Scope creep during a test
Testing outside authorization, which can be a criminal act regardless of intent.
Tap to turn
Service and version detection
Identifying the software behind a port, which maps to known vulnerabilities.
Tap to turn
Insecure protocols
Unencrypted or legacy protocols exposing credentials and data in transit.
Tap to turn
Defense against cross-site scripting
Context-aware output encoding plus a content security policy.
Tap to turn
Why segmentation matters
It forces the attacker through choke points where detection is possible.
Tap to turn
Testing from client-provided infrastructure
Sometimes required, and it changes the attribution and monitoring picture.
Tap to turn
Domain registration records
Organization, contacts and name servers, which seed further discovery.
Tap to turn
Evidence in a finding
Reproducible steps, screenshots or captures proving the condition, without excessive data.
Tap to turn
Device drops
Leaving media or devices to test user behavior, only where authorized.
Tap to turn
Documenting the attack path
The sequence of findings that produced access, which is the report's centrepiece.
Tap to turn
Retesting
Verifies remediation, and should be agreed in the engagement terms.
Tap to turn
Social media reconnaissance
Roles, relationships and technology, used to build targeted approaches.
Tap to turn
Credential testing
Checking for default, weak and reused credentials within authorized scope.
Tap to turn
Physical entry techniques in scope
Tailgating and visitor process weaknesses, with written authorization and a carry letter.
Tap to turn
Restoring changed configurations
Return systems to their prior state and record anything that could not be restored.
Tap to turn
Anterior 1 of 15 Next card
Question 1 of 10 · Engagement Management
What is a reason to pause an engagement immediately?
A The scan reached fifty percent complete B The tester found a low-severity issue C The lunch break has started D The testing has caused an unexpected outage
An outage or critical incident warrants pausing and notifying the client.
Next question
Question 2 of 10 · Reconnaissance and Enumeration
Which tool is commonly used for network mapping and scanning?
A Nmap B Hashcat, which cracks passwords C Mimikatz D Responder
Nmap maps hosts, ports and services.
Next question
Question 3 of 10 · Vulnerability Discovery and Analysis
What does exploitability tell a tester about a vulnerability?
A The color to use in the report across the environment being tested B The client's budget C The tester's schedule D How feasible it is to exploit, including available exploit code
Available exploits and low complexity increase exploitability.
Next question
Question 4 of 10 · Attacks and Exploits
Which attack manipulates a user into revealing credentials on a fake page?
A A SYN scan B Credential harvesting via a phishing site C A zone transfer D Banner grabbing
Fake login pages capture credentials the user enters.
Next question
Question 5 of 10 · Post-exploitation and Lateral Movement
Which is an example of staging before exfiltration?
A Scanning public DNS across the environment being tested B Writing the SOW C Collecting and compressing target data in one location D Holding a kickoff
Staging gathers and prepares data before exfiltration.
Next question
Question 6 of 10 · Engagement Management
What is a get-out-of-jail-free letter in a penetration test?
A A guarantee of no findings B A discount on the engagement fee C Written authorization confirming the testing is permitted D A legal waiver of all liability for the client
It authorizes testing so activities are not treated as crimes.
Next question
Question 7 of 10 · Reconnaissance and Enumeration
What does banner grabbing reveal?
A The user's password B Service and version information from a listening port C The physical server location D The company's revenue
Banners often disclose software and versions, guiding vulnerability research.
Next question
Question 8 of 10 · Vulnerability Discovery and Analysis
Which CVSS metric captures whether an attack needs network access?
A Attack vector B Scope, which reflects impact beyond the component C Privileges required D User interaction
Attack vector records network, adjacent, local or physical access.
Next question
Question 9 of 10 · Attacks and Exploits
Which attack tries a few common passwords across many accounts?
A Brute forcing one account with all passwords B Phishing a single user C Pass the hash D Password spraying
Spraying avoids lockouts by trying few passwords across many users.
Next question
Question 10 of 10 · Post-exploitation and Lateral Movement
What does dumping the SAM database provide?
A The server's temperature B The network diagram C The client's contracts D Local account password hashes for cracking or reuse
The SAM holds local hashes usable for cracking or pass-the-hash.
See my score
0 of 10
Engagement Management
Reconnaissance and Enumeration
Vulnerability Discovery and Analysis
Attacks and Exploits
Post-exploitation and Lateral Movement