I85PREP
⌘ K
CAP-PL ENS study materials
CAP-PL ENS study resources

CAP-PL ENS practice questions

One question at a time. Build your CAP-PL ENS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Pentesting Exams

In a penetration test engagement, which document primarily defines the authorized scope, testing windows, and rules of engagement?

  1. The final penetration test report delivered to stakeholders
  2. The tester's personal methodology checklist
  3. The vulnerability scanner's configuration profile
  4. The statement of work and rules of engagement signed by the client Correct answer.

Explanation

The statement of work combined with rules of engagement establishes what is authorized, when testing may occur, and any constraints. Without this signed authorization, testing activity is not legally defensible, so it must exist before any active testing begins.

Question 2Pentesting Exams

A tester discovers a critical remote code execution flaw in a production payment service during an authorized assessment. What is the most appropriate immediate action?

  1. Publish a proof of concept to a public repository
  2. Exploit it fully to demonstrate maximum business impact
  3. Wait until the final report to disclose the finding
  4. Notify the designated client contact through the agreed escalation channel Correct answer.

Explanation

Critical findings that threaten production availability or data should be escalated immediately using the pre-agreed communication channel defined in the rules of engagement. Delaying disclosure until the report or exploiting further increases risk to the client without authorization.

Question 3Pentesting Exams

Which phase of a structured penetration test immediately follows reconnaissance and precedes exploitation?

  1. Post-exploitation persistence
  2. Scope negotiation with the client
  3. Threat modeling and vulnerability analysis Correct answer.
  4. Reporting and remediation verification

Explanation

After gathering information during reconnaissance, testers analyze it to identify and validate potential vulnerabilities, often supported by threat modeling. Only once viable weaknesses are confirmed does exploitation begin.

Question 4Pentesting Exams

During an internal network assessment, a tester captures NTLM authentication traffic. Which technique uses that captured challenge-response to authenticate as the victim without cracking the password?

  1. LLMNR poisoning
  2. Kerberoasting
  3. Pass-the-hash Correct answer.
  4. Password spraying

Explanation

Pass-the-hash reuses a captured NTLM hash directly in the authentication protocol, so the plaintext password never needs to be recovered. Cracking is unnecessary because the hash itself satisfies the challenge-response.

Question 5Pentesting Exams

A web application returns different response lengths for valid versus invalid usernames during login. Which weakness does this most directly indicate?

  1. Insecure direct object reference
  2. Server-side request forgery
  3. Cross-site request forgery
  4. Username enumeration Correct answer.

Explanation

Observable differences in response size, timing, or messaging let an attacker distinguish existing accounts from nonexistent ones, which is username enumeration. Consistent generic responses are the usual mitigation.

Question 6Pentesting Exams

Which Nmap scan type completes the TCP three-way handshake but avoids logging a full connection in many application logs?

  1. TCP SYN scan Correct answer.
  2. TCP connect scan
  3. Idle scan
  4. UDP scan

Explanation

A SYN scan sends a SYN and reads the response, then resets the connection before the handshake completes, so many applications never record a full session. A connect scan completes the handshake through the OS and is more likely to be logged.

Question 7Pentesting Exams

A tester needs to identify all hosts responding on a large subnet without performing port scans. Which Nmap option accomplishes host discovery only?

  1. -A
  2. -O
  3. -sV
  4. -sn Correct answer.

Explanation

The -sn option performs ping-style host discovery and skips port scanning, making it suitable for mapping live hosts quickly. Version detection, OS fingerprinting, and aggressive mode all require probing ports.

Question 8Pentesting Exams

During exploitation of a Linux host, a tester finds the SUID bit set on a binary that executes a shell. What does this most likely allow?

  1. Privilege escalation to the file owner's privileges Correct answer.
  2. Remote code execution from the internet
  3. Decrypting TLS traffic
  4. Bypassing network firewalls

Explanation

A SUID binary runs with the privileges of its owner regardless of who executes it, so a root-owned SUID shell grants root. This is a classic local privilege escalation vector on Linux.

Question 9Pentesting Exams

An Active Directory environment allows unconstrained Kerberos delegation on a server. Which attack does this configuration most directly enable?

  1. Credential capture via delegation impersonation Correct answer.
  2. Kerberoasting of service accounts
  3. DNS cache poisoning
  4. Silver ticket forgery

Explanation

With unconstrained delegation, a compromised host can impersonate users who authenticate to it and obtain their credentials or tickets. Attackers often coerce authentication to such hosts specifically to capture privileged credentials.

Question 10Pentesting Exams

A tester wants to safely demonstrate SQL injection impact on a production database. Which approach best limits risk while proving the vulnerability?

  1. Extract the full user table to prove data access
  2. Drop a test table to show write capability
  3. Attempt to execute operating system commands via the database
  4. Use a boolean or time-based blind payload that returns a controlled marker Correct answer.

Explanation

A controlled payload that proves injection without touching real data demonstrates the flaw while minimizing impact. Destructive or data-exfiltrating actions can violate the rules of engagement and harm the client.

Question 11Pentesting Exams

Which finding is most important to document first in a penetration test report?

  1. The full list of open ports on every host
  2. A critical vulnerability that is remotely exploitable without authentication Correct answer.
  3. Minor informational headers missing
  4. The tester's tool versions

Explanation

Reports are prioritized by risk, so an unauthenticated remote critical vulnerability affecting confidentiality or availability comes first. Supporting details like port lists and tool versions belong in appendices.

Question 12Pentesting Exams

A tester obtains a low-privilege shell on a Windows host and wants to identify missing patches that could enable local privilege escalation. Which approach is most appropriate?

  1. Deleting event logs to avoid detection
  2. Running a full network scan from the host
  3. Enumerating installed updates and comparing against known vulnerable builds Correct answer.
  4. Attempting to brute force the domain administrator

Explanation

Local privilege escalation on Windows commonly relies on unpatched kernel or component vulnerabilities, so comparing the build and installed hotfixes against known-vulnerable versions is the standard step. This stays local and low impact.

Question 13Pentesting Exams

Which statement best describes the purpose of a proof of concept in a penetration test deliverable?

  1. It documents the tester's hourly billing
  2. It replaces the need for a written description of the flaw
  3. It guarantees the client will patch immediately
  4. It shows reproducible steps demonstrating the vulnerability's real impact Correct answer.

Explanation

A proof of concept provides reproducible steps and evidence so the client can verify the finding and understand impact. It complements, rather than replaces, the written description and remediation guidance.

Question 14Pentesting Exams

A tester is authorized to test a web application but discovers a shared database server used by other applications. What is the correct course of action?

  1. Stop and confirm scope with the client before touching shared infrastructure Correct answer.
  2. Pivot into the shared database and test every hosted application
  3. Exploit the database to prove impact on other tenants
  4. Ignore the shared server entirely and end the engagement

Explanation

Shared infrastructure may fall outside the authorized scope and affect other parties, so the tester should pause and clarify with the client. Proceeding without confirmation risks unauthorized testing of third-party systems.

Question 15Pentesting Exams

Which technique best mitigates the risk of account lockout during a password guessing assessment against Active Directory?

  1. Using the same password repeatedly until the account unlocks
  2. Locking out accounts deliberately to test helpdesk response
  3. Spraying one or two common passwords across many accounts with delays Correct answer.
  4. Trying thousands of passwords against a single account rapidly

Explanation

Password spraying tries a small number of likely passwords across many accounts, staying under per-account lockout thresholds. Adding delays further reduces the chance of triggering lockout policies.

Question 16Pentesting Exams

A penetration tester identifies an open SMB share with write access. Which risk does this most directly present?

  1. Immediate remote code execution on the file server
  2. Automatic domain administrator compromise
  3. Placement of malicious files that users may execute Correct answer.
  4. Disclosure of TLS private keys

Explanation

Write access to an SMB share lets an attacker plant files that may be opened by users, enabling phishing or payload delivery. It does not by itself grant code execution or domain admin rights.

Question 17Pentesting Exams

Which Metasploit component stores and manages collected hosts, services, and credentials during an engagement?

  1. The database backend Correct answer.
  2. The payload encoder
  3. The console theme
  4. The NOP generator

Explanation

Metasploit's database backend records hosts, services, vulnerabilities, and loot, enabling correlation across modules. Encoders, NOP generators, and console settings do not store engagement data.

Question 18Pentesting Exams

A web application reflects user input into an HTML page without encoding. Which vulnerability class is most likely present?

  1. XML external entity injection
  2. SQL injection
  3. Cross-site scripting Correct answer.
  4. Insecure deserialization

Explanation

Reflecting unencoded input into HTML allows injected script to execute in victims' browsers, which is cross-site scripting. Output encoding and content security policy are standard mitigations.

Question 19Pentesting Exams

During post-exploitation, a tester wants to maintain access in a way that survives reboots but is least likely to disrupt the client. Which action aligns with typical rules of engagement?

  1. Disable endpoint protection to ensure persistence
  2. Deploy a persistent implant without notifying the client
  3. Create multiple backdoor accounts for redundancy
  4. Document the persistence mechanism and remove it during cleanup Correct answer.

Explanation

Persistence should be documented and removed during cleanup so the client is not left with residual access paths. Leaving implants or disabling defenses violates typical engagement terms and creates ongoing risk.

Question 20Pentesting Exams

A tester observes that an application uses sequential numeric identifiers in URLs and can access another user's invoice by changing the number. Which vulnerability is this?

  1. Open redirect
  2. Clickjacking
  3. Insecure direct object reference Correct answer.
  4. Cross-site request forgery

Explanation

Insecure direct object reference occurs when an application exposes internal identifiers and fails to verify that the requester is authorized for that object. Changing the number to access another user's invoice is the classic pattern.

Question 21Pentesting Exams

A tester needs to crack NTLM hashes captured from a domain controller dump. Which tool and mode are most appropriate?

  1. John the Ripper in single crack mode only
  2. Hashcat with mode 1000 Correct answer.
  3. Hashcat with mode 0
  4. Wireshark with a display filter

Explanation

Hashcat mode 1000 corresponds to NTLM hashes, so it is the correct mode for cracking them. Mode 0 targets raw MD5, and Wireshark is an analysis tool, not a cracker.

Question 22Pentesting Exams

Which control most directly mitigates pass-the-hash attacks in a Windows domain?

  1. Enabling SMB signing only on workstations
  2. Using longer Wi-Fi passphrases
  3. Enforcing NTLMv2 and restricting local administrator reuse Correct answer.
  4. Disabling Windows Firewall on servers

Explanation

Pass-the-hash relies on reusable NTLM credentials, so restricting local administrator reuse and enforcing stronger NTLM settings reduces exposure. Unique local admin passwords prevent a single hash from unlocking many hosts.

Question 23Pentesting Exams

A tester wants to determine whether a target web server supports HTTP methods such as PUT or DELETE. Which approach is most direct?

  1. Running a full TCP port scan
  2. Performing a DNS zone transfer
  3. Sending an OPTIONS request and inspecting the Allow header Correct answer.
  4. Capturing wireless handshakes

Explanation

An OPTIONS request queries the server for supported methods, and the Allow header often lists them. Port scanning, zone transfers, and wireless capture do not reveal HTTP method support.

Question 24Pentesting Exams

During an engagement, a tester finds a service banner revealing an outdated version with a known public exploit. What is the most rigorous next step before exploitation?

  1. Ignore it because banners are always spoofed
  2. Verify the version through a second method and confirm the exploit applies Correct answer.
  3. Report the banner as a confirmed critical finding
  4. Immediately run the public exploit against production

Explanation

Banners can be spoofed or patched, so confirming the version independently and validating exploit applicability reduces false positives. Only then should exploitation be considered within scope.

Question 25Pentesting Exams

Which activity is part of the cleanup phase at the end of a penetration test?

  1. Delivering the final report
  2. Negotiating the scope of work
  3. Performing initial reconnaissance
  4. Removing test accounts, implants, and uploaded files Correct answer.

Explanation

Cleanup removes artifacts created during testing, such as test accounts, implants, and uploaded tools, restoring the environment. Reporting and scoping occur at other stages.

Question 26Pentesting Exams

A penetration tester is preparing for a CAP-PL assessment and must classify the engagement type where the client provides only a public IP range and no internal credentials. Which engagement type does this describe?

  1. Internal white-box assessment
  2. Assumed-breach assessment
  3. Red team full-scope engagement
  4. External black-box assessment Correct answer.

Explanation

An external black-box assessment starts with no prior knowledge and only externally reachable targets, which matches a public IP range without credentials. Internal assessments begin inside the network, white-box implies full documentation, and assumed breach starts with credentials already granted.

Question 27Pentesting Exams

Before active testing begins on a CAP-PL engagement, which document most directly defines the legal boundaries of systems the tester may attack?

  1. The tester's methodology checklist
  2. The rules of engagement Correct answer.
  3. The penetration test report template
  4. The vulnerability scanner configuration

Explanation

The rules of engagement (RoE) defines scope, permitted techniques, timing, and prohibited actions, and it is the primary document bounding legal and authorized activity. Report templates, scanner configurations, and methodology checklists support execution but do not grant or restrict authorization.

Question 28Pentesting Exams

A tester wants to enumerate the SMB dialect and signing status of a Windows file server without authenticating. Which approach best fits this goal?

  1. Perform a full TCP connect scan of all 65535 ports with service detection
  2. Run an SMB vulnerability script against port 445 to retrieve dialect and signing details Correct answer.
  3. Send a DNS zone transfer request to the domain's authoritative server
  4. Use an SNMP walk against UDP 161 with the public community string

Explanation

SMB dialect negotiation and signing status are exposed during the SMB handshake, and NSE scripts such as smb2-security-mode or smb-security-mode retrieve these details over port 445. Full port scanning, DNS zone transfers, and SNMP walks do not report SMB protocol configuration.

Question 29Pentesting Exams

During a CAP-PL web assessment, a tester observes that the login form returns different response times for valid versus invalid usernames. Which weakness does this most directly indicate?

  1. Insecure direct object reference in the session token
  2. Username enumeration through timing side channel Correct answer.
  3. Cross-site request forgery on the login form
  4. Server-side request forgery in the authentication flow

Explanation

Differential response timing for existing versus non-existing accounts lets an attacker infer valid usernames, which is a timing-based enumeration side channel. CSRF, IDOR, and SSRF describe different flaw classes that do not match the observed behavior.

Question 30Pentesting Exams

A tester must verify whether a target host is vulnerable to a specific CVE without causing a denial of service. Which action is most appropriate?

  1. Run the public exploit module with the default payload to confirm exploitability
  2. Send malformed packets repeatedly until the service fails
  3. Use a non-destructive version check or safe-mode NSE script that confirms the vulnerable version Correct answer.
  4. Launch a stress test against the service to observe crash behavior

Explanation

Confirming a vulnerable version with a safe detection script validates the finding while minimizing risk to the target. Running exploits with default payloads, stress testing, or crash-inducing packets can cause outages and exceed the agreed scope.

Question 31Pentesting Exams

A tester gains access to a Linux host and finds a writable cron job script executed as root. Which escalation path does this most directly enable?

  1. Bypassing SELinux enforcement by editing the policy file
  2. Reading the root password hash from /etc/shadow without privileges
  3. Disabling the firewall to allow inbound connections
  4. Modifying the script to execute a root shell when the job runs Correct answer.

Explanation

A writable script scheduled to run as root lets an attacker inject commands that execute with root privileges at the next job interval. Reading /etc/shadow requires root or specific group membership, and SELinux or firewall changes require elevated privileges as well.

Question 32Pentesting Exams

A tester needs to capture authentication traffic on a switched network segment where port mirroring is unavailable. Which technique is most appropriate?

  1. Performing a DNS zone transfer against the internal resolver
  2. Running a full TCP SYN scan of the segment
  3. Sending ICMP redirects to the default gateway only
  4. ARP spoofing to position the tester as a man in the middle Correct answer.

Explanation

ARP spoofing poisons the ARP cache so traffic between hosts flows through the tester, enabling capture on a switched segment without mirroring. Port scanning, DNS zone transfers, and one-way ICMP redirects do not reposition traffic for capture.

Question 33Pentesting Exams

Which tool is designed specifically for offline cracking of captured WPA2 handshakes using wordlists and rule-based mangling?

  1. Responder
  2. Hashcat Correct answer.
  3. Wireshark
  4. Nmap

Explanation

Hashcat is a GPU-accelerated password recovery tool that supports WPA/WPA2 handshake cracking with wordlists, rules, and masks. Nmap performs scanning, Responder poisons name resolution, and Wireshark captures and analyzes packets.

Question 34Pentesting Exams

A tester wants to determine the OS version of a live host using only ICMP echo replies. Which technique fits best?

  1. Performing a UDP scan of the top 1000 ports
  2. Analyzing TTL values in ICMP echo replies to infer the operating system family Correct answer.
  3. Querying the target's WHOIS record for OS details
  4. Sending a DNS ANY query to the target's resolver

Explanation

Initial TTL values differ by OS family, so observing TTL in ICMP replies provides a coarse OS fingerprint. DNS queries, UDP port scans, and WHOIS records do not reveal the target's operating system.

Question 35Pentesting Exams

During a CAP-PL engagement, a tester discovers an exposed cloud storage bucket listing directory contents. Which action best aligns with responsible disclosure?

  1. Publicly post the bucket URL to pressure the client into fixing it
  2. Document the exposure with evidence and notify the client through the agreed channel Correct answer.
  3. Share the bucket contents with a third-party researcher for analysis
  4. Download all objects to measure the full extent of the exposure

Explanation

Responsible disclosure requires documenting the finding and reporting it through the engagement's agreed communication channel without exfiltrating data. Downloading contents, public posting, or sharing with third parties violates confidentiality and engagement rules.

Question 36Pentesting Exams

A tester needs to identify whether a web application is vulnerable to server-side template injection. Which payload is most appropriate for initial detection?

  1. A path traversal string such as ../../etc/passwd
  2. A template expression such as {{7*7}} and observing whether the response contains 49 Correct answer.
  3. A single quote followed by a comment delimiter
  4. An HTML entity such as <script>

Explanation

Template engines evaluate expressions, so submitting {{7*7}} and seeing 49 in the response indicates server-side template evaluation. Comment-based SQL payloads, HTML entities, and path traversal strings target different vulnerability classes.

Question 37Pentesting Exams

Which phase of a penetration test most directly establishes the baseline inventory of reachable hosts and services before exploitation?

  1. Discovery and enumeration Correct answer.
  2. Cleanup and restoration
  3. Post-exploitation persistence
  4. Reporting and remediation

Explanation

Discovery and enumeration produce the host and service inventory that guides later exploitation. Reporting documents results, persistence maintains access after exploitation, and cleanup restores the environment after testing.

Question 38Pentesting Exams

A tester captures NTLMv2 challenge-response traffic on the internal network. Which attack becomes directly feasible with this material?

  1. Decrypting the response to recover the plaintext password offline
  2. Relaying the captured response to another host that accepts NTLM authentication Correct answer.
  3. Extracting the domain krbtgt hash from the response
  4. Forging a Kerberos ticket-granting ticket for the domain

Explanation

NTLMv2 responses can be relayed to hosts that accept NTLM authentication when signing is not enforced, granting access without cracking the password. The response cannot be decrypted to plaintext, does not yield Kerberos tickets, and does not contain the krbtgt hash.

Question 39Pentesting Exams

During an internal assessment, a tester finds that LDAP allows anonymous binds and returns directory objects. Which risk does this most directly present?

  1. SMB signing bypass on member servers
  2. Unauthenticated disclosure of user, group, and computer objects Correct answer.
  3. Remote code execution on the domain controller
  4. Kerberos ticket forgery without any credentials

Explanation

Anonymous LDAP binds that return objects expose directory structure and account details useful for reconnaissance. They do not by themselves enable code execution, ticket forgery, or SMB signing bypass.

Question 40Pentesting Exams

A tester wants to test for blind SQL injection where no output is reflected but the application behavior changes on true versus false conditions. Which technique is most appropriate?

  1. Out-of-band exfiltration through a DNS callback domain
  2. Boolean-based inference using paired true and false payloads Correct answer.
  3. Union-based extraction of data into the page output
  4. Error-based extraction relying on verbose database errors

Explanation

Boolean-based inference compares responses to true and false conditions to extract information when no data is reflected. Union and error-based methods require reflected output or verbose errors, and out-of-band is a distinct channel not implied by the scenario.

Question 41Pentesting Exams

A tester is asked to assess a wireless network and must capture a WPA2 four-way handshake. Which prerequisite is most important?

  1. Enabling SMB signing on the wireless client
  2. Being within radio range of the access point and a client association or deauthentication event Correct answer.
  3. Configuring a VPN tunnel to the access point management interface
  4. Having domain administrator credentials for the access point

Explanation

Capturing a WPA2 handshake requires proximity to the AP and a client authentication event, which can be triggered by a deauthentication frame. Domain credentials, VPN tunnels, and SMB signing are unrelated to wireless handshake capture.

Question 42Pentesting Exams

A tester obtains domain user credentials and wants to enumerate which systems the account can administer remotely. Which approach is most appropriate?

  1. Query directory groups and use authenticated SMB or WMI checks against candidate hosts Correct answer.
  2. Run a DNS zone transfer against the domain controller
  3. Perform an unauthenticated SYN scan of the entire network
  4. Send broadcast NetBIOS name queries to discover workstations

Explanation

Authenticated enumeration of group membership combined with remote SMB or WMI connectivity checks identifies hosts the account can administer. Unauthenticated scans, NetBIOS broadcasts, and zone transfers do not reveal administrative access rights.

Question 43Pentesting Exams

A tester must demonstrate impact of a file upload vulnerability without harming the target. Which payload best demonstrates risk while remaining low-impact?

  1. Upload a destructive script that deletes application files
  2. Upload a large file to exhaust server disk space
  3. Upload a benign file that proves server-side execution of the chosen extension Correct answer.
  4. Upload a fully functional reverse shell and connect to it

Explanation

A benign proof file that executes server-side demonstrates the vulnerability's impact without establishing persistent access or damaging data. Reverse shells, destructive scripts, and disk exhaustion cause harm or exceed the demonstration objective.

Question 44Pentesting Exams

During a CAP-PL engagement, the tester must test a production API that other teams depend on. Which practice best limits operational impact?

  1. Run high-concurrency fuzzing continuously during business hours
  2. Schedule testing in a maintenance window and throttle request rates Correct answer.
  3. Perform destructive write operations to confirm data integrity
  4. Disable API authentication to simplify testing

Explanation

Scheduling in a maintenance window and throttling request rates reduces the chance of service degradation on a shared production API. Continuous high-concurrency fuzzing, disabling authentication, and destructive writes risk outages and data loss.

Question 45Pentesting Exams

A tester discovers that a web server returns the Server header disclosing an outdated framework version. What is the most appropriate next step in the assessment?

  1. Ignore the header because banners are never actionable
  2. Immediately report it as a critical remote code execution finding
  3. Correlate the version with known vulnerabilities and validate safely before reporting Correct answer.
  4. Exploit the framework with a public proof of concept in production

Explanation

A version banner is a lead, not a confirmed vulnerability; the tester should correlate it with known CVEs and validate safely before assigning severity. Reporting it as critical without validation is inaccurate, ignoring it is incorrect, and exploiting in production risks harm.

Question 46Pentesting Exams

Which activity belongs to the cleanup phase of a CAP-PL engagement?

  1. Delivering the final report to the client
  2. Performing the initial scope confirmation meeting
  3. Running the first vulnerability scan of the engagement
  4. Removing uploaded tools, test accounts, and scheduled tasks created during testing Correct answer.

Explanation

Cleanup removes artifacts such as uploaded tools, created accounts, and scheduled tasks so the environment returns to its pre-test state. Reporting, scope confirmation, and initial scanning occur in other phases.

Question 47Pentesting Exams

A tester wants to escalate privileges on a Windows host and finds that the AlwaysInstallElevated policy is enabled in both HKLM and HKCU. Which technique does this enable?

  1. Installing a crafted MSI package that executes with SYSTEM privileges Correct answer.
  2. Bypassing AppLocker by renaming a binary
  3. Disabling Windows Defender through a registry read
  4. Reading LSASS memory without administrative rights

Explanation

AlwaysInstallElevated allows any user to install MSI packages with elevated (SYSTEM) privileges, so a crafted MSI yields privilege escalation. It does not grant LSASS access, bypass AppLocker by renaming, or disable Defender via a read.

Question 48Pentesting Exams

A tester needs to determine whether a target application is vulnerable to cross-site scripting in a stored context. Which method is most appropriate?

  1. Send a payload and check only the immediate HTTP response code
  2. Test only the login page with an HTML entity
  3. Inject into a parameter that is never rendered and observe the status code
  4. Submit a unique benign marker payload and verify it executes when the page is later viewed Correct answer.

Explanation

Stored XSS is confirmed when a submitted marker is persisted and executed on a later page view, ideally with a benign proof such as an alert. Checking status codes, testing non-rendered parameters, or using entities does not confirm stored execution.

Question 49Pentesting Exams

A tester must report a finding with a CVSS v3.1 base score. Which metric group most directly reflects whether the vulnerability requires local or network access?

  1. The attack vector metric Correct answer.
  2. The user interaction metric
  3. The privileges required metric
  4. The confidentiality impact metric

Explanation

The attack vector metric captures the context from which the vulnerability is exploitable, such as network, adjacent, local, or physical. Confidentiality impact describes data exposure, privileges required describes authentication needs, and user interaction describes victim involvement.

Question 50Pentesting Exams

During a CAP-PL engagement, a tester finds a Kerberoastable service account with a weak password. Which sequence best reflects a safe and effective approach?

  1. Request the service ticket, crack it offline, and document the weak credential without logging in Correct answer.
  2. Delete the service principal name to demonstrate impact
  3. Request the service ticket and immediately authenticate to every server in the domain
  4. Reset the service account password to prove weakness

Explanation

Kerberoasting requests a service ticket encrypted with the account's password hash, which can be cracked offline; documenting the weak credential proves the finding without lateral movement. Authenticating broadly, resetting the password, or deleting the SPN causes disruption.