Network Security Assessment Techniques and Tools CCT Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A penetration tester is assessing a web application and has identified a potential SQL injection vulnerability using a vulnerability scanner. The tester needs to confirm the vulnerability and determine the impact, but the client has strict rules of engagement that prohibit any action that could modify data. Which approach should the tester take?

   • AUse Metasploit to exploit the SQL injection and retrieve data
   • BUse sqlmap with --batch and --risk=3
   • CSkip the validation and report the scanner finding as confirmed
   • DUse a manual SQL injection payload that only tests for error messages
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   You have obtained a password hash from a Windows system and need to crack it. The password is known to be a common word followed by two digits. Which password cracking technique would be most efficient for this scenario?

   • APure brute-force attack over all possible characters
   • BPassive network sniffing
   • CDictionary attack with a rule-based mutation
   • DRainbow table attack
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A security consultant has completed a penetration test and is writing the final report. The client's IT team wants detailed technical steps to reproduce the findings, while the legal team wants to limit liability by avoiding overly specific exploit details. Which approach best balances these needs?

   • AProvide a high-level summary in the main report and include technical details in a separate appendix
   • BInclude full exploit code and step-by-step instructions in the main report
   • COnly provide the executive summary and no technical report
   • DOmit all technical details to protect the client
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A wireless security assessment is being conducted on a corporate WPA2-Enterprise network. The assessment team has captured the handshake, but the network uses 802.1X with certificate-based authentication. The team wants to test the security of the wireless network without disrupting service. Which approach is most appropriate?

   • AUse a deauthentication attack to force clients to reconnect and capture the handshake
   • BAssess the certificate validation process and test for misconfigurations
   • CAttempt to crack the handshake using a dictionary attack
   • DPerform a rogue access point attack to capture credentials
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   During a password audit, a tester obtained a dump of hashed passwords from a Linux server. The tester wants to crack the passwords efficiently, knowing that many users choose common words or simple variations. Which attack method should the tester use first?

   • ARainbow table attack
   • BDictionary attack
   • CBrute force attack
   • DRule-based attack
   Reveal Solution Discussion Select an answer first