I85PREP
⌘ K
CPENT study materials
CPENT study resources

CPENT practice questions

One question at a time. Build your CPENT understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Reconnaissance, enumeration and confidence in observations

In a supplied authorized classic NTLM-relay lab, authentication is available to relay and other protections do not defeat it. Which listed attack can disabled target SMB signing help make feasible?

  1. DNS cache poisoning
  2. NTLM relay attack Correct answer.
  3. ARP spoofing on a switched segment
  4. SSL stripping

Explanation

NTLM relay is the relevant technique under the explicitly supplied conditions. Actual target protocol, signing, channel binding, extended protection and authorization affect feasibility; disabled SMB signing alone does not prove every host can be compromised or reveal a plaintext password.

Question 2Reconnaissance, enumeration and confidence in observations

Which Nmap scan type sends SYN packets and does not complete the TCP handshake, making it less likely to be logged by the target system?

  1. TCP connect scan (-sT)
  2. SYN stealth scan (-sS) Correct answer.
  3. UDP scan (-sU)
  4. FIN scan (-sF)

Explanation

A SYN stealth scan (-sS) sends SYN packets and analyzes the response without completing the TCP three-way handshake. Because the connection is never fully established, many legacy logging mechanisms do not record the attempt. This makes it the default and most popular Nmap scan type for penetration testers.

Question 3Reconnaissance, enumeration and confidence in observations

What is the primary purpose of a pivot during a penetration test?

  1. To escalate privileges on the current host
  2. To use a compromised system to attack other systems on an internal network Correct answer.
  3. To exfiltrate data through an encrypted tunnel
  4. To modify firewall rules to allow inbound connections

Explanation

Pivoting uses a compromised host as a relay point to access and attack systems on network segments that are not directly reachable from the attacker's position. This technique is essential in advanced penetration testing because critical internal assets are typically segmented behind multiple network boundaries. Tools like SSH tunnels, Meterpreter routes, and SOCKS proxies facilitate pivoting.

Question 4Reconnaissance, enumeration and confidence in observations

Which protocol is commonly targeted when performing a Man-in-the-Middle (MitM) attack on a local network?

  1. HTTPS with certificate pinning
  2. ARP (Address Resolution Protocol) Correct answer.
  3. DNSSEC
  4. IPsec ESP

Explanation

ARP operates at Layer 2 without authentication, making it trivially spoofable. By sending gratuitous ARP replies, an attacker can associate their MAC address with another host's IP address, redirecting traffic through their machine. This ARP poisoning is the foundation for many MitM attacks on local area networks.

Question 5Reconnaissance, enumeration and confidence in observations

What does the LLMNR protocol do, and why is it a security concern in penetration testing?

  1. It encrypts DNS queries; it can be bypassed with certificate spoofing
  2. It resolves hostnames on the local network when DNS fails; it can be poisoned to capture credentials Correct answer.
  3. It manages DHCP leases; attackers can exhaust the address pool
  4. It handles multicast routing; attackers can redirect traffic to unauthorized segments

Explanation

Link-Local Multicast Name Resolution (LLMNR) is a protocol that allows hosts to resolve names on the local network when DNS resolution fails. Because LLMNR responses are unauthenticated, an attacker can respond to LLMNR queries and direct the victim to an attacker-controlled host, capturing NTLMv2 hashes in the process. Tools like Responder exploit this vulnerability.

Question 6Reconnaissance, enumeration and confidence in observations

You have compromised a Linux host and want to establish persistence. Which method installs a recurring callback without requiring root privileges?

  1. Adding a systemd service unit file
  2. Installing a cron job in the user's crontab Correct answer.
  3. Modifying /etc/rc.local
  4. Adding a kernel module

Explanation

User-level cron jobs can be created without root privileges by editing the current user's crontab with 'crontab -e'. This allows scheduling a reverse shell or beacon to execute at regular intervals. Systemd services, rc.local modifications, and kernel modules all require elevated privileges, making them unsuitable for persistence from a low-privilege foothold.

Question 7Reconnaissance, enumeration and confidence in observations

What is the primary advantage of using Cobalt Strike's Beacon over a basic Meterpreter session during a penetration test?

  1. Beacon is open-source and free to use
  2. Beacon uses asynchronous communication with configurable sleep intervals to reduce detection Correct answer.
  3. Beacon automatically exploits vulnerabilities without user interaction
  4. Beacon works only over HTTPS, making it inherently secure

Explanation

Cobalt Strike's Beacon uses an asynchronous, callback-based communication model where the implant sleeps for configurable intervals before checking in with the team server. This sleep-and-callback pattern generates less network traffic than Meterpreter's persistent connection, making it harder for network monitoring tools to detect. Beacon also supports multiple C2 channels including HTTP, HTTPS, and DNS.

Question 8Reconnaissance, enumeration and confidence in observations

When performing a wireless penetration test, which attack captures the WPA2 four-way handshake?

  1. Evil twin access point
  2. Deauthentication attack followed by passive capture Correct answer.
  3. WPS PIN brute force
  4. Karma attack

Explanation

A deauthentication attack sends forged deauth frames to force clients to disconnect from the access point. When clients automatically reconnect, the tester captures the four-way handshake with a tool like airodump-ng. This handshake contains the information needed to perform an offline dictionary or brute-force attack against the WPA2 pre-shared key.

Question 9Reconnaissance, enumeration and confidence in observations

In a double-tagging VLAN hopping attack, why does the attacker's frame include two 802.1Q tags?

  1. To encrypt the frame for secure transmission
  2. To cause the first switch to strip one tag and forward the frame to a different VLAN Correct answer.
  3. To increase the frame size beyond MTU for fragmentation attacks
  4. To spoof the source MAC address twice for redundancy

Explanation

In a double-tagging attack, the outer VLAN tag matches the attacker's native VLAN, causing the first switch to strip it during normal processing. The inner tag specifies the target VLAN. When the frame is forwarded to the next switch, only the inner tag remains, causing the frame to be delivered to the target VLAN. This attack only works in one direction and requires the attacker to be on the native VLAN.

Question 10Reconnaissance, enumeration and confidence in observations

Which Windows command extracts stored credentials from the SAM database on a compromised system?

  1. net user /domain
  2. mimikatz sekurlsa::logonpasswords Correct answer.
  3. ipconfig /all
  4. systeminfo

Explanation

Mimikatz's sekurlsa::logonpasswords module extracts credentials from the LSASS process memory, including NTLM hashes, Kerberos tickets, and plaintext passwords. While the SAM database stores local account hashes, mimikatz can also dump these using lsadump::sam. This tool is the de facto standard for credential harvesting during Windows penetration tests.

Question 11Reconnaissance, enumeration and confidence in observations

What is the key advantage of using DNS tunneling for command-and-control communication during a pentest?

  1. DNS traffic is always encrypted end-to-end
  2. DNS queries are rarely blocked by firewalls and can bypass network egress controls Correct answer.
  3. DNS tunneling provides higher bandwidth than HTTPS
  4. DNS traffic cannot be logged by security devices

Explanation

DNS tunneling encodes data within DNS queries and responses, which are rarely blocked by firewalls since DNS (port 53) is essential for network operations. This makes it an effective covert channel for exfiltrating data or maintaining C2 communications in heavily restricted environments where HTTP/HTTPS outbound traffic is proxied or blocked. Tools like dnscat2 and Iodine implement DNS tunneling.

Question 12Reconnaissance, enumeration and confidence in observations

During privilege escalation on a Linux system, you find a SUID binary owned by root. Why is this significant?

  1. SUID binaries always contain vulnerabilities
  2. SUID binaries execute with the file owner's privileges regardless of who runs them Correct answer.
  3. SUID binaries are encrypted and require the root password to run
  4. SUID binaries are immune to buffer overflow attacks

Explanation

The Set User ID (SUID) bit causes a binary to execute with the permissions of the file owner rather than the user who runs it. When a SUID binary is owned by root, any user executing it gains root-level execution context for that program. If the binary has a vulnerability (buffer overflow, path injection, etc.), an attacker can exploit it to gain a root shell.

Question 13Reconnaissance, enumeration and confidence in observations

What is the primary purpose of an SSL/TLS stripping attack?

  1. To break the encryption algorithm used by TLS
  2. To downgrade HTTPS connections to HTTP, allowing the attacker to view plaintext traffic Correct answer.
  3. To inject malicious certificates into the target's trust store
  4. To exploit vulnerabilities in the TLS handshake protocol

Explanation

SSL stripping is a MitM attack where the attacker intercepts the victim's HTTP requests and proxies them to the server over HTTPS, while serving the victim unencrypted HTTP responses. The victim believes they have a normal connection while the attacker can read and modify all traffic in plaintext. HSTS (HTTP Strict Transport Security) was designed to mitigate this attack.

Question 14Reconnaissance, enumeration and confidence in observations

During a penetration test, you need to tunnel your traffic through a compromised SSH server to reach an internal network. Which SSH option creates a SOCKS proxy?

  1. ssh -L localport:remotehost:remoteport
  2. ssh -D localport user@server Correct answer.
  3. ssh -R remoteport:localhost:localport
  4. ssh -X user@server

Explanation

The ssh -D option creates a dynamic port forward that acts as a SOCKS proxy on the specified local port. All traffic sent through this SOCKS proxy is tunneled through the SSH connection and exits at the remote server. This is extremely useful for pivoting, as you can configure tools like proxychains to route all traffic through the SOCKS proxy to access internal networks.

Question 15Reconnaissance, enumeration and confidence in observations

Which Python library is most commonly used for crafting and sending custom network packets during a penetration test?

  1. Requests
  2. Scapy Correct answer.
  3. Beautiful Soup
  4. Paramiko

Explanation

Scapy is a powerful Python library for crafting, sending, receiving, and analyzing network packets at any layer of the protocol stack. It supports creating custom packets for any protocol, making it ideal for network penetration testing, fuzzing, protocol analysis, and developing custom exploitation tools. Scapy can construct packets from raw bytes or high-level protocol constructors.

Question 16Reconnaissance, enumeration and confidence in observations

Which technique allows an attacker to bypass two-factor authentication that uses SMS-based one-time passwords?

  1. Brute-forcing the TOTP seed value
  2. SIM swapping to receive the victim's SMS messages on an attacker-controlled phone Correct answer.
  3. Replaying a previously intercepted HOTP code
  4. Modifying the authentication server's time synchronization

Explanation

SIM swapping involves convincing a mobile carrier to transfer the victim's phone number to a SIM card controlled by the attacker. Once successful, all SMS messages, including OTP codes, are delivered to the attacker's device. This attack exploits the carrier's identity verification process rather than any cryptographic weakness, which is why SMS-based 2FA is considered less secure than app-based TOTP or hardware tokens.

Question 17Reconnaissance, enumeration and confidence in observations

Which network protocol analyzer feature is most useful for extracting credentials from captured traffic during a penetration test?

  1. Packet colorization rules
  2. Follow TCP stream and protocol dissectors for HTTP, FTP, SMTP, and other cleartext protocols Correct answer.
  3. Packet length histograms
  4. Capture file compression

Explanation

Wireshark's 'Follow TCP Stream' feature reconstructs the full conversation between endpoints, making it easy to identify cleartext credentials in protocols like HTTP Basic/Form authentication, FTP, Telnet, SMTP, and POP3. Protocol dissectors automatically parse and label authentication fields, allowing penetration testers to quickly identify credential exposure in captured traffic.

Question 18Reconnaissance, enumeration and confidence in observations

Which privilege escalation technique on Windows exploits misconfigured service permissions where a low-privilege user can modify the service binary path?

  1. DLL hijacking
  2. Unquoted service path exploitation
  3. Service binary path manipulation Correct answer.
  4. Token impersonation

Explanation

When a Windows service's binary path is writable by a low-privilege user, the attacker can replace the binary with a malicious executable or modify the service configuration to point to their payload. When the service restarts (or the system reboots), the malicious binary executes with the service account's privileges, typically SYSTEM. Tools like accesschk.exe and PowerUp.ps1 identify misconfigured service permissions.

Question 19Reconnaissance, enumeration and confidence in observations

What is the primary purpose of using chisel during a penetration test?

  1. Password cracking
  2. Creating TCP tunnels and SOCKS proxies through HTTP for pivoting through firewalls Correct answer.
  3. Vulnerability scanning
  4. Wireless packet capture

Explanation

Chisel is a fast TCP/UDP tunnel tool that creates encrypted connections over HTTP, making it ideal for pivoting through firewalls and proxies. It supports both forward and reverse port forwarding, as well as SOCKS5 proxy mode. Because it tunnels through HTTP, it can traverse environments where only web traffic is allowed, making it a valuable tool for reaching segmented internal networks.

Question 20Reconnaissance, enumeration and confidence in observations

Which EternalBlue-related CVE targets SMBv1 and was used by WannaCry ransomware?

  1. CVE-2014-0160 (Heartbleed)
  2. CVE-2017-0144 (EternalBlue) Correct answer.
  3. CVE-2014-6271 (Shellshock)
  4. CVE-2021-44228 (Log4Shell)

Explanation

CVE-2017-0144, known as EternalBlue, is a critical vulnerability in Microsoft's SMBv1 protocol implementation. It allows remote code execution by sending specially crafted packets to the SMB service on port 445. Originally developed as an NSA exploit and leaked by the Shadow Brokers, it was weaponized by WannaCry and NotPetya ransomware. Penetration testers use this to demonstrate the risk of running unpatched SMBv1.

Question 21Reconnaissance, enumeration and confidence in observations

What is the purpose of using ProxyChains during a penetration test?

  1. To encrypt all network traffic with TLS
  2. To route TCP connections through one or more proxy servers for anonymity and pivoting Correct answer.
  3. To capture and analyze network packets
  4. To scan for open proxy servers on the internet

Explanation

ProxyChains forces TCP connections from any application through one or more SOCKS4/SOCKS5 or HTTP proxies. In penetration testing, it is commonly used with SSH SOCKS proxies for pivoting through compromised hosts to reach internal networks. It can chain multiple proxies for multi-hop pivoting and supports dynamic chain mode for resilience if one proxy in the chain fails.

Question 22Reconnaissance, enumeration and confidence in observations

What is the purpose of the Responder tool in Windows network penetration testing?

  1. To perform port scanning on Windows hosts
  2. To poison LLMNR, NBT-NS, and MDNS responses to capture NTLMv2 hashes Correct answer.
  3. To crack captured password hashes
  4. To exploit SMB vulnerabilities for remote code execution

Explanation

Responder listens for and responds to LLMNR (Link-Local Multicast Name Resolution), NBT-NS (NetBIOS Name Service), and MDNS (Multicast DNS) broadcast queries on the local network. When a Windows machine fails to resolve a hostname via DNS, it falls back to these protocols. Responder answers these queries, directing the victim to the attacker's machine and capturing NTLMv2 authentication hashes that can be cracked offline or relayed.

Question 23Reconnaissance, enumeration and confidence in observations

Which PowerShell execution policy bypass technique is commonly used during a penetration test to run unsigned scripts?

  1. Modifying the Windows Registry to disable execution policy globally
  2. Using -ExecutionPolicy Bypass flag when launching PowerShell Correct answer.
  3. Reinstalling PowerShell with execution policy disabled
  4. Converting scripts to .bat files

Explanation

The -ExecutionPolicy Bypass flag tells PowerShell to ignore the execution policy for the current session without requiring administrative privileges or registry modifications. This is the most common technique because it is simple, does not persist, and does not require elevated privileges. Other bypass techniques include piping scripts through stdin, using Invoke-Expression with downloaded content, or encoding commands with -EncodedCommand.

Question 24Reconnaissance, enumeration and confidence in observations

What is the PrintNightmare vulnerability (CVE-2021-34527) and why is it significant in penetration testing?

  1. A vulnerability in PDF rendering that allows XSS attacks
  2. A Windows Print Spooler vulnerability that allows remote code execution with SYSTEM privileges Correct answer.
  3. A printer firmware vulnerability that enables network-based attacks
  4. A vulnerability in print management software allowing denial of service

Explanation

PrintNightmare (CVE-2021-34527) is a critical vulnerability in the Windows Print Spooler service that allows authenticated users to execute arbitrary code with SYSTEM privileges remotely. It exploits the ability to install printer drivers, which run with elevated privileges. Because the Print Spooler service runs on virtually all Windows systems by default, this vulnerability provides a reliable privilege escalation and lateral movement vector.

Question 25Reconnaissance, enumeration and confidence in observations

Which command-line tool is used to enumerate Windows domain information including users, groups, and shares from a Linux attack box?

  1. Nmap
  2. enum4linux or CrackMapExec Correct answer.
  3. tcpdump
  4. arp-scan

Explanation

Enum4linux and CrackMapExec are tools that enumerate Windows/Active Directory information from Linux. Enum4linux wraps smbclient and rpcclient to extract users, groups, shares, and policies. CrackMapExec (now NetExec) is a Swiss army knife for Windows network pentesting that supports SMB, WMI, WinRM, LDAP, and MSSQL, enabling credential validation, share enumeration, command execution, and more.

Question 26Reconnaissance, enumeration and confidence in observations

Which type of scan does Nmap use by default when run without root/sudo privileges?

  1. SYN scan (-sS)
  2. TCP connect scan (-sT) Correct answer.
  3. UDP scan (-sU)
  4. ACK scan (-sA)

Explanation

When Nmap is run without root/sudo privileges, it defaults to a TCP connect scan (-sT) because SYN scans require raw socket access, which is restricted to privileged users. A TCP connect scan completes the full three-way handshake using the operating system's connect() system call. While more detectable than a SYN scan, it does not require elevated privileges and works reliably across all platforms.

Question 27Reconnaissance, enumeration and confidence in observations

Which Windows utility allows a penetration tester to execute commands on a remote system using named pipes over SMB?

  1. netstat
  2. PsExec Correct answer.
  3. tracert
  4. certutil

Explanation

PsExec from Sysinternals uses SMB named pipes to execute commands on remote Windows systems. It copies a service binary to the target's ADMIN$ share, installs and starts a service, and communicates over named pipes for I/O redirection. This technique is widely used for lateral movement in penetration tests. Its behavior is emulated by tools like Impacket's psexec.py and CrackMapExec.

Question 28Reconnaissance, enumeration and confidence in observations

Which technique allows Windows credential theft without touching LSASS, making it harder to detect by EDR solutions?

  1. Using mimikatz sekurlsa module
  2. Extracting credentials from the DPAPI master key blobs or SAM/SYSTEM registry hive backup Correct answer.
  3. Dumping lsass.exe process memory with Task Manager
  4. Using procdump on lsass.exe

Explanation

Modern EDR solutions heavily monitor LSASS process access. Alternative credential theft techniques include: extracting DPAPI master key blobs to decrypt saved credentials, copying SAM and SYSTEM registry hives (reg save) for offline hash extraction, harvesting credentials from the Credential Manager vault, or reading cached credentials from registry. These approaches avoid direct LSASS interaction that triggers EDR alerts.

Question 29Reconnaissance, enumeration and confidence in observations

Which Linux privilege escalation technique exploits writable cron jobs or cron directories?

  1. Kernel exploit
  2. Modifying scripts executed by root-owned cron jobs to inject malicious commands Correct answer.
  3. PATH variable manipulation
  4. Sudo misconfiguration exploitation

Explanation

If a cron job runs a script with root privileges and that script is writable by a lower-privileged user, the attacker can modify the script to include malicious commands (like a reverse shell). The next time cron executes the job, it runs the modified script with root privileges. Similarly, if /etc/cron.d or similar directories are writable, the attacker can add their own cron entries to execute as root.

Question 30Authorized identity-path analysis and Windows domain boundaries

What is the primary purpose of a Golden Ticket attack in Active Directory?

  1. To crack user passwords using rainbow tables
  2. To forge Kerberos TGTs that grant unrestricted access to any service in the domain Correct answer.
  3. To modify Group Policy Objects for persistence
  4. To enumerate all user accounts in the directory

Explanation

A Golden Ticket attack forges a Kerberos Ticket Granting Ticket (TGT) using the KRBTGT account's password hash. Since the domain controller trusts any TGT encrypted with the KRBTGT hash, the forged ticket grants the attacker unrestricted access to any resource in the domain for the ticket's lifetime. This is one of the most powerful post-exploitation techniques in Active Directory environments.

Question 31Authorized identity-path analysis and Windows domain boundaries

What is Kerberoasting, and what does it target in Active Directory?

  1. Brute-forcing domain administrator passwords via LDAP
  2. Requesting TGS tickets for service accounts and cracking them offline to recover plaintext passwords Correct answer.
  3. Exploiting Kerberos delegation to impersonate users
  4. Injecting forged Kerberos tickets to gain domain admin access

Explanation

Kerberoasting targets service accounts with Service Principal Names (SPNs) in Active Directory. Any authenticated domain user can request TGS tickets for these services, which are encrypted with the service account's password hash. The attacker extracts these tickets and cracks them offline using tools like Hashcat or John the Ripper. Service accounts with weak passwords are particularly vulnerable to this attack.

Question 32Authorized identity-path analysis and Windows domain boundaries

In an Active Directory environment, what is the DCSync attack and what privilege is required to perform it?

  1. Exploiting DNS to redirect domain controller traffic; requires DNS admin
  2. Impersonating a domain controller to request password replication data; requires Replicating Directory Changes privileges Correct answer.
  3. Injecting commands into AD Group Policy; requires Group Policy creator rights
  4. Modifying LDAP entries directly; requires Schema Admin membership

Explanation

DCSync uses the Directory Replication Service (DRS) protocol to request password data from a domain controller, mimicking the behavior of a legitimate replication partner. An attacker with Replicating Directory Changes and Replicating Directory Changes All permissions (typically Domain Admins) can use tools like mimikatz to extract any account's password hash, including KRBTGT. This avoids the need to run code directly on a domain controller.

Question 33Authorized identity-path analysis and Windows domain boundaries

What is the AS-REP Roasting attack in Active Directory, and which accounts are vulnerable?

  1. Attacking accounts with Kerberos delegation enabled
  2. Requesting AS-REP responses for accounts with Kerberos pre-authentication disabled and cracking them offline Correct answer.
  3. Exploiting expired Kerberos tickets for session hijacking
  4. Brute-forcing the KDC master key

Explanation

AS-REP Roasting targets Active Directory accounts that have Kerberos pre-authentication disabled. When pre-auth is disabled, anyone can request an AS-REP message for that account, which contains data encrypted with the user's password hash. The attacker can then crack this data offline using tools like Hashcat. Unlike Kerberoasting, AS-REP Roasting does not require any domain authentication to initiate.

Question 34Authorized identity-path analysis and Windows domain boundaries

What is the Silver Ticket attack in Active Directory, and how does it differ from a Golden Ticket?

  1. Silver Ticket forges a TGS for a specific service using the service account hash; Golden Ticket forges a TGT using the KRBTGT hash Correct answer.
  2. Silver Ticket requires domain admin; Golden Ticket does not
  3. Silver Ticket works across domains; Golden Ticket is limited to one domain
  4. Silver Ticket is more detectable; Golden Ticket is completely invisible

Explanation

A Silver Ticket attack forges a Kerberos Ticket Granting Service (TGS) ticket for a specific service using that service account's NTLM hash. Unlike a Golden Ticket (which forges a TGT using the KRBTGT hash and grants access to everything), a Silver Ticket only grants access to the targeted service. However, Silver Tickets never communicate with the domain controller, making them harder to detect through KDC logs.

Question 35Authorized identity-path analysis and Windows domain boundaries

What is the purpose of the Constrained Delegation attack in Active Directory?

  1. To limit which users can delegate authentication to services
  2. To abuse services configured for constrained delegation to impersonate any user to the delegated service Correct answer.
  3. To constrain the number of authentication attempts before lockout
  4. To delegate DNS zone transfers between domain controllers

Explanation

Constrained Delegation allows a service to impersonate users when accessing specific backend services. An attacker who compromises an account with constrained delegation rights can use the S4U2Self and S4U2Proxy Kerberos extensions to request service tickets impersonating any user (including domain admins) to the delegated services. This enables privilege escalation and lateral movement through Kerberos delegation abuse.

Question 36Web application and data-protection foundations

A supplied authorized web test confirms that untrusted reflected input reaches an executable browser context and runs as script under the page’s origin. Which listed vulnerability best describes that demonstrated behavior?

  1. SQL injection
  2. Cross-Site Scripting (XSS) Correct answer.
  3. Server-Side Request Forgery (SSRF)
  4. Insecure Direct Object Reference (IDOR)

Explanation

The supplied executable browser-context behavior supports XSS, rather than reflection alone being sufficient proof. Correct output handling depends on context, and actual impact follows session, browser and application conditions. No request or payload is executed by this written recognition question.

Question 37Web application and data-protection foundations

Which OWASP Top 10 category addresses flaws where an application fails to properly restrict users from accessing other users' data?

  1. A01: Broken Access Control Correct answer.
  2. A02: Cryptographic Failures
  3. A03: Injection
  4. A05: Security Misconfiguration

Explanation

Broken Access Control (A01) covers vulnerabilities where an application does not properly enforce restrictions on what authenticated users are allowed to do. This includes accessing other users' accounts, viewing sensitive data, or modifying access rights. It has been the number one category in the OWASP Top 10 since 2021, reflecting its widespread prevalence.

Question 38Web application and data-protection foundations

Which SQL injection payload would you use to determine the number of columns in a SELECT statement?

  1. ' OR 1=1--
  2. ' UNION SELECT NULL,NULL,NULL-- Correct answer.
  3. '; DROP TABLE users--
  4. ' AND SLEEP(5)--

Explanation

The UNION SELECT NULL technique is used to enumerate the number of columns in the original query. By incrementally adding NULL values (UNION SELECT NULL, then UNION SELECT NULL,NULL, etc.), the tester determines when the query succeeds, indicating the correct column count. This step is essential before extracting data via UNION-based SQL injection.

Question 39Web application and data-protection foundations

Which tool is specifically designed for automated discovery and exploitation of SQL injection vulnerabilities?

  1. Burp Suite
  2. SQLMap Correct answer.
  3. Nikto
  4. Dirb

Explanation

SQLMap is an open-source tool that automates the detection and exploitation of SQL injection flaws. It supports multiple database backends (MySQL, PostgreSQL, Oracle, MSSQL, SQLite), various injection techniques (UNION, boolean-blind, time-blind, error-based, stacked queries), and can extract databases, tables, columns, and data. It also supports OS command execution and file system access through SQL injection.

Question 40Web application and data-protection foundations

You discover a Server-Side Request Forgery (SSRF) vulnerability in a web application. What is the most impactful attack you can perform in a cloud environment?

  1. Redirect users to a phishing page
  2. Access the cloud instance metadata service to retrieve IAM credentials Correct answer.
  3. Perform a denial-of-service attack against the web server
  4. Enumerate subdomains of the target organization

Explanation

In cloud environments like AWS, GCP, and Azure, SSRF vulnerabilities can be leveraged to access the instance metadata service (e.g., http://169.254.169.254). This service often contains temporary IAM credentials, API keys, and configuration data. Retrieving these credentials can grant the attacker access to cloud resources such as S3 buckets, databases, and other services beyond the web application.

Question 41Web application and data-protection foundations

During a web application test, you discover that the application deserializes user-supplied data without validation. What vulnerability class does this represent?

  1. Cross-Site Request Forgery
  2. Insecure deserialization Correct answer.
  3. XML External Entity injection
  4. HTTP request smuggling

Explanation

Insecure deserialization occurs when an application deserializes untrusted data without proper validation, potentially allowing an attacker to manipulate serialized objects to achieve remote code execution, privilege escalation, or injection attacks. This vulnerability is particularly dangerous in Java, PHP, and Python applications where serialized objects can contain executable code or references to system commands.

Question 42Web application and data-protection foundations

Which tool is best suited for intercepting and modifying HTTP/HTTPS traffic between a browser and a web application during a penetration test?

  1. Wireshark
  2. Burp Suite Proxy Correct answer.
  3. Nmap
  4. Netcat

Explanation

Burp Suite's proxy intercepts HTTP and HTTPS requests between the browser and the target web application, allowing the tester to view, modify, and replay requests. It supports SSL/TLS interception through its CA certificate, request modification, automated scanning, and has an extensive extension ecosystem. It is the industry-standard tool for web application penetration testing.

Question 43Web application and data-protection foundations

Which technique allows a penetration tester to extract data from a database through a SQL injection when no error messages or data are displayed on the page?

  1. UNION-based injection
  2. Error-based injection
  3. Blind boolean-based injection Correct answer.
  4. Stacked queries

Explanation

Blind boolean-based SQL injection extracts data by asking the database true/false questions and observing the application's response. The tester crafts conditions like 'AND SUBSTRING(username,1,1)='a'' and observes whether the page renders differently for true vs. false conditions. This technique works even when no database errors or query results are displayed on the page, though it is slower than UNION-based methods.

Question 44Web application and data-protection foundations

During a web application test, you identify a JWT token using the 'none' algorithm. What is the security implication?

  1. The token is encrypted and cannot be modified
  2. The token has no signature verification, allowing an attacker to forge tokens with arbitrary claims Correct answer.
  3. The token expires immediately and cannot be reused
  4. The token is bound to a specific IP address

Explanation

When a JWT uses the 'none' algorithm (alg: none), it means the token has no signature protection. An attacker can modify the token's payload (changing roles, user IDs, or permissions) and the application will accept it without verification. This is a critical vulnerability that allows complete authentication and authorization bypass. Applications should always reject tokens with the 'none' algorithm.

Question 45Web application and data-protection foundations

When testing a REST API, you discover that changing the user ID in the URL from /api/users/123 to /api/users/124 returns another user's data. What vulnerability is this?

  1. SQL injection
  2. Insecure Direct Object Reference (IDOR) Correct answer.
  3. Cross-Site Request Forgery
  4. XML External Entity injection

Explanation

Insecure Direct Object Reference (IDOR) occurs when an application exposes internal implementation objects (like database IDs) in URLs or parameters and fails to verify that the authenticated user is authorized to access the referenced object. This is a form of broken access control where authorization checks are missing or insufficient, allowing horizontal privilege escalation between users.

Question 46Web application and data-protection foundations

Which OWASP testing methodology phase involves mapping the application's functionality and identifying entry points?

  1. Vulnerability scanning
  2. Information gathering and reconnaissance Correct answer.
  3. Exploitation
  4. Reporting

Explanation

The information gathering and reconnaissance phase of the OWASP testing methodology involves mapping all application functionality, identifying entry points (forms, APIs, parameters), understanding the technology stack, and documenting the application's attack surface. This phase is critical because thorough reconnaissance ensures no testable functionality is overlooked during the subsequent vulnerability assessment and exploitation phases.

Question 47Web application and data-protection foundations

Which web vulnerability allows an attacker to force a logged-in user's browser to send an unwanted request to a web application?

  1. Cross-Site Scripting (XSS)
  2. Cross-Site Request Forgery (CSRF) Correct answer.
  3. Server-Side Request Forgery (SSRF)
  4. HTTP Response Splitting

Explanation

Cross-Site Request Forgery (CSRF) tricks a user's browser into making requests to a web application where the user is authenticated, using the user's existing session cookies. The attacker crafts a malicious page that automatically submits a form or triggers an API call to the target application. CSRF tokens and SameSite cookie attributes are the primary defenses against this attack.

Question 48Web application and data-protection foundations

During a web application penetration test, you discover that the application includes user-controlled XML input. Which attack should you attempt first?

  1. SQL injection
  2. XML External Entity (XXE) injection Correct answer.
  3. Cross-Site Scripting
  4. Directory traversal

Explanation

XML External Entity (XXE) injection exploits XML parsers that process external entity declarations in user-supplied XML input. A successful XXE attack can read local files on the server, perform server-side request forgery (SSRF), enumerate internal network services, and potentially achieve remote code execution. This vulnerability is particularly dangerous because it often provides direct file system access on the server.

Question 49Web application and data-protection foundations

Which web application vulnerability allows an attacker to include files from the web server's local filesystem in the application's output?

  1. Remote File Inclusion (RFI)
  2. Local File Inclusion (LFI) Correct answer.
  3. Cross-Site Scripting (XSS)
  4. Command injection

Explanation

Local File Inclusion (LFI) occurs when a web application includes files from the local filesystem based on user-controlled input without proper validation. Attackers can use path traversal sequences (../../etc/passwd) to read sensitive files like configuration files, password databases, and application source code. In some cases, LFI can be escalated to remote code execution through log poisoning or PHP filter chains.

Question 50Web application and data-protection foundations

Which type of XSS attack stores the malicious payload on the target server and executes when any user views the affected page?

  1. Reflected XSS
  2. Stored (Persistent) XSS Correct answer.
  3. DOM-based XSS
  4. Self-XSS

Explanation

Stored (Persistent) XSS occurs when the malicious script is permanently saved on the target server, typically in a database, forum post, comment field, or user profile. Every user who views the affected page executes the payload, making stored XSS more dangerous than reflected XSS. It does not require social engineering to deliver the payload since victims simply need to visit the compromised page.