I85PREP
⌘ K
CPTE study materials
CPTE study resources

CPTE practice questions

One question at a time. Build your CPTE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Penetration Testing

During an authorized external engagement, the client supplies only a CIDR block and asks the tester to discover live hosts before deeper enumeration. Which activity best fits the reconnaissance phase of that engagement?

  1. Sending ICMP echo and TCP SYN probes across the authorized CIDR to map responsive hosts Correct answer.
  2. Performing a password spray against the VPN portal to enumerate valid accounts
  3. Dumping the SAM database from a compromised workstation to extract hashes
  4. Launching an exploit against the mail gateway to confirm remote code execution

Explanation

Reconnaissance covers host discovery and information gathering before exploitation, so probing the authorized range for live hosts is the correct activity. Exploitation, credential attacks, and post-exploitation credential dumping belong to later phases and would exceed the stated scope.

Question 2Penetration Testing

A tester needs to enumerate DNS records for a target domain using only publicly available data and without sending queries directly to the target's authoritative servers. Which approach fits that requirement?

  1. Running a zone transfer request against each authoritative nameserver
  2. Brute-forcing subdomains with a large wordlist against the target resolver
  3. Querying third-party passive DNS and certificate transparency logs for historical records Correct answer.
  4. Sending ANY queries to the target's recursive resolver at high rate

Explanation

Passive DNS databases and certificate transparency logs are third-party sources that reveal records without touching the target's infrastructure directly. The other options generate traffic toward the target's own DNS services, which is active enumeration rather than passive collection.

Question 3Penetration Testing

An Nmap scan of a host returns the state "filtered" for TCP port 445. What does that state indicate about the probe?

  1. The port is open and the service banner was successfully retrieved
  2. No response was received, suggesting a packet filter is dropping the probe Correct answer.
  3. The port responded but the service could not be fingerprinted
  4. The host is reachable but the port is closed and returned a reset

Explanation

Nmap reports filtered when it cannot determine the port state because no reply arrives, which typically means a firewall or filter is dropping the packets. Open ports return a SYN-ACK, closed ports return a RST, and fingerprinting failures are reported separately.

Question 4Penetration Testing

A tester wants Nmap to perform a TCP connect scan because raw socket privileges are unavailable. Which flag accomplishes this?

  1. -sn
  2. -sT Correct answer.
  3. -sU
  4. -sS

Explanation

The -sT flag selects the TCP connect scan, which completes the full three-way handshake using the operating system's connect call and therefore does not require raw packet privileges. The -sS flag is a SYN scan needing raw sockets, -sU scans UDP, and -sn performs host discovery only.

Question 5Penetration Testing

Which tool is designed specifically to automate the exploitation phase of a penetration test by matching vulnerabilities to payloads through a modular framework?

  1. Wireshark
  2. Metasploit Framework Correct answer.
  3. Nmap
  4. Burp Suite Community Edition

Explanation

Metasploit Framework is an exploitation framework that pairs exploit modules with payloads and provides handlers and session management. Wireshark captures traffic, Nmap maps hosts and services, and Burp Suite focuses on web proxy testing rather than general exploit delivery.

Question 6Penetration Testing

After gaining a shell on a Linux host, a tester runs whoami and id. Which objective do these commands primarily serve during post-exploitation?

  1. Establishing persistence across reboots
  2. Determining the privilege context and group memberships of the current session Correct answer.
  3. Extracting cached credentials from memory
  4. Enumerating reachable network segments from the host

Explanation

whoami reports the current user and id lists the user's UID, GID, and supplementary groups, which establishes the privilege context of the session. Network enumeration, credential extraction, and persistence require different commands and techniques.

Question 7Penetration Testing

A client requires that a penetration test report distinguish findings by severity. Which scoring system is most commonly used to assign a standardized severity rating to a technical vulnerability?

  1. EPSS percentile
  2. CWE category
  3. CVSS base score Correct answer.
  4. CVE identifier

Explanation

The Common Vulnerability Scoring System produces a numeric base score that maps to severity bands such as low, medium, high, and critical. CVE is an identifier, CWE classifies weakness types, and EPSS estimates exploitation probability rather than severity.

Question 8Penetration Testing

Which statement correctly describes the purpose of a rules of engagement document in a penetration test?

  1. It specifies the exploit code the tester must use for each finding
  2. It defines authorized targets, time windows, testing limits, and escalation contacts Correct answer.
  3. It replaces the need for written authorization from the target owner
  4. It lists every vulnerability the tester expects to find during the engagement

Explanation

Rules of engagement record the agreed scope, permitted techniques, timing, constraints, and emergency contacts so both parties share the same boundaries. It is not a prediction of findings, does not substitute for authorization, and does not dictate specific exploits.

Question 9Penetration Testing

A web application returns different response lengths when a valid username is submitted to the login form. Which technique does this behavior enable?

  1. Cross-site request forgery
  2. HTTP response splitting
  3. Server-side request forgery
  4. Username enumeration Correct answer.

Explanation

Observable differences in response size, timing, or messaging for valid versus invalid accounts allow an attacker to enumerate existing usernames. CSRF, SSRF, and response splitting involve different mechanisms and do not rely on account validity signals.

Question 10Penetration Testing

A tester observes that an application accepts a serialized object in a cookie and that the object's class name appears in the decoded value. Which vulnerability class should be investigated first?

  1. SQL injection
  2. Directory traversal
  3. Insecure deserialization Correct answer.
  4. Cross-site scripting

Explanation

Client-controlled serialized data whose class information is visible strongly suggests insecure deserialization, where attacker-supplied objects can trigger dangerous behavior during reconstruction. SQL injection, XSS, and traversal involve query manipulation, script injection, and path handling respectively.

Question 11Penetration Testing

During an internal test, a tester captures NTLM authentication traffic and wants to relay it to another host. Which control most directly prevents a successful NTLM relay attack?

  1. Blocking outbound DNS to the internet
  2. Disabling NetBIOS over TCP/IP on workstations
  3. Enforcing SMB signing on servers and clients Correct answer.
  4. Requiring long user account passwords

Explanation

SMB signing cryptographically binds each message to the session, so relayed authentication cannot be reused against a signing-required server. Disabling NetBIOS, blocking DNS, and lengthening passwords do not stop an attacker from relaying captured authentication to another host.

Question 12Penetration Testing

A tester needs to identify whether a target web server supports the TLS 1.0 protocol. Which approach directly answers that question?

  1. Sending an HTTP OPTIONS request to enumerate allowed methods
  2. Querying the server's DNS TXT records for version information
  3. Negotiating a connection restricted to TLS 1.0 and observing whether the handshake succeeds Correct answer.
  4. Requesting the server's HTML index page and inspecting response headers

Explanation

Protocol support is confirmed by attempting a handshake constrained to the specific version and checking whether negotiation completes. Inspecting HTML, enumerating HTTP methods, or reading DNS records does not reveal which TLS versions the listener accepts.

Question 13Penetration Testing

A tester gains a low-privilege shell on a Windows host and finds the SeImpersonatePrivilege token privilege assigned to the account. Which escalation technique does this privilege most directly enable?

  1. Token impersonation to run code as a higher-privileged account Correct answer.
  2. Bypassing application allowlisting with signed binaries
  3. Kernel exploitation through a vulnerable driver
  4. Credential dumping from the LSASS process

Explanation

SeImpersonatePrivilege allows a process to impersonate a token it can obtain, which well-known techniques abuse to run code in a higher-privileged security context. Driver exploitation, LSASS dumping, and allowlist bypass are separate techniques with different prerequisites.

Question 14Penetration Testing

A tester discovers that a Linux binary has the SUID bit set and is owned by root. Which condition would make this a viable local privilege escalation path?

  1. The binary requires a password before it runs
  2. The binary is statically linked and stripped of symbols
  3. The binary allows execution of arbitrary commands or reads files with root privileges Correct answer.
  4. The binary is stored in a directory writable only by root

Explanation

A SUID root binary is dangerous when it lets an unprivileged user influence privileged operations, such as running commands or reading protected files as root. Static linking, symbol stripping, a root-only directory, and a password prompt do not by themselves grant escalation.

Question 15Penetration Testing

A tester wants to pivot from a compromised Linux host into an otherwise unreachable internal subnet. Which capability is required on the compromised host to forward traffic to that subnet?

  1. The host has a DNS record in the public zone
  2. The host has a valid public TLS certificate
  3. The host runs an antivirus product
  4. The host can route packets between the tester and the internal subnet Correct answer.

Explanation

Pivoting relies on the compromised host forwarding traffic between the tester's network and the internal segment, which requires routing or proxy capability on that host. Certificates, antivirus, and public DNS records do not affect the ability to relay traffic.

Question 16Penetration Testing

A tester identifies that a web application builds an LDAP filter by concatenating user input directly. Which input is most likely to alter the filter's logic?

  1. A value containing a null byte
  2. A value containing a long random string
  3. A value containing an HTML script tag
  4. A value containing asterisk and parenthesis characters Correct answer.

Explanation

LDAP filters use asterisks as wildcards and parentheses to delimit expressions, so injecting those characters can change the filter's boolean logic. Script tags target browsers, null bytes affect string termination in other contexts, and random strings do not modify filter structure.

Question 17Penetration Testing

A tester needs to verify whether a target host allows anonymous LDAP binds before attempting authenticated enumeration. Which action most directly answers that question?

  1. Requesting a certificate from the directory service
  2. Sending an HTTP GET request to the directory service port
  3. Querying the host's reverse DNS record
  4. Binding to the directory service with an empty distinguished name and password Correct answer.

Explanation

An anonymous bind is tested by attempting a bind with no credentials and observing whether the server accepts it. HTTP requests, reverse DNS lookups, and certificate requests do not establish whether unauthenticated binds are permitted.

Question 18Penetration Testing

A tester captures a WPA2 handshake during a wireless assessment and wants to test the passphrase offline. Which element of the captured handshake is used to verify a candidate passphrase?

  1. The client's DHCP lease duration
  2. The beacon frame's supported data rates
  3. The four-way handshake nonces and message integrity check Correct answer.
  4. The access point's SSID broadcast interval

Explanation

Offline passphrase testing derives the pairwise master key from the SSID and candidate passphrase, then checks the derived session keys against the captured handshake nonces and integrity check. SSID intervals, DHCP leases, and data rates do not verify a passphrase.

Question 19Penetration Testing

A tester wants to intercept and modify HTTPS traffic from a mobile application during an authorized assessment. Which setup enables this while keeping the connection usable by the app?

  1. Disabling TLS on the server side for the test window
  2. Configuring the device to trust a proxy's certificate authority and routing traffic through that proxy Correct answer.
  3. Capturing traffic with a passive tap and never decrypting it
  4. Blocking all outbound port 443 traffic from the device

Explanation

Interception requires the client to trust the proxy's CA so the proxy can terminate and re-sign TLS connections, allowing inspection and modification. Blocking port 443, disabling server TLS, or passively tapping without decryption does not permit modification of HTTPS content.

Question 20Penetration Testing

During an assessment, a tester finds a server that reflects user input into an HTTP response header without sanitization. Which attack does this most directly enable?

  1. Insecure direct object reference
  2. Blind SQL injection
  3. HTTP response splitting Correct answer.
  4. Server-side template injection

Explanation

Unsanitized input placed into response headers can allow carriage return and line feed injection, splitting the response and adding attacker-controlled headers or bodies. The other vulnerabilities involve database queries, template evaluation, or object reference manipulation.

Question 21Penetration Testing

A tester needs to demonstrate impact from a found SQL injection without exfiltrating production data. Which approach best supports a safe proof of concept?

  1. Dumping the full customer table to a local file for evidence
  2. Using boolean or time-based inference to confirm injection and extract a harmless marker value Correct answer.
  3. Dropping a test table to show write access
  4. Escalating to operating system command execution on the database host

Explanation

A safe proof confirms the vulnerability with minimal data exposure, such as extracting a value the tester controls or a version string. Dumping production tables, dropping tables, and escalating to command execution cause unnecessary risk and exceed a minimal proof of concept.

Question 22Penetration Testing

A tester obtains a hash from a Windows host and wants to authenticate to another host without cracking the plaintext. Which technique does this describe?

  1. Golden ticket forgery
  2. Pass-the-ticket
  3. Pass-the-hash Correct answer.
  4. Kerberoasting

Explanation

Pass-the-hash reuses a captured NTLM hash directly in authentication, so the plaintext password is never needed. Pass-the-ticket reuses Kerberos tickets, Kerberoasting requests service tickets for offline cracking, and a golden ticket is forged with the KRBTGT key.

Question 23Penetration Testing

A tester finds that a web application uses a signed JSON Web Token and that the server accepts tokens whose header specifies the none algorithm. What is the security consequence?

  1. An attacker can decrypt the token to recover the signing key
  2. An attacker can forge arbitrary claims because signature verification is bypassed Correct answer.
  3. An attacker can force the server to reissue the signing key
  4. An attacker can replay the token only within its original session

Explanation

If the server honors the none algorithm, it accepts unsigned tokens, letting an attacker craft any claims without knowing the signing key. The flaw does not reveal the key, restrict replay, or cause key reissuance.

Question 24Penetration Testing

A tester identifies a Kerberos delegation configuration where a service account can impersonate users to any service in the domain. Which delegation type does this describe?

  1. Unconstrained delegation Correct answer.
  2. Constrained delegation
  3. Protocol transition
  4. Resource-based constrained delegation

Explanation

Unconstrained delegation allows a service to obtain tickets for any service on behalf of a user, making it far more dangerous than constrained variants. Constrained delegation limits targets, resource-based constrained delegation is configured on the resource, and protocol transition concerns obtaining tickets without a user password.

Question 25Penetration Testing

A tester discovers a web cache that stores responses keyed only on the URL path while the application varies content on the X-Forwarded-Host header. Which attack does this configuration enable?

  1. Race condition through concurrent requests
  2. Cross-site request forgery through cookie fixation
  3. Open redirect through path normalization
  4. Web cache poisoning through unkeyed header injection Correct answer.

Explanation

When a header influences the response but is not part of the cache key, an attacker can inject a malicious value that gets stored and served to other users, which is cache poisoning. CSRF, open redirects, and race conditions involve different mechanisms.

Question 26Penetration Testing

During an authorized assessment, a tester must confirm which TCP services are listening on a target subnet before deeper enumeration. Which activity best fits the scoping phase of a penetration test?

  1. Obtaining written authorization and defining in-scope IP ranges and test windows Correct answer.
  2. Publishing discovered vulnerabilities to a public disclosure platform
  3. Running a full port sweep against the entire corporate address space
  4. Launching an exploit against the first discovered service

Explanation

Scoping establishes written authorization, in-scope targets, excluded systems, timing, and constraints before any active testing begins. Active scanning or exploitation without that agreement risks unauthorized access and legal exposure.

Question 27Penetration Testing

A tester wants to enumerate live hosts on an internal /24 without generating TCP handshakes. Which technique matches that goal?

  1. A full TCP connect scan of all 65535 ports
  2. An HTTP GET request to each host's web root
  3. ARP requests to each address in the subnet Correct answer.
  4. A DNS zone transfer request to each host

Explanation

On a local Layer 2 segment, ARP requests resolve which IP addresses are actively claimed, and replies indicate live hosts without completing TCP handshakes. This is fast and quiet compared with port scanning every address.

Question 28Penetration Testing

A tester needs to determine the operating system of a remote host from network responses alone, without credentials. Which approach is appropriate?

  1. Querying the local Windows registry remotely with reg query
  2. Inspecting the target's BIOS version through WMI
  3. Analyzing TCP/IP stack fingerprints such as initial TTL and window size Correct answer.
  4. Reading the host's /etc/os-release file over SMB

Explanation

Passive and active stack fingerprinting infers the OS from characteristics like initial TTL, TCP window size, and option ordering in responses. It requires no credentials and works against remote hosts.

Question 29Penetration Testing

A tester is performing a web application assessment and needs to map the application's visible structure without authentication. Which activity describes spidering?

  1. Injecting SQL payloads into every parameter
  2. Brute-forcing passwords against the login form
  3. Intercepting traffic between the browser and server
  4. Crawling links and forms to build a map of reachable resources Correct answer.

Explanation

Spidering follows hyperlinks, form actions, and script references to enumerate reachable pages and parameters. It builds the attack surface map that later testing targets.

Question 30Penetration Testing

A tester must capture and replay HTTP requests to inspect and modify parameters during a web assessment. Which tool category is designed for this?

  1. A password cracker
  2. A port scanner
  3. An intercepting web proxy Correct answer.
  4. A packet capture library

Explanation

An intercepting proxy sits between the browser and server, letting the tester view, pause, and alter requests and responses. This is the standard way to manipulate parameters manually.

Question 31Penetration Testing

A tester needs to verify whether a target host permits anonymous FTP login. Which action directly answers that question?

  1. Sending a DNS query for an FTP SRV record
  2. Requesting the server's TLS certificate
  3. Connecting with the username anonymous and any email-style password Correct answer.
  4. Running a SYN scan against port 21

Explanation

Anonymous FTP access is confirmed by authenticating with the anonymous account, which conventionally accepts any email address as a password. A successful login proves the misconfiguration.

Question 32Penetration Testing

During an internal assessment, a tester wants to capture broadcast traffic to identify protocols and hosts in use. Which capability is required on the tester's interface?

  1. Promiscuous mode to receive frames not addressed to the interface Correct answer.
  2. IPv6 privacy extensions enabled
  3. A DHCP reservation for the tester's address
  4. A static ARP entry for the default gateway

Explanation

Promiscuous mode lets the network card pass frames not destined for the tester's MAC address to the capture stack. Without it, the interface discards other hosts' traffic.

Question 33Penetration Testing

A tester needs to confirm whether a target web server accepts the obsolete SSLv3 protocol. Which method directly determines this?

  1. Running a UDP scan against port 443
  2. Requesting the server's robots.txt file
  3. Sending an HTTP OPTIONS request to the server
  4. Attempting a TLS handshake restricted to SSLv3 with a client such as openssl s_client Correct answer.

Explanation

Protocol support is verified by negotiating a handshake constrained to the specific protocol version. A successful handshake proves the server accepts it.

Question 34Penetration Testing

A tester has identified a login form that returns a distinct error message for valid versus invalid usernames. Which follow-up action best confirms and quantifies the enumeration issue?

  1. Capture the session cookie and decode it
  2. Attempt SQL injection in the password field
  3. Submit a list of candidate usernames and compare response content and timing Correct answer.
  4. Run a directory brute-force against the web root

Explanation

Confirming username enumeration requires systematically submitting candidates and comparing observable differences such as message text, length, or timing. This distinguishes genuine enumeration from incidental variation.

Question 35Penetration Testing

A tester finds a service banner reporting an outdated version and wants to verify whether a known vulnerability applies before exploiting it. Which step is most appropriate?

  1. Ignore the banner because version strings are always spoofed
  2. Assume the banner is accurate and report critical severity
  3. Test the specific vulnerable behavior against the service in a controlled manner Correct answer.
  4. Immediately run a public exploit without further checks

Explanation

Banners can be inaccurate or backported patches may already be applied, so the specific vulnerable behavior should be confirmed before exploitation. This avoids false positives and unnecessary service disruption.

Question 36Penetration Testing

During a password attack against a web login, a tester wants to avoid locking out accounts. Which control most directly limits lockout risk?

  1. Throttling request rate and stopping after a set number of failures per account Correct answer.
  2. Adding more proxy threads
  3. Switching from HTTP to HTTPS
  4. Increasing the size of the password wordlist

Explanation

Lockout policies trigger on repeated failures within a window, so limiting attempts per account and pacing requests avoids tripping them. More threads or larger lists increase the risk.

Question 37Penetration Testing

A tester needs to enumerate SMB shares on a Windows host with valid low-privilege domain credentials. Which approach is appropriate?

  1. Sending ICMP echo requests to the host
  2. Querying the host's DNS PTR record
  3. Listing shares using authenticated SMB enumeration Correct answer.
  4. Attempting anonymous LDAP binds

Explanation

Share enumeration requires speaking SMB with the supplied credentials to list available shares and permissions. That directly reveals what the account can access.

Question 38Penetration Testing

A tester discovers that a web application trusts the X-Forwarded-For header for access control decisions. Which impact is most likely if this is confirmed?

  1. Decrypting TLS traffic between clients and the server
  2. Bypassing IP-based restrictions by spoofing the header value Correct answer.
  3. Escalating to domain administrator on the backend
  4. Achieving remote code execution through the header parser

Explanation

If the application authorizes based on a client-supplied header, a tester can set that header to an allowed address and reach restricted functionality. This is an access control bypass, not code execution.

Question 39Penetration Testing

A tester wants to identify hidden administrative endpoints on a web application. Which technique is most appropriate?

  1. Port scanning the server's UDP services
  2. Content discovery using a curated wordlist of common administrative paths Correct answer.
  3. Capturing broadcast traffic on the local segment
  4. Enumerating the server's TLS cipher suites

Explanation

Content discovery requests candidate paths from a wordlist and compares responses to find unlinked resources such as admin panels. It targets web content rather than network services.

Question 40Penetration Testing

A tester gains a foothold on a Linux host and wants to identify privilege escalation paths. Which artifact is most relevant to review first?

  1. The system's keyboard layout settings
  2. The host's NTP configuration
  3. Files with SUID or SGID bits set and their owners Correct answer.
  4. The DNS resolver configuration

Explanation

SUID and SGID binaries execute with the owner's or group's privileges and are a common escalation vector when misconfigured. Reviewing them identifies candidates for abuse.

Question 41Penetration Testing

A tester finds a service running as a high-privilege account and wants to check for unquoted service path issues on Windows. Which condition makes this exploitable?

  1. The service uses a signed binary from a protected directory
  2. The service binary path contains spaces and is unquoted, with a writable directory earlier in the path Correct answer.
  3. The service account is a low-privilege local user
  4. The service is disabled at startup

Explanation

Windows resolves unquoted paths containing spaces by trying successive prefixes, so a writable earlier directory lets an attacker plant a binary that runs with the service's privileges.

Question 42Penetration Testing

A tester needs to determine whether an internal DNS server allows recursive queries from arbitrary clients. Which query best tests this?

  1. Requesting resolution of an external domain the server does not host Correct answer.
  2. Sending a query with the recursion desired flag cleared
  3. Querying the root zone for the server's hostname
  4. Requesting the server's own SOA record

Explanation

Recursion is confirmed when the server resolves a name outside its authoritative zones on behalf of the client. That behavior indicates open recursion.

Question 43Penetration Testing

A tester finds that an application stores session identifiers in URLs rather than cookies. Which risk is most directly introduced?

  1. Session identifiers leak through logs, referrer headers, and shared links Correct answer.
  2. TLS certificates expire prematurely
  3. The application becomes vulnerable to buffer overflows
  4. Passwords are stored in plaintext in the database

Explanation

URL-based session identifiers are recorded in browser history, proxy logs, and referrer headers sent to third parties, enabling session hijacking. Moving identifiers into secure cookies mitigates this.

Question 44Penetration Testing

A tester must demonstrate the impact of a blind command injection without causing damage. Which approach is most appropriate?

  1. Modify the application's configuration file
  2. Delete a temporary file to prove execution
  3. Open a reverse shell to the tester's host
  4. Trigger a benign out-of-band interaction such as a DNS lookup to a tester-controlled host Correct answer.

Explanation

Out-of-band callbacks prove command execution while minimizing impact on the target. Destructive actions or shells exceed what is needed for a safe proof of concept.

Question 45Penetration Testing

A tester finds that a web application accepts a file upload and stores files in a web-accessible directory. Which follow-up most directly tests for remote code execution risk?

  1. Uploading a large text file to test size limits
  2. Renaming an uploaded image file
  3. Uploading a benign script with an executable extension and requesting it Correct answer.
  4. Checking the upload form's HTML source

Explanation

If an uploaded script with a server-executable extension can be retrieved and executed, the upload path enables code execution. Using a benign script keeps the test safe.

Question 46Penetration Testing

A tester observes that an application's password reset token is derived from a predictable timestamp. Which attack becomes feasible?

  1. Predicting valid reset tokens to take over other accounts Correct answer.
  2. Decrypting the application's TLS session
  3. Escalating to database administrator through SQL injection
  4. Intercepting Kerberos tickets on the network

Explanation

Predictable tokens let an attacker generate likely values and submit them for victim accounts, enabling account takeover. Tokens should be generated with a cryptographically secure random source.

Question 47Penetration Testing

During an internal assessment, a tester captures challenge-response authentication traffic and wants to reuse it against another host. Which condition must hold for the relay to succeed?

  1. The target must run an obsolete web server
  2. The captured traffic must be encrypted with TLS
  3. The tester must know the user's plaintext password
  4. The target must accept the relayed authentication and the protocol must not enforce signing Correct answer.

Explanation

Relaying works when the target accepts the authentication exchange and integrity protections such as signing are not enforced. Knowing the plaintext is not required for relay.

Question 48Penetration Testing

A tester finds that a web application deserializes user-controlled data and that a vulnerable library is present on the classpath. Which outcome best demonstrates exploitability?

  1. Finding the serialization format in the request body
  2. Achieving a controlled out-of-band callback from a crafted serialized payload Correct answer.
  3. Confirming the library version from a banner
  4. Observing an error page after submitting malformed data

Explanation

A controlled callback from a crafted payload demonstrates that deserialization leads to code execution or equivalent impact. Errors or version strings alone do not prove exploitability.

Question 49Penetration Testing

A tester identifies a service account configured for constrained delegation to a single SPN. Which factor most determines whether the tester can impersonate arbitrary users to that service?

  1. Whether the target host has IPv6 enabled
  2. Whether the service account password is long
  3. Whether the tester controls an account trusted for delegation and can obtain a service ticket for the target SPN Correct answer.
  4. Whether the domain uses LDAP over TLS

Explanation

Abuse of delegation requires the ability to request a service ticket for the delegated SPN on behalf of another user, typically via an account trusted for delegation. Host networking or password length do not enable impersonation.

Question 50Penetration Testing

A tester finds a web cache that keys responses only on the URL path while the application varies content based on a request header. Which attack does this enable?

  1. Web cache poisoning that serves attacker-influenced content to other users Correct answer.
  2. TLS downgrade to an obsolete protocol
  3. Server-side request forgery through URL parsing
  4. Cross-site request forgery against authenticated administrators

Explanation

When the cache key omits an input that changes the response, an attacker can prime the cache with a malicious response that is then served to other users. This is web cache poisoning.