Network Security Assessment Techniques and Tools CCT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   After completing a network security assessment, a consultant must deliver a report to the client's management team. The report should summarize the overall security posture, highlight the most critical findings, and provide prioritized remediation recommendations. Which section of the report should the consultant emphasize for the management audience?

   • ARaw scan logs
   • BExecutive summary
   • CExploitation proof-of-concept code
   • DDetailed technical findings
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security analyst is assessing a Windows domain. The analyst has discovered that SMB is open on several servers. The analyst wants to enumerate domain users and group memberships without triggering account lockouts. Which approach is most appropriate?

   • AUse Nmap scripts to enumerate users via SMB
   • BUse enum4linux with a low number of queries and a delay between requests
   • CUse Metasploit's smb_enumusers module
   • DUse a vulnerability scanner to enumerate users
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which tool is commonly used for enumeration of Windows user accounts and shares?

   • ANmap
   • BBurp Suite
   • CAircrack-ng
   • DEnum4linux
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A penetration tester is performing reconnaissance on a target that uses a cloud-based email service. The tester wants to identify valid email addresses and the email server configuration without sending any emails to the target. Which technique should the tester use?

   • ASend a test email to a non-existent address and observe the bounce
   • BUse Nmap to scan the mail server for open ports
   • CQuery the DNS MX records and use SMTP VRFY commands
   • DSearch public sources for email addresses and query DNS TXT records for SPF and DMARC
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the main advantage of a rainbow table attack over a brute force attack?

   • AIt works even if the password is salted
   • BIt is faster because it uses precomputed hash chains to look up passwords
   • CIt is completely undetectable by intrusion detection systems
   • DIt does not require access to the password hash
   Reveal Solution Discussion Select an answer first