I85PREP
⌘ K
PECB Certified Lead Ethical Hacker study materials
PECB Certified Lead Ethical Hacker study resources

PECB Certified Lead Ethical Hacker practice questions

One question at a time. Build your PECB Certified Lead Ethical Hacker understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information gathering tools and techniques

During an authorized engagement, a tester needs to identify which hosts on a /24 subnet are alive before launching a deeper scan. Which technique produces the most reliable host-discovery result without relying on ICMP echo alone?

  1. ARP requests to each address when the tester is on the same broadcast domain Correct answer.
  2. ICMP timestamp requests to each address
  3. Reverse DNS lookups for each address
  4. TCP SYN to port 80 only on each address

Explanation

On a local segment, ARP resolution is authoritative because a host must answer to receive traffic, whereas ICMP echo is frequently filtered. ARP scanning therefore yields fewer false negatives than ICMP-based discovery when the tester shares the broadcast domain.

Question 2Information gathering tools and techniques

Which tool is specifically designed for passive OSINT collection of domain registration data such as registrar, creation date, and registrant organization?

  1. traceroute
  2. whois Correct answer.
  3. netdiscover
  4. hping3

Explanation

WHOIS queries registry and registrar databases and returns registration metadata for a domain or IP block. The other tools operate on live network paths or local hosts and do not retrieve registration records.

Question 3Information gathering tools and techniques

A tester wants to enumerate subdomains of a target domain using only publicly available certificate transparency logs. Which approach best matches this requirement?

  1. Running a brute-force DNS dictionary against the authoritative server
  2. Sending ICMP echo requests to guessed hostnames
  3. Querying a certificate transparency log service for certificates issued to the domain Correct answer.
  4. Performing a zone transfer against each authoritative name server

Explanation

Certificate transparency logs record issued TLS certificates and their subject alternative names, which often reveal internal and external subdomains without touching the target. Brute force and zone transfers are active techniques that generate traffic toward the target.

Question 4Information gathering tools and techniques

Which DNS record type most directly supports email sender authentication information useful during OSINT reconnaissance of a target's mail infrastructure?

  1. TXT Correct answer.
  2. PTR
  3. CNAME
  4. MX

Explanation

SPF, DKIM, and DMARC policies are published as TXT records and reveal how a domain authenticates mail. MX records only identify mail exchangers, while CNAME and PTR serve aliasing and reverse resolution.

Question 5Information gathering tools and techniques

A tester runs a query against a public search engine using operators to find documents hosted on the target's site. Which operator restricts results to a specific domain?

  1. intitle:
  2. cache:
  3. filetype:
  4. site: Correct answer.

Explanation

The site: operator limits results to a specified domain or subdomain, which is a standard way to enumerate indexed content belonging to a target. The other operators filter by file extension, page title, or cached copy rather than domain.

Question 6Information gathering tools and techniques

During reconnaissance, a tester observes that a target's name server allows a zone transfer. What is the primary significance of this finding?

  1. The target's TLS private keys are retrievable
  2. The name server is confirmed to be vulnerable to cache poisoning
  3. The full set of DNS records for the zone may be disclosed to the requester Correct answer.
  4. The domain's registrar credentials are exposed

Explanation

An unrestricted AXFR returns every record in the zone, exposing hostnames, mail servers, and internal naming conventions. It does not by itself prove cache poisoning exposure, registrar compromise, or key disclosure.

Question 7Information gathering tools and techniques

Which Nmap option performs host discovery without port scanning, making it suitable for a first-pass inventory of a subnet?

  1. -sV
  2. -sS
  3. -sn Correct answer.
  4. -O

Explanation

The -sn option runs ping scan mode, which discovers live hosts without probing ports. The other options perform TCP SYN scanning, service version detection, or operating system fingerprinting.

Question 8Information gathering tools and techniques

A tester wants to passively capture traffic on a switched LAN segment to observe broadcast protocols and ARP behavior. Which tool is most appropriate?

  1. Nikto
  2. Gobuster
  3. Wireshark Correct answer.
  4. theHarvester

Explanation

Wireshark captures and dissects live packets, making it suitable for observing ARP and broadcast traffic. The other tools perform web vulnerability scanning, OSINT collection, or content brute forcing rather than packet capture.

Question 9Information gathering tools and techniques

An assessor must map the network path to a target across multiple autonomous systems and wants autonomous system numbers for each hop. Which tool best fits this need?

  1. traceroute with AS lookup enabled Correct answer.
  2. ping with the flood option
  3. dig with the trace option
  4. arp-scan

Explanation

Traceroute reveals each hop along the path, and when combined with AS lookups it annotates hops with autonomous system numbers. Ping, dig, and arp-scan do not map multi-hop paths with AS attribution.

Question 10Information gathering tools and techniques

Which technique uses a search engine to find documents that reference the target organization but are hosted on third-party sites, often revealing leaked information?

  1. Using the link: or related search operators and keyword combinations Correct answer.
  2. Performing a DNS zone transfer
  3. Running a TCP connect scan against the target
  4. Executing an SNMP walk against the target

Explanation

Search operators and keyword combinations surface third-party pages that mention the organization, which can expose leaked documents or partner references. The other options are active network techniques that do not search indexed external content.

Question 11Information gathering tools and techniques

A tester discovers a public code repository containing a configuration file with internal hostnames. Which classification best describes this finding in an information-gathering context?

  1. A denial-of-service condition on the target
  2. Passive OSINT exposure requiring validation before use Correct answer.
  3. A cryptographic weakness in the target's TLS configuration
  4. Active scanning evidence admissible without verification

Explanation

Repository content is passively collected open-source intelligence and must be validated because it may be outdated or decoy data. It is not active scanning output, a denial-of-service condition, or a TLS weakness.

Question 12Information gathering tools and techniques

Which tool is commonly used to enumerate DNS records, perform reverse lookups, and attempt zone transfers from a single command-line interface?

  1. msfvenom
  2. dnsrecon Correct answer.
  3. sqlmap
  4. hydra

Explanation

dnsrecon automates DNS enumeration, reverse lookups, and zone transfer attempts. The other tools target SQL injection, credential brute forcing, and payload generation respectively.

Question 13Information gathering tools and techniques

A tester wants to identify live hosts on a local subnet using ARP requests and receive results in a concise list. Which tool is purpose-built for this?

  1. curl
  2. arp-scan Correct answer.
  3. whois
  4. nslookup

Explanation

arp-scan sends ARP requests across a range and reports responding hosts with their MAC addresses. The other tools resolve names, query registration data, or transfer web content.

Question 14Information gathering tools and techniques

During OSINT work, a tester wants to find email addresses and employee names associated with a target domain from public sources. Which tool is designed for this aggregation?

  1. John the Ripper
  2. Wireshark
  3. Nmap
  4. theHarvester Correct answer.

Explanation

theHarvester aggregates names and email addresses from search engines and public sources for a given domain. The other tools capture packets, scan networks, or crack passwords.

Question 15Information gathering tools and techniques

A tester wants to determine which web technologies, server versions, and frameworks a target site exposes through response headers. Which approach is most appropriate?

  1. Performing a DNS zone transfer
  2. Inspecting HTTP response headers and using a fingerprinting tool such as WhatWeb Correct answer.
  3. Sending ARP requests to the web server
  4. Running an SNMP walk against the web server

Explanation

HTTP headers and fingerprinting tools reveal server software, frameworks, and versions. SNMP, zone transfers, and ARP do not disclose web stack details.

Question 16Information gathering tools and techniques

Which record type would a tester query to determine the mail servers responsible for accepting email on behalf of a target domain?

  1. SOA
  2. NS
  3. MX Correct answer.
  4. A

Explanation

MX records list the mail exchangers for a domain along with their preference values. A records map names to addresses, NS records identify name servers, and SOA records describe zone authority.

Question 17Information gathering tools and techniques

A tester obtains a list of IP ranges belonging to a target from regional internet registry data. Which source is most appropriate for this task?

  1. A local ARP cache dump
  2. RIR WHOIS databases queried by organization name Correct answer.
  3. A browser cookie store
  4. A packet capture of the tester's own workstation

Explanation

Regional internet registries publish allocation records searchable by organization, revealing assigned IP ranges. Local ARP caches, cookies, and workstation captures do not contain registry allocation data.

Question 18Information gathering tools and techniques

When performing active reconnaissance, why should a tester prefer a TCP SYN scan over a TCP connect scan in many authorized scenarios?

  1. A SYN scan encrypts the probe traffic by default
  2. A SYN scan requires no privileges on any operating system
  3. A SYN scan does not complete the handshake and is less likely to be logged by the application Correct answer.
  4. A SYN scan bypasses all host-based firewalls

Explanation

A half-open SYN scan sends a SYN and interprets the response without completing the three-way handshake, so application-layer logging is less likely. It does not encrypt traffic, bypass all firewalls, or avoid privilege requirements.

Question 19Information gathering tools and techniques

A tester wants to passively identify hosts and services by observing traffic mirrored from a switch port rather than sending probes. Which configuration supports this?

  1. A default gateway change on the target subnet
  2. A DHCP scope reservation for the tester
  3. A SPAN or mirror port configured to copy traffic to the tester's interface Correct answer.
  4. A DNS forwarder pointed at the tester

Explanation

Switch port mirroring copies selected traffic to a monitoring interface, enabling passive observation without probes. Gateway changes, DHCP reservations, and DNS forwarders alter network behavior rather than mirror traffic.

Question 20Information gathering tools and techniques

A tester finds that a target's DNS server returns different answers depending on the source address of the query. Which reconnaissance implication is most significant?

  1. The target has no mail infrastructure
  2. The zone is guaranteed to permit unrestricted transfers
  3. Split-horizon DNS may hide internal records from external queries, so external enumeration is incomplete Correct answer.
  4. The DNS server is confirmed to be running outdated software

Explanation

Split-horizon configurations serve different views to internal and external clients, so external enumeration reveals only the public view. This does not prove outdated software, transfer permission, or absence of mail.

Question 21Information gathering tools and techniques

Which approach best validates that a hostname discovered through passive OSINT actually resolves to a live service before it is reported?

  1. Immediately include it in the report without further checks
  2. Resolve the name and probe the identified service within the authorized scope Correct answer.
  3. Delete the finding because passive data is unreliable
  4. Assume the hostname is internal and out of scope

Explanation

Passive findings require confirmation, so the tester resolves the name and probes the service only within the agreed scope. Reporting unverified data, assuming scope, or discarding valid findings are all poor practice.

Question 22Information gathering tools and techniques

A tester needs to enumerate SNMP information such as system description and interface details from a network device in scope. Which tool is most appropriate?

  1. ncrack
  2. gobuster
  3. dnsenum
  4. snmpwalk Correct answer.

Explanation

snmpwalk retrieves a subtree of management information from an SNMP agent, exposing system and interface data. The other tools brute-force content, crack credentials, or enumerate DNS.

Question 23Information gathering tools and techniques

During reconnaissance, a tester observes that responses to crafted probes vary subtly between two hosts sharing an IP address. Which conclusion is most defensible?

  1. The hosts are confirmed to be the same physical machine
  2. The target is confirmed to be vulnerable to ARP spoofing
  3. A load balancer or reverse proxy may be distributing traffic, so fingerprinting must account for multiple backends Correct answer.
  4. The network is confirmed to be free of filtering devices

Explanation

Inconsistent responses from one address often indicate load balancing or proxying, meaning fingerprinting must be repeated and correlated. It does not prove a single machine, absence of filtering, or ARP spoofing exposure.

Question 24Information gathering tools and techniques

Which method best supports discovering virtual hosts served by a single IP address during web reconnaissance?

  1. Querying the SOA record of the domain
  2. Sending requests with different Host headers and comparing responses Correct answer.
  3. Capturing broadcast traffic on the local segment
  4. Running an ARP scan against the IP address

Explanation

Virtual host discovery relies on varying the Host header and comparing status codes, content lengths, and bodies. ARP, SOA queries, and broadcast capture do not enumerate name-based virtual hosts.

Question 25Information gathering tools and techniques

A tester wants to gather information about a target's public cloud footprint by examining DNS records that point to provider-hosted services. Which record types are most useful for this purpose?

  1. CNAME and A records resolving to provider domains and address ranges Correct answer.
  2. NS and SOA records only
  3. MX and PTR records only
  4. SOA and TXT records describing zone policy

Explanation

CNAMEs often alias to provider hostnames, and A records may resolve into provider address ranges, revealing hosted services. SOA, TXT, MX, PTR, and NS records do not directly map services to cloud providers.

Question 26Information gathering tools and techniques

A tester wants to enumerate employee names, job titles, and departmental structure from a target's public website without sending packets to the target's own infrastructure. Which information-gathering category does this activity belong to?

  1. Credentialed vulnerability scanning
  2. Passive open source intelligence collection Correct answer.
  3. Network-layer route tracing
  4. Active service banner grabbing

Explanation

Passive collection relies on third-party or publicly published data and does not touch the target's systems directly, so the target has no opportunity to log the activity. Banner grabbing, route tracing, and vulnerability scanning all generate traffic toward target-owned assets and therefore belong to active reconnaissance.

Question 27Information gathering tools and techniques

During DNS reconnaissance, a tester queries the target domain for TXT records. Which finding most directly indicates an email anti-spoofing policy in force?

  1. A record containing a DKIM public key selector
  2. A record mapping the domain to an IPv6 address
  3. A record delegating a subdomain to an external name server
  4. A record beginning with v=spf1 and listing authorized sending hosts Correct answer.

Explanation

SPF policy is published as a TXT record whose value starts with the v=spf1 version tag and enumerates the hosts permitted to send mail for the domain. Its presence tells the tester that spoofed envelope senders may be rejected, which shapes later phishing or social-engineering assessments.

Question 28Information gathering tools and techniques

A tester wants to collect historical registration details for a target domain, including the original registrant organization and creation date, after the current record has been redacted for privacy. Which source is most appropriate?

  1. A passive DNS database of observed resolutions
  2. The authoritative name server for the domain
  3. The zone file published by the registry
  4. A historical WHOIS archive service Correct answer.

Explanation

Historical WHOIS archives retain earlier snapshots of registration records, so pre-redaction registrant data and creation dates can often still be recovered. Authoritative servers, passive DNS, and registry zone files describe name resolution rather than registrant identity.

Question 29Information gathering tools and techniques

An assessor needs to identify which hosts on a routed subnet are alive while minimizing the chance that a stateful firewall logs completed connections. Which Nmap scan type best matches this requirement?

  1. TCP SYN scan that never completes the handshake Correct answer.
  2. Idle scan using a third-party zombie host
  3. TCP connect scan using the operating system call
  4. UDP scan with ICMP port unreachable analysis

Explanation

A SYN scan sends the initial synchronize segment and tears the connection down before the handshake completes, so many stateful devices never record an established session. This makes it the common choice when the engagement requires low-observability port discovery.

Question 30Information gathering tools and techniques

While reviewing a target's published documents, a tester extracts author metadata, software versions, and internal file paths from the files themselves. Which technique is being applied?

  1. Subdomain brute forcing against authoritative servers
  2. Service version detection through crafted probes
  3. Certificate transparency log correlation
  4. Metadata harvesting from publicly available documents Correct answer.

Explanation

Documents frequently embed author names, creation software, and internal directory paths in their properties, and extracting these is a standard OSINT technique. The recovered details often reveal usernames, office suite versions, and naming conventions useful for later targeting.

Question 31Information gathering tools and techniques

A tester uses a search engine operator to restrict results to a specific site while excluding a term that appears in marketing pages. Which query best achieves this?

  1. related:example.com marketing
  2. link:example.com intext:marketing
  3. cache:example.com marketing
  4. site:example.com -inurl:marketing Correct answer.

Explanation

The site: operator limits results to the named domain, and a leading minus sign excludes results containing the following term, so site:example.com -inurl:marketing returns pages on the domain whose URLs omit the marketing path. Combining operators this way narrows large result sets to meaningful reconnaissance targets.

Question 32Information gathering tools and techniques

A tester needs to enumerate hosts and services exposed on the public internet by a target organization without sending any packets to the organization's own address space. Which data source supports this goal?

  1. A full TCP connect sweep of the target's registered ranges
  2. A zone transfer request to each authoritative name server
  3. An SNMP walk of each discovered router
  4. A commercial internet-wide scan dataset such as Shodan or Censys Correct answer.

Explanation

Internet-wide scan datasets are built by third parties crawling the public address space, so querying them returns observed open ports and banners without the tester touching the target. This is passive from the target's perspective and useful when the rules of engagement restrict direct probing.

Question 33Information gathering tools and techniques

A tester obtains a certificate transparency log entry showing a hostname that does not appear in any public DNS record. What is the most reliable next step to determine whether the host currently serves content?

  1. Query the certificate issuer to confirm the hostname is valid
  2. Resolve the hostname and probe it only within the authorized scope Correct answer.
  3. Submit the hostname to a search engine and wait for indexing
  4. Assume the host is decommissioned because DNS does not resolve it

Explanation

Certificate logs record names at issuance time, and a name may exist in logs while lacking a current public record or resolving only internally. The defensible action is to verify resolution and reachability within the agreed scope before drawing any conclusion.

Question 34Information gathering tools and techniques

A tester plans to gather information about a target's mail infrastructure and wants to identify which third-party providers handle inbound mail before any direct interaction. Which record should be examined first?

  1. The SOA record for the target's zone
  2. The PTR records for the target's address blocks
  3. The CAA records for the target's certificates
  4. The MX records for the target's mail domain Correct answer.

Explanation

MX records name the hosts that accept mail for a domain, so their targets immediately reveal whether inbound mail is handled in-house or by a hosted provider. This lets the tester map the mail architecture passively before deciding on further probes.

Question 35Threat modeling and vulnerability identification

In threat modeling, what is the primary purpose of building a data flow diagram (DFD) before enumerating threats?

  1. To list the security controls required by a specific compliance framework
  2. To estimate the annual financial loss expected from each identified risk
  3. To document how data moves between external entities, processes, data stores, and trust boundaries Correct answer.
  4. To record the exact patch level of every server in the production environment

Explanation

A DFD models the system as external entities, processes, data stores, and flows crossing trust boundaries, giving the analyst a structural map on which threats can be located. Patch levels, financial loss estimates, and control catalogues are produced by other activities such as vulnerability scanning, risk quantification, and compliance mapping.

Question 36Threat modeling and vulnerability identification

An analyst is decomposing a system for threat modeling and needs a consistent way to classify what must be protected. Which element set matches the STRIDE-per-element approach?

  1. External interactors, processes, data stores, and data flows Correct answer.
  2. Vulnerabilities, exploits, payloads, and impacts
  3. Assets, owners, custodians, and users
  4. Policies, procedures, standards, and guidelines

Explanation

STRIDE-per-element applies threat categories to the four DFD element types: external interactors, processes, data stores, and data flows. Each element type is susceptible to a characteristic subset of threats, which makes enumeration systematic rather than ad hoc.

Question 37Threat modeling and vulnerability identification

A team wants a threat modeling method that starts from the attacker's goals and decomposes them into sub-goals represented as a tree. Which method fits?

  1. FAIR analysis
  2. Attack trees Correct answer.
  3. OCTAVE Allegro
  4. CVSS v3.1 scoring

Explanation

Attack trees begin with an attacker goal at the root and decompose it into sub-goals combined by AND/OR logic, exposing the cheapest paths to that goal. OCTAVE Allegro is an organizational risk method, CVSS scores individual vulnerabilities, and FAIR quantifies risk in financial terms.

Question 38Threat modeling and vulnerability identification

Which pairing of STRIDE category and violated security property is correct?

  1. Tampering violates integrity Correct answer.
  2. Spoofing violates availability
  3. Denial of service violates authenticity
  4. Repudiation violates confidentiality

Explanation

STRIDE maps each threat to the property it undermines: spoofing to authenticity, tampering to integrity, repudiation to non-repudiation, information disclosure to confidentiality, denial of service to availability, and elevation of privilege to authorization. Tampering with data therefore violates integrity.

Question 39Threat modeling and vulnerability identification

During reconnaissance, an ethical hacker queries public certificate transparency logs to discover hostnames belonging to a target organization. Which activity does this represent?

  1. Exploit development
  2. Privilege escalation
  3. Active service enumeration
  4. Passive information gathering Correct answer.

Explanation

Querying third-party public logs does not send traffic directly to the target's infrastructure, so it is passive reconnaissance. Active enumeration, exploitation, and privilege escalation all involve direct interaction with target systems.

Question 40Threat modeling and vulnerability identification

What does the Common Vulnerability Scoring System base score primarily express?

  1. The likelihood that the vulnerability will be exploited by a specific actor
  2. The intrinsic characteristics of a vulnerability independent of the target environment Correct answer.
  3. The remediation cost required to patch the affected software
  4. The business impact of the vulnerability on a named production asset

Explanation

The CVSS base score reflects intrinsic, environment-independent characteristics of a vulnerability such as attack vector, complexity, and impact. Temporal and environmental metrics exist separately to adjust for exploit maturity and deployed context.

Question 41Threat modeling and vulnerability identification

A vulnerability scanner reports a finding, and the analyst must decide whether it is a true positive. Which action best supports that determination?

  1. Delete the finding to reduce report noise
  2. Assign the highest severity to every unverified finding
  3. Escalate the finding directly to the patch management team without review
  4. Manually verify the finding against the affected service and version Correct answer.

Explanation

Validation confirms that the reported condition actually exists on the target, distinguishing true positives from scanner artifacts. Suppressing, escalating, or over-rating unverified findings undermines the integrity of the vulnerability management process.

Question 42Threat modeling and vulnerability identification

Which statement best describes the difference between a threat and a vulnerability?

  1. A threat is a confirmed exploit, while a vulnerability is an unconfirmed report
  2. A threat is a control gap, while a vulnerability is a compensating control
  3. A threat is a potential cause of harm, while a vulnerability is a weakness that a threat can exploit Correct answer.
  4. A threat is a weakness in code, while a vulnerability is an attacker's motivation

Explanation

Threats are potential actors or events that can cause harm, whereas vulnerabilities are weaknesses in assets, code, or configuration that a threat could exploit. Keeping these concepts distinct prevents conflating attacker capability with defensive weakness.

Question 43Threat modeling and vulnerability identification

An analyst is modeling a web application and wants to enumerate threats per interaction. Which approach is characteristic of the STRIDE methodology?

  1. Applying each STRIDE category to each DFD element and interaction to derive candidate threats Correct answer.
  2. Scoring each vulnerability with a vector string and ranking by base score
  3. Building a fault tree from hardware failure probabilities
  4. Mapping controls to the CIS Critical Security Controls

Explanation

STRIDE is applied systematically to DFD elements and the flows between them, producing a checklist-driven set of candidate threats for each interaction. Scoring, fault-tree reliability analysis, and control mapping are separate techniques.

Question 44Threat modeling and vulnerability identification

A threat model identifies that an internal administrative API trusts any request arriving from the corporate network. Which threat category does this most directly illustrate?

  1. Information disclosure through verbose error messages
  2. Repudiation through missing audit logs
  3. Denial of service through resource exhaustion
  4. Elevation of privilege through broken trust assumptions Correct answer.

Explanation

Relying on network location as an authorization decision lets an attacker who reaches the internal network act with elevated rights, which is a broken trust boundary and an elevation-of-privilege concern. Logging, error verbosity, and resource consumption are different threat categories.

Question 45Threat modeling and vulnerability identification

An attack tree shows that reaching the root goal requires either compromising the VPN concentrator or phishing an administrator. How should the analyst interpret this structure?

  1. The cheaper path should be ignored because it is less likely to be attempted
  2. Both paths must succeed, so the attacker needs the VPN and the administrator credential
  3. The tree is invalid because attack trees allow only single-child nodes
  4. The paths are alternatives combined by OR logic, so defeating one path does not prevent the goal Correct answer.

Explanation

In attack trees, sibling nodes joined by OR logic represent alternative routes to the parent goal, so mitigating one route leaves the other viable. AND nodes, by contrast, require all children to succeed.

Question 46Threat modeling and vulnerability identification

A team uses Microsoft's threat modeling framework. Which sequence reflects its standard workflow?

  1. Inventory assets, score CVSS, patch systems, and close tickets
  2. Scan the network, exploit findings, escalate privileges, and exfiltrate data
  3. Define scope, run a penetration test, write a report, and retest
  4. Model the system, enumerate threats, identify mitigations, and validate the model Correct answer.

Explanation

The Microsoft approach proceeds from decomposing and modeling the system, through threat enumeration, to mitigation identification and validation of the model and its assumptions. The other sequences describe penetration testing or vulnerability management workflows.

Question 47Threat modeling and vulnerability identification

A vulnerability has a CVSS base score of 9.8, but the affected service is isolated on a segment with no reachable attack path from untrusted networks. How should the analyst treat this finding?

  1. Increase the score further to reflect worst-case exposure
  2. Use environmental metrics to reflect reduced exploitability in the deployed context Correct answer.
  3. Ignore the finding permanently because the service is isolated
  4. Report it as a false positive because the base score is too high

Explanation

CVSS environmental metrics allow the analyst to adjust the score for the deployed architecture, such as modified attack vector and reduced confidentiality, integrity, and availability requirements. Isolation lowers realized risk but does not make the underlying vulnerability disappear or a false positive.

Question 48Threat modeling and vulnerability identification

Which activity in a penetration test most directly corresponds to active reconnaissance?

  1. Reading an annual report to learn about business partners
  2. Reviewing job postings for technology stack hints
  3. Banner grabbing from exposed services on in-scope hosts Correct answer.
  4. Searching a public WHOIS record for registrar details

Explanation

Banner grabbing sends packets to in-scope hosts to elicit service responses, making it active reconnaissance. Reading reports, WHOIS lookups, and job-posting review rely on third-party or public sources and are passive.

Question 49Threat modeling and vulnerability identification

A threat modeling team is deciding how to prioritize mitigations. Which criterion best aligns with a risk-based prioritization of modeled threats?

  1. Likelihood of exploitation combined with potential impact to the organization Correct answer.
  2. The number of STRIDE letters a threat matches
  3. The order in which threats were discovered during the workshop
  4. The seniority of the person who raised the threat

Explanation

Risk-based prioritization weighs how probable exploitation is against the harm it would cause, directing limited mitigation effort where it reduces risk most. Discovery order, category count, and seniority are not measures of risk.

Question 50Threat modeling and vulnerability identification

A data flow crosses from a public web tier into a backend database tier. What does the crossing of that trust boundary primarily indicate for threat modeling?

  1. The flow can be excluded from the model because both tiers are owned by the same team
  2. The flow is automatically encrypted by the operating system
  3. The flow requires authentication, input validation, and authorization checks at the boundary Correct answer.
  4. The flow should be scored with CVSS before threats are enumerated

Explanation

Trust boundary crossings are where privilege and trust levels change, so they demand scrutiny of authentication, authorization, validation, and encryption controls. Ownership or implicit encryption assumptions do not remove the need for controls at the boundary.