I85PREP
⌘ K
CFR-410 study materials
CFR-410 study resources

CFR-410 practice questions

One question at a time. Build your CFR-410 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

During a black-box web assessment, an assessor needs an initial passive map of a target domain's subdomains and registered hosts without sending packets to the target. Which approach best fits that requirement?

  1. Running a full TCP SYN scan against the target's allocated address ranges
  2. Querying public certificate transparency logs and passive DNS data sources Correct answer.
  3. Launching an unauthenticated Nmap service-version scan on discovered hosts
  4. Brute-forcing virtual host names with a wordlist over HTTP

Explanation

Passive reconnaissance gathers intelligence from third-party datasets such as certificate transparency logs, passive DNS, and public registries, so the target never sees the queries. Active techniques like SYN scanning, vhost brute forcing, and service detection all generate traffic attributable to the assessor.

Question 2Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor runs the Metasploit module auxiliary/scanner/http/dir_scanner against a web server. What is the module primarily used to discover?

  1. TLS certificate weaknesses on the virtual host
  2. Hidden directories and files by requesting candidate paths Correct answer.
  3. Open UDP ports on the host
  4. SQL injection points in login forms

Explanation

The dir_scanner auxiliary module issues HTTP requests for entries drawn from a wordlist and flags responses that indicate existing paths. It does not test injection, inspect certificates, or scan UDP ports.

Question 3Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

A tester identifies that an application reflects the value of a query parameter into the HTML body without encoding. Which vulnerability class is most directly indicated?

  1. SQL injection
  2. Reflected cross-site scripting Correct answer.
  3. Server-side request forgery
  4. Stored cross-site scripting

Explanation

Reflected XSS occurs when user-supplied input is echoed into the response without output encoding, letting an attacker execute script in a victim's browser via a crafted link. Stored XSS requires persistence, SQL injection targets database queries, and SSRF targets server-side requests.

Question 4Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor needs to set the RHOSTS option and payload for an exploit module in msfconsole. Which command displays the module's configurable options and their current values?

  1. show options Correct answer.
  2. sessions -l
  3. show payloads
  4. db_status

Explanation

The show options command lists the datastore options for the currently selected module, including RHOSTS and which fields are required. show payloads lists compatible payloads, sessions -l lists active sessions, and db_status reports database connectivity.

Question 5Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

Which Metasploit payload type establishes a connection from the target back to the attacker's listener?

  1. A bind payload
  2. A stager-less payload
  3. A staged payload
  4. A reverse payload Correct answer.

Explanation

A reverse payload makes the compromised host connect outbound to the attacker's handler, which helps traverse egress filtering. A bind payload instead opens a listening port on the target, while staged and stager-less describe payload delivery, not connection direction.

Question 6Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

During a web assessment, a tester submits a single quote into a login field and the application returns a database error message. Which next step best confirms SQL injection rather than assuming it?

  1. Submit a boolean or time-based payload and compare application behavior against a baseline Correct answer.
  2. Immediately run an automated exploit that dumps the users table
  3. Switch to scanning the host for open TCP ports
  4. Check whether the response includes a Content-Security-Policy header

Explanation

Error messages alone are weak evidence; confirming injection requires observing a consistent behavioral difference, such as a boolean condition changing output or a deliberate delay. Dumping data before confirmation risks false positives and unnecessary impact, and port scanning or header inspection does not validate injection.

Question 7Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

A web application uses a numeric parameter in a URL and the tester wants to test for SQL injection without relying on error messages. Which pair of techniques is most appropriate?

  1. Directory traversal and local file inclusion
  2. Boolean-based blind and time-based blind inference Correct answer.
  3. Cross-site request forgery and clickjacking
  4. TLS downgrade and certificate pinning bypass

Explanation

Blind SQL injection is detected by inferring truth from observable differences: boolean-based payloads change the response content, and time-based payloads cause measurable delays. The other pairs address unrelated web or transport weaknesses.

Question 8Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor uses the Metasploit module auxiliary/scanner/ssl/openssl_heartbleed. What does a positive result indicate?

  1. The target's TLS service is vulnerable to memory disclosure via the Heartbleed bug Correct answer.
  2. The target's certificate has expired
  3. The target accepts anonymous TLS ciphers
  4. The target uses an outdated TLS cipher suite

Explanation

The Heartbleed scanner checks whether the TLS heartbeat extension can be abused to read process memory, potentially exposing keys and credentials. Cipher-suite weakness, certificate expiry, and anonymous ciphers are separate checks handled by other modules.

Question 9Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

A tester discovers that an application accepts a file path parameter and returns the contents of /etc/passwd when the value ../../../../etc/passwd is supplied. Which vulnerability is demonstrated?

  1. Insecure direct object reference
  2. Path traversal leading to arbitrary file read Correct answer.
  3. XML external entity injection
  4. Remote file inclusion

Explanation

Path traversal uses dot-dot-slash sequences to escape the intended directory and read files outside it. Remote file inclusion would execute a remotely hosted file, XXE abuses XML entity resolution, and IDOR concerns accessing objects by manipulating identifiers.

Question 10Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor wants to exploit a known vulnerability on a host but does not know which Metasploit module applies. Which approach best identifies a candidate module?

  1. Use the db_nmap command to import scan results and search by reference
  2. Search the module database by CVE identifier or service name Correct answer.
  3. Run the exploit/multi/handler module against the host
  4. Start a reverse shell payload with no exploit module

Explanation

Metasploit's search command matches module metadata such as CVE references, platform, and service names, making it the direct way to locate a candidate module. The handler only receives connections, a payload requires an exploit, and db_nmap imports scan data rather than mapping a CVE to a module.

Question 11Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

Which statement correctly describes the difference between a Metasploit exploit module and a payload module?

  1. Both are interchangeable and either can be used alone
  2. The exploit is only used for scanning, while the payload performs authentication
  3. The exploit delivers the attack, while the payload is the code executed after successful exploitation Correct answer.
  4. The payload delivers the attack, while the exploit maintains persistence

Explanation

An exploit module takes advantage of a vulnerability to gain execution, and the payload is the code that then runs on the target, such as a shell or meterpreter. They are complementary, not interchangeable, and scanning is handled by auxiliary modules.

Question 12Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

A tester finds that a web application builds an LDAP query from user input and returns different results for crafted filter characters. Which vulnerability is most likely present?

  1. LDAP injection Correct answer.
  2. Open redirect
  3. Command injection
  4. Server-side template injection

Explanation

LDAP injection occurs when unescaped input is concatenated into an LDAP filter, allowing an attacker to alter the query logic. Command injection targets shell execution, SSTI targets template evaluation, and open redirect targets unvalidated redirect destinations.

Question 13Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

During exploitation, an assessor obtains a Meterpreter session and wants to move to another host on the internal network. Which Meterpreter capability is designed for this?

  1. The screenshot command to capture the remote desktop
  2. The hashdump command to extract local account hashes
  3. The route and port forwarding commands to pivot through the session Correct answer.
  4. The sysinfo command to enumerate host details

Explanation

Meterpreter's route command adds a network route through the session, and port forwarding lets the assessor reach internal hosts via the compromised machine. Screenshot, hashdump, and sysinfo collect information from the current host rather than providing a pivot.

Question 14Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor needs to test whether a web application is vulnerable to cross-site request forgery. Which condition is most relevant to confirm the vulnerability?

  1. The application accepts file uploads with arbitrary extensions
  2. The application reflects user input into the response body without encoding
  3. The application discloses stack traces on malformed input
  4. State-changing requests are accepted based on ambient session cookies without a validated anti-CSRF token Correct answer.

Explanation

CSRF is possible when a state-changing action relies solely on the browser's automatic credential submission and lacks a token or origin check. Reflection, file upload handling, and error disclosure are separate issues.

Question 15Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

A tester observes that an application's search feature returns results from an internal service when the parameter contains a URL. Which vulnerability should be investigated first?

  1. HTTP request smuggling
  2. Insecure deserialization
  3. Cross-site scripting
  4. Server-side request forgery Correct answer.

Explanation

When a parameter causes the server to fetch a URL, the application may be coerced into requesting internal or attacker-controlled resources, which is SSRF. XSS affects the client, deserialization concerns object reconstruction, and request smuggling concerns parsing discrepancies between intermediaries.

Question 16Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor runs an Nmap scan and sees TCP port 445 open on a Windows host. Which Metasploit module family is most relevant for testing SMB-related vulnerabilities?

  1. auxiliary/scanner/smb and exploit/windows/smb modules Correct answer.
  2. auxiliary/scanner/http and exploit/multi/http modules
  3. auxiliary/scanner/ftp and exploit/unix/ftp modules
  4. auxiliary/scanner/ssh and exploit/linux/ssh modules

Explanation

Port 445 carries SMB, so SMB scanner and exploit modules are the relevant family for version detection, credential checks, and known SMB vulnerabilities. HTTP, FTP, and SSH modules target entirely different services and ports.

Question 17Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

Which technique best demonstrates that a web application is vulnerable to stored cross-site scripting?

  1. Injecting a payload that causes a database error
  2. Uploading a file that overwrites a configuration file
  3. Sending a crafted link that reflects a payload in the same response
  4. Submitting a script payload that is saved and later rendered unencoded to another user Correct answer.

Explanation

Stored XSS requires the payload to persist server-side and execute when another user views the affected content. Reflection in the same response is reflected XSS, database errors suggest SQL injection, and file overwrite suggests an upload vulnerability.

Question 18Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor wants to automate credential guessing against an SSH service in Metasploit. Which module is intended for this task?

  1. post/multi/recon/local_exploit_suggester
  2. auxiliary/scanner/http/http_version
  3. auxiliary/scanner/ssh/ssh_login Correct answer.
  4. exploit/multi/handler

Explanation

The ssh_login auxiliary module performs SSH authentication attempts using supplied usernames and passwords or wordlists. The handler receives payloads, http_version fingerprints web servers, and local_exploit_suggester runs post-exploitation on a compromised host.

Question 19Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

A tester finds that an application deserializes a cookie value supplied by the client and later triggers unexpected object behavior. Which vulnerability class is most relevant?

  1. Open redirect
  2. Cross-site request forgery
  3. Directory traversal
  4. Insecure deserialization Correct answer.

Explanation

Insecure deserialization occurs when untrusted serialized data is reconstructed into objects, potentially enabling code execution or logic abuse. CSRF, open redirect, and traversal concern request forgery, redirects, and filesystem paths respectively.

Question 20Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

During a web assessment, a tester needs to determine whether a parameter is vulnerable to command injection. Which approach provides the clearest evidence while limiting impact?

  1. Inject a destructive command that deletes files on the server
  2. Inject a payload that dumps all environment variables at once
  3. Inject a payload that opens a reverse shell immediately
  4. Inject a benign command such as a DNS lookup to a controlled host and observe the callback Correct answer.

Explanation

A benign out-of-band callback, such as a DNS or HTTP request to an assessor-controlled host, confirms command execution with minimal impact. Destructive commands, bulk data dumping, and immediate shells increase risk and are unnecessary for confirmation.

Question 21Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor discovers a web application that accepts XML input and returns parsed entity values. Which vulnerability should be tested by submitting an external entity declaration?

  1. XML external entity injection Correct answer.
  2. SQL injection via YAML
  3. Server-side request forgery via JSON
  4. Cross-site scripting via CSV

Explanation

XXE is tested by declaring an external entity that references a local file or remote URL and observing whether its value is resolved and returned. The other options misattribute the data format or vulnerability class.

Question 22Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor has a low-privilege shell on a Linux host and wants Metasploit to identify local privilege escalation opportunities. Which module is appropriate?

  1. post/multi/recon/local_exploit_suggester Correct answer.
  2. exploit/multi/http/tomcat_mgr_upload
  3. auxiliary/scanner/smb/smb_version
  4. auxiliary/scanner/portscan/tcp

Explanation

local_exploit_suggester inspects the compromised host and checks for known local privilege escalation exploits applicable to its configuration. Port scanning, Tomcat manager exploitation, and SMB version scanning are pre-exploitation or remote tasks.

Question 23Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

A tester observes that a web application returns a 200 response with a body indicating an error when a crafted SQL payload is supplied, but returns a different body for a logically equivalent false condition. Which conclusion is best supported?

  1. The application is vulnerable to open redirect
  2. The parameter is likely vulnerable to boolean-based blind SQL injection Correct answer.
  3. The application is vulnerable to XML external entity injection
  4. The application is vulnerable to stored cross-site scripting

Explanation

A consistent difference in response content between true and false injected conditions is the signature of boolean-based blind SQL injection. XSS, open redirect, and XXE would produce different observable behaviors.

Question 24Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor needs to exploit a Windows SMB vulnerability remotely with Metasploit. Which sequence best reflects the correct workflow?

  1. Run a port scan, then use the local_exploit_suggester module
  2. Search for the SMB exploit, select it, set RHOSTS and the target payload, then run Correct answer.
  3. Start a handler first, then select any HTTP module and run
  4. Select the ssh_login module and supply a wordlist

Explanation

The standard workflow is to locate the relevant exploit module, configure the target and payload options, and execute it against the host. Starting a handler without an exploit, using an unrelated HTTP module, or running SSH credential guessing does not deliver an SMB exploit.

Question 25Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

A web application uses a session cookie with the HttpOnly flag absent and reflects user input into an authenticated page. Which combined impact is most significant?

  1. An attacker can bypass TLS certificate validation on the server
  2. An attacker can escalate privileges on the underlying operating system
  3. An attacker can execute script that reads the session cookie and hijacks the user's session Correct answer.
  4. An attacker can read server-side configuration files directly

Explanation

Without HttpOnly, injected script can access document.cookie, so reflected or stored XSS can lead to session hijacking. Reading server files, bypassing TLS validation, and OS privilege escalation are not direct consequences of missing HttpOnly combined with XSS.

Question 26Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor runs a full TCP connect scan with Nmap against a target subnet and receives a response of 'filtered' for several ports. What does this result most directly indicate about those ports?

  1. The port is closed and the host sent a TCP RST in reply.
  2. The port is open and the service banner was captured successfully.
  3. The target host is down and ARP resolution failed.
  4. A packet filter or firewall is dropping probe packets so the port state cannot be determined. Correct answer.

Explanation

A 'filtered' state means Nmap could not determine whether the port is open because probes were dropped or rejected by filtering devices. It is distinct from 'closed', where the host actively refuses the connection with a reset.

Question 27Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

During reconnaissance, an assessor wants to enumerate subdomains of a target organization to widen the attack surface. Which activity best fits passive reconnaissance?

  1. Running a full TCP scan against every resolved address.
  2. Attempting default credentials against discovered login pages.
  3. Sending crafted packets to brute-force virtual host names on the web server.
  4. Querying public certificate transparency logs and search engines for hostnames tied to the domain. Correct answer.

Explanation

Passive reconnaissance gathers information from third-party sources without directly interacting with the target's infrastructure. Certificate transparency logs and public search indexes reveal hostnames without sending traffic to the organization.

Question 28Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor uses Metasploit and selects a module under auxiliary/gather. What is the primary purpose of modules in this category?

  1. Encoding a payload to evade antivirus detection.
  2. Escalating privileges on an already compromised session.
  3. Collecting information such as credentials, banners, or data without delivering a payload. Correct answer.
  4. Establishing an interactive shell on the target host.

Explanation

Auxiliary modules perform scanning, enumeration, and information gathering and do not pair with a payload to open a session. Exploit modules combined with payloads are what create sessions.

Question 29Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

A tester identifies a reflected cross-site scripting flaw but the application sets the session cookie with the HttpOnly attribute. What is the most accurate impact assessment?

  1. The flaw is fully mitigated because HttpOnly prevents all script execution.
  2. The flaw only affects the attacker's own session and poses no risk to other users.
  3. Script injected via the flaw cannot read the cookie, but it can still perform actions and read page content in the victim's context. Correct answer.
  4. The cookie can still be stolen directly because HttpOnly only affects HTTPS traffic.

Explanation

HttpOnly blocks JavaScript from reading the cookie but does not stop injected script from acting within the authenticated page. An attacker can still issue requests, read rendered data, and manipulate the DOM on behalf of the victim.

Question 30Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor wants to test a web login form for username enumeration. Which observation most reliably indicates that the application leaks valid usernames?

  1. The form includes a hidden anti-CSRF token field.
  2. The response time or error message differs consistently between valid and invalid usernames. Correct answer.
  3. The login form uses the POST method instead of GET.
  4. The application sets a new session cookie on every request.

Explanation

Username enumeration is demonstrated when the application behaves observably differently for existing versus non-existing accounts, such as distinct error text or timing. Consistent differences allow an attacker to build a list of valid accounts.

Question 31Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor is exploiting a vulnerable web application and wants to use Metasploit's msfvenom to generate a payload that connects back to the attacker. Which option specifies the attacker's listening address and port in a reverse payload?

  1. SRVHOST and SRVPORT
  2. LHOST and LPORT Correct answer.
  3. TARGETURI and VHOST
  4. RHOST and RPORT

Explanation

For reverse payloads, LHOST and LPORT define the local listener the target connects back to. RHOST and RPORT refer to the remote target instead.

Question 32Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

During a web assessment, an assessor finds an endpoint that fetches a URL supplied by the user and returns the response body. Which test most directly confirms server-side request forgery?

  1. Supply a URL with a fragment identifier and check that it is stripped.
  2. Supply a URL pointing to an internal-only address such as a metadata service and observe its content returned. Correct answer.
  3. Supply a URL using the HTTPS scheme and confirm TLS negotiation succeeds.
  4. Supply a very long URL and observe a 414 status code.

Explanation

SSRF is confirmed when the server fetches a resource the client could not reach directly, such as an internal metadata endpoint or localhost service. Returning that internal content demonstrates the server made the request on the attacker's behalf.

Question 33Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor is reviewing a Metasploit exploit attempt that repeatedly fails with 'Exploit completed, but no session was created.' Which troubleshooting step is most appropriate first?

  1. Verify the target service version matches the module and confirm LHOST is reachable from the target. Correct answer.
  2. Immediately escalate to a different exploit module regardless of version.
  3. Change the database backend used by msfconsole.
  4. Disable the payload encoder to improve reliability.

Explanation

A failed session often stems from a version mismatch or an unreachable callback address. Confirming the module matches the detected service version and that LHOST is routable from the target addresses the most common causes.

Question 34Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor wants to identify whether a web server is vulnerable to directory traversal on a file-download endpoint. Which request most directly tests the flaw?

  1. Request a path using encoded dot-dot sequences that resolves outside the intended directory. Correct answer.
  2. Request the endpoint with an extremely large query string.
  3. Request the endpoint over HTTP instead of HTTPS.
  4. Request the endpoint with a different User-Agent header.

Explanation

Directory traversal is tested by supplying sequences such as encoded ../ that attempt to escape the intended base directory. A successful response revealing files outside that directory confirms the vulnerability.

Question 35Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor is preparing an exploitation phase and wants to confirm which service and version is running on a discovered port before selecting a Metasploit module. Which Nmap feature best supports this?

  1. Version detection with the -sV flag Correct answer.
  2. Ping sweep with the -sn flag
  3. Fragmenting packets with the -f flag
  4. Idle scan with the -sI flag

Explanation

The -sV option performs service and version detection by probing open ports and matching responses to known signatures. This information guides selection of a compatible Metasploit exploit module.

Question 36Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

A tester finds that a web application reflects user input inside an HTML attribute without encoding and the input is not inside a script block. Which payload construction is most appropriate to demonstrate execution?

  1. Break out of the attribute with a quote and inject an event handler such as onmouseover. Correct answer.
  2. Use a SQL comment sequence to truncate the attribute.
  3. Append a null byte to terminate the attribute string.
  4. Inject a full script tag inside the attribute value and rely on automatic execution.

Explanation

When input lands inside an attribute, the attacker must first break out of the attribute context and then introduce an executable handler. An event handler like onmouseover executes when the element is interacted with, confirming XSS.

Question 37Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor obtains a set of hashes during an engagement and wants to determine whether they can be cracked offline. Which factor most directly affects the feasibility of offline cracking?

  1. The presence of a firewall filtering inbound connections.
  2. The network latency between the assessor and the target host.
  3. The version of the target's web server software.
  4. The hash algorithm and password complexity combined with available computing power. Correct answer.

Explanation

Offline cracking depends on the hash algorithm's speed, the entropy of the underlying passwords, and the attacker's compute resources. Network conditions and server versions do not influence offline cracking once hashes are obtained.

Question 38Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor wants Metasploit to store and query scan results, hosts, and credentials across sessions. Which component provides this capability?

  1. The msfvenom payload generator
  2. The resource script runner
  3. The Meterpreter stdapi extension
  4. The Metasploit database backed by PostgreSQL Correct answer.

Explanation

The Metasploit database, typically PostgreSQL, stores hosts, services, vulnerabilities, loot, and credentials for querying and correlation. It enables commands like hosts and services within msfconsole.

Question 39Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

A web application uses a numeric identifier in a URL to retrieve user invoices, and changing the identifier returns another user's invoice. Which vulnerability does this represent?

  1. Open redirect
  2. Server-side template injection
  3. Cross-site request forgery
  4. Insecure direct object reference Correct answer.

Explanation

Insecure direct object reference occurs when an application exposes an internal object identifier and fails to verify the requester's authorization for that object. Changing the identifier to access another user's data is the classic demonstration.

Question 40Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor is testing a REST API and observes that the server accepts JSON input containing a field named 'role'. The assessor changes 'role' from 'user' to 'admin' and gains elevated access. Which weakness has been demonstrated?

  1. Mass assignment of a privileged field Correct answer.
  2. Broken authentication via session fixation
  3. Cross-site scripting in JSON responses
  4. Insecure deserialization of a binary blob

Explanation

Mass assignment occurs when an application binds client-supplied fields directly to internal objects, allowing attackers to set properties like role that should be protected. Changing the role field and gaining privilege confirms the flaw.

Question 41Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor wants to perform a brute-force attack against a web login form while avoiding account lockout. Which approach best reduces the risk of lockout during testing?

  1. Attempt the same password repeatedly for every account.
  2. Use a small, targeted credential list and throttle requests with delays between attempts. Correct answer.
  3. Disable the account lockout by editing the application source.
  4. Send all password guesses in a single parallel burst.

Explanation

Lockout thresholds are typically triggered by rapid repeated failures. Using a short targeted list with deliberate delays keeps attempts below the threshold and reduces disruption to production accounts.

Question 42Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

During an assessment, an assessor notices that a web application includes verbose stack traces and framework version details in error responses. Why is this significant for the attack phase?

  1. It disables the web application firewall automatically.
  2. It proves the application is vulnerable to SQL injection.
  3. It reveals component versions and code paths that help select applicable exploits. Correct answer.
  4. It directly grants remote code execution on the server.

Explanation

Verbose errors leak framework and library versions plus internal paths, which help an attacker map the technology stack and choose relevant exploits. Information disclosure itself does not execute code or prove a specific injection flaw.

Question 43Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor uses Metasploit's search command and finds multiple modules for a service. Which criterion most reliably narrows the list to a module applicable to the detected version?

  1. Picking the module listed first in the search output.
  2. Choosing the module with the highest rank regardless of version.
  3. Matching the module's documented affected versions against the detected service version. Correct answer.
  4. Selecting the module with the shortest name.

Explanation

Module applicability depends on the affected version ranges documented for each module. Comparing those ranges to the version detected during enumeration avoids attempts against non-vulnerable services.

Question 44Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

A tester is assessing a web application for open redirect vulnerabilities. Which request most directly tests the flaw?

  1. Supply a null byte in the redirect parameter and check for file inclusion.
  2. Supply an SQL comment in the redirect parameter and check for database errors.
  3. Supply a very long value in the redirect parameter and check for truncation.
  4. Supply an external URL in a redirect parameter and check whether the response Location header points to it. Correct answer.

Explanation

Open redirect is confirmed when a user-controlled parameter causes the application to issue a redirect to an arbitrary external destination. Inspecting the Location header after supplying an external URL demonstrates this behavior.

Question 45Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor has identified a vulnerable web application and wants to deliver a payload that executes in the context of the web server process. Which Metasploit payload type is most appropriate for a PHP-based web application?

  1. A Windows x64 reverse TCP shell
  2. A browser-based JavaScript payload
  3. A PHP Meterpreter payload Correct answer.
  4. A Linux kernel local privilege escalation exploit

Explanation

A PHP Meterpreter payload runs within the PHP interpreter of the web server, matching the target technology. Payload selection should align with the language and platform of the vulnerable component.

Question 46Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor is reviewing the output of a vulnerability scan and finds a finding described as 'possible SQL injection' based only on a generic signature. What is the most appropriate next step before reporting it as confirmed?

  1. Report it as a confirmed critical vulnerability immediately.
  2. Discard the finding because scanners produce false positives.
  3. Re-run the same scan with the same signature and treat agreement as confirmation.
  4. Manually verify the finding with controlled injection tests and confirm a reproducible effect. Correct answer.

Explanation

Scanner signatures can produce false positives, so findings must be manually validated with controlled tests that demonstrate a reproducible impact. Confirmation requires evidence beyond a single automated match.

Question 47Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor wants to exploit a known remote code execution vulnerability in a web application and needs a callback that survives service restarts. Which payload characteristic is most relevant?

  1. Whether the payload uses an encoder.
  2. Whether the payload establishes persistence or only a transient session. Correct answer.
  3. Whether the payload is staged or stageless.
  4. Whether the payload uses TCP or UDP transport.

Explanation

Surviving a service restart requires a persistence mechanism, such as a scheduled task or startup entry, delivered through post-exploitation. A transient session alone will not return after the process restarts.

Question 48Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor is testing a web application that builds an operating system command from a parameter and passes it to a shell. The assessor wants a reliable way to confirm command execution without relying on visible output. Which technique is most appropriate?

  1. Inject a command that causes an out-of-band interaction such as a DNS lookup to a controlled host. Correct answer.
  2. Inject a command that lists the current directory and inspect the response body.
  3. Inject a command that writes to a log file on the server.
  4. Inject a command that sleeps for one second and measure total response time.

Explanation

Out-of-band confirmation via DNS or HTTP callbacks reliably demonstrates command execution even when output is not returned in the response. It provides evidence independent of application response rendering.

Question 49Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor is conducting an engagement and wants to simulate an attacker performing internal reconnaissance after gaining a foothold. Which Metasploit capability best supports pivoting traffic into the internal network?

  1. An msfvenom payload encoded with shikata_ga_nai
  2. A route added through an existing session combined with a SOCKS proxy Correct answer.
  3. Auxiliary modules that only fingerprint public websites
  4. A Nmap scan run directly from the assessor's laptop

Explanation

Metasploit can add a route through a compromised session and expose a SOCKS proxy, allowing tools to traverse the pivot into internal networks. This simulates an attacker using a foothold to reach otherwise unreachable hosts.

Question 50Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)

An assessor is evaluating a web application that stores uploaded files in a directory served by the web server. Which finding most strongly indicates that arbitrary file upload could lead to code execution?

  1. The upload directory is not listed in the site navigation.
  2. The application renames uploaded files with a random identifier.
  3. The upload form enforces a maximum file size.
  4. The server executes uploaded files with a script-capable extension and does not validate content type. Correct answer.

Explanation

Code execution via upload requires that the server execute the uploaded content, typically when a script-capable extension is accepted and content validation is absent. Size limits, random names, and hidden directories reduce risk but do not by themselves enable execution.