I85PREP
⌘ K
CPEH study materials
CPEH study resources

CPEH practice questions

One question at a time. Build your CPEH understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Ethics, Legal Frameworks, and Compliance

An authorized penetration tester discovers that a client's web application exposes another customer's invoice data. Under the scope of engagement, which action best reflects the ethical standard for handling this discovery?

  1. Document the finding with minimal proof and report it through the agreed client channel without accessing further records Correct answer.
  2. Download a sample of the exposed invoices to demonstrate business impact in the final report
  3. Continue enumerating invoices until the full extent of exposure is quantified for the client
  4. Post a sanitized screenshot on a public forum to warn other potential customers

Explanation

Ethical testing requires minimizing access to sensitive data beyond what is necessary to prove the vulnerability, and disclosing findings only through the contracted reporting channel. Collecting additional real customer records, even for impact demonstration, exceeds the authorized purpose and creates avoidable privacy harm.

Question 2Ethics, Legal Frameworks, and Compliance

Which principle of the widely referenced Menlo Report adapts traditional human-subjects research ethics to cybersecurity research?

  1. Due care, due diligence, and fiduciary responsibility
  2. Respect for persons, beneficence, justice, and respect for law and public interest Correct answer.
  3. Confidentiality, integrity, and availability of information systems
  4. Least privilege, separation of duties, and need to know

Explanation

The Menlo Report extends the Belmont principles of respect for persons, beneficence, and justice with a fourth principle, respect for law and public interest, tailored to security and privacy research. The other lists describe security controls or corporate governance concepts rather than research ethics frameworks.

Question 3Ethics, Legal Frameworks, and Compliance

A penetration testing firm is engaged by a company to test its production environment. Which document most directly establishes the legal authorization to perform the testing?

  1. A verbal approval from the IT help desk manager during a kickoff call
  2. A rules of engagement and authorization letter signed by an officer with authority over the systems Correct answer.
  3. An internal change management ticket approving a firewall rule
  4. A public bug bounty policy page on the company's website

Explanation

Written authorization signed by someone with genuine authority over the target systems, paired with rules of engagement, is the primary legal basis that distinguishes authorized testing from unauthorized access. Verbal approvals and internal tickets do not reliably convey authority from the asset owner.

Question 4Ethics, Legal Frameworks, and Compliance

During an assessment, a tester finds a server that appears to be outside the listed IP ranges but is reachable from an in-scope host. What is the most compliant course of action?

  1. Test the host only during non-business hours to reduce impact
  2. Test the host because it is reachable from an in-scope system
  3. Test the host but exclude findings from the final report
  4. Pause testing on that host and request written scope clarification from the client before proceeding Correct answer.

Explanation

Scope is defined by explicit written authorization, not by network reachability. Discovering an out-of-scope asset is a trigger to stop and obtain documented clarification rather than to expand testing unilaterally.

Question 5Ethics, Legal Frameworks, and Compliance

Which data protection role does an organization typically hold when it determines the purposes and means of processing personal data?

  1. Sub-processor
  2. Controller Correct answer.
  3. Processor
  4. Supervisory authority

Explanation

Under frameworks such as the GDPR, the controller decides why and how personal data is processed, while processors act on the controller's documented instructions. The distinction drives obligations such as lawful basis, transparency, and accountability.

Question 6Ethics, Legal Frameworks, and Compliance

A tester must retain client evidence containing personal data after the engagement ends. Which practice best aligns with data minimization and confidentiality obligations?

  1. Store only the evidence necessary for the report and agreed retention period, encrypted and access-restricted Correct answer.
  2. Share copies with colleagues for training without client consent
  3. Upload evidence to a public cloud bucket with a random name for convenience
  4. Retain full disk images indefinitely in case future questions arise

Explanation

Data minimization and confidentiality require retaining only what is necessary, for no longer than agreed, protected by encryption and need-to-know access. Indefinite retention or uncontrolled sharing of client personal data exceeds the lawful and contractual basis for processing.

Question 7Ethics, Legal Frameworks, and Compliance

Which legal theory most commonly underpins a claim against a security firm whose negligent testing caused an outage at a client site?

  1. Breach of contract and negligence Correct answer.
  2. Copyright fair use
  3. Antitrust violation
  4. Trademark infringement

Explanation

A client harmed by careless testing typically pleads breach of the engagement contract and negligence, arguing the firm failed to exercise reasonable care. Trademark, antitrust, and copyright doctrines address unrelated areas of law.

Question 8Ethics, Legal Frameworks, and Compliance

A client requests that a tester delete all evidence of a critical vulnerability from the report to avoid regulatory scrutiny. How should the tester respond?

  1. Replace the finding with a low-severity placeholder
  2. Remove the finding but keep a private copy for personal records
  3. Comply because the client owns the report under the contract
  4. Decline to omit material findings and escalate the request through the firm's management and legal channels Correct answer.

Explanation

Professional and ethical standards require accurate reporting of material findings; suppressing them can mislead stakeholders and regulators. Requests to falsify or omit findings should be escalated rather than accommodated.

Question 9Ethics, Legal Frameworks, and Compliance

Which element is most essential for a valid consent basis when an organization relies on consent to process personal data?

  1. The consent must be renewed every thirty days
  2. The consent must be freely given, specific, informed, and revocable Correct answer.
  3. The consent must be witnessed by a notary
  4. The consent must be obtained in writing only

Explanation

Valid consent under regimes such as the GDPR requires it to be freely given, specific, informed, unambiguous, and as easy to withdraw as to give. Written form, fixed renewal intervals, and notarization are not general legal requirements.

Question 10Ethics, Legal Frameworks, and Compliance

A tester wants to use a commercial exploitation framework during an engagement. Which consideration is most relevant to licensing compliance?

  1. Whether the tool was downloaded over HTTPS
  2. Whether the license permits commercial use and the specific modules being used Correct answer.
  3. Whether the tester has used the tool before
  4. Whether the tool's interface is in English

Explanation

Commercial tool licenses often restrict commercial use or certain modules, so verifying permitted use is the core compliance question. Download transport security and prior familiarity are operational concerns, not licensing terms.

Question 11Ethics, Legal Frameworks, and Compliance

Which scenario best describes a lawful basis of legitimate interests for processing personal data in a security monitoring context?

  1. The organization assumes security monitoring is always permitted without assessment
  2. The organization processes data only after a breach occurs
  3. The organization documents a balancing test showing its security need outweighs minimal privacy impact Correct answer.
  4. The organization obtains consent from every network visitor

Explanation

Legitimate interests requires a documented balancing assessment showing the processing is necessary for a legitimate purpose and does not override individual rights. Assuming automatic permission or waiting for incidents does not satisfy this test.

Question 12Ethics, Legal Frameworks, and Compliance

What is the primary purpose of a data processing agreement between a controller and a processor?

  1. To transfer ownership of all personal data to the processor
  2. To define the processor's obligations, security measures, and instructions for handling personal data Correct answer.
  3. To allow the processor to determine new processing purposes
  4. To eliminate the controller's accountability to regulators

Explanation

A data processing agreement sets out the subject matter, duration, nature and purpose of processing, and the processor's confidentiality, security, and assistance obligations. Accountability and purpose decisions remain with the controller.

Question 13Ethics, Legal Frameworks, and Compliance

A tester is asked to assess a system hosted in a country with strict data localization rules. Which step is most important before transmitting test data across borders?

  1. Transfer only the largest files to reduce the number of transfers
  2. Encrypt the data and transfer it without further review
  3. Assume the client's contract overrides national law
  4. Confirm the transfer is permitted under applicable localization and cross-border transfer rules Correct answer.

Explanation

Data localization and cross-border transfer restrictions are legal requirements that contractual terms cannot override. Confirming permitted transfer mechanisms before moving data is essential to compliance.

Question 14Ethics, Legal Frameworks, and Compliance

Which activity is generally outside the scope of a standard security assessment engagement unless explicitly authorized?

  1. Scanning in-scope hosts for open ports
  2. Reviewing publicly available DNS records
  3. Interviewing system administrators about procedures
  4. Social engineering employees to obtain credentials Correct answer.

Explanation

Social engineering targets people and typically requires explicit written authorization because it involves deception and potential employee harm. Passive DNS review, authorized scanning, and interviews are standard activities within agreed scope.

Question 15Ethics, Legal Frameworks, and Compliance

An organization suffers a breach involving personal data. Which obligation most directly arises under many data protection laws?

  1. Notify all employees before assessing the incident
  2. Notify the relevant supervisory authority within a defined timeframe where required Correct answer.
  3. Delete affected records immediately without investigation
  4. Publish the full forensic report publicly

Explanation

Many regimes require notification to a supervisory authority, and sometimes affected individuals, within defined timeframes when a breach poses risk. Premature deletion or public disclosure is not a standard obligation and can impede investigation.

Question 16Ethics, Legal Frameworks, and Compliance

A tester discovers evidence of a prior criminal intrusion unrelated to the engagement. What is the most appropriate immediate action?

  1. Stop interacting with the affected evidence and notify the client contact per the incident escalation plan Correct answer.
  2. Continue investigating the intrusion to identify the attacker
  3. Publish indicators of compromise on a public feed immediately
  4. Delete the evidence to avoid contaminating the assessment

Explanation

Evidence of a real intrusion triggers the agreed escalation plan, and the tester should avoid altering potential evidence. Independent investigation or public disclosure exceeds the engagement and may compromise a criminal matter.

Question 17Ethics, Legal Frameworks, and Compliance

In a jurisdiction where computer misuse law criminalizes unauthorized access, which factor most reliably distinguishes authorized penetration testing from an offense?

  1. Testing performed remotely rather than on site
  2. Prior written permission from the system owner covering the specific systems and methods Correct answer.
  3. Use of open-source tools rather than commercial tools
  4. Absence of any data copied during testing

Explanation

Authorization from the party entitled to grant it, covering the specific systems and techniques, is the key legal distinction in computer misuse statutes. Tool type, location, and data copying do not supply authorization.

Question 18Ethics, Legal Frameworks, and Compliance

A firm operates in multiple jurisdictions and must reconcile conflicting breach notification deadlines. Which approach best manages compliance risk?

  1. Notify only the jurisdiction where the server is physically located
  2. Map each jurisdiction's requirements and design an incident process that meets the strictest applicable deadline Correct answer.
  3. Apply the longest deadline across all jurisdictions to simplify reporting
  4. Wait for regulators to request notification before acting

Explanation

Conflicting obligations are managed by mapping requirements per jurisdiction and building an incident workflow that satisfies the most stringent applicable deadline. Applying the longest deadline or waiting for regulators risks non-compliance in stricter jurisdictions.

Question 19Ethics, Legal Frameworks, and Compliance

A client asks a tester to sign a contract clause requiring the tester to indemnify the client for all regulatory fines arising from the client's own prior non-compliance. Which response best reflects sound professional risk management?

  1. Accept the clause because clients always dictate contract terms
  2. Accept the clause and recover the cost through higher fees
  3. Ignore the clause because it is unenforceable in all jurisdictions
  4. Negotiate the indemnity to cover only losses caused by the tester's negligence or breach Correct answer.

Explanation

Indemnities should be proportionate to the party's own fault, so limiting coverage to losses caused by the tester's negligence or breach aligns risk with responsibility. Accepting unlimited liability for a client's pre-existing non-compliance is commercially and ethically unsound.

Question 20Ethics, Legal Frameworks, and Compliance

Which practice best demonstrates due care when a tester plans to use a newly released exploit against a production system?

  1. Disable logging to avoid capturing sensitive data
  2. Run the exploit in production first to confirm it works
  3. Skip documentation to reduce exposure of the technique
  4. Validate the exploit in a controlled replica and obtain explicit client approval for production use Correct answer.

Explanation

Due care means validating potentially disruptive techniques in a safe environment and securing explicit approval before touching production. Testing directly in production or disabling logging increases the risk of outage and loss of accountability.

Question 21Reconnaissance and Footprinting

During passive reconnaissance against a target organization, which activity keeps you from directly touching the target's infrastructure?

  1. Banner-grabbing the public web server on port 443
  2. Running a full TCP connect scan against the mail server
  3. Querying public certificate transparency logs for subdomains Correct answer.
  4. Enumerating SMB shares on an internal file server

Explanation

Passive reconnaissance gathers information from third-party or public sources without sending packets to the target itself. Certificate transparency logs are published by certificate authorities and can reveal subdomain names without any direct interaction. Scans and banner grabs generate traffic that reaches the target and are therefore active techniques.

Question 22Reconnaissance and Footprinting

Which DNS record type is commonly abused to enumerate an organization's mail infrastructure during footprinting?

  1. SOA
  2. PTR
  3. CNAME
  4. MX Correct answer.

Explanation

MX records list the mail exchangers responsible for a domain and often reveal mail gateway hostnames, third-party filtering providers, and IP ranges worth mapping. CNAME, PTR, and SOA records serve different purposes and do not directly enumerate mail servers.

Question 23Reconnaissance and Footprinting

An analyst wants to discover hosts and open ports without completing the TCP three-way handshake. Which technique matches this goal?

  1. SYN scan Correct answer.
  2. TCP connect scan
  3. UDP scan
  4. ACK scan

Explanation

A SYN scan sends a SYN packet and interprets the SYN/ACK or RST response without completing the handshake, so a full connection is never established. A TCP connect scan completes the handshake through the operating system. UDP and ACK scans do not use SYN-based half-open logic to find open TCP ports.

Question 24Reconnaissance and Footprinting

Which tool is primarily designed for passive OSINT collection from public web sources such as search engines and social media?

  1. Maltego Correct answer.
  2. Hydra
  3. Nmap
  4. Nikto

Explanation

Maltego is a link-analysis and OSINT platform that aggregates public data sources and visualizes relationships among entities. Nmap performs network scanning, Nikto checks web server vulnerabilities, and Hydra performs online credential attacks, so none of them is a passive OSINT aggregator.

Question 25Reconnaissance and Footprinting

What does a WHOIS lookup on a registered domain typically return?

  1. The target's internal Active Directory structure
  2. The full directory listing of the web root
  3. The registrant contact and registrar details Correct answer.
  4. The plaintext passwords of administrative accounts

Explanation

WHOIS returns registration data such as the registrar, creation and expiry dates, name servers, and registrant contact information where not redacted. It does not expose internal directory services, credentials, or web server file listings.

Question 26Reconnaissance and Footprinting

Which search operator restricts results to a specific site in most major search engines?

  1. cache:
  2. site: Correct answer.
  3. inurl:
  4. filetype:

Explanation

The site: operator limits results to pages within a specified domain or host. The inurl: operator matches terms in the URL path, filetype: filters by file extension, and cache: retrieves a search engine's cached copy of a page.

Question 27Reconnaissance and Footprinting

During footprinting, an analyst finds the target uses a third-party cloud email provider. What is the most useful follow-on inference?

  1. The organization has no need for SPF or DKIM records
  2. The organization's internal passwords are stored in DNS TXT records
  3. The organization's web servers are hosted on the same provider by default
  4. The organization's email filtering and IP reputation may depend on that provider Correct answer.

Explanation

When mail is outsourced, the provider controls filtering, relay behavior, and sending IP reputation, which shapes how phishing simulations and email-based tests will be treated. It does not follow that DNS TXT records hold passwords or that web hosting is co-located. SPF and DKIM remain necessary regardless of provider.

Question 28Reconnaissance and Footprinting

An analyst performs a zone transfer attempt with dig axfr against a name server and receives a full listing of records. What does this indicate?

  1. The analyst successfully exploited a buffer overflow in BIND
  2. The name server allows unauthenticated AXFR from arbitrary clients Correct answer.
  3. The target uses DNSSEC and therefore permits transfers
  4. The domain has no MX records configured

Explanation

A successful AXFR from an untrusted source means the name server is misconfigured to permit zone transfers to anyone, exposing the full record set. DNSSEC does not grant transfer permission, and a zone transfer is a configuration weakness rather than a memory-corruption exploit.

Question 29Reconnaissance and Footprinting

A tester wants to map which subdomains exist for a target without brute-forcing names. Which approach best fits this requirement?

  1. Reviewing certificate transparency logs and passive DNS datasets Correct answer.
  2. Running a UDP scan of the entire IPv4 space
  3. Querying the target's internal DHCP server
  4. Sending ICMP echo requests to every address in a /8

Explanation

Certificate transparency logs and passive DNS datasets record names that have already been observed publicly, enabling subdomain discovery without guessing. Scanning huge address ranges is slow and noisy, and an internal DHCP server is not reachable from outside.

Question 30Reconnaissance and Footprinting

Which technique uses the target's own web application to fetch a URL you control, helping reveal internal-only services?

  1. Directory traversal
  2. Server-side request forgery Correct answer.
  3. SQL injection
  4. Cross-site scripting

Explanation

Server-side request forgery causes the server to make requests on the attacker's behalf, which can expose internal services reachable only from the server's network position. XSS executes in the victim's browser, SQL injection manipulates database queries, and directory traversal reads files outside the web root.

Question 31Reconnaissance and Footprinting

An analyst captures traffic and observes a host sending DNS queries for many random-looking subdomains of one domain. What is the most likely explanation?

  1. The host is running an NTP sync
  2. The host is resolving MX records for mail delivery
  3. The host is performing a DNS zone transfer
  4. The host is beaconing via DNS tunneling or a domain generation algorithm Correct answer.

Explanation

High-volume queries to random subdomains of a single parent domain are characteristic of DNS tunneling or domain generation algorithm beaconing. Zone transfers are single AXFR operations, NTP uses UDP port 123 without DNS names, and MX lookups target a fixed set of records.

Question 32Reconnaissance and Footprinting

Which resource is most appropriate for identifying an organization's publicly announced IP address ranges?

  1. The organization's source code repository
  2. The organization's employee onboarding checklist
  3. The organization's WHOIS and Regional Internet Registry records Correct answer.
  4. The organization's internal vulnerability scanner reports

Explanation

WHOIS and Regional Internet Registry records document the allocation of IP address blocks to organizations and are a reliable source for announced ranges. Internal scanner reports, onboarding documents, and source code are not authoritative for public IP allocation.

Question 33Reconnaissance and Footprinting

A tester identifies a web server running an outdated content management system version from its response headers. What is the most defensible next step in a reconnaissance workflow?

  1. Assume the version is patched and ignore it
  2. Publish the finding on social media
  3. Exploit the known vulnerability immediately without authorization
  4. Correlate the version with public advisories and document it for the engagement Correct answer.

Explanation

Version disclosure from headers is a reconnaissance finding that should be correlated with public advisories and recorded within the agreed scope. Exploiting without authorization is out of scope, assuming the version is patched is unjustified, and public disclosure violates engagement confidentiality.

Question 34Reconnaissance and Footprinting

Which record type, when misconfigured, can allow an attacker to send email appearing to come from the target domain?

  1. CAA
  2. SRV
  3. NS
  4. SPF Correct answer.

Explanation

A missing or overly permissive SPF record allows unauthorized senders to spoof the domain in email. CAA restricts which certificate authorities may issue certificates, SRV locates services, and NS delegates name servers, none of which govern email sender authorization.

Question 35Reconnaissance and Footprinting

An analyst wants to determine whether a target uses a web application firewall before launching tests. Which observation is the strongest indicator?

  1. The server redirects HTTP to HTTPS
  2. The server responds with a 200 status to a normal GET request
  3. The server returns a consistent block page with a vendor-specific header on suspicious requests Correct answer.
  4. The server uses HTTPS with a valid certificate

Explanation

A WAF typically returns a distinctive block page or vendor header when it detects malicious patterns, which is a strong indicator of its presence. Normal responses, valid TLS certificates, and HTTP-to-HTTPS redirects are common on any web server and do not indicate a WAF.

Question 36Reconnaissance and Footprinting

Which data source most directly reveals an organization's third-party vendors and technology stack during passive reconnaissance?

  1. The organization's internal HR database
  2. The organization's private source code
  3. Job postings and press releases Correct answer.
  4. The organization's physical security logs

Explanation

Job postings and press releases often mention specific technologies, vendors, and projects, making them a rich passive source for mapping the technology stack and supply chain. Internal HR data, private source code, and physical security logs are not publicly available to an external tester.

Question 37Reconnaissance and Footprinting

An analyst observes that reverse DNS lookups for a range of IP addresses resolve to hostnames like db01.corp.example.com. What is the most useful conclusion?

  1. The hostnames likely indicate internal naming conventions and roles Correct answer.
  2. The IP range belongs to a cloud provider
  3. The organization uses IPv6 exclusively
  4. The organization has no DNS records

Explanation

Reverse DNS entries that follow a structured naming scheme reveal internal naming conventions and likely host roles such as database servers. The presence of these records disproves the absence of DNS, and naming alone does not prove cloud ownership or exclusive IPv6 use.

Question 38Reconnaissance and Footprinting

A tester must map an organization's external attack surface while minimizing detection by monitoring tools. Which approach best balances coverage and stealth?

  1. A full-speed port scan of all addresses simultaneously
  2. Repeated credential spraying against VPN endpoints
  3. Slow, distributed queries to passive sources followed by low-and-slow targeted probes Correct answer.
  4. A single SYN flood against the perimeter

Explanation

Combining passive source queries with rate-limited, targeted probes reduces the traffic signature while still building a useful external map. Full-speed scans, SYN floods, and credential spraying generate obvious alerts and may disrupt services.

Question 39Reconnaissance and Footprinting

An analyst finds a JavaScript file on the target's site that references an internal API endpoint at api.internal.example.com. What is the most accurate interpretation?

  1. The endpoint proves the organization uses no API gateway
  2. The endpoint is a decoy with no real function
  3. The endpoint is certainly reachable from the internet
  4. The endpoint may be internal-only and warrants further passive investigation Correct answer.

Explanation

References to internal-looking hostnames in client-side code suggest services that may be reachable only from internal networks, so the finding should be investigated further through passive means. It does not prove internet reachability, decoy status, or the absence of an API gateway.

Question 40Reconnaissance and Footprinting

During reconnaissance, an analyst discovers a publicly accessible Git repository containing configuration files with internal hostnames. What is the most significant risk this represents?

  1. Improved performance of the target's build pipeline
  2. Automatic patching of the organization's servers
  3. Exposure of internal architecture that aids further targeting Correct answer.
  4. Reduced need for the organization to use DNS

Explanation

Leaked configuration files reveal internal hostnames, services, and sometimes credentials, giving an attacker a roadmap for further targeting. Such exposure does not improve performance, remove DNS requirements, or patch servers automatically.

Question 41Scanning, Enumeration, and Vulnerability Assessment

During an authorized assessment of a web server, you need to identify which HTTP methods the server accepts before probing further. Which technique most directly enumerates the allowed methods?

  1. Issuing a TCP SYN scan against port 80 and inspecting the response flags
  2. Crafting a malformed HTTP request to trigger a 500 error page
  3. Running a reverse DNS lookup on the server's IP address
  4. Sending an OPTIONS request to the target resource and reading the Allow header Correct answer.

Explanation

The HTTP OPTIONS method asks the server which methods are supported for a given resource, and the reply typically includes an Allow header listing them. A SYN scan only reports whether the port is open, not which verbs the application layer accepts. This makes OPTIONS the direct enumeration technique.

Question 42Scanning, Enumeration, and Vulnerability Assessment

A vulnerability scanner reports a service as 'potentially vulnerable' based only on the banner it received. Why should this finding be treated cautiously during assessment?

  1. Banner grabbing is illegal without a signed scope document
  2. Banners are encrypted and cannot be read by scanners without credentials
  3. Banner-based detection can be fooled by version spoofing or backported patches, so confirmation requires active validation Correct answer.
  4. Scanners never produce false positives on network services

Explanation

Banner grabbing infers software versions from self-reported strings, which administrators can alter, and vendors often backport security fixes without changing the version number. Therefore banner-only findings must be validated with targeted checks before being reported as real vulnerabilities. This is a core limitation of unauthenticated scanning.

Question 43Scanning, Enumeration, and Vulnerability Assessment

Which Nmap scan type completes the TCP three-way handshake with the target before tearing down the connection?

  1. TCP SYN scan (-sS)
  2. UDP scan (-sU)
  3. TCP connect scan (-sT) Correct answer.
  4. NULL scan (-sN)

Explanation

A TCP connect scan uses the operating system's connect() call, which performs the full three-way handshake and then closes the connection. The SYN scan, by contrast, sends a SYN and resets the connection after receiving SYN-ACK, never completing the handshake. This distinction matters when the scanner lacks raw socket privileges.

Question 44Scanning, Enumeration, and Vulnerability Assessment

Which DNS record type is queried to discover the mail exchangers responsible for a domain during enumeration?

  1. MX Correct answer.
  2. CNAME
  3. A
  4. TXT

Explanation

MX records list the mail exchanger hosts for a domain along with their preference values, making them the correct record type for mail infrastructure enumeration. A records map names to IPv4 addresses, CNAMEs create aliases, and TXT records hold arbitrary text such as SPF data. Each record type answers a different enumeration question.

Question 45Scanning, Enumeration, and Vulnerability Assessment

An assessor wants to enumerate SMB shares on a Windows host using only built-in or common tooling. Which command correctly lists shares on a remote host?

  1. smbclient -R //10.10.10.5 -N
  2. smbclient -P //10.10.10.5 -N
  3. smbclient -M //10.10.10.5 -N
  4. smbclient -L //10.10.10.5 -N Correct answer.

Explanation

The -L flag tells smbclient to list the services (shares) available on the target, and -N suppresses the password prompt for a null session attempt. This is the standard way to enumerate shares with smbclient. Other single-letter flags in the options do not perform share listing.

Question 46Scanning, Enumeration, and Vulnerability Assessment

Which tool is specifically designed to automate the discovery of content such as hidden directories and files on a web server?

  1. Wireshark
  2. ffuf Correct answer.
  3. traceroute
  4. John the Ripper

Explanation

ffuf is a fast web fuzzer commonly used for content discovery, sending requests against wordlists to find hidden directories and files. Wireshark captures packets, John the Ripper cracks password hashes, and traceroute maps network paths. Only ffuf targets web content enumeration directly.

Question 47Scanning, Enumeration, and Vulnerability Assessment

A scanner identifies a web server as running an outdated version of its software. What is the most reliable next step to confirm whether the associated vulnerability is actually exploitable?

  1. Ignore the finding because version detection is always wrong
  2. Perform a targeted, non-destructive proof-of-concept check that verifies the vulnerable behavior Correct answer.
  3. Immediately run an exploit that could crash the service
  4. Assume the finding is valid because the version is old

Explanation

Version-based findings require validation because banners can be spoofed and patches may be backported. A controlled, non-destructive proof-of-concept confirms the vulnerable behavior without risking service stability. This aligns with responsible assessment practices.

Question 48Scanning, Enumeration, and Vulnerability Assessment

During enumeration you find an LDAP service on port 389 responding to anonymous binds. What does this misconfiguration primarily expose?

  1. The plaintext passwords of all domain users
  2. Directory information such as user accounts, groups, and organizational structure Correct answer.
  3. The firewall rule set of the perimeter device
  4. The server's private TLS keys

Explanation

Anonymous LDAP binds allow unauthenticated queries against the directory, exposing user accounts, group memberships, and organizational data useful for further attacks. The directory does not store TLS private keys or plaintext passwords by default. Firewall rules are unrelated to LDAP content.

Question 49Scanning, Enumeration, and Vulnerability Assessment

Which Nmap option enables version detection so that the scanner probes open ports to identify the running service and its version?

  1. -sn
  2. -O
  3. -Pn
  4. -sV Correct answer.

Explanation

The -sV flag activates service and version detection, sending probes to determine the exact application and version behind an open port. The -sn flag performs host discovery without port scanning, -Pn skips host discovery, and -O enables operating system fingerprinting. Only -sV identifies service versions.

Question 50Scanning, Enumeration, and Vulnerability Assessment

An assessor runs a UDP scan and receives no response from a targeted port. How should this result be interpreted in Nmap's output?

  1. The target host is offline
  2. The port is definitively open and running a service
  3. The port is definitively closed
  4. The port is likely open|filtered because an open UDP service may not reply to the probe Correct answer.

Explanation

UDP is connectionless, and open services often do not respond to arbitrary probes, so the absence of a reply is reported as open|filtered rather than a definitive state. A closed port would normally return an ICMP port-unreachable message. This ambiguity is inherent to UDP scanning.