Penetration Testing Fundamentals And Advanced Exploitation Assessment Practice Tests

Question 1

Using Google Dorking, you identify a directory listing on a target server. If the search query is 'site:target.com intitle:"index of"', which of the following best describes the information leakage risk?

Accepted Answer

The server is exposing its file system structure, potentially revealing sensitive configuration files or backups.

Answer

The server is performing a DNS zone transfer to the public.

Answer

The server is vulnerable to a SQL injection attack via the URL parameters.

Answer

The server is blocking all incoming traffic from the search engine crawler.

Question 2

An Nmap scan is performed with the command 'nmap -sS -p 1-65535 192.168.1.5'. If the scan takes $T$ seconds to complete, and the time per port is $t_p = 0.002$ seconds, calculate the total time $T$ in seconds for the full port scan.

Accepted Answer

131.07

Question 3

During DNS enumeration, you attempt a zone transfer using 'dig axfr @ns1.target.com target.com'. If the server returns a list of all subdomains and their corresponding IP addresses, what is the primary security implication?

Accepted Answer

The DNS server is misconfigured, allowing unauthorized parties to map the entire internal and external network infrastructure.

Answer

The DNS server is vulnerable to a buffer overflow attack.

Answer

The DNS server is performing an encrypted handshake with the client.

Answer

The DNS server is rejecting the request because the client is not authorized.

Question 4

In CVSS 3.1, the Base Score is calculated using the formula $BaseScore = Roundup(Minimum[(Impact + Exploitability), 10])$. If the Impact sub-score is $5.2$ and the Exploitability sub-score is $3.9$, calculate the raw sum before the roundup.

Accepted Answer

9.1

Question 5

Which of the following Nmap flags are used for active reconnaissance and service identification?

Answer

-sV

Answer

-O

Answer

-sn

Answer

-p

Question 6

Passive reconnaissance techniques, such as analyzing WHOIS records, involve direct interaction with the target's production servers.

Accepted Answer

False

Answer

True

Question 7

If a vulnerability scanner identifies a flaw with a CVSS Base Score of $7.5$, and the temporal multiplier $M_t$ is $0.9$, calculate the adjusted score $S_{adj} = 7.5 	imes M_t$.

Accepted Answer

6.75

Question 8

When performing network discovery with 'nmap -sn 192.168.1.0/24', what is the mathematical range of IP addresses being scanned?

Accepted Answer

256

Answer

24

Answer

128

Answer

512

Question 9

A vulnerability scanner finds $n$ vulnerabilities on a host. If the probability of a false positive for each scan is $p = 0.05$, and the scanner reports $10$ vulnerabilities, calculate the expected number of true positives $E = n(1 - p)$.

Accepted Answer

9.5

Question 10

Which of the following best describes the purpose of the 'TXT' record in DNS enumeration during a security assessment?

Accepted Answer

To identify domain ownership verification tokens or SPF/DKIM records that may reveal security configurations.

Answer

To map a hostname to an IPv4 address.

Answer

To define the primary authoritative name server for the zone.

Answer

To provide a pointer to a canonical name for an alias.

Question 11

In an ARP spoofing scenario, an attacker sends gratuitous ARP replies to map the victim's IP address $I_v$ to the attacker's MAC address $M_a$. If the network latency is $L$ and the packet processing time is $P$, calculate the total time delay $T$ for a single spoofed packet to reach the target, given $T = L + P$. If $L = 0.002$ seconds and $P = 0.0005$ seconds, determine $T$ in milliseconds.

Accepted Answer

2.5

Question 12

A buffer overflow exploit targets a stack-based buffer of size $S = 128$ bytes. The return address is located at an offset $O = 144$ bytes from the start of the buffer. If an attacker provides an input string of length $N$, determine the minimum value of $N$ required to overwrite the return address.

Accepted Answer

Option A

Answer

Option B

Answer

Option C

Answer

Option D

Question 13

An SQL injection vulnerability exists in a query: SELECT * FROM users WHERE id = '$id'. If the input is sanitized by removing spaces, which payload would effectively bypass the filter to perform a UNION-based attack if the table has $C = 3$ columns?

Accepted Answer

Option A

Answer

Option B

Answer

Option C

Answer

Option D

Question 14

Which of the following conditions are necessary for a successful privilege escalation via an SUID binary?

Accepted Answer

Option A

Answer

Option B

Answer

Option C

Answer

Option D

Question 15

In a fuzzing exercise, an application crashes when the input length $L$ exceeds the threshold $T = 2^n + k$, where $n = 10$ and $k = 56$. Calculate the exact number of bytes $L$ that triggers the crash.

Accepted Answer

1080

Question 16

If a Snort rule is defined as 'alert tcp any any -> any 80 (msg: "SQLi Attempt"; content: "UNION SELECT";)', it will successfully detect an SQL injection attack using the payload 'union/**/select'.

Accepted Answer

False

Answer

True

Question 17

A Snort IDS rule is designed to detect a specific buffer overflow attempt. The rule triggers when the payload size $P$ exceeds the threshold $T = 1024$ bytes. If a packet payload is represented by the function $f(x) = 2x^2 + 500$ where $x$ is the input sequence length, determine the minimum integer value of $x$ that causes the IDS to trigger an alert.

Accepted Answer

18

Question 18

In a patch management lifecycle, the probability of a system being compromised is modeled by $P(t) = 1 - e^{-\lambda t}$, where $\lambda$ is the vulnerability exposure rate and $t$ is the time in days until a patch is applied. If $\lambda = 0.05$, calculate the probability of compromise if the patch is applied after $t = 10$ days.

Accepted Answer

Option A

Answer

Option B

Answer

Option C

Answer

Option D

Question 19

Given a network traffic monitoring system where the false positive rate is $\alpha = 0.01$ and the true positive rate (sensitivity) is $\beta = 0.95$, if the prior probability of an attack is $P(A) = 0.001$, the posterior probability $P(A|Alert)$ is greater than 0.1.

Accepted Answer

False

Answer

True

Question 20

A security engineer is analyzing the effectiveness of an IPS rule. The rule's performance is defined by the matrix $M = \begin{pmatrix} TP & FN \ FP & TN \end{pmatrix}$. Which of the following metrics are correctly derived from this matrix?

Accepted Answer

Option A

Answer

Option B

Answer

Option C

Answer

Option D

Penetration Testing Fundamentals And Advanced Exploitation Assessment Practice Tests

Practice Tests

Penetration Testing Fundamentals and Advanced Exploitation Assessment

Generate Penetration Testing Fundamentals And Advanced Exploitation Assessment practice tests with AI