CCNA Vulnerability Discovery and Analysis Questions

MCQmedium

During code review, a penetration tester identifies the following line in a PHP web application: $sql = "SELECT * FROM users WHERE username='" . $_GET['user'] . "'"; Which type of vulnerability is most likely present?

A.SQL injection

B.Insecure deserialization

C.Command injection

D.Cross-site scripting (XSS)

AnswerA

Correct. Input is directly concatenated into an SQL query.

Why this answer

Direct concatenation of user input into an SQL query without sanitization results in SQL injection vulnerability.

Practice this question →

MCQmedium

A penetration tester has captured a WPA2 handshake. Which tool from the Aircrack-ng suite is used to crack the pre-shared key?

A.airmon-ng

B.airodump-ng

C.aireplay-ng

D.aircrack-ng

AnswerD

Correct: cracks WEP and WPA keys from captured handshakes.

Why this answer

Aircrack-ng (option D) is the tool in the Aircrack-ng suite specifically designed to crack WPA2 pre-shared keys (PSK) by performing an offline dictionary or brute-force attack against the captured four-way handshake. It uses the handshake data (specifically the EAPOL frames) to derive the Pairwise Master Key (PMK) and verify it against candidate passphrases, making it the correct choice for this task.

Exam trap

The trap here is that candidates often confuse the tool that captures the handshake (airodump-ng) or the tool that forces the handshake (aireplay-ng) with the tool that actually performs the cryptographic cracking (aircrack-ng), leading them to select a wrong option.

How to eliminate wrong answers

Option A (airmon-ng) is wrong because it is used to enable or disable monitor mode on wireless interfaces, not to crack captured handshakes. Option B (airodump-ng) is wrong because it captures packets and handshakes but does not perform any cracking; it only outputs the handshake for later use. Option C (aireplay-ng) is wrong because it injects packets (e.g., deauthentication frames) to force a client to reconnect and generate a handshake, but it does not crack the PSK.

Practice this question →

MCQmedium

A penetration tester has obtained a set of NTLM password hashes from a Windows domain controller. The tester wants to perform an offline cracking attack using GPU acceleration. Which tool is best suited for this purpose?

A.Hashcat

B.CrackMapExec

C.John the Ripper

D.Hydra

AnswerA

Correct. Hashcat is optimized for GPU-accelerated cracking.

Why this answer

Hashcat is a powerful password cracker that supports GPU acceleration and can crack NTLM hashes efficiently.

Practice this question →

Multi-Selectmedium

A penetration tester has captured network traffic and wants to analyze it using Wireshark. Which two actions can the tester perform to focus on specific types of communication? (Choose TWO.)

Select 2 answers

A.Use the Conversations window

B.Decrypt SSL/TLS traffic

C.Apply a display filter

D.Run a port scan

E.Generate a report with Nmap

AnswersA, C

Conversations show traffic between specific endpoints.

Why this answer

Display filters filter packets based on criteria, and conversation analysis groups traffic between endpoints.

Practice this question →

MCQmedium

A penetration tester is writing a Python script to send a crafted TCP packet to a target. Which Python library should the tester use for low-level packet crafting and injection?

A.requests

B.impacket

C.scapy

D.socket

AnswerC

Correct. Scapy allows crafting and sending custom packets.

Why this answer

Scapy is the correct choice because it is a powerful Python library specifically designed for low-level packet crafting, manipulation, and injection. It allows the tester to construct arbitrary TCP packets at the raw socket level, control individual flags, sequence numbers, and payloads, and send them directly over the wire using Layer 2 or Layer 3 sockets. This makes it ideal for tasks like SYN flooding, TCP handshake manipulation, or custom protocol fuzzing.

Exam trap

CompTIA often tests the distinction between high-level protocol libraries (requests, impacket) and low-level packet crafting tools (scapy), trapping candidates who confuse 'network scripting' with 'raw packet manipulation'.

How to eliminate wrong answers

Option A is wrong because the 'requests' library is a high-level HTTP client library used for sending and receiving HTTP requests; it operates at the application layer and cannot craft or inject raw TCP packets. Option B is wrong because 'impacket' is a collection of Python classes for working with network protocols, particularly SMB and Kerberos, but it is not designed for low-level packet crafting and injection; it focuses on protocol-level interactions rather than raw packet manipulation. Option D is wrong because the 'socket' library provides low-level networking interfaces (e.g., raw sockets) but lacks the high-level abstractions, protocol dissection, and packet-building utilities that Scapy offers; using raw sockets alone would require manually constructing all packet headers and handling checksums, which is error-prone and far less efficient.

Practice this question →

Multi-Selecthard

During a cloud security assessment of AWS, a tester wants to identify misconfigurations using automated tools. Which THREE tools are specifically designed for AWS security auditing?

Select 3 answers

A.Hashcat

B.Pacu

C.Prowler

D.CrackMapExec

E.ScoutSuite

AnswersB, C, E

Correct: AWS exploitation framework.

Why this answer

Pacu is an open-source AWS exploitation framework designed for offensive security testing. It automates the identification of misconfigurations, such as overly permissive IAM policies, exposed S3 buckets, and vulnerable Lambda functions, making it a correct choice for cloud security auditing.

Exam trap

CompTIA often tests candidates' ability to distinguish between general-purpose security tools (like Hashcat for cracking) and cloud-specific auditing tools (like Pacu, Prowler, and ScoutSuite), leading to confusion when tools have overlapping names or functions.

Practice this question →

MCQeasy

Which tool is used for security auditing of AWS environments and can enumerate misconfigurations in IAM, S3, and other services?

A.Pacu

B.CrackMapExec

C.Prowler

D.ScoutSuite

AnswerA

Correct: AWS-specific security testing framework.

Why this answer

Pacu is an open-source AWS security testing framework designed for offensive security audits. It includes modules that enumerate and exploit misconfigurations in IAM policies, S3 bucket permissions, and other AWS services, making it the correct tool for this specific purpose.

Exam trap

The trap here is that candidates often confuse Prowler or ScoutSuite with Pacu because all three are AWS security tools, but only Pacu is designed for offensive enumeration and exploitation of misconfigurations, while the others are primarily compliance and reporting tools.

How to eliminate wrong answers

Option B (CrackMapExec) is wrong because it is a post-exploitation tool for assessing Active Directory environments, not AWS cloud services. Option C (Prowler) is wrong because, while it is an AWS security auditing tool, it focuses on CIS benchmark compliance and best-practice checks rather than active exploitation or enumeration of misconfigurations. Option D (ScoutSuite) is wrong because it is a multi-cloud security auditing tool that provides a compliance report but lacks the offensive, exploitation-oriented modules that Pacu offers for enumerating and exploiting misconfigurations.

Practice this question →

MCQeasy

A penetration tester needs to enumerate Active Directory users and groups from a Windows domain. Which PowerShell tool is specifically designed for AD enumeration and is commonly used in post-exploitation?

A.Invoke-Mimikatz

B.Nmap

C.CrackMapExec

D.PowerView

AnswerD

Correct. PowerView is for AD reconnaissance.

Why this answer

PowerView (option D) is a PowerShell tool specifically designed for Active Directory enumeration, providing functions to query users, groups, computers, and permissions via LDAP. It is widely used in post-exploitation because it runs in-memory, avoids writing to disk, and integrates seamlessly with PowerShell's pipeline for stealthy reconnaissance.

Exam trap

The trap here is that candidates confuse post-exploitation credential tools (like Invoke-Mimikatz) with enumeration tools, or assume general-purpose scanners (Nmap) or multi-function frameworks (CrackMapExec) are PowerShell-native AD enumeration tools, when PowerView is the correct specialized PowerShell module for this task.

How to eliminate wrong answers

Option A is wrong because Invoke-Mimikatz is a tool for credential dumping (e.g., extracting plaintext passwords, hashes, and Kerberos tickets), not for enumerating AD users and groups. Option B is wrong because Nmap is a network scanning tool that discovers hosts and services via raw packets, not a PowerShell-based AD enumeration tool. Option C is wrong because CrackMapExec is a post-exploitation tool that automates credential spraying, SMB enumeration, and lateral movement, but it is not a PowerShell tool specifically designed for AD user/group enumeration; PowerView fills that niche.

Practice this question →