Automating Offensive Workflows GASAE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An automated offensive pipeline uses Nmap for scanning, a custom script for service enumeration, and Metasploit for exploitation. The pipeline currently fails because Nmap output is not directly usable by the custom script, and the custom script's output is not in a format that Metasploit can import. The team needs to fix the integration with minimal code changes. Which approach is most effective?

   • AReplace the custom script with a Metasploit plugin that performs the same enumeration.
   • BUse Metasploit's db_import to directly import Nmap XML, and then manually copy the custom script output into Metasploit.
   • CUse a parser library to convert Nmap XML to a common JSON format, and then have the custom script read that JSON and output a Metasploit resource script.
   • DRewrite the custom script to output Metasploit's XML format and modify Nmap to output JSON.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What does OSINT (Open Source Intelligence) gathering involve in automated reconnaissance?

   • ACollecting information from publicly available sources
   • BSending phishing emails to employees
   • CPerforming denial-of-service attacks
   • DExploiting vulnerabilities in target systems
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   When scheduling offensive automation tasks, what is a key consideration for reliability?

   • AAvoiding logging of any activity
   • BUsing only manual triggers
   • CImplementing retry and error recovery mechanisms
   • DRunning all tasks at the same time
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A penetration tester is automating the exploitation of a known vulnerability in a web application. The exploit requires a specific payload that is generated by a separate tool, and the tester wants to integrate this into a continuous testing pipeline. The pipeline should run the exploit only if the target is confirmed vulnerable. Which approach is most efficient?

   • ARun the exploit tool directly without a pre-check, assuming the target is vulnerable based on the scan results.
   • BUse a bash script that runs the payload generator and then the exploit tool sequentially, regardless of the target's state.
   • CUse a Python script that first runs a vulnerability check (e.g., a curl request to verify the vulnerability), then generates the payload using the separate tool, and finally executes the exploit if the check passes.
   • DManually verify the vulnerability and then run the exploit tool from the command line.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of workflow orchestration in offensive automation?

   • ATo eliminate the need for error handling
   • BTo replace the need for security analysts
   • CTo coordinate multiple tasks and manage dependencies between them
   • DTo perform all tasks in parallel without any sequencing
   Reveal Solution Discussion Select an answer first