Question 1

Question #:98 - (Exam Topic 3)

A penetration tester is conducting an assessment of a web application for a financial institution. The

application uses form-based authentication and does not implement account lockout policies after multiple

failed login attempts. Interestingly, the application displays detailed error messages that disclose whether the

username or password entered is incorrect. The tester also notices that the application uses HTTP headers to

prevent clickjacking attacks but does not implement Content Security Policy (CSP). With these observations,

which of the following attack methods would likely be the most effective for the penetration tester to exploit

these vulnerabilities and attempt unauthorized access?

Options :

A :

The tester could execute a Brute Force attack, leveraging the lack of account lockout policy and the verbose error messages to guess the correct credentials

B : The tester could exploit a potential SQL Injection vulnerability to manipulate the application-s database

C :

The tester could launch a Cross-Site Scripting (XSS) attack to steal authenticated session cookies, potentially bypassing the clickjacking protection

D :

The tester could execute a Man-in-the-Middle (MitM) attack to intercept and modify the HTTP headers for a Clickjacking attack

Answer: A

Question 2

Becky has been hired by a client from Dubai to perform a penetration test against one of their remote offices. Working from her location in Columbus, Ohio, Becky runs her usual reconnaissance scans to obtain basic information about their network. When analyzing the results of her Whois search, Becky notices that the IP was allocated to a location in Le Havre, France. Which regional Internet registry should Becky go to for detailed information?

Options :

A : ARIN

B : APNIC

C : RIPE

D : LACNIC

Answer: C

Question 3

If a tester is attempting to ping a target that exists but receives no response or a response that states the

destination is unreachable, ICMP may be disabled and the network may be using TCP. Which other option

could the tester use to get a response from a host using TCP?

Options :

A : Traceroute

B : Hping

C : TCP ping

D : Broadcast ping

Answer: B

Question 4

Which address translation scheme would allow a single public IP address to always correspond to a single

machine on an internal network, allowing "server publishing"?

Options :

A : Overloading Port Address Translation

B : Dynamic Port Address Translation

C : Dynamic Network Address Translation

D : Static Network Address Translation

Answer: D

Question 5

In Trojan terminology, what is a covert channel?

Options :

A : A channel that transfers information within a computer system or network in a way that violates the security policy

B : A legitimate communication path within a computer system or network for transfer of data

C : It is a kernel operation that hides boot processes and services to mask detection

D : It is Reverse tunneling technique that uses HTTPS protocol instead of HTTP protocol to establish connections

Answer: A

Confidently Practice Online with Free 312-50v12 Exam Cram

Buying Options: