CompTIA PenTest+ (PT0-003) (PT0-003) — Questions 301–375

A JWT alg:none attack works by changing the token's `alg` header field to `none`, signaling that the token is unsecured. Vulnerable JWT libraries that accept this value will skip signature verification entirely, allowing an attacker to forge tokens with arbitrary claims, such as elevating privileges, without knowing the secret key. This directly exploits the server's failure to enforce strict algorithm allowlists.

White box testing grants the assessor complete visibility — network diagrams, source code and administrative credentials — so effort focuses on finding flaws rather than reconnaissance. This contrasts with black box, where no internal knowledge is supplied, and grey box, which provides partial detail.

Overwriting data multiple times with a secure destruction tool renders the original bit patterns unrecoverable, satisfying the requirement to dispose of test data securely. Unlike degaussing, which only works on magnetic media, overwriting suits SSDs and HDDs alike, and it preserves the drive for reuse where the stem does not mandate physical destruction.

The correct approach is to exploit a vulnerability in the SUID binary itself. Because the binary's effective UID is root, a successful buffer overflow exploit that hijacks control flow can execute shellcode with privileges equivalent to root. The shellcode should typically set real/effective/saved UID to 0 and then spawn a shell, yielding an interactive root session without altering any system state or requiring credentials.

The scope explicitly permits only Nmap, so introducing another tool breaches the agreed rules of engagement. Requesting client approval first keeps the tester within authorisation; using an unapproved tool, however effective against packet filtering, would be unauthorised testing.

pth-winexe is part of the pass-the-hash toolkit that implements the Windows SMB client and authentication stack, allowing you to authenticate to a remote Windows host using only the NTLM hash as the credential. It substitutes the password in the NTLM/SPNEGO exchange with the hash, establishes an authenticated session, and executes a specified command without ever knowing the plaintext password. This directly demonstrates pass-the-hash: the hash itself serves as the proof of knowledge to impersonate the user.

theHarvester is built for OSINT gathering and can query search engines, certificate transparency logs, and other public sources without sending traffic to the target. It returns emails, hostnames, and employee names, matching the passive requirement. It does not need credentials or direct target access, so it avoids alerting the target while still producing actionable reconnaissance data.

Using the 'site:' search engine operator is a purely passive technique because you are querying a third-party search index rather than touching the target's infrastructure. Search engines crawl and recursively list indexed subdomains under 'example.com', revealing them without generating any traffic to the target. This makes it an ideal OSINT method for subdomain discovery.

SQL injection occurs when untrusted input is concatenated directly into a SQL statement without proper parameterization or escaping, allowing an attacker to alter the query's logic. For example, injecting ' OR '1'='1 modifies a WHERE clause to bypass authentication or retrieve all rows. Since the code review shows concatenation into a database query, this is the correct vulnerability: the attacker can manipulate the SQL command structure.

-T0 is Nmap's Paranoid timing template, which intentionally introduces extreme delays between successive probes, typically waiting 300 seconds (5 minutes) before sending the next packet. This serialized, near-constant pacing is designed to stay well below the threshold that most real-time intrusion detection systems use for alerting, making it the slowest and most stealthy timing mode available. Its entire purpose is to minimize network footprint and avoid rate-based detection, directly fulfilling the penetration tester's requirement for a slow and stealthy scan, so it is the correct answer.

EAX holds 0x00401234, a 32-bit value in the typical executable image range, so it is a virtual memory address rather than an instruction opcode or immediate operand. Debuggers display register contents this way when tracing code.

Appending an attacker-controlled public key to ~/.ssh/authorized_keys on the compromised Linux host enables passwordless SSH authentication for that user at any time. This grants persistent remote access that survives reboots and does not rely on additional commands running at intervals. It is a stealthy and reliable persistence method, especially on servers where SSH is exposed.

Microsoft-DS on port 445 exposes SMB, historically vulnerable to unauthenticated remote code execution such as EternalBlue (MS17-010). That flaw lets an attacker execute code without credentials, matching the stem's requirement for a well-known no-authentication RCE service.

CSP headers instruct the browser to load scripts only from approved sources and block inline execution, providing defence in depth when an injection slips past other controls. This constrains the impact of any reflected or stored XSS payload that reaches the rendered page.

Written authorization to test specified targets is the foundational legal document for any penetration test. It establishes explicit permission from the system owner, defines the exact scope of systems and networks in scope, and limits the tester's authority to those targets. Without this signed authorization, even benign security testing could constitute unauthorized access under laws like the CFAA or similar cybercrime statutes, exposing the tester to civil and criminal liability.

GTFOBins is a curated repository of Unix binary exploitation techniques, specifically cataloging ways to abuse binaries for privilege escalation. For a Linux system, if a penetration tester discovers via 'sudo -l' that a binary can be executed with sudo privileges, GTFOBins provides exact command sequences to leverage that binary to spawn a root shell or read protected files. It is the go-to, command-focused resource for sudo misconfigurations and setuid abuse, making it directly applicable to the scenario.

Executive audiences prioritize fiduciary responsibility; translating a discovered vulnerability into projected financial impact (potential breach cost, legal fines, operational downtime) and reputational damage (customer churn, media exposure, diminished brand trust) makes the finding actionable at a governance level. This framing establishes why remediation deserves budget and executive sponsorship, rather than treating the issue as purely an IT concern. It also aligns the finding with organizational risk appetite and regulatory obligations that executives are accountable for.

Shodan's pre-collected banners and service fingerprints let the tester infer the host's operating system from cached scan data, satisfying the passive-only constraint since no packets reach the target network. Active fingerprinting techniques would generate traffic and violate the requirement.

Explicitly listing the database server as out-of-scope in the rules of engagement is the only contractual and technical guarantee that no tool will send packets to it, as all scanning and testing tools can be configured with exclusion lists. This eliminates any risk of accidental disruption, data corruption, or service outage, and also protects the tester from legal and professional liability. It is the cleanest, most enforceable scoping decision.

The Penetration Testing Execution Standard (PTES) is explicitly designed as a step-by-step methodology for conducting penetration tests. It defines seven distinct phases—pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting—each with detailed technical guidance and deliverables. This lifecycle coverage makes PTES the most complete answer for a standard that walks an assessor through the entire engagement from scoping to final report.

By running a Docker container with the host filesystem mounted (e.g., `docker run -v /:/mnt -it alpine chroot /mnt`), the user can access all host files as root because Docker effectively runs as root. This bypasses normal privilege restrictions.

Hashcat mode 1000 is the correct choice for NTLM hashes, which are the standard credential material extracted from Windows SAM files, NTDS.dit, or memory dumps. These hashes are computed by first converting the password to UTF-16LE and then applying the MD4 hash algorithm, a process unique to Windows authentication. Mode 1000 tells Hashcat to treat each hash as a 32-character hexadecimal NTLM digest, enabling efficient dictionary, rule-based, or brute-force attacks specifically tailored to this format, including pass-the-hash and offline cracking scenarios.

A risk matrix allows the tester to rate each finding based on the likelihood of exploitation and the potential business impact. This gives the client a clear, actionable prioritization that accounts for their specific environment and risk tolerance.

Chisel is a single-binary client/server tunnel program that can establish an outbound reverse tunnel from a compromised Linux host to the attacker's C2 server, then expose a SOCKS5 proxy on the attacking machine at the remote end. For example, the attacker runs `chisel server --reverse --socks5` and the compromised host runs `chisel client <attacker-ip>:8080 R:socks`. Because the client makes the initial outbound connection, this evades most inbound firewall rules, and the resulting SOCKS5 proxy allows any attacker tool to route scans and traffic into the target's internal network through the compromised host.

Pacu is the correct answer because it is an open-source AWS exploitation framework designed specifically for offensive cloud security testing. It automates attack chains against AWS environments, including privilege escalation, Lambda backdooring, and S3 bucket misconfiguration exploitation, making it the only option that directly performs exploitation rather than just auditing or reconnaissance.

The executive summary is the standard deliverable for management, condensing the entire engagement into a concise, business-focused narrative. It prioritizes findings by risk and business impact, translating technical vulnerabilities into language that non-technical stakeholders can immediately understand and act upon. For a client requesting a one-page overview, this is the appropriate format because it highlights critical issues and recommended next steps without overwhelming detail.

The Computer Fraud and Abuse Act (CFAA), codified at 18 U.S.C. §1030, is the primary U.S. federal statute prohibiting unauthorized access to computers and protected systems. It criminalizes intentionally accessing a computer without authorization, or exceeding authorized access, to obtain information, cause damage, or commit fraud. This makes CFAA the legal framework that directly targets unauthorized computer access, which is why it is the correct answer.

A ROP chain reuses sequences of existing instructions (gadgets) terminated by a ret, all located in executable modules such as loaded DLLs or system libraries. Because these gadgets reside in executable memory, DEP does not block them; chaining them lets the attacker simulate arbitrary logic or call functions like VirtualProtect to change memory permissions and then execute shellcode. With ASLR disabled, gadget addresses are fixed and predictable, making this a reliable bypass of DEP on Windows.

Risk ratings, business impact, and a high-level remediation strategy align security findings directly with the organization's operational and financial goals, which is what executive audiences need to prioritize actions and allocate resources. Ratings such as Critical/High/Medium/Low, derived from likelihood and impact (e.g., CVSS base scores adjusted for business context), translate technical vulnerabilities into decision-ready language. The high-level remediation strategy—such as 'segment the payment network' or 'accelerate patching of internet-facing systems'—gives executives actionable direction without drowning them in implementation minutiae.

The Rules of Engagement (RoE) is the authoritative document that defines the boundaries, testing windows, legal authorizations, and permissible techniques for a penetration test. In a grey box engagement, the RoE should explicitly list the provided credentials—such as usernames, passwords, API tokens, or SSO accounts—along with their validity period, or state where they will be securely delivered (e.g., an encrypted annex). This ensures the tester only uses authorized accounts and does not exceed the granted access level. Without this, the tester would have no legal proof that using those credentials was permitted.

When Nmap receives no response (or an ICMP unreachable message, such as type 3 code 13, administratively prohibited) to a SYN probe to a specific port, it labels that port 'filtered'. This indicates that a firewall or packet-filtering device is interfering with the probe, either by dropping the packet silently or by sending back a rejection message. Consequently, Nmap cannot definitively determine whether the port is open or closed because it lacks a TCP-level response like SYN/ACK or RST. This is a common result when stateful firewalls inspect and block unsolicited inbound packets during active reconnaissance.

This is the correct function: multi/handler acts as a listener that waits for a reverse TCP connection from a target that has already executed a Meterpreter or other reverse payload. In a typical attack workflow, the tester starts this handler on their machine, then delivers a payload to the target via phishing, exploit, or direct execution; once the target runs the payload, it connects back to the handler's listening port. The handler then provides an interactive session (e.g., Meterpreter) for post-exploitation. It is a generic catch-all for reverse shells and is indispensable when using staged payloads, where the initial stager connects back to fetch the full payload.

Kernel vulnerabilities are a classic local privilege escalation vector because the kernel executes in the most privileged CPU ring (ring 0 on x86). A flaw such as a use-after-free or missing permission check in a syscall handler lets an unprivileged user execute arbitrary code with kernel or root privileges. Exploits like Dirty COW (CVE-2016-5195) and CVE-2022-0847 (Dirty Pipe) demonstrate how a low-privileged attacker can overwrite read-only files or gain root, making this a primary target for post-exploitation.

Passive sniffing captures the WPA2 four-way handshake without transmitting any frames, so the live network remains untouched — satisfying the non-disruptive constraint. Cracking then occurs offline against the captured handshake, meaning no authentication attempts or deauthentication frames ever reach the access point.

aireplay-ng is the correct tool because it can inject arbitrary 802.11 frames, including deauthentication packets. The command `aireplay-ng -0 <count> -a <BSSID> <interface>` sends repeated deauth frames to disconnect connected clients, forcing them to reconnect and generate new EAPOL handshakes that airodump-ng can capture. It is the active component of the deauthentication attack.

The Rules of Engagement defines scope, timing, permitted techniques and stop conditions, so it is the document authorising the tester to halt activity if disruption risk appears. It directly satisfies the client's requirement for agreed business-hours testing safeguards.

To protect a cloud client from accidental availability impact, the rules of engagement should define explicit DoS indicators—for example, sustained packet loss, error-rate thresholds, or load-balancer health-check failures—and require the tester to stop immediately when any indicator is seen. Cloud elasticity can mask or amplify failures, so predefined numeric thresholds and a communication plan let both sides distinguish test-induced disruption from real incidents. This clause is superior because it directly manages the highest-risk outcome of penetration testing rather than merely limiting when or how testing may occur.

Querying the TXT records of the third-party domain is correct because the target's SPF record contains an include: directive that tells the receiver to perform a DNS TXT query on that third-party domain to fetch its SPF policy. That third-party's TXT records may themselves include other domains, or list additional authorized sending hosts/subdomains, thereby mapping out the full SPF include chain and expanding the attacker's view of the target's infrastructure. This is a direct, low-noise recon technique that exploits the trust relationship encoded in SPF, which is exactly what the scenario hints at.

arp-scan sends ARP requests, which operate at layer 2, so it discovers live hosts on the local subnet without transmitting IP packets. In a switched Ethernet environment this bypasses router boundaries and reliably maps active devices by MAC address.

A timestamp, ideally with an explicit timezone offset (e.g., 2025-04-11T14:32:07Z), is critical because it binds the evidence to a specific moment in time, proving that the finding was captured during the authorized penetration testing period. It supports the evidentiary chain of custody and enables correlation with external logs (e.g., target authentication logs, network captures) to corroborate that the reported activity actually occurred. Without an accurate timestamp, a screenshot can be challenged as having been taken before, during, or after the engagement, potentially invalidating the entire finding in a compliance or legal review. Therefore, the timestamp is essential for establishing both the validity and the reliability of the evidence.

OllyDbg is a 32-bit user-mode debugger for Windows, well-known for assembling inline patches, analyzing stack imbalances, and stepping through instructions at the assembly level. It lets an analyst execute the binary dynamically, observe EIP/RSP moves, set conditional breakpoints on API calls like strcpy or memcpy, and manipulate memory to prove an overflow. This runtime perspective directly exposes how input affects control flow, making it the preferred tool for validating an exploit's viability within a live process.

Activating the 'safe checks' option is the correct solution because it instructs the scanner to suppress all plugins that are flagged as intrusive, disruptive, or destructive, and instead rely on non-invasive methods such as banner grabbing, version fingerprinting, and configuration analysis. This prevents the scanner from actively attempting to exploit a vulnerability to confirm its existence, thereby avoiding service crashes, data corruption, or other unintended side effects. It also reduces false positives that can arise from failed exploit attempts, making the scan results more reliable in a production environment.

Mode 1000 is the correct hashcat mode for pure NTLM hashes, which are the MD4 digest of the user's password encoded in UTF-16LE and stored in the Windows SAM database or NTDS.dit. This mode directly feeds the raw 32-character hexadecimal NTLM hash into hashcat's cracking algorithms, such as dictionary, rule-based, or brute-force attacks. Selecting any other mode will cause hashcat to parse the hash incorrectly, leading to false negatives or incorrect crack attempts.

dnSpy is a purpose-built .NET assembly editor, decompiler, and debugger that can read .NET metadata, decode CIL bytecode, and reconstruct readable C# or VB.NET source code. It also supports editing assemblies in place and debugging managed code, making it the correct choice when the target is a .NET binary.

An XML parser allows an attacker to define an external entity, such as `<!ENTITY xxe SYSTEM "file:///etc/passwd">`. When the application processes the XML and includes the entity in a response or error message, the server reads the local file and returns its contents, disclosing credentials, configuration, or other sensitive data. This requires the parser to resolve external general entities without secure settings, a common misconfiguration in web applications.

This query combines the site: operator to restrict the domain to target.com, filetype:pdf to limit results to Portable Document Format files, and the term password to surface documents containing that string. It is the most direct way to locate potential credential disclosures because PDFs are commonly used for reports, manuals, and configuration guides that may embed default or hardcoded passwords. Unlike other queries, it precisely targets the document type specified in the objective, minimizing irrelevant HTML or spreadsheet results.

Limiting testing to off-peak hours lowers the likelihood that legitimate transactions are interrupted, while a rollback plan ensures that any configuration or data changes made during the test can be undone quickly. This combination reduces both the probability and the impact of a service disruption, which is the core objective of a well-defined rules-of-engagement scope. It also shows the tester is managing operational risk, not just technical risk.

WPScan is purpose-built for WordPress security assessments: it queries the WPScan vulnerability database, enumerates installed plugins, themes, and users, and can test for weak credentials against wp-login. Its fingerprinting goes beyond generic HTTP probing, identifying specific core versions and CVEs, making it the correct choice for a WordPress web application assessment.

Providing a step-by-step guide with exact commands, patch identifiers, and configuration changes gives the client a clear, repeatable path to close the vulnerability. This specificity reduces the chance of misinterpretation and allows the client to verify the fix via retesting, which is a key requirement of a professional pentest report. It also enables junior staff to execute the remediation with confidence, minimizing errors and downtime.

CrackMapExec is a post-exploitation and lateral movement tool that natively supports pass-the-hash by accepting NTLM hashes via the -H or --hash parameter. It actively authenticates to SMB, WinRM, and other services using the supplied hash, enabling command execution, credential dumping, and domain enumeration across multiple hosts. This makes it a direct and effective utility for conducting pass-the-hash attacks in a penetration test.

Wireshark is a full-featured packet analyzer that captures frames in promiscuous mode via libpcap/WinPcap and dissects hundreds of protocols across all OSI layers. It supports live capture and offline analysis, with powerful display filters, color coding, TCP stream reassembly, and expert information to identify anomalies. This makes it the standard tool for traffic capture and analysis.

The Rules of Engagement (ROE) is the authoritative document that defines the terms under which the penetration test is conducted, including explicit authorization for specific IP ranges, allowable testing times, emergency contacts, notification requirements for detected incidents, and any prohibited techniques such as social engineering or denial-of-service. It operationalizes the client's objectives into concrete constraints that testers must follow to stay within legal and ethical boundaries. For a hybrid infrastructure spanning on-premises and cloud IaaS, the ROE also clarifies cloud-specific considerations like consent for third-party testing and data handling.

The executive summary is a one-page, non-technical brief designed for C-suite and board-level stakeholders. It condenses the engagement's scope, key findings, and risk exposure into business-oriented language, prioritizing action items and strategic recommendations over raw technical detail. This format enables leadership to quickly grasp the organization's security posture and approve funding or policy changes.

Unquoted service path exploitation occurs when a Windows service binary's path contains spaces but is not enclosed in quotes. When Windows resolves the path, it checks each space-separated segment in turn, so an attacker with write access to an early directory (e.g., C:\Program.exe or C:\Program Files\Sub.exe) can plant a malicious executable that the service will launch with its own high-integrity privileges, typically SYSTEM. This yields arbitrary code execution without needing credentials or exploiting a kernel bug.

Appending the attacker's public key to ~/.ssh/authorized_keys enables passwordless key-based authentication for the targeted user account. This grants persistent SSH access without needing to re-establish a foothold through a vulnerability, and it remains effective across reboots and user sessions. The private key stays with the attacker, allowing them to authenticate at any time as long as the SSH service is exposed and the user account remains valid.

Immediately notifying the client point of contact fulfills the tester's primary obligation during a suspected active breach. The client can then activate their incident response plan, preserve forensic evidence, and decide on involving law enforcement or other third parties. This aligns with the rules of engagement, contractual duties, and the need for timely mitigation to minimize damage.

Hashcat's -m 5600 specifically targets NetNTLMv2 hashes, the exact challenge-response format captured via LLMNR/NBNS poisoning tools like Responder. The -a 0 flag designates a straight dictionary attack, allowing you to feed a wordlist of candidate passwords. This is the correct and complete command for cracking the captured NTLMv2 hash, as it selects both the right hash type and the appropriate attack mode.

TheHarvester correctly uses public search engines like Google and Bing to passively discover email addresses, subdomains, and hostnames that are publicly indexed. It queries these search engines by crafting targeted search queries, scrapes the search result pages for patterns matching email addresses and domain names, and does not interact directly with the target's infrastructure. This passive approach reduces the likelihood of detection and aligns with the OSINT phase of a penetration test, making Google and Bing the default and most commonly used sources.

Including the full proof-of-concept code and the exact HTTP requests (method, URL, headers, body, and parameter) gives developers a step-by-step reproduction recipe. They can run the same request locally under a debugger to trace the data flow from input to the SQL query, confirm the vulnerable code path, and then verify the fix by re-executing the identical payload. This level of detail also eliminates guesswork about which parameter is injectable and demonstrates the actual impact, such as data extraction, without requiring the developer to craft a payload from scratch.

SQL injection maps to A03: Injection in the OWASP Top 10, so testing must attempt payloads through input fields, parameters and headers to confirm parameterised queries prevent database compromise. This directly satisfies the stem's OWASP Top 10 coverage requirement.

A risk rating of 'Critical' that is explicitly predicated on high business impact and high likelihood is a bespoke severity assessment, because those factors are derived from the organization's own risk context and priorities. Unlike standard CVSS or DREAD scores, this rating maps technical severity to business consequences, which is exactly what a custom severity rating is intended to do. It reflects an informed risk decision, not merely a formulaic score.

A WAF deployed in front of the application can inspect request parameters, headers, and cookies for SQL injection signatures and block malicious traffic in real time, acting as a virtual patch. This provides immediate containment while the development team corrects the underlying code, and rules can be tuned to reduce false positives. It is not a permanent solution—attackers can bypass poorly tuned rules with obfuscation—so it must be paired with an eventual framework update.

Fuzzing automatically generates and sends unexpected, malformed, or boundary-case inputs to a program, which exposes weaknesses such as missing length checks, improper encoding, or inadequate sanitization. When a fuzzer triggers an assertion, buffer overflow, or unexpected state transition, it typically indicates that the program trusted user input without proper validation. This makes fuzzing particularly effective at uncovering input-validation flaws across parsers, protocol handlers, and file-format libraries.

Grouping findings by severity and likelihood lets stakeholders triage remediation by actual risk, satisfying the report's need to prioritise action. This ordering maps directly to the risk rating assigned to each vulnerability, ensuring critical, easily exploitable issues are addressed before low-impact ones.

Scope is defined solely by the client's authorisation. Testing a third-party vendor without confirmed permission risks legal exposure, so the tester must pause and obtain written clarification from the client before touching the vendor's system.

Blind SQL injection is correct because the tester is exploiting the vulnerability without seeing actual query results or database errors in the application response. Instead, they infer database behavior by observing differences in application responses — either boolean outcomes (e.g., ' AND 1=1 vs ' AND 1=2 causing different page content) or time delays (e.g., SLEEP or WAITFOR DELAY). These indirect signals allow the tester to extract data piece by piece, which aligns with the scenario of exploiting a SQL injection in a low-information environment.

Return-oriented programming (ROP) is the direct solution because it reuses machine code gadgets already present in the executable or its libraries, so no new code is injected and NX is never triggered. By chaining gadgets that end in 'ret', an attacker can perform arbitrary computation while maintaining control of the stack. If the binary is non-PIE or ASLR is defeated with a leak, the fixed gadget addresses are known, making the chain deterministic. This elegantly bypasses both NX and ASLR, which is why it is the correct answer.

Since the script uses $(dirname $0) without an absolute path, the system searches PATH for 'dirname'. If the attacker puts a malicious 'dirname' script in a writable directory earlier in PATH, it will be executed as root.

Executives need business risk and impact, not exploit payloads or command output. Framing findings around likelihood, affected assets and remediation cost lets non-technical decision-makers prioritise spend, satisfying the executive-summary purpose. Technical reproduction steps belong in the detailed findings section instead.

The script leverages paramiko, a Python implementation of the SSHv2 protocol, to iterate over hosts and attempt authentication with multiple passwords. Repeating login attempts with different credential pairs against an SSH service is the textbook pattern of a brute-force attack. Unlike a single-target dictionary attack, this exhaustive trial-and-error approach may also cycle through usernames, and a successful connect call indicates valid credentials have been uncovered.

JWT algorithm confusion (alg:none) occurs when a server accepts a JWT whose header declares the "alg" parameter as "none" (or "None"/"NONE"), which instructs the verifier that the token has no digital signature. An attacker can modify the token's payload, set alg to none, and remove the signature entirely; if the library does not explicitly reject none, the token is trusted as if it were properly signed. This directly bypasses signature verification without the attacker knowing any secret key.

Including a timestamp and the IP address/hostname of the affected system provides verifiable, reproducible proof of the finding. The timestamp lets the client correlate the event with their own logs, while the IP/hostname pinpoints the exact asset that needs remediation. This aligns with penetration test reporting standards that demand objective evidence over subjective summaries.

DREAD is a risk-scoring model that ranks threats by scoring each of five categories: Damage (potential loss), Reproducibility (ease of recreating the attack), Exploitability (effort required to exploit), Affected users (number of users impacted), and Discoverability (likelihood the vulnerability is found). Each category is scored on a consistent scale (e.g., 1-10) and the scores are averaged to produce an overall risk rating. Because the question explicitly asks for the model with DREAD categories, DREAD is the correct answer.

This is the correct action because a penetration test is executed under a contractual RoE that defines an explicit escalation path for exceptional findings. The tester must activate the client's named emergency contact and follow the incident response procedures to preserve evidence, contain the situation, and coordinate any law enforcement referral through the client's legal counsel. This approach balances the tester's legal duty to report criminal activity with the client's ownership of the systems and their authority to control external communications, ensuring the response is both lawful and consistent with the engagement's scope.

For an NTLM relay attack against SMB to work, the target server must not require SMB signing, meaning signing is disabled or set to 'Not Enforced.' Without mandatory signing, the server accepts SMB packets without verifying their integrity, allowing an attacker to forward a captured NTLM authentication exchange to establish a session. This is why the correct condition is that SMB signing must be disabled or not enforced, as enforced signing blocks the relay entirely.