CAS-004 Security Operations Practice Question
During a penetration test, the tester has gained initial access to a web server and wants to perform lateral movement to reach a database server. The tester enumerates the network and finds that the web server has two network interfaces: one connected to a DMZ and one to an internal network. The database server is on the internal network. Which TWO techniques could the tester use to pivot from the web server to the database server? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use SSH tunneling to create a local forward to the database server's port
Pivoting techniques include using the compromised host as a proxy to route traffic and port forwarding to tunnel to internal systems. SSH tunneling and Metasploit's pivot module are common. A reverse shell is for initial access, not pivoting. SQL injection is for initial compromise, not lateral movement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use SSH tunneling to create a local forward to the database server's port
Why this is correct
SSH tunneling can forward local ports to internal services.
- ✗
Perform a SQL injection attack against the database server
Why it's wrong here
SQL injection is typically used for initial access, not lateral movement from another host.
- ✗
Deploy a reverse shell from the web server to the tester's machine
Why it's wrong here
Reverse shells provide access to the web server, not pivoting to internal hosts.
- ✗
Install a keylogger on the web server to capture database credentials
Why it's wrong here
Keylogging is for credential theft, not direct pivoting.
- ✓
Use Metasploit's route add command to add a route to the internal subnet through the web server
Why this is correct
This enables Metasploit to route traffic through the compromised host.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.