I85PREP
⌘ K
HTB CPTS study materials
HTB CPTS study resources

HTB CPTS practice questions

One question at a time. Build your HTB CPTS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Penetration Testing Process and Methodologies

During a penetration test, which phase immediately follows the completion of active information gathering and precedes vulnerability assessment?

  1. Threat modeling and attack path planning Correct answer.
  2. Reporting and remediation verification
  3. Post-exploitation and data exfiltration
  4. Service exploitation and privilege escalation

Explanation

After information gathering, a tester correlates discovered assets, services, and versions to identify likely weaknesses and plan attack paths before attempting exploitation. This planning stage bridges reconnaissance and vulnerability assessment by prioritizing targets. Exploitation, post-exploitation, and reporting all occur later in the methodology.

Question 2Penetration Testing Process and Methodologies

A tester is scoping an engagement and the client provides only a domain name with no IP ranges or credentials. Which testing approach best matches this starting condition?

  1. White-box source code review
  2. Assumed-breach simulation with valid credentials
  3. Black-box external assessment Correct answer.
  4. Grey-box internal assessment

Explanation

When only a public identifier such as a domain is provided, the tester has no internal knowledge or access, which defines a black-box external assessment. White-box and grey-box approaches require insider information or credentials. An assumed-breach simulation presumes valid access the client has not supplied.

Question 3Penetration Testing Process and Methodologies

Which document formally defines the targets, time window, permitted techniques, and legal boundaries of a penetration test before testing begins?

  1. Rules of engagement Correct answer.
  2. Vulnerability disclosure policy
  3. Penetration test report
  4. Incident response runbook

Explanation

The rules of engagement (RoE) is the agreement that specifies scope, timing, allowed techniques, and legal constraints prior to testing. It protects both tester and client by establishing authorization boundaries. The report, disclosure policy, and IR runbook serve different purposes after or outside testing.

Question 4Penetration Testing Process and Methodologies

Which activity is part of passive information gathering rather than active reconnaissance?

  1. Querying public certificate transparency logs for subdomains Correct answer.
  2. Running a TCP connect scan against discovered hosts
  3. Sending crafted requests to enumerate virtual hosts
  4. Performing a DNS zone transfer against the target's nameserver

Explanation

Passive gathering relies on third-party or public data sources and never directly touches the target's infrastructure, as with certificate transparency logs. Zone transfers, port scans, and vhost enumeration all send traffic directly to target systems, making them active.

Question 5Penetration Testing Process and Methodologies

In the penetration testing lifecycle, what is the primary purpose of the reporting phase?

  1. Communicating findings, risk, and remediation guidance to stakeholders Correct answer.
  2. Confirming that all in-scope hosts have been enumerated
  3. Selecting which exploitation tools will be used
  4. Establishing legal authorization before testing starts

Explanation

Reporting translates technical findings into business-relevant risk with evidence and remediation advice so stakeholders can act. It is the final communication deliverable of the engagement. Enumeration, authorization, and tool selection belong to earlier phases.

Question 6Penetration Testing Process and Methodologies

A tester discovers a critical remote code execution flaw but the rules of engagement prohibit exploiting production systems. What is the most appropriate action?

  1. Document the finding with evidence and defer exploitation per the agreed constraints Correct answer.
  2. Ignore the finding because exploitation is prohibited
  3. Exploit the flaw to prove impact and document it afterward
  4. Escalate by exploiting a lower-severity issue instead

Explanation

The rules of engagement define hard boundaries, so the tester must respect them and report the finding with whatever non-destructive evidence is permitted. Exploiting against the agreement exposes the tester and client to legal and operational risk. Findings are still valuable without exploitation.

Question 7Penetration Testing Process and Methodologies

During enumeration, a tester identifies an internal wiki reachable only from a compromised host. Which methodology concept does this best illustrate?

  1. Pivoting to expand reachable attack surface Correct answer.
  2. Passive OSINT collection
  3. Scope reduction
  4. Regression testing

Explanation

Pivoting uses a compromised host as a foothold to reach network segments not directly accessible to the tester, expanding the assessable attack surface. Passive OSINT uses public data and does not involve internal hosts. Scope reduction and regression testing are unrelated to reaching new segments.

Question 8Penetration Testing Process and Methodologies

A client asks the tester to prioritize findings by business impact rather than raw CVSS score. Which practice best supports this request?

  1. Reporting only vulnerabilities with public exploits
  2. Mapping each finding to the affected business asset and its criticality Correct answer.
  3. Sorting findings strictly by CVSS base score
  4. Excluding low-CVSS findings from the report entirely

Explanation

Business-impact prioritization requires contextualizing technical findings against the value and role of the affected assets. CVSS base scores alone ignore asset criticality and exposure. Excluding findings or filtering by exploit availability does not reflect business context.

Question 9Penetration Testing Process and Methodologies

Which element is essential for a penetration test finding to be considered reproducible by the client's remediation team?

  1. Clear steps, affected hosts, and evidence demonstrating the issue Correct answer.
  2. A list of every tool installed on the tester's machine
  3. The tester's personal opinion of severity
  4. The total duration of the engagement

Explanation

Reproducibility requires enough detail for another party to confirm the issue: affected assets, exact steps, and supporting evidence. Tool inventories, personal opinions, and engagement duration do not enable reproduction. Well-structured findings let remediation teams verify and fix issues independently.

Question 10Penetration Testing Process and Methodologies

A tester plans to test a third-party SaaS provider used by the client but not named in the scope. What is the correct course of action?

  1. Assume the provider's terms permit testing
  2. Proceed because the client uses the service
  3. Test only the login page to stay within scope
  4. Obtain explicit written authorization from the provider before testing Correct answer.

Explanation

Third parties are separate legal entities, so testing them requires their own explicit authorization regardless of the client's use. Client consent does not extend to a provider's infrastructure. Proceeding without authorization risks legal exposure and violates professional ethics.

Question 11Penetration Testing Process and Methodologies

Which sequence correctly orders the core phases of a typical penetration test?

  1. Scoping, information gathering, vulnerability assessment, exploitation, post-exploitation, reporting Correct answer.
  2. Scoping, exploitation, information gathering, post-exploitation, vulnerability assessment, reporting
  3. Information gathering, scoping, exploitation, reporting, vulnerability assessment, post-exploitation
  4. Vulnerability assessment, scoping, information gathering, exploitation, reporting, post-exploitation

Explanation

A standard methodology begins with scoping and authorization, then gathers information, assesses vulnerabilities, exploits confirmed weaknesses, performs post-exploitation, and finally reports. Each phase builds on the previous one. The other sequences place exploitation or reporting before the groundwork that informs them.

Question 12Penetration Testing Process and Methodologies

During post-exploitation, a tester finds credentials that grant domain administrator access. Which action best aligns with responsible methodology?

  1. Document the impact and limit further use to what the scope permits Correct answer.
  2. Delete the credentials to avoid temptation
  3. Immediately use the access to modify domain policies
  4. Exfiltrate all sensitive data to demonstrate maximum impact

Explanation

Responsible post-exploitation demonstrates impact while staying within agreed limits and avoiding unnecessary damage or data loss. Modifying policies or exfiltrating data can cause real harm and exceed authorization. Documenting the privilege escalation path is sufficient to prove impact.

Question 13Penetration Testing Process and Methodologies

A tester wants to reduce false positives before reporting a suspected SQL injection. Which approach best reflects sound methodology?

  1. Suppress the finding because scanners are unreliable
  2. Escalate severity without verification to ensure attention
  3. Manually verify the finding and capture reproducible evidence of the behavior Correct answer.
  4. Report it immediately based on the scanner's high confidence rating

Explanation

Sound methodology requires manual validation of automated findings to eliminate false positives and produce reliable evidence. Scanner confidence ratings are heuristics and can be wrong. Suppressing valid findings or inflating severity without verification undermines report credibility.

Question 14Penetration Testing Process and Methodologies

A tester must decide whether a discovered default credential on an internal admin panel constitutes a reportable finding given the client's low-risk tolerance policy. Which reasoning is most defensible?

  1. Wait for the next engagement to assess it
  2. Report it as high risk because default credentials enable unauthorized administrative access Correct answer.
  3. Dismiss it because the panel is internal-only
  4. Report it as informational because no exploit was run

Explanation

Default administrative credentials grant direct unauthorized access to a sensitive function, which is a significant risk regardless of network location, especially under a low-risk-tolerance policy. Internal-only placement does not neutralize the exposure. Deferring or downgrading without justification misrepresents risk.

Question 15Penetration Testing Process and Methodologies

An engagement requires testing a web application and its supporting API. Which scoping detail most directly prevents accidental out-of-scope testing?

  1. Listing the tester's preferred toolset
  2. Enumerating explicitly in-scope hosts, endpoints, and excluded third-party services Correct answer.
  3. Recording the client's organizational chart
  4. Specifying the report template format

Explanation

Precise scope definitions listing in-scope assets and explicit exclusions prevent testers from touching systems outside authorization. Tool preferences, report formats, and org charts do not define technical boundaries. Clear scope mapping is foundational to safe testing.

Question 16Penetration Testing Process and Methodologies

Which statement best describes the relationship between vulnerability assessment and exploitation in a penetration test?

  1. Assessment identifies and validates candidate weaknesses, while exploitation confirms real impact Correct answer.
  2. Exploitation always precedes vulnerability assessment
  3. Exploitation replaces assessment because scanners are unnecessary
  4. Assessment and exploitation are identical activities

Explanation

Vulnerability assessment identifies and validates potential weaknesses, and exploitation demonstrates whether those weaknesses yield real impact. They are complementary phases, not substitutes. Exploitation logically follows assessment rather than preceding it.

Question 17Reconnaissance, Enumeration, and OSINT

During an external assessment you find a TLS certificate on a company's mail gateway whose Subject Alternative Name lists several internal hostnames. Which passive reconnaissance technique does this best illustrate?

  1. Certificate transparency log and SAN harvesting Correct answer.
  2. TCP SYN scanning of the DMZ
  3. SNMP community string brute forcing
  4. Reverse DNS sweeping of the /24 block

Explanation

Certificates published to Certificate Transparency logs are public and often leak internal or staging hostnames in the Subject Alternative Name extension. Harvesting these names is passive because you query public logs rather than touching the target's infrastructure directly.

Question 18Reconnaissance, Enumeration, and OSINT

Which DNS record type is queried specifically to discover the hosts authorized to send mail for a domain, making it useful for mapping an organization's mail infrastructure?

  1. NS
  2. SOA
  3. TXT
  4. MX Correct answer.

Explanation

MX records list the mail exchangers that accept email for a domain, which directly exposes mail server hostnames and priorities. This helps an assessor map perimeter mail infrastructure during passive DNS enumeration.

Question 19Reconnaissance, Enumeration, and OSINT

You run `dig axfr @ns1.example.com example.com` and receive a full zone listing. What does this indicate about the target's DNS configuration?

  1. The name server allows unrestricted zone transfers to any client. Correct answer.
  2. The name server is configured as a recursive resolver only.
  3. The zone uses wildcard records for all subdomains.
  4. The name server enforces DNSSEC validation strictly.

Explanation

A successful AXFR from an arbitrary client means the primary or secondary name server permits zone transfer requests without restricting them to trusted secondaries. That leaks the entire zone, including internal hostnames and service records.

Question 20Reconnaissance, Enumeration, and OSINT

Which tool is purpose-built for enumerating SMB shares, users, and OS information on a Windows host without requiring credentials?

  1. smbclient
  2. nikto
  3. gobuster
  4. enum4linux Correct answer.

Explanation

enum4linux wraps Samba utilities to gather share listings, user accounts, groups, and OS details from SMB/RPC services, often with null sessions. It is designed specifically for SMB enumeration rather than web or DNS discovery.

Question 21Reconnaissance, Enumeration, and OSINT

An Nmap scan returns port 22 open with the banner `SSH-2.0-OpenSSH_7.4`. What is the most reliable next step to determine supported authentication methods?

  1. Send a crafted TCP RST to fingerprint the kernel
  2. Perform a UDP sweep of the subnet
  3. Query the host's SNMP sysDescr OID
  4. Run `ssh-audit` to list algorithms and then attempt `ssh -o PreferredAuthentications=none user@host` Correct answer.

Explanation

ssh-audit enumerates key exchange, ciphers, and MAC algorithms from the handshake, while a connection with no authentication methods reveals which methods the server offers. Together these give a precise picture of SSH configuration without guessing.

Question 22Reconnaissance, Enumeration, and OSINT

While enumerating a web application you notice the response header `X-Powered-By: Express`. What does this observation most directly provide?

  1. The backend framework in use Correct answer.
  2. The load balancer vendor
  3. The server's TLS certificate chain
  4. The database engine version

Explanation

The X-Powered-By header commonly discloses the application framework, here Express for Node.js. Knowing the framework guides targeted testing of framework-specific routes, defaults, and known issues.

Question 23Reconnaissance, Enumeration, and OSINT

You want to discover virtual hosts served by the same IP address that are not linked from the main site. Which approach is most appropriate?

  1. Run a full TCP port scan of the target IP
  2. Perform a WHOIS lookup on the IP address
  3. Query the PTR record for the IP address
  4. Brute-force common vhost names and compare response bodies and status codes per Host header Correct answer.

Explanation

Virtual host discovery relies on sending requests with different Host header values and comparing responses, since vhosts share an IP and port. Guessing common names reveals sites that are not referenced anywhere in the primary application.

Question 24Reconnaissance, Enumeration, and OSINT

Which OSINT source is most useful for finding employee email addresses and job titles tied to a target organization?

  1. Shodan
  2. Censys
  3. theHarvester
  4. LinkedIn Correct answer.

Explanation

Professional networking sites such as LinkedIn publish employee names, roles, and organizational structure, which support social engineering and username pattern derivation. Tools like theHarvester aggregate such data but the underlying source is the social network itself.

Question 25Reconnaissance, Enumeration, and OSINT

A Google dork `site:example.com filetype:pdf confidential` returns several documents. What is the primary reconnaissance value of this result?

  1. It confirms the web server is vulnerable to SQL injection.
  2. It identifies the target's TLS cipher suite.
  3. It reveals indexed documents that may contain sensitive internal information. Correct answer.
  4. It enumerates the target's DNS zone transfers.

Explanation

Search engine dorks surface content the crawler indexed, including documents that were never meant to be public. Such files often disclose internal naming, credentials, or architecture details useful for later stages.

Question 26Reconnaissance, Enumeration, and OSINT

You are enumerating an FTP service and find it allows anonymous login. Which information is most directly obtainable from this access?

  1. The private SSH keys of other users
  2. The database schema of the backend
  3. The operating system kernel version
  4. The contents of directories the anonymous account can read Correct answer.

Explanation

Anonymous FTP grants access to whatever files and directories the anonymous user is permitted to read, often including public drops or misconfigured backups. It does not inherently expose kernel, database, or other users' private key material.

Question 27Reconnaissance, Enumeration, and OSINT

An Nmap service scan reports `msrpc` on port 135 and `netbios-ssn` on 139. Which enumeration step is most logical next?

  1. Attempt an AXFR against the host
  2. Perform a TLS handshake against port 135
  3. Enumerate RPC endpoints and SMB shares to map users and services Correct answer.
  4. Run a UDP SNMP walk of the host

Explanation

Ports 135 and 139 indicate Windows RPC and SMB services, which can be queried for endpoint mappings, shares, and user information. RPC endpoint enumeration and SMB share listing directly build on those open services.

Question 28Reconnaissance, Enumeration, and OSINT

Which technique best helps identify a web application's underlying content management system when generator meta tags have been removed?

  1. Send an ICMP timestamp request to the host
  2. Query the domain's MX records
  3. Request known CMS-specific paths and compare their responses to baseline 404 pages Correct answer.
  4. Run a reverse DNS lookup on the IP

Explanation

CMS fingerprinting often relies on distinctive paths such as /wp-login.php or /administrator and on how the server responds to them versus a generic 404. Comparing responses reduces false positives from catch-all handlers.

Question 29Reconnaissance, Enumeration, and OSINT

You are performing passive reconnaissance and want to avoid touching the target's infrastructure. Which activity qualifies?

  1. Attempting default credentials on the target's login page
  2. Running a full port scan against the target
  3. Sending crafted packets to the target's web server
  4. Querying a public certificate transparency search engine for the target domain Correct answer.

Explanation

Passive reconnaissance gathers information from third-party or public sources without sending traffic to the target. Searching public certificate transparency data meets that criterion, whereas scanning and login attempts are active interactions.

Question 30Reconnaissance, Enumeration, and OSINT

A WHOIS lookup on a target domain returns a registrar but the registrant fields are redacted. What is the most reasonable conclusion?

  1. The domain has no name servers configured.
  2. The domain is hosted on a private IP address.
  3. The domain is unregistered and available.
  4. Privacy protection or redaction is applied to registrant details. Correct answer.

Explanation

Registrar and registry WHOIS output frequently redacts registrant contact details for privacy or legal reasons. Redaction says nothing about registration status, name servers, or hosting addresses.

Question 31Reconnaissance, Enumeration, and OSINT

During enumeration you discover an LDAP service on port 389 that permits anonymous binds. Which action most directly leverages this finding?

  1. Attempt a DNS zone transfer
  2. Query the directory for user, group, and computer objects Correct answer.
  3. Perform an SNMP walk
  4. Brute-force the local administrator password

Explanation

Anonymous LDAP binds allow unauthenticated queries against the directory, which can reveal users, groups, computers, and sometimes descriptive attributes. This information supports password spraying and privilege mapping.

Question 32Reconnaissance, Enumeration, and OSINT

Which Nmap option combination best performs service and version detection with default scripts against discovered open ports?

  1. -sS -O
  2. -sU -p-
  3. -sn -Pn
  4. -sV -sC Correct answer.

Explanation

The -sV flag enables version detection and -sC runs the default NSE script set, both useful for enumeration. Combining them yields banners and script output that guide follow-up testing.

Question 33Reconnaissance, Enumeration, and OSINT

An SNMP service responds to the community string `public`. Which OID area is most useful for gathering system identification details?

  1. The ARP cache table
  2. The TCP connection table under 1.3.6.1.2.1.6
  3. The ICMP statistics group
  4. The MIB-II system group under 1.3.6.1.2.1.1 Correct answer.

Explanation

The MIB-II system group exposes sysDescr, sysName, sysContact, and sysLocation, which identify the device and its role. This is the standard starting point for SNMP enumeration with a valid community string.

Question 34Reconnaissance, Enumeration, and OSINT

You observe that a target's web server returns a 200 status with a generic page for every nonexistent path. What does this most affect in your enumeration methodology?

  1. The validity of the TLS certificate
  2. The accuracy of WHOIS data
  3. The ability to resolve DNS records
  4. The reliability of content discovery results Correct answer.

Explanation

A catch-all handler that returns 200 for missing paths causes content discovery tools to report false positives. You must compare response sizes, hashes, or bodies against the baseline to filter real resources.

Question 35Reconnaissance, Enumeration, and OSINT

A Censys or Shodan search for `ssl.cert.subject.cn:"example.com"` is most useful for which reconnaissance goal?

  1. Extracting password hashes from a directory service
  2. Transferring a DNS zone from an authoritative server
  3. Enumerating local user accounts on a domain controller
  4. Finding internet-facing hosts presenting certificates for a domain Correct answer.

Explanation

Internet-wide scan databases index certificate subjects, so querying for a domain's certificate reveals hosts that present it. This uncovers exposed services and subdomains that may not be discoverable through DNS alone.

Question 36Reconnaissance, Enumeration, and OSINT

During OSINT work you find that a target's GitHub organization has public repositories. Which finding is most likely to assist later exploitation?

  1. Hardcoded API keys committed in repository history Correct answer.
  2. The organization's office floor plan
  3. The registrar of the target's domain
  4. The target's TLS cipher preferences

Explanation

Public repositories and their commit history often contain secrets such as API keys, tokens, and internal hostnames that were committed and later removed. These secrets can grant access or reveal internal architecture.

Question 37Reconnaissance, Enumeration, and OSINT

Which approach most effectively enumerates subdomains using only passive data sources?

  1. Performing a zone transfer against the root name servers
  2. Running a TCP connect scan against every /16 address
  3. Sending DNS queries for random labels to the authoritative server
  4. Querying certificate transparency logs and passive DNS databases for the domain Correct answer.

Explanation

Certificate transparency logs and passive DNS datasets record names previously observed for a domain, so querying them reveals subdomains without probing the target. Active guessing and scanning send traffic to the target and are not passive.

Question 38Reconnaissance, Enumeration, and OSINT

An assessment requires mapping a target's external attack surface with minimal noise. Which combination best fits that requirement?

  1. Passive DNS, certificate transparency, and internet scan database queries Correct answer.
  2. Full-port SYN scans followed by aggressive NSE script runs
  3. Default credential attempts against every discovered login
  4. UDP sweeps of all private address ranges

Explanation

Passive DNS, certificate transparency, and scan database queries derive information from third-party observations rather than sending traffic to the target. This produces an attack surface map with minimal detectable footprint.

Question 39Reconnaissance, Enumeration, and OSINT

You discover a Git repository exposed at `/.git/` on a web server. What is the most direct way to recover source code from it?

  1. Query the server's DNS TXT records
  2. Perform an SNMP walk of the host
  3. Request the index.php file directly from the web root
  4. Mirror the .git directory and reconstruct the working tree locally Correct answer.

Explanation

An exposed .git directory contains objects and refs that can be mirrored and used to reconstruct the repository contents locally. This can reveal source code, configuration, and secrets not served by the application.

Question 40Reconnaissance, Enumeration, and OSINT

Which HTTP response characteristic most reliably distinguishes a valid virtual host from a default catch-all site?

  1. A response body and certificate that match the requested hostname Correct answer.
  2. A Content-Length header of zero
  3. A 301 redirect to HTTPS
  4. A Server header containing nginx

Explanation

A genuine virtual host typically returns content and a certificate consistent with the requested hostname, whereas a catch-all returns a generic default page. Comparing body content and certificate subject against the requested name is the reliable discriminator.

Question 41Network and Service Exploitation (including Active Directory)

During an internal assessment you capture NTLMv2 challenge-response traffic with Responder. Which attack can you realistically perform against the captured hash without cracking it offline?

  1. Decrypt it with the machine account password
  2. Crack it with a rainbow table of NTLMv2 responses
  3. Replay it to the same server to obtain a session
  4. Relay it to a host that does not enforce SMB signing Correct answer.

Explanation

NTLMv2 responses cannot be replayed to the same server because the challenge is unique per session, but they can be relayed to a different host that accepts NTLM authentication. SMB signing (and LDAP signing/channel binding) blocks relay, so unsigned targets are the viable path. Offline cracking is possible but is not guaranteed and is not what relay means.

Question 42Network and Service Exploitation (including Active Directory)

You have valid domain credentials and want to enumerate Active Directory users, groups, and computers without triggering noisy service authentication. Which approach best fits?

  1. Send SMB null sessions to every workstation
  2. Capture broadcast traffic and parse NetBIOS names
  3. Run a password spray against OWA
  4. Query LDAP on port 389 with the authenticated account Correct answer.

Explanation

Authenticated LDAP queries against a domain controller return rich directory data (users, groups, computers, ACLs) using legitimate credentials. This is quieter than spraying or mass SMB connections and does not rely on legacy null sessions. Broadcast parsing yields limited, unreliable information.

Question 43Network and Service Exploitation (including Active Directory)

A service account is configured with an SPN and you have obtained its password. Which technique directly yields Kerberos service tickets for that account that can be cracked offline?

  1. Pass-the-hash
  2. Silver ticket forgery
  3. Kerberoasting Correct answer.
  4. AS-REP roasting

Explanation

Kerberoasting requests a service ticket for an account with an SPN; the ticket is encrypted with the service account's key and can be cracked offline. AS-REP roasting targets accounts without pre-authentication and does not require an SPN. Pass-the-hash and silver tickets do not produce crackable service tickets in this way.

Question 44Network and Service Exploitation (including Active Directory)

Which nmap invocation performs a UDP scan of the top common ports against a single host while also detecting service versions?

  1. nmap -sU -sV --top-ports 50 10.10.10.5 Correct answer.
  2. nmap -sS -sV 10.10.10.5
  3. nmap -sT -O 10.10.10.5
  4. nmap -sn 10.10.10.5

Explanation

-sU selects UDP scanning, -sV enables version detection, and --top-ports 50 limits the scan to the 50 most common ports. Combining these gives a focused UDP service scan. The other invocations use TCP scanning, OS detection, or host discovery only.

Question 45Network and Service Exploitation (including Active Directory)

What is the primary purpose of setting the SRVHOST and SRVPORT options in Metasploit when exploiting a client-side vulnerability?

  1. To specify the database backend for loot storage
  2. To host the malicious file or page the target is tricked into fetching Correct answer.
  3. To set the local port used for the initial exploit connection
  4. To define where the payload handler listens for the reverse shell

Explanation

SRVHOST and SRVPORT tell the exploit module where to serve the malicious content (for example an HTA or document) that the victim retrieves. The reverse shell listener is configured separately with LHOST and LPORT. Database and initial connection settings use different options.

Question 46Network and Service Exploitation (including Active Directory)

You have obtained an NTLM hash for a local administrator and want to authenticate to a remote host without knowing the plaintext password. Which technique applies?

  1. Golden ticket creation using the administrator hash
  2. Pass-the-hash using the NTLM hash over SMB Correct answer.
  3. Kerberoasting the administrator account
  4. AS-REP roasting the administrator account

Explanation

Pass-the-hash uses the NTLM hash directly in an SMB or other NTLM authentication exchange, so plaintext is unnecessary. Kerberoasting and AS-REP roasting target Kerberos ticket issuance and require specific account properties. A golden ticket requires the krbtgt key, not a local administrator hash.

Question 47Network and Service Exploitation (including Active Directory)

Which tool is designed specifically to discover hidden content such as directories and files on a web server by brute-forcing common names?

  1. Hydra
  2. Wireshark
  3. Gobuster Correct answer.
  4. Nikto

Explanation

Gobuster performs content discovery by requesting candidate paths from a wordlist and reporting those that return interesting status codes. Nikto focuses on known vulnerabilities and misconfigurations, Wireshark captures traffic, and Hydra performs online credential brute-forcing.

Question 48Network and Service Exploitation (including Active Directory)

When exploiting an unquoted service path on Windows, what condition allows an attacker to place a malicious executable that the service will run?

  1. The service runs under the LocalSystem account
  2. The service binary path contains spaces and is not wrapped in quotes Correct answer.
  3. The service startup type is set to Automatic
  4. The service has a dependency on another service

Explanation

An unquoted path containing spaces makes Windows try successive interpretations of the path, such as C:\Program.exe before C:\Program Files\App\svc.exe. If an attacker can write to one of those earlier locations, the service executes the planted binary. Account context, dependencies, and startup type do not by themselves create the hijack.

Question 49Network and Service Exploitation (including Active Directory)

BloodHound output shows that a user you control has GenericAll over a group. What is the most direct way to leverage this for privilege escalation?

  1. Add your user to the group, inheriting its permissions Correct answer.
  2. Read the group's LAPS attribute
  3. Disable Kerberos pre-authentication on the group
  4. Reset the group's password

Explanation

GenericAll on a group grants full control, including the ability to add members. Adding your controlled account to a privileged group inherits that group's rights. Groups have no password, LAPS applies to computers, and pre-authentication is a user-account property.

Question 50Network and Service Exploitation (including Active Directory)

You want to perform a Kerberos-based password spray that avoids lockout and reduces noise. Which consideration matters most?

  1. Disabling Kerberos pre-authentication on target accounts
  2. Counting failures per account against the lockout threshold and spacing attempts Correct answer.
  3. Sending all attempts within a single second to finish quickly
  4. Using only the Administrator account to limit scope

Explanation

Lockout policy defines a failure threshold and observation window, so spraying must stay below the threshold per account and respect the reset window. Rapid attempts or single-account focus increase lockout risk, and disabling pre-authentication is a change, not a spraying technique.