Mastering the Metasploit Framework CPENT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which external tool can be integrated with Metasploit to perform network scanning and have the results automatically stored in the Metasploit database?

   • ANessus
   • BWireshark
   • CNmap
   • DProxychains
   Reveal Solution Discussion Select an answer first
2. 17application · easy

   You are using the Metasploit console to run an exploit. You need to see the available options for the currently selected module. Which command should you use?

   • Ainfo
   • Bshow targets
   • Cshow payloads
   • Dshow options
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which command is used to initialize and manage the Metasploit database?

   • Amsfconsole
   • Bmsfupdate
   • Cmsfvenom
   • Dmsfdb
   Reveal Solution Discussion Select an answer first
5. 19application · hard

   You have generated a Meterpreter payload with msfvenom, but it is being detected by antivirus on the target. You want to evade detection without significantly increasing the payload size. Which approach is most effective?

   • AUse a custom C# or PowerShell payload that is compiled or obfuscated, and use a reverse_https payload.
   • BUse a staged payload and deliver it in multiple parts to avoid detection.
   • CUse a different encoder, such as x86/shikata_ga_nai, and increase the encoding iterations.
   • DUse a custom template and pack the payload with a tool like UPX.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   During an internal penetration test, you have a Windows 10 target that is not directly reachable from your attack host, but you have a foothold on a Linux server that can reach it. You need to establish a Meterpreter session on the Windows target through the Linux server. Which Metasploit approach should you use?

   • AGenerate a stageless Meterpreter payload and execute it on the Windows target via the Linux server's shell.
   • BUse the auxiliary module scanner/smb/pipe_auditor directly against the Windows target without any routing.
   • CRun the exploit with the PAYLOAD set to windows/meterpreter/reverse_tcp and LHOST set to the Linux server's IP.
   • DSet up a route in Metasploit to the Windows target's subnet via the Linux session, then run an exploit that targets the Windows machine.
   Reveal Solution Discussion Select an answer first