Select Two (Multi-Select) Questions

Configuring automated alerts for unusual spikes in cloud resource creation.

Why it fails: Alerting on unusual spikes in resource creation is a recommended detection control, so it is not a deficiency. It is tempting to flag because alerting can be noisy, but the practice itself strengthens monitoring rather than weakening it.

Using cloud-native Key Management Services with automatic key rotation enabled.

Why it fails: Automatic rotation with cloud-native KMS is a recommended control, so it cannot be a deficiency. The auditor's question targets missing logging, monitoring or alerting; key rotation addresses cryptographic key lifecycle, not visibility. It would be the right answer if the stem asked which practice strengthens key management rather than which weakens cloud monitoring.

Enforcing least-privilege access principles across all IAM service accounts.

Why it fails: Least-privilege IAM enforcement is a security baseline, not a logging or monitoring deficiency, so it fails the scenario's audit scope. The question asks for gaps in cloud logging and monitoring configurations. This practice would be correct if the stem asked which control limits credential blast radius across service accounts.

arp -a

Why it fails: arp -a lists the neighbour cache, exposing hosts on the local segment, not sudo privileges. It tempts during network reconnaissance or lateral-movement mapping, and would be correct for enumerating adjacent systems, but sudo escalation needs sudo -l, sudoers file review, and checks for editable scripts or LD_PRELOAD rights.

uname -r

Why it fails: uname -r prints the kernel release and reveals nothing about sudoers entries or permitted commands. It tempts because kernel version maps to known local exploits, and would be correct when hunting kernel-level escalation, but sudo misconfiguration requires reading /etc/sudoers via sudo -l and checking NOPASSWD or wildcard entries.

Verifying that the broker responds to Modbus/TCP function code 0x10 write requests

Why it fails: Modbus/TCP function code 0x10 writes registers on industrial PLCs, a protocol absent from MQTT brokers, so the check cannot reveal broker misconfiguration. It is tempting because unauthenticated Modbus writes are a classic ICS finding, and would be correct when assessing a Modbus-enabled OT gateway or SCADA environment.

Executing an 802.11 deauthentication flood against the MQTT broker's MAC address

Why it fails: 802.11 deauthentication floods disrupt Wi-Fi link-layer associations; they reveal nothing about broker configuration such as anonymous access, ACLs or TLS enforcement. The technique is tempting because wireless deauth testing is standard in WLAN penetration tests, and would be correct when assessing Wi-Fi client isolation or PSK weaknesses in the same smart home.

Windows Disk Cleanup utility (cleanmgr.exe)

Why it fails: Disk Cleanup removes temporary files and has no directory-query capability, so it cannot read the userAccountControl attribute where the preauthentication flag resides. It is tempting as a built-in Windows tool, but it is for disk maintenance, not LDAP enumeration.

Mimikatz (lsadump::dcsync)

Why it fails: lsadump::dcsync requires DCSync rights (Replicating Directory Changes), which an unprivileged domain user lacks, so it cannot enumerate AS-REP roastable accounts. It is tempting because it extracts Kerberos secrets, but that is a post-exploitation technique, not unprivileged enumeration.

Local Security Policy snap-in (secpol.msc)

Why it fails: secpol.msc edits local machine security settings and cannot query domain objects, so it cannot list accounts with the preauthentication flag cleared. It is tempting because it exposes Kerberos policy locally, but domain-wide enumeration requires LDAP queries against a domain controller.

Using a non-root user directive (USER 1000) inside the Dockerfile.

Why it fails: Running as a non-root user removes privilege, hardening the container rather than enabling escape. Escapes stem from privileged mode, hostPath mounts and CAP_SYS_ADMIN. The directive is correct when limiting blast radius after compromise, which is why it appears in hardened images and Pod Security admission baselines.

Enabling Kubernetes Role-Based Access Control (RBAC) with least-privilege binding.

Why it fails: Least-privilege RBAC restricts service-account permissions, mitigating cluster compromise instead of causing it. Escalation arises from cluster-admin bindings, privileged pods and hostPath volumes. Least-privilege RBAC is the right choice when scoping namespace access for workloads, as mandated by CIS Kubernetes benchmarks.

Disable Kerberos pre-authentication across all domain controller computer accounts.

Why it fails: Kerberos pre-authentication is unrelated to AD CS abuse; disabling it weakens authentication and enables AS-REP roasting. It is tempting as a hardening-sounding account change, and would be correct where the goal is reducing authentication traffic, though that never justifies removing a security control.

Enforce unconstrained delegation on all certificate authority servers.

Why it fails: Unconstrained delegation lets any service on those hosts impersonate users to any resource, worsening ESC abuse rather than remediating it. It is tempting because delegation is a legitimate CA configuration, and would be correct where a service genuinely must authenticate to arbitrary back-end resources on a user's behalf.

Enabling multi-factor authentication (MFA) on all IAM users with console access.

Why it fails: MFA on console users is a hardening control, not a risk; it blocks credential-stuffing and password reuse against privileged sign-ins. It tempts because MFA can be misconfigured, for example with SMS-only factors or no break-glass account, but enabling it remains an AWS best practice.

Enabling AWS CloudTrail logging across all regions in the account.

Why it fails: CloudTrail logging is a security control, not a risk, so it cannot be one of the two misconfigurations the auditor seeks. It is tempting because CloudTrail genuinely matters for auditing API activity, and enabling it across all regions is exactly the recommended hardening step.

Attaching AWS managed policies for read-only access to auditing roles.

Why it fails: Attaching AWS managed read-only policies to auditing roles follows least privilege and is a recommended practice, not a misconfiguration. It tempts because broad managed policies can over-grant, but read-only auditing access is precisely the scope those roles require, so the risk is minimal.

Query Active Directory for the ms-DS-MachineAccountQuota attribute on the domain object to determine which machines allow unsigned SMB.

Why it fails: The ms-DS-MachineAccountQuota attribute controls how many computer accounts a non-privileged user may create in the domain; it has no relationship to SMB signing enforcement on individual hosts. Reading it tells you about account creation rights, not about whether a particular server will accept unsigned SMB sessions. It cannot distinguish relay-feasible targets from hardened ones.

Enable the LanmanServer service on each target and set the RequireSecuritySignature registry value to 0 before testing.

Why it fails: Modifying the target's registry to weaken signing is a destructive change that alters the environment under test and invalidates the engagement. A penetration tester must observe the existing configuration, not change it to manufacture a finding. This action would also require administrative access that the scenario does not grant, and it defeats the purpose of identifying genuinely vulnerable hosts.

Perform a broadcast NetBIOS name query for each host to read the SMB signing flag from the node status response.

Why it fails: A NetBIOS name query returns name and role information from the target's NetBIOS name table; it does not carry SMB2 negotiate data and therefore exposes no signing configuration. SMB signing enforcement is negotiated in the SMB2/3 negotiate response, which requires an actual SMB connection. This action cannot produce the required list of signing-disabled hosts.

Reviewing local ARP cache tables

Why it fails: ARP cache tables map IP addresses to MAC addresses within the local broadcast domain, revealing nothing about an upstream WAF. It is tempting because ARP inspection is a genuine reconnaissance step, but it identifies local hosts and possible spoofing. WAF detection requires comparing HTTP responses, headers and blocking behaviour.

Performing a standard ICMP ping sweep

Why it fails: An ICMP ping sweep only tests host reachability; a WAF sits inline inspecting HTTP/HTTPS and typically forwards or drops packets without altering ICMP replies. It is tempting because ping sweeps are standard host-discovery reconnaissance, but they enumerate live hosts. WAF fingerprinting instead compares HTTP response headers, cookies and error pages.

Running a DNS zone transfer (AXFR) query

Why it fails: AXFR queries enumerate DNS records for a zone and never touch the web tier, so they cannot reveal an inline HTTP filter. It is tempting because zone transfers are a classic reconnaissance technique for mapping hosts and subdomains. WAF detection instead relies on comparing HTTP response headers, cookies and blocking behaviour.

dir /s /b config.php

Why it fails: The dir command lists directories and files, so it cannot parse or extract values from config.php; it merely reports the filename. It is tempting because directory enumeration is a genuine local reconnaissance step on Windows, but that requires commands such as findstr or type to read file contents, not dir.

netsh wlan show profiles

Why it fails: This lists saved wireless network profiles and their cleartext keys, exposing Wi-Fi credentials rather than host data such as services, patches or permissions needed for escalation. It is tempting because it is a genuine local enumeration command, but it belongs to wireless credential harvesting, not Windows privilege escalation.

Aircrack-ng suite for cracking WPA-PSK Wi-Fi pre-shared keys

Why it fails: Aircrack-ng targets 802.11 Wi-Fi WPA-PSK handshakes and keys, not 802.15.4 frames or Zigbee network keys. It tempts because it is a familiar wireless auditing suite, but Zigbee operates on a different radio standard requiring dedicated 802.15.4 sniffing and injection hardware.

Metasploit 'msfvenom' module generating Windows Meterpreter payloads for Active Directory persistence

Why it fails: msfvenom generates Windows Meterpreter payloads for host compromise and Active Directory persistence, none of which touch 802.15.4 or Zigbee radio traffic. It tempts because Metasploit is a staple penetration-testing framework, but Zigbee assessment needs radio-layer capture and injection tools.

Burp Suite Professional for intercepting HTTP requests from web applications

Why it fails: Burp Suite Professional intercepts HTTP and HTTPS traffic from web applications, operating at the application layer, whereas Zigbee runs over 802.15.4 at the link layer. It tempts for IoT web interfaces, but assessing Zigbee frames requires 802.15.4-aware sniffing and injection tooling.

sqlmap -u target-url

Why it fails: sqlmap automates SQL injection detection and exploitation against database-backed web applications, so it cannot enumerate SMB shares or their permissions. It is tempting because it is a standard enumeration tool, but it would be the correct choice only when testing a web application's database layer for injection flaws.

nmap --script http-enum

Why it fails: The http-enum NSE script enumerates web server directories and files over HTTP, so it cannot list SMB shares or permissions. It is tempting because nmap is a common enumeration tool, but it would be the correct choice only when fingerprinting a web server's exposed paths rather than a Windows file server.

aircrack-ng target.cap

Why it fails: aircrack-ng cracks 802.11 Wi-Fi encryption keys from captured packet files, so it cannot query SMB shares or permissions. It is tempting because it is a well-known enumeration tool, but it would be the correct choice only when auditing wireless network security, not a Windows file server.

John the Ripper

Why it fails: John the Ripper cracks password hashes offline after capture; it does not sniff or parse live network traffic. It tempts because it recovers credentials, but that occurs post-capture against hash files, whereas the scenario requires on-the-wire interception tools such as Wireshark or Ettercap.

Sqlmap

Why it fails: Sqlmap automates SQL injection against database endpoints; it neither captures nor parses network authentication traffic. It tempts because it extracts credentials from vulnerable databases, but that requires an injection point, not a man-in-the-middle position, so it cannot intercept ARP-spoofed traffic.

Disable all TCP and UDP ports on the SCADA network switches

Why it fails: Disabling all TCP and UDP ports would halt SCADA communications entirely, breaking industrial control processes. The goal is to constrain traffic to necessary flows, not eliminate connectivity. Port-level filtering via firewalls or ACLs, permitting only required protocol traffic between known hosts, is the compensating control.

Install traditional endpoint antivirus software directly on the Programmable Logic Controllers (PLCs)

Why it fails: PLCs run real-time operating systems and often cannot host traditional antivirus agents without risking process disruption or violating vendor certification. Network segmentation, protocol-aware firewalls, and monitoring are viable compensating controls. Endpoint antivirus belongs on general-purpose IT hosts, not embedded industrial controllers.

IEEE 802.11 WPA2 four-way handshake cryptographic parameters

Why it fails: WPA2's four-way handshake secures IEEE 802.11 wireless links, whereas DNP3 runs over serial or TCP/IP with its own link-layer framing and Secure Authentication. It is tempting because wireless is common in substations, and it would be correct when analysing Wi-Fi capture rather than DNP3 packet structure.

HTTP Authorization Bearer tokens used for REST API authentication

Why it fails: HTTP Bearer tokens belong to web REST authentication, not DNP3, which is a serial and TCP/IP SCADA protocol using link-layer frames and application-layer function codes. It is tempting because token-based auth is common in modern OT gateways, and it would be correct when securing an HTTPS API front end.

Enabling Azure Defender for SQL on all Azure SQL databases.

Why it fails: Enabling Defender for SQL is a protective control, not a risk finding, so it cannot be a high-severity misconfiguration. It is tempting because Defender for SQL genuinely detects anomalous access and injection attempts, and would be the right answer if the question asked which control to enable for database threat detection.

Configuring Azure Monitor alerts for failed sign-in attempts.

Why it fails: Alerting on failed sign-in attempts is a detection control that surfaces brute-force or credential-stuffing activity, so it mitigates risk rather than creating it. It is tempting to flag as noise, but it is the correct choice when the scenario asks for monitoring coverage, not a high-severity misconfiguration.

Enabling soft-delete and purge protection on Azure Key Vaults.

Why it fails: Soft-delete and purge protection harden Key Vault against accidental or malicious secret destruction, so they are remediations rather than risks. They would be correct if the stem asked how to prevent permanent deletion of vault objects, since purge protection blocks irreversible removal during the retention window.

TCP Connect scan (-sT)

Why it fails: A TCP Connect scan completes the full three-way handshake against TCP ports, which the question explicitly excludes. It is used when raw-socket privileges are unavailable, since it needs no special access. Host discovery here relies on ICMP echo or ARP instead of any TCP port traffic.

TCP SYN port scan (-sS)

Why it fails: A TCP SYN scan sends TCP segments to ports, which the question explicitly excludes, and half-open probes are logged by many firewalls. It is the standard stealthy port-enumeration technique when mapping services. For port-free host discovery, ICMP echo or ARP requests are used instead.

UDP port scan (-sU)

Why it fails: A UDP port scan sends UDP datagrams to ports, which the question explicitly excludes, and its unreliable replies make it slow for host discovery. UDP scanning is for enumerating open UDP services, not for quiet subnet sweeps. ICMP echo or ARP requests discover hosts without touching transport ports.

Using the -p- option to scan all 65,535 TCP ports on the target host

Why it fails: Scanning all 65,535 TCP ports widens coverage but changes neither packet headers nor timing, so inspection filters still detect it. It tempts because thorough port coverage feels evasive, and it would be correct where the goal is complete port discovery rather than bypassing filters.

Using the --script option to execute NSE vulnerability scripts against open ports

Why it fails: NSE scripts probe services for vulnerabilities; they do not alter packet headers or timing to slip past inspection filters. It tempts because scripts are a core Nmap capability, and it would be correct where the task is service enumeration or vulnerability detection rather than evasion.

Using the -oA option to output scan results simultaneously in normal, XML, and Grepable formats

Why it fails: The -oA flag only controls output file formats (normal, XML, grepable); it changes nothing in the packets Nmap transmits, so no inspection filter is evaded. It is tempting because it is a genuine Nmap option, but its purpose is post-scan reporting and record-keeping, not header or timing manipulation.

tracert <target_ip>

Why it fails: tracert maps network hops to a target, revealing nothing about SMB signing configuration; it cannot read SMB negotiate responses. It is tempting because it confirms host reachability across subnets, which is useful for scoping live targets before running Nmap's smb2-security-mode script or CrackMapExec to enumerate signing settings.

ping -t <target_ip>

Why it fails: ping only tests ICMP reachability and reports nothing about SMB signing configuration, so it cannot identify relay-vulnerable hosts. It is tempting because ping is a quick host-discovery step during enumeration, but reachability is unrelated to SMB signing state.

nslookup -type=mx <domain>

Why it fails: nslookup with an MX query retrieves mail exchanger DNS records, returning no SMB signing configuration data. It is tempting because nslookup is a standard reconnaissance tool, but DNS enumeration cannot reveal whether SMB signing is disabled on hosts.

Enforcing strong password complexity and expiration policies for all cloud user accounts.

Why it fails: Complexity and expiration policies reduce brute-force and credential-stuffing success, so they harden cloud accounts rather than expose them. It is tempting because forced rotation is debated, but the auditor seeks insecure practices; this is a baseline control, not a finding.

Implementing Microsoft Entra ID Protection to detect compromised credentials and risky sign-ins.

Why it fails: Entra ID Protection flags leaked credentials, atypical travel and risky sign-ins, so it strengthens identity assurance rather than weakening it. It is tempting to misread risk detection as exposure, but the auditor seeks insecure practices; this is a recommended control, not a finding.

Utilizing Microsoft Entra ID managed identities for Azure resources instead of hardcoded credentials.

Why it fails: Managed identities let Azure resources obtain tokens from Microsoft Entra ID without stored secrets, eliminating credential sprawl. It is tempting to flag any identity mechanism as risky, but the auditor wants insecure practices; removing hardcoded credentials is a hardening measure, not a weakness.