacks proper input validation. The tester suspects that the application is vulnerable to a malicious code injection attack.

What is the most effective way to confirm and exploit this vulnerability?

A penetration tester discovers that a web application uses unsanitized user input to dynamically generate file paths. The tester identifies that the application is vulnerable to Remote File Inclusion (RFI).

Which action should the tester take to exploit this vulnerability?

env x='(){ :;}; echo exploit' bash -c 'cat/etc/passwd'

What is the Shellshock bash vulnerability attempting to do on a vulnerable Linux host?

A penetration tester is assessing a company’s vulnerability to advanced social engineering attacks targeting its legal department. Using comprehensive knowledge of recent mergers and internal legal proceedings, the tester crafts a highly credible pretext to deceive legal employees into sharing confidential case documents.

What is the most effective social engineering technique the tester should employ to obtain confidential documents without raising suspicion?

A penetration tester performs a vulnerability scan on a company’s web server and identifies several medium-risk vulnerabilities related to misconfigured settings.

What should the tester do to verify the vulnerabilities?

During a security assessment of a cloud-hosted application using SOAP-based web services, a red team operator intercepts a legitimate SOAP request sent by a user. The operator duplicates the body of the message along with its digital signature, inserts the duplicate into the same SOAP envelope, and forwards it to the server. Due to improper validation of the message structure, the server accepts the duplicated body as authentic and processes it, resulting in unauthorized code execution. This behavior reveals a vulnerability in how the server handles signed SOAP messages.

What type of attack does this scenario illustrate?

A financial institution’s online banking platform is experiencing intermittent downtime caused by a sophisticated DDoS attack that combines SYN floods and HTTP GET floods from a distributed botnet. Standard firewalls and load balancers are unable to mitigate the attack without affecting legitimate users.

To protect their infrastructure and maintain service availability, which advanced mitigation strategy should the institution implement?

A global fintech company that processes millions of online payments daily begins receiving alarming emails from an unknown threat actor claiming to represent a notorious hacktivist group. The email includes a demand for 20 BTC in cryptocurrency, warning that a large-scale DDoS attack will cripple their infrastructure if the ransom is not paid within 72 hours. To prove their seriousness, the attacker initiates a short-lived HTTP flood targeting the company’s checkout service. Within minutes, legitimate users report long delays and service timeouts during payment processing. The incident response team observes a significant spike in POST requests with incomplete payloads, overwhelming the application layer and causing partial service disruptions. The attack ceases after 15 minutes, followed by a second email reinforcing the ransom demand and threatening a more severe attack.

What type of DDoS attack is being carried out in this scenario?

A penetration tester is evaluating a web application that uses HTTPS, secure cookies, and implements multi factor authentication to prevent session hijacking.

To hijack a legitimate user’s session without triggering security alerts, which advanced technique should the tester employ?

A university’s online registration system is experiencing disruptions due to a DDoS attack that combines DNS reflection and HTTP slowloris techniques. Standard firewalls and load balancers are unable to mitigate the attack without impacting legitimate users.

To ensure uninterrupted registration services, which advanced mitigation strategy should the university implement?

A penetration tester is assessing a web application that employs secure, HTTP-only cookies, regenerates session IDs upon login and uses strict session timeout policies.

To hijack a user’s session without triggering the application's security defenses, which advanced technique should the tester utilize?

A bank stores and processes sensitive privacy information related to home loans. However, auditing has never been enabled on the system.

What is the first step that the bank should take before enabling the audit feature?

An e-commerce platform hosted on a public cloud infrastructure begins to experience significant latency and timeout issues during its peak sales hours. Security logs indicate thousands of incoming HTTP connections, each of which starts sending headers extremely slowly and never completes the full request. Over time, the number of open connections rises beyond the server’s handling capacity, leading to system instability and service unavailability. The network team verifies that these connections are not transmitting malformed packets or high volumes of traffic and appear to originate from legitimate IPs.

Which specific DoS technique is most likely responsible for the degradation of service?

During a penetration test, an ethical hacker discovers that a web application accepts user input without proper validation and uses it directly in SQL queries. The hacker wants to test if the application is vulnerable to SQL injection.

Which input should the tester use to confirm the SQL injection vulnerability?

A security researcher is analyzing a target organization’s publicly accessible cloud infrastructure. While reviewing the website’s HTML source code, the researcher discovers direct references to files hosted on Amazon S3.

What is the most effective way to identify additional publicly accessible bucket URLs used by the target?