Objective 1.5 Exploiting Vulnerabilities in Systems. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Why is Python commonly used for automation in penetration testing?

   • AIt has extensive libraries for networking and exploitation
   • BIt is a compiled language that runs faster than C
   • CIt is the only language that can run on Linux
   • DIt automatically bypasses all security controls
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the impact of DNS poisoning?

   • AAll passwords on the system are changed
   • BNetwork traffic is encrypted
   • CThe attacker gains physical access to servers
   • DUsers are redirected to malicious websites without knowing
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A penetration tester needs to automate a multi-step attack against a web application: first, brute-force the admin login using a wordlist; then, after successful login, extract a session token and use it to access an admin-only endpoint. The tester wants a single script that handles both steps. Which approach is most appropriate?

   • AUse a Bash script with curl to brute-force the login and then extract the cookie from the response headers
   • BWrite a Python script using the requests library to perform the brute-force and then reuse the session cookie for the admin endpoint
   • CUse Wireshark to capture the login and replay the session token
   • DUse Hydra to brute-force the login and then manually copy the session cookie into a browser
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is Hydra primarily used for?

   • AOffline hash cracking
   • BOnline password cracking against network services
   • CPort scanning
   • DNetwork packet analysis
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A penetration tester is assessing a company's web application and discovers that the login form does not implement account lockout or rate limiting. The tester has obtained a list of employee usernames from a public corporate directory. Which tool and approach would be most efficient for testing weak passwords against the live login service?

   • AUse John the Ripper with a rule-based wordlist against captured password hashes
   • BUse Hydra with a targeted wordlist against the HTTPS login endpoint
   • CUse Ettercap to perform ARP poisoning and intercept the login form submission
   • DUse Wireshark to capture login traffic and extract plaintext passwords
   Reveal Solution Discussion Select an answer first