I85PREP
⌘ K
OSC study materials
OSC study resources

OSC practice questions

One question at a time. Build your OSC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information Gathering and Enumeration

During a reconnaissance engagement, an analyst queries a public WHOIS record for a target domain. Which piece of information does WHOIS most reliably provide at this stage?

  1. The internal IP addressing scheme of the target network
  2. The registrar and registration dates associated with the domain Correct answer.
  3. The open TCP ports on the domain's web server
  4. The web application framework used by the site

Explanation

WHOIS returns registration metadata for a domain or IP block, including the registrar, creation and expiry dates, and often registrant or administrative contacts. It does not probe hosts, so it reveals nothing about open ports, internal addressing, or application frameworks. This makes it a passive starting point before any active scanning.

Question 2Information Gathering and Enumeration

An analyst wants to enumerate subdomains without sending any packets directly to the target's infrastructure. Which technique best fits that constraint?

  1. Querying passive DNS and certificate transparency logs for the domain Correct answer.
  2. Brute-forcing common subdomain names against the target's authoritative DNS
  3. Running a full TCP connect scan across the target's address space
  4. Requesting zone transfers from the target's primary name server

Explanation

Passive DNS databases and certificate transparency logs are third-party repositories that already recorded name resolutions and issued certificates, so querying them does not touch the target directly. Brute-forcing names, port scanning, and zone transfer requests all generate traffic toward target-controlled systems. This distinction is central to passive versus active enumeration.

Question 3Information Gathering and Enumeration

What does a DNS zone transfer (AXFR) accomplish when a name server is misconfigured to allow it?

  1. It returns the complete set of resource records for a zone Correct answer.
  2. It caches responses for faster subsequent lookups
  3. It encrypts DNS queries between resolver and server
  4. It resolves a single hostname to its canonical name

Explanation

AXFR is a zone replication mechanism that, when unrestricted, hands the requester every record in the zone, exposing hostnames, mail servers, and internal naming conventions. It is not a single-record lookup, an encryption feature, or a caching function. Restricting AXFR to authorized secondary servers is the standard mitigation.

Question 4Information Gathering and Enumeration

A tester runs a DNS query and receives the response code NXDOMAIN. What does this indicate about the queried name?

  1. The response was truncated and must be retried over TCP
  2. The name server refused to answer the query
  3. The name exists but has no address record of the requested type
  4. The name does not exist in the queried zone Correct answer.

Explanation

NXDOMAIN means the queried domain name itself does not exist according to the responding server. It differs from NODATA, where the name exists but lacks a record of the requested type, and from REFUSED, where policy blocks the answer. Truncation is signaled separately by the TC flag.

Question 5Information Gathering and Enumeration

Which DNS record type should an analyst review to identify the hosts authorized to send email on behalf of a domain?

  1. PTR
  2. MX
  3. SPF (TXT) Correct answer.
  4. CNAME

Explanation

SPF is published as a TXT record and lists the hosts and networks permitted to send mail for the domain, making it valuable for mapping mail infrastructure and third-party senders. MX records only name the inbound mail exchangers, CNAME aliases a name, and PTR supports reverse lookups. Reviewing SPF often reveals SaaS providers and cloud ranges tied to the target.

Question 6Information Gathering and Enumeration

An analyst performs a reverse DNS lookup on an IP address. What is being queried?

  1. The A record for the address's primary hostname
  2. The MX record for the address's mail domain
  3. The NS record delegating the address's zone
  4. The PTR record that maps the address back to a hostname Correct answer.

Explanation

Reverse DNS queries the in-addr.arpa or ip6.arpa namespace for a PTR record, returning the hostname associated with an address. It does not resolve forward A records, mail exchangers, or zone delegations. Reverse lookups help confirm ownership and naming conventions of discovered hosts.

Question 7Information Gathering and Enumeration

During enumeration, an analyst captures a DNS response containing a record type of 16. Which record type was returned?

  1. SOA
  2. SRV
  3. AAAA
  4. TXT Correct answer.

Explanation

DNS type code 16 corresponds to TXT records, which commonly carry SPF, DKIM, and domain verification strings useful for reconnaissance. AAAA is type 28, SOA is type 6, and SRV is type 33. Recognizing numeric type codes helps when parsing raw DNS traffic.

Question 8Information Gathering and Enumeration

What primary purpose does an SRV record serve during service enumeration?

  1. It defines the default TTL for the zone
  2. It advertises the host and port for a specific service and protocol Correct answer.
  3. It stores the public key used to sign zone data
  4. It lists the authoritative name servers for the zone

Explanation

SRV records publish the target host and port for a named service, such as _sip._tcp or _ldap._tcp, which helps testers locate non-standard service endpoints. They do not store signing keys, list name servers, or set TTL defaults. Enumerating common SRV names can reveal internal services not otherwise exposed.

Question 9Information Gathering and Enumeration

An analyst uses a search engine operator such as site:example.com filetype:pdf to gather information. What is being performed?

  1. Zone transfer enumeration
  2. Port scanning with a SYN sweep
  3. Active service fingerprinting
  4. Passive OSINT collection via search engines Correct answer.

Explanation

Search-engine operators query indexed third-party data without touching the target, making this a passive OSINT technique. It can surface documents, login portals, and directory listings already crawled. It does not probe services, transfer zones, or scan ports.

Question 10Information Gathering and Enumeration

A tester wants to discover documents and directories on a web server that are not linked from the site. Which enumeration approach is most appropriate?

  1. Reviewing the server's WHOIS registrant contact
  2. Querying the domain's MX records
  3. Performing content discovery with a wordlist of common paths Correct answer.
  4. Reading the certificate transparency log for the domain

Explanation

Content discovery requests candidate paths from a wordlist and inspects response codes and sizes to find unlinked files and directories. WHOIS, MX records, and certificate logs describe registration and naming data, not the web content tree. Response differences such as 200 versus 404 distinguish existing resources.

Question 11Information Gathering and Enumeration

While enumerating a web server, an analyst requests /robots.txt. What useful information can this file provide?

  1. Directories and paths the site owner prefers crawlers to avoid Correct answer.
  2. The server's private TLS key material
  3. The list of authorized email senders for the domain
  4. The internal IP addresses of backend database servers

Explanation

robots.txt lists paths that crawlers are asked not to index, which often points to administrative panels, staging areas, and other sensitive locations worth investigating. It never contains private keys, sender authorization, or backend addressing. Testers treat it as a hint list rather than an access control mechanism.

Question 12Information Gathering and Enumeration

An analyst inspects HTTP response headers and sees Server: nginx/1.18.0. What type of information gathering does this represent?

  1. Certificate transparency mining
  2. WHOIS contact harvesting
  3. Passive DNS correlation
  4. Banner-based service fingerprinting Correct answer.

Explanation

The Server header is a banner disclosing the software and version, which supports fingerprinting the service and mapping known vulnerabilities. This requires direct interaction with the target, unlike passive DNS or certificate log review. WHOIS harvesting concerns registration contacts.

Question 13Information Gathering and Enumeration

An analyst reviews a TLS certificate presented by a target host. Which field most often reveals additional hostnames belonging to the same organization?

  1. The validity notBefore date
  2. The signature algorithm identifier
  3. The subject alternative name extension Correct answer.
  4. The certificate serial number

Explanation

The subject alternative name extension lists every hostname the certificate is valid for, frequently exposing internal or staging names alongside the primary host. Serial numbers, signature algorithms, and validity dates carry no naming information. Certificate transparency logs make these names searchable at scale.

Question 14Information Gathering and Enumeration

Which tool is commonly used to perform an automated, multi-protocol enumeration of SMB shares on a Windows host?

  1. traceroute
  2. dig
  3. enum4linux Correct answer.
  4. whois

Explanation

enum4linux automates queries against SMB and related RPC interfaces to list shares, users, and groups. whois and dig operate on domain registration and DNS data, and traceroute maps network paths. Selecting the right tool for the protocol is a core enumeration skill.

Question 15Information Gathering and Enumeration

An analyst connects to an SMB service and attempts to list shares using null credentials, and the server returns a list. What does this indicate?

  1. The server permits anonymous session access to share listings Correct answer.
  2. The server has been compromised by the analyst
  3. The server is running a non-Microsoft SMB implementation
  4. The server requires Kerberos authentication for all sessions

Explanation

A successful null session means the server allows anonymous logon and exposes share or user information without credentials. This is a misconfiguration that aids enumeration but does not imply compromise or a specific SMB implementation. Requiring Kerberos would cause the anonymous attempt to fail.

Question 16Information Gathering and Enumeration

What does an SNMP walk against a device with the default community string 'public' typically allow an analyst to do?

  1. Execute arbitrary commands on the device
  2. Decrypt encrypted user traffic passing through the device
  3. Obtain domain administrator password hashes
  4. Retrieve management objects such as interfaces, routes, and system descriptions Correct answer.

Explanation

An SNMP walk reads the management information base, which can expose interface lists, routing tables, and system descriptions useful for mapping the environment. SNMP read access does not decrypt traffic, dump password hashes, or provide command execution. Default community strings are a common weak configuration.

Question 17Information Gathering and Enumeration

An analyst needs to identify which hosts are alive on a subnet before port scanning. Which approach most directly answers that question?

  1. A content discovery scan of a web server
  2. A WHOIS query on the subnet's netblock
  3. A DNS zone transfer request
  4. A host discovery sweep using ICMP or ARP probes Correct answer.

Explanation

Host discovery sends ICMP echo or ARP requests to determine which addresses respond, producing a live-host list to scan further. WHOIS describes block ownership, zone transfer lists DNS records, and content discovery targets web paths. ARP is especially reliable on local segments where ICMP may be filtered.

Question 18Information Gathering and Enumeration

During a port scan, an analyst observes that filtered ports return no response while closed ports return a TCP RST. What does the absence of a response most likely indicate?

  1. The port is open and accepting connections
  2. The service on the port is running but slow
  3. The host has assigned the port to an ephemeral range
  4. A firewall or filter is dropping the probe packets Correct answer.

Explanation

When probes to a port yield no reply, a filtering device is likely dropping them, which is distinct from a closed port that actively resets the connection. An open port would normally complete the handshake or send a SYN-ACK. Slow services still respond, and ephemeral range assignment does not suppress replies.

Question 19Information Gathering and Enumeration

An analyst uses a tool that sends a TCP SYN and interprets a SYN-ACK as open, a RST as closed, and no reply as filtered. Which scan type is being described?

  1. UDP scan
  2. TCP SYN half-open scan Correct answer.
  3. TCP connect scan
  4. XMAS tree scan

Explanation

The SYN scan, often called half-open, never completes the handshake and interprets SYN-ACK, RST, or silence to classify ports. A connect scan completes the handshake through the operating system. UDP and XMAS scans use different probe and response semantics.

Question 20Information Gathering and Enumeration

An analyst runs a version detection scan and sees the banner 'OpenSSH 7.4' on port 22. Why is this banner valuable beyond confirming the port is open?

  1. It identifies the software and version, enabling mapping to known issues Correct answer.
  2. It discloses the user's private key
  3. It proves the host is vulnerable to remote code execution
  4. It reveals the operating system's patch level with certainty

Explanation

Version detection maps the observed banner to specific software releases, which can then be correlated with public vulnerability information. A banner alone does not prove exploitability, does not establish patch level with certainty, and never discloses private keys. Confirming exploitability requires further validation.

Question 21Information Gathering and Enumeration

An analyst wants to enumerate users on an LDAP-accessible directory service without credentials. Which outcome would confirm anonymous bind is enabled?

  1. The server returns an invalid credentials error for every query
  2. The server refuses all connections on port 389
  3. The server requires a client certificate before responding
  4. The server returns a bind success and allows directory searches Correct answer.

Explanation

Anonymous bind is confirmed when the directory accepts a bind with no credentials and then permits search operations, potentially exposing user and group objects. An invalid credentials error means anonymous access is denied, and connection refusal or certificate requirements indicate other controls. This misconfiguration is a common enumeration finding.

Question 22Information Gathering and Enumeration

A tester wants to map the network path packets take to a target and identify intermediate routers. Which technique is designed for that purpose?

  1. A reverse DNS sweep of the subnet
  2. A content discovery scan of the target
  3. Traceroute using incrementing TTL values Correct answer.
  4. A WHOIS lookup on the target address

Explanation

Traceroute sends packets with increasing TTL values so each hop returns an ICMP time-exceeded message, revealing intermediate routers. WHOIS describes ownership, reverse DNS maps addresses to names, and content discovery targets web resources. The resulting path helps identify network boundaries and filtering points.

Question 23Information Gathering and Enumeration

An analyst gathers employee names, email formats, and technology stack details before password attacks. Why is this information gathering relevant to later credential testing?

  1. It bypasses multi-factor authentication automatically
  2. It disables account lockout policies on the target
  3. It directly grants access to the target's internal database
  4. It allows construction of targeted username lists and realistic password guesses Correct answer.

Explanation

Knowing naming conventions and organizational context lets testers build accurate username lists and informed password guesses, improving the efficiency of authorized credential testing. It does not grant database access, defeat MFA, or alter lockout policy. Reconnaissance feeds later phases rather than replacing them.

Question 24Information Gathering and Enumeration

An analyst finds an exposed .git directory on a web server during enumeration. What risk does this most directly represent?

  1. The domain's WHOIS record will be made public
  2. The server's TLS certificate will be automatically revoked
  3. Source code and embedded secrets may be recoverable Correct answer.
  4. The server will refuse all future HTTP requests

Explanation

An exposed .git directory can allow reconstruction of source code and reveal embedded credentials, API keys, and configuration details. It has no effect on certificate revocation, WHOIS publication, or the server's willingness to serve requests. This is a common finding in web content discovery.

Question 25Information Gathering and Enumeration

An analyst is choosing between active and passive information gathering at the start of an authorized assessment. Which consideration most strongly favors starting passive?

  1. Passive collection requires no scope agreement
  2. Passive collection always yields more accurate port information
  3. Passive collection reduces the chance of alerting the target's monitoring Correct answer.
  4. Active collection cannot be authorized in writing

Explanation

Passive collection draws on third-party and public sources, lowering the risk of triggering intrusion detection or tipping off defenders while scope and rules of engagement are confirmed. It does not produce port-level accuracy, and active testing is routinely authorized in writing. Scope agreements apply to both approaches.

Question 26Information Gathering and Enumeration

An analyst wants to discover hosts and services on a small subnet without sending any packets to the targets, relying only on third-party data sources. Which activity fits this goal?

  1. Sending ICMP echo requests to every address in the range
  2. Active scanning with a SYN sweep across the /24 range
  3. Banner grabbing each discovered service to confirm versions
  4. Passive OSINT using certificate transparency logs and search engine caches Correct answer.

Explanation

Passive reconnaissance relies on data already published by third parties, so the target receives no traffic from the analyst. Certificate transparency logs, cached search results, and public DNS data all reveal hostnames and sometimes services without touching the target. Any technique that sends probes to the target, such as a SYN sweep or ICMP echo, is active and therefore outside the stated constraint.

Question 27Information Gathering and Enumeration

An analyst queries a DNS server for the TXT records of a domain and finds a long string beginning with 'v=spf1'. What does this record most directly reveal during information gathering?

  1. The geographic location of the authoritative name servers
  2. The mail-sending hosts and policies authorized for the domain Correct answer.
  3. The internal hostnames of the organization's domain controllers
  4. The TLS certificate issuer used for the web front end

Explanation

SPF is published as a TXT record and lists the hosts and mechanisms permitted to send mail for the domain. For an analyst this maps out third-party mail providers and IP ranges, which can expand the external attack surface. It does not describe name server location, internal directory hosts, or certificate issuers.

Question 28Information Gathering and Enumeration

During host discovery an analyst sends a UDP packet to a closed port on a target and receives an ICMP port unreachable message. What does this response indicate about the host?

  1. The host is unreachable because ICMP was generated by a router
  2. The host is reachable and responding, so it is likely up Correct answer.
  3. The port is open and running an unidentified UDP service
  4. The host is behind a stateful firewall that drops all UDP

Explanation

A closed UDP port normally causes the host's IP stack to return ICMP type 3 code 3 (port unreachable). Receiving that message proves the packet reached a live host, which is exactly what UDP-based host discovery looks for. An open UDP port would typically stay silent, and a filtering device would usually drop the probe without any reply.

Question 29Information Gathering and Enumeration

An analyst reviews zone transfer behavior and finds that a name server refuses AXFR requests from external hosts but answers them from an internal address. Which conclusion is best supported?

  1. The server does not support zone transfers at all
  2. The server restricts zone transfers by source address, so the control exists but is network-scoped Correct answer.
  3. The zone contains no records beyond the SOA and NS entries
  4. The server is a caching resolver rather than an authoritative server

Explanation

A server that refuses AXFR externally but permits it internally is enforcing an address-based access control list rather than disabling transfers. The control is present but scoped to trusted networks, which means an attacker positioned inside that range could still dump the zone. The differing answers by source address rule out both a total lack of support and an empty zone.

Question 30Information Gathering and Enumeration

An analyst enumerates a target and finds an exposed API endpoint that returns verbose error messages containing stack traces, framework versions, and internal file paths. Which follow-on risk does this most directly create?

  1. Disclosure of the organization's public TLS private key
  2. Precise fingerprinting that narrows the exploit set to known-vulnerable component versions Correct answer.
  3. Immediate domain administrator compromise through the error output
  4. Automatic bypass of network segmentation between the DMZ and internal hosts

Explanation

Verbose errors leak component names, versions, and file paths, letting an analyst match the stack against known vulnerabilities and tailor payloads. This is an information disclosure issue whose primary consequence is improved fingerprinting and targeting. It does not by itself grant administrative access, expose private keys, or defeat network segmentation.

Question 31Vulnerability Discovery and Analysis

During a web application assessment you observe that user input is reflected in the response body without encoding. Which vulnerability class does this behavior most directly indicate?

  1. SQL injection
  2. Server-side request forgery
  3. Reflected cross-site scripting Correct answer.
  4. Stored cross-site scripting

Explanation

Reflected XSS occurs when input from the current request is echoed back into the response without context-appropriate encoding, so the payload executes in the victim's browser only when the crafted request is followed. Stored XSS instead persists the payload server-side, and SQL injection or SSRF involve backend query or network behavior rather than immediate reflected markup.

Question 32Vulnerability Discovery and Analysis

A scanner reports a possible SQL injection in a parameter. Which manual technique best confirms exploitability while minimizing risk to the database?

  1. Sending a single quote and assuming any error means full exploitability
  2. Replacing the parameter value with a very long string to observe truncation
  3. Running an automated fuzzer with destructive payloads such as DROP TABLE
  4. Injecting a boolean condition that changes the response compared with a false condition Correct answer.

Explanation

Boolean-based confirmation compares a logically true condition against a false one and looks for a consistent difference in the response, which demonstrates that input reaches the query without altering data. Error messages alone can be caused by many conditions, and destructive payloads risk data loss.

Question 33Vulnerability Discovery and Analysis

In a Linux binary, an attacker overwrites a saved return address on the stack to redirect execution to a function that was never called. What is this technique called?

  1. Return-oriented programming
  2. Stack buffer overflow control-flow hijack Correct answer.
  3. Format string read
  4. Heap spraying

Explanation

Overwriting a saved return address via an out-of-bounds stack write is the classic stack buffer overflow hijack, which redirects control flow when the function returns. ROP chains existing gadgets rather than jumping to a whole function, heap spraying places payloads in memory, and format string reads leak data.

Question 34Vulnerability Discovery and Analysis

A web server returns a directory listing that exposes backup archives containing source code. Which vulnerability category best describes the underlying issue?

  1. Insecure direct object reference
  2. Insufficient logging
  3. Security misconfiguration exposing sensitive files Correct answer.
  4. Cross-site request forgery

Explanation

Directory listing and publicly reachable backup files are configuration weaknesses that expose sensitive artifacts, falling under security misconfiguration. IDOR concerns access to objects by manipulating identifiers, CSRF concerns forged state-changing requests, and logging concerns detection.

Question 35Vulnerability Discovery and Analysis

You are testing an API and notice that changing the numeric user identifier in a request returns another user's records. Which vulnerability is most likely present?

  1. Open redirect
  2. Server-side template injection
  3. Broken object level authorization Correct answer.
  4. XML external entity injection

Explanation

Broken object level authorization (often called IDOR) occurs when the server fails to verify that the requester is entitled to the object referenced by an identifier. The other options describe template evaluation, XML entity expansion, and redirect manipulation, none of which match identifier substitution returning foreign records.

Question 36Vulnerability Discovery and Analysis

A Java application deserializes untrusted data with a library known to permit gadget chains. Which impact is most characteristic if exploitation succeeds?

  1. Denial of service through cookie exhaustion
  2. Cross-origin data theft via CORS misconfiguration
  3. Remote code execution through crafted object graphs Correct answer.
  4. Reflected content injection in the browser

Explanation

Insecure deserialization of untrusted data can let an attacker supply a crafted object graph that triggers gadget chains, frequently resulting in remote code execution. Browser reflection, CORS data theft, and cookie exhaustion describe different mechanisms and impacts.

Question 37Vulnerability Discovery and Analysis

Which practice most directly reduces false positives when triaging automated vulnerability scanner output?

  1. Increasing the scanner's request rate
  2. Accepting all findings rated high severity
  3. Manually reproducing each finding with a controlled proof of concept Correct answer.
  4. Disabling authentication during the scan

Explanation

Manual reproduction with a minimal, controlled proof of concept confirms whether the reported condition is actually exploitable and filters out heuristic noise. Changing scan speed, trusting severity labels, or disabling authentication does not validate individual findings.

Question 38Vulnerability Discovery and Analysis

A web application uses a template engine and renders user-supplied input as template syntax rather than data. Which class of vulnerability results?

  1. Local file inclusion
  2. Server-side template injection Correct answer.
  3. Subresource integrity bypass
  4. HTTP request smuggling

Explanation

When user input is evaluated by the template engine as template code instead of being treated as inert data, the result is server-side template injection, which can escalate to data disclosure or code execution. File inclusion, request smuggling, and integrity bypass involve different mechanisms.

Question 39Vulnerability Discovery and Analysis

During analysis of a crash, you find that an attacker-controlled length value is used to compute a memory copy size without bounds checking. Which root cause best describes this?

  1. Race condition in thread synchronization
  2. Type confusion between object classes
  3. Integer overflow leading to an undersized allocation Correct answer.
  4. Use-after-free from premature object release

Explanation

An unchecked length used in size arithmetic can overflow, producing a smaller allocation than the copy requires and enabling a heap overflow. Use-after-free, races, and type confusion involve lifetime, timing, or type handling rather than arithmetic on a length.

Question 40Vulnerability Discovery and Analysis

Which HTTP response header setting most directly mitigates cross-site scripting impact by restricting script sources?

  1. Strict-Transport-Security
  2. X-Frame-Options
  3. Referrer-Policy
  4. Content-Security-Policy Correct answer.

Explanation

Content-Security-Policy lets a site declare which script sources are allowed, limiting execution of injected inline or third-party scripts. HSTS enforces HTTPS, X-Frame-Options controls framing, and Referrer-Policy controls referrer leakage.

Question 41Vulnerability Discovery and Analysis

An attacker submits an XML document containing an external entity declaration to a vulnerable parser. What is the most direct security consequence?

  1. Persistence of the payload across sessions
  2. Bypass of transport layer encryption
  3. Execution of JavaScript in the victim's browser
  4. Disclosure of local files or outbound requests from the server Correct answer.

Explanation

XML external entity injection abuses entity resolution so the parser reads local files or issues requests to attacker-controlled hosts, often enabling data exfiltration or SSRF. Browser script execution, TLS bypass, and cross-session persistence are different mechanisms.

Question 42Vulnerability Discovery and Analysis

Which technique helps identify whether a binary was compiled with stack canary protections during static analysis?

  1. Reviewing the license header in the source repository
  2. Counting the number of imported network functions
  3. Checking whether the binary is stripped of symbols
  4. Examining function prologues for references to a thread-local guard value Correct answer.

Explanation

Stack canaries are implemented by loading a guard value, typically from thread-local storage, storing it on the stack, and verifying it before return, which is visible in function prologues and epilogues. Import counts, symbol stripping, and license headers do not reveal canary usage.

Question 43Vulnerability Discovery and Analysis

A penetration test reveals that a web application accepts a user-controlled URL and fetches it server-side. Which vulnerability should be documented?

  1. Cross-site scripting
  2. Server-side request forgery Correct answer.
  3. Insecure deserialization
  4. Directory traversal

Explanation

When the server fetches a URL supplied by the user, an attacker can direct requests to internal services or metadata endpoints, which is server-side request forgery. XSS, deserialization, and traversal involve browser execution, object graphs, and file paths respectively.

Question 44Vulnerability Discovery and Analysis

Which finding indicates a path traversal vulnerability during review of a file download endpoint?

  1. The response includes a Content-Disposition header
  2. The endpoint requires an authenticated session cookie
  3. A sequence such as ../../ in the filename parameter resolves to a file outside the intended directory Correct answer.
  4. The server returns a 404 for nonexistent filenames

Explanation

Path traversal is demonstrated when relative path sequences in a user-controlled filename cause the server to read files outside the intended base directory. Authentication requirements, disposition headers, and 404 responses are normal behaviors that do not indicate traversal.

Question 45Vulnerability Discovery and Analysis

A vulnerability report notes that a heap object is freed and then dereferenced after a subsequent allocation reuses the same memory. Which exploitation primitive does this most directly provide?

  1. Controlled overwrite via reallocated object Correct answer.
  2. Format string write through a specifier
  3. Integer truncation in a length field
  4. Stack canary leak

Explanation

In a use-after-free, freeing an object and then reallocating the same memory with attacker-influenced data lets the attacker control the contents that the stale pointer references, often yielding an overwrite primitive. Canary leaks, format string writes, and integer truncation are separate mechanisms.

Question 46Vulnerability Discovery and Analysis

Which control most directly mitigates the impact of a successful cross-site scripting payload in a modern browser?

  1. Disabling TLS session resumption
  2. Rotating server signing keys daily
  3. Marking session cookies HttpOnly Correct answer.
  4. Enabling verbose error messages

Explanation

The HttpOnly attribute prevents client-side script from reading the cookie, so injected script cannot directly steal the session token. TLS resumption settings, key rotation, and error verbosity do not restrict script access to cookies.

Question 47Vulnerability Discovery and Analysis

You observe that a web application's password reset token is a predictable value derived from the current timestamp. Which weakness does this represent?

  1. Improper certificate validation
  2. Insufficient entropy in security tokens Correct answer.
  3. Missing rate limiting on login
  4. Weak password hashing algorithm

Explanation

Tokens derived from predictable values such as timestamps lack sufficient entropy and can be guessed or brute-forced, undermining the reset flow. Rate limiting, certificate validation, and password hashing address different weaknesses.

Question 48Vulnerability Discovery and Analysis

Which artifact is most useful for mapping a discovered vulnerability to a standardized weakness category during reporting?

  1. The HTTP status code of the exploit request
  2. A CWE identifier describing the underlying weakness Correct answer.
  3. A CVSS temporal score alone
  4. The affected server's uptime record

Explanation

CWE provides a taxonomy of software weakness types, making it the appropriate reference for classifying root causes in a report. CVSS scores measure severity, while uptime and status codes describe operational state rather than weakness category.

Question 49Vulnerability Discovery and Analysis

A server parses the Content-Length and Transfer-Encoding headers inconsistently with an upstream proxy. Which vulnerability class is most relevant?

  1. Cross-site request forgery
  2. HTTP request smuggling Correct answer.
  3. Open redirect
  4. Insecure direct object reference

Explanation

Disagreement between front-end and back-end servers about where one request ends and the next begins enables request smuggling, allowing attackers to prefix or poison subsequent requests. CSRF, open redirect, and IDOR involve forged requests, redirect targets, and object identifiers.

Question 50Vulnerability Discovery and Analysis

When building a proof of concept for a blind command injection, which approach best confirms execution without relying on visible output?

  1. Send the payload repeatedly and watch for HTTP 500 responses
  2. Compare response times for a single request
  3. Increase the payload length until the server errors
  4. Trigger an out-of-band interaction with a controlled listener Correct answer.

Explanation

Out-of-band confirmation, such as a DNS or HTTP callback to an attacker-controlled listener, demonstrates that injected commands executed even when the response contains no output. Length changes, error codes, and single timing samples are weak or ambiguous signals.