Scenario practice questions

A penetration tester has gained a foothold on a Windows server and wants to move laterally to a domain controller. The tester has access to a service account that is a member of the 'Remote Management Users' group on the domain controller. Which of the following tools would be MOST appropriate for lateral movement in this scenario?

Trap 1: PsExec

PsExec requires administrative privileges and file sharing, which may not be available with the given group membership.

Trap 2: MS16-075 exploit

MS16-075 is a local privilege escalation exploit (token impersonation), not a lateral movement tool.

Trap 3: BloodHound

BloodHound is a reconnaissance tool for mapping Active Directory relationships, not for direct lateral movement execution.

A
PsExec
Why wrong: PsExec requires administrative privileges and file sharing, which may not be available with the given group membership.
B
MS16-075 exploit
Why wrong: MS16-075 is a local privilege escalation exploit (token impersonation), not a lateral movement tool.
C
WinRM
Correct. WinRM is designed for remote management and the account's group membership makes it usable for lateral movement.
D
BloodHound
Why wrong: BloodHound is a reconnaissance tool for mapping Active Directory relationships, not for direct lateral movement execution.

Question 2hardmultiple choice

A penetration tester discovers a remote command injection vulnerability in a Java-based web application on a Windows server. The tester wants to execute a PowerShell reverse shell. Which encoding technique is most effective to avoid filter restrictions on special characters?

Trap 1: URL encoding

URL encoding only encodes specific characters for HTTP transmission; it does not bypass application-level input filters that scan for command injection patterns.

Trap 2: Unicode encoding

Unicode encoding is not typically used to obfuscate PowerShell commands; it may also not be decoded by the shell automatically.

Trap 3: Hex encoding

Hex encoding is used for certain contexts like binary data, but PowerShell does not natively execute hex-encoded commands without additional decoding.

A
Base64 encoding
PowerShell supports -EncodedCommand, allowing the entire command to be Base64-encoded, which evades many filter restrictions on special characters.
B
URL encoding
Why wrong: URL encoding only encodes specific characters for HTTP transmission; it does not bypass application-level input filters that scan for command injection patterns.
C
Unicode encoding
Why wrong: Unicode encoding is not typically used to obfuscate PowerShell commands; it may also not be decoded by the shell automatically.
D
Hex encoding
Why wrong: Hex encoding is used for certain contexts like binary data, but PowerShell does not natively execute hex-encoded commands without additional decoding.

Question 3mediummultiple choice

A penetration tester is using a vulnerability scanner on a web application and notices that many findings are false positives caused by the scanner sending oversized payloads that the application truncates or rejects. Which scanner configuration change would MOST effectively reduce false positives in this scenario?

Trap 1: Increase the scan intensity to send more payloads

Higher intensity typically increases the number of requests and can lead to more false positives, not fewer.

Trap 2: Increase the HTTP request timeout

Timeout adjustments handle slow responses, not the accuracy of vulnerability detection.

Trap 3: Disable vulnerability detection for certain plugins

Disabling checks reduces false positives but also risks missing real vulnerabilities; it is not a targeted solution for payload truncation issues.

A
Increase the scan intensity to send more payloads
Why wrong: Higher intensity typically increases the number of requests and can lead to more false positives, not fewer.
B
Enable safe checks or anti-false positive mode
Safe checks use additional verification steps to confirm a vulnerability before reporting it, reducing false positives.
C
Increase the HTTP request timeout
Why wrong: Timeout adjustments handle slow responses, not the accuracy of vulnerability detection.
D
Disable vulnerability detection for certain plugins
Why wrong: Disabling checks reduces false positives but also risks missing real vulnerabilities; it is not a targeted solution for payload truncation issues.

Question 4easymultiple choice

A penetration tester is performing a client-side attack against a user. The tester sends an email with a malicious attachment that, when opened, executes a macro that downloads a payload. Which type of attack is this?

Trap 1: Vishing

Vishing (voice phishing) uses phone calls or voice messages, not email attachments.

Trap 2: Smishing

Smishing (SMS phishing) uses text messages, not email.

Trap 3: Watering hole

A watering hole attack compromises a trusted website that the target visits, rather than sending a direct email.

A
Spear phishing
This is the correct answer because the attack targets a specific user via email with a malicious attachment, which is the definition of spear phishing.
B
Vishing
Why wrong: Vishing (voice phishing) uses phone calls or voice messages, not email attachments.
C
Smishing
Why wrong: Smishing (SMS phishing) uses text messages, not email.
D
Watering hole
Why wrong: A watering hole attack compromises a trusted website that the target visits, rather than sending a direct email.

Question 5hardmultiple choice

After completing a penetration test, the lead tester is preparing the executive summary. The client's CISO wants to understand the business impact of a critical vulnerability found in the customer-facing web application. Which of the following is the BEST way to convey this in the report?

Trap 1: List the CVSS score and exploitability metrics

CVSS scores are technical and may not effectively communicate business impact to non-technical executives.

Trap 2: Provide the raw log entries showing the exploitation

Raw logs are too detailed for an executive summary and do not directly convey business impact.

Trap 3: Recommend a specific patch version

Patch recommendations belong in the technical remediation section, not the executive summary.

A
List the CVSS score and exploitability metrics
Why wrong: CVSS scores are technical and may not effectively communicate business impact to non-technical executives.
B
Describe the attack scenario and potential financial loss
Correct. This explains the real-world consequences in business terms, which is most relevant for an executive summary.
C
Provide the raw log entries showing the exploitation
Why wrong: Raw logs are too detailed for an executive summary and do not directly convey business impact.
D
Recommend a specific patch version
Why wrong: Patch recommendations belong in the technical remediation section, not the executive summary.

Question 6hardmultiple choice

A penetration tester has compromised a Linux server and wants to move laterally to a Windows server. The Linux server has network access to the Windows server on port 445. The tester has a captured NTLM hash of a domain administrator account. Which technique is most likely to allow the tester to authenticate and execute commands on the Windows server?

Trap 1: Kerberos Golden Ticket attack

Golden Ticket requires the KRBTGT hash and is used for maintaining persistence in Active Directory, not for straightforward authentication with a single hash.

Trap 2: SMB relay attack using the hash

SMB relay captures authentication and forwards it; the tester already has the hash and does not need to relay it.

Trap 3: Brute-force password cracking of the hash

While possible, cracking is time-consuming and unnecessary since the hash can be used directly for authentication via PtH.

A
Pass-the-hash using Impacket's psexec
Pass-the-hash allows authentication using the NTLM hash directly, enabling lateral movement to Windows systems.
B
Kerberos Golden Ticket attack
Why wrong: Golden Ticket requires the KRBTGT hash and is used for maintaining persistence in Active Directory, not for straightforward authentication with a single hash.
C
SMB relay attack using the hash
Why wrong: SMB relay captures authentication and forwards it; the tester already has the hash and does not need to relay it.
D
Brute-force password cracking of the hash
Why wrong: While possible, cracking is time-consuming and unnecessary since the hash can be used directly for authentication via PtH.

Question 7hardmultiple choice

A vulnerability scanner reports a reflected XSS vulnerability in a web application. Manual testing confirms that the application HTML-encodes all user input in the response. Which scanner misconfiguration is MOST likely causing this false positive?

Trap 1: The scanner used a POST request instead of a GET request for the…

The request method does not affect whether output is encoded; it is unlikely to cause a false positive.

Trap 2: The scanner's payload was reflected in a different context not…

If the payload is reflected in a context that is not encoded, it could be a real vulnerability, but here manual testing shows encoding is applied in all contexts.

Trap 3: The scanner used a payload with special characters that were…

Truncation would likely prevent the payload from appearing in the response, not cause a false positive.

A
The scanner used a POST request instead of a GET request for the payload
Why wrong: The request method does not affect whether output is encoded; it is unlikely to cause a false positive.
B
The scanner's payload was reflected in a different context not subject to HTML encoding
Why wrong: If the payload is reflected in a context that is not encoded, it could be a real vulnerability, but here manual testing shows encoding is applied in all contexts.
C
The scanner used a payload with special characters that were truncated by the server
Why wrong: Truncation would likely prevent the payload from appearing in the response, not cause a false positive.
D
The scanner's payload triggered a server error that echoed back the input without encoding
Error messages may reflect input without encoding, leading the scanner to flag a false XSS finding.

Question 8easymultiple choice

A penetration tester is planning a social engineering campaign against a corporation. The goal is to trick the CEO into revealing sensitive information. Which type of attack should the tester use?

Trap 1: Vishing

Vishing is voice phishing, which can target anyone but is not the most precise term for targeting a CEO; whaling is more specific.

Trap 2: Spear phishing

Spear phishing targets specific individuals but is not specific to executives; it is used for general targeting.

Trap 3: Pharming

Pharming involves redirecting users to fraudulent websites via DNS manipulation, not direct social engineering.

A
Vishing
Why wrong: Vishing is voice phishing, which can target anyone but is not the most precise term for targeting a CEO; whaling is more specific.
B
Spear phishing
Why wrong: Spear phishing targets specific individuals but is not specific to executives; it is used for general targeting.
C
Pharming
Why wrong: Pharming involves redirecting users to fraudulent websites via DNS manipulation, not direct social engineering.
D
Whaling
Whaling is a form of spear phishing that targets senior executives such as CEOs, making it the correct choice for this scenario.

Question 9easymultiple choice

A client requests a penetration test but only provides network diagrams and application credentials. Which type of test is being scoped?

Trap 1: Red team

Red team is a type of adversarial simulation, not a classification of information sharing.

Trap 2: Black box

Black box testing assumes no prior knowledge, but the client provided some information.

Trap 3: White box

White box testing requires full disclosure, which is more than just diagrams and credentials.

A
Red team
Why wrong: Red team is a type of adversarial simulation, not a classification of information sharing.
B
Black box
Why wrong: Black box testing assumes no prior knowledge, but the client provided some information.
C
Grey box
Grey box testing involves limited information sharing, such as network diagrams and credentials.
D
White box
Why wrong: White box testing requires full disclosure, which is more than just diagrams and credentials.

Open the full VLAN trunking answer →

Question 10easymultiple choice

During a penetration test of a corporate network, you discover a Linux server running a custom Python application that handles authentication for a web portal. The server is configured to allow SSH access only from a specific management subnet. You have obtained a limited shell on a different host within the same VLAN as the target server. From your limited shell, you can reach the target server on TCP port 22, but you do not have valid credentials. The Python authentication script uses a flat file database to store user credentials in the format 'username:hashed_password'. You suspect the script has a vulnerability that allows reading arbitrary files, such as the password file. Which of the following actions should you take to exploit this vulnerability?

Trap 1: Use Wireshark on the limited shell to capture SSH traffic and…

Wireshark requires root privileges and a GUI, which are unlikely available on the limited shell.

Trap 2: Perform a port knocking sequence to open SSH access to the target…

There is no evidence of port knocking in the scenario.

Trap 3: Use Hydra to brute-force SSH credentials from the limited shell…

SSH only allows connections from the management subnet, so brute-forcing from a different subnet will be blocked.

A
Use Wireshark on the limited shell to capture SSH traffic and extract credentials
Why wrong: Wireshark requires root privileges and a GUI, which are unlikely available on the limited shell.
B
Perform a port knocking sequence to open SSH access to the target server
Why wrong: There is no evidence of port knocking in the scenario.
C
Craft an HTTP request to the web portal's authentication script with a path traversal payload to read the password file
If the script is vulnerable to path traversal, you can read the password file and crack hashes.
D
Use Hydra to brute-force SSH credentials from the limited shell because it is on the same VLAN
Why wrong: SSH only allows connections from the management subnet, so brute-forcing from a different subnet will be blocked.

Open the full VLAN trunking answer →

Question 11hardmultiple choice

A medium-sized e-commerce company, CyberMart, has contracted your penetration testing firm to assess their security posture. The company operates from three physical locations: headquarters, a data center, and a remote warehouse. They have a flat internal network but separate VLANs for production, development, and guest Wi-Fi. CyberMart's CISO insists that the test must be conducted without causing any disruption to the production environment, especially the payment processing system. The test should simulate an external attacker targeting the public-facing web servers and an internal attacker who has gained initial access to the guest network. The CISO also requests that all testing be done during off-peak hours to minimize impact. You are preparing the rules of engagement. Which of the following is the most appropriate action to include in the ROE to satisfy the client's requirements while maintaining a realistic test scenario?

Trap 1: Include all VLANs but with explicit permission to conduct…

Denial-of-service tests would disrupt production, contradicting the CISO's request.

Trap 2: Focus exclusively on the external web servers and exclude internal…

This ignores the internal attacker scenario, which is part of the test objectives.

Trap 3: Restrict testing to only the guest network and external IPs,…

This fails to test internal segmentation beyond the guest network, which is a key requirement.

A
Include all VLANs but with explicit permission to conduct denial-of-service tests only during off-peak hours.
Why wrong: Denial-of-service tests would disrupt production, contradicting the CISO's request.
B
Allow testing on all VLANs except the production VLAN containing payment processing, with a rule to immediately stop if any degradation is observed.
This covers the required scenarios while protecting critical systems.
C
Focus exclusively on the external web servers and exclude internal network testing due to the risk of disruption.
Why wrong: This ignores the internal attacker scenario, which is part of the test objectives.
D
Restrict testing to only the guest network and external IPs, excluding all production VLANs.
Why wrong: This fails to test internal segmentation beyond the guest network, which is a key requirement.