Automating Offensive Workflows GASAE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A red team is building an automated pipeline that integrates a vulnerability scanner (Nessus), a penetration testing framework (Metasploit), and a custom Python script for data enrichment. The pipeline must pass findings from Nessus to Metasploit to automatically exploit vulnerabilities, but the two tools use different data formats. The team also needs to ensure that only vulnerabilities confirmed by the enrichment script are exploited. Which integration approach is most robust?

   • AUse a commercial SOAR platform that has built-in connectors for Nessus and Metasploit, but requires manual approval for each exploit.
   • BExport Nessus results as CSV, manually import into Metasploit, and run the enrichment script separately.
   • CRun Metasploit's db_import command to import Nessus results directly, and then use the enrichment script to filter the database.
   • DUse a middleware script that parses Nessus XML output, enriches the data, and generates a Metasploit resource script that only runs exploits for confirmed vulnerabilities.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a common framework used to automate exploitation in offensive security?

   • ANessus
   • BMetasploit
   • CWireshark
   • DBurp Suite
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a key characteristic of automated exploitation in a controlled and repeatable manner?

   • AIt uses predefined exploit modules that are executed consistently
   • BIt requires no prior knowledge of the target
   • CIt always uses zero-day exploits
   • DIt relies on manual trial-and-error to find vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A red team is automating initial reconnaissance for a client engagement. The team needs to gather subdomains, identify open ports, and detect web technologies for a list of target domains. They want a single script that runs nightly and outputs structured JSON for downstream analysis. Which approach best meets these requirements?

   • ADeploy a commercial vulnerability scanner that includes asset discovery and web application scanning, and export its built-in report to PDF.
   • BUse a single Nmap command with the --script=http-title and --script=ssl-cert flags to gather subdomains, ports, and technologies in one pass.
   • CWrite a Python script that calls the SecurityTrails API for subdomains, uses Masscan for port scanning, and uses WhatWeb for tech detection, then normalizes results into JSON.
   • DRun Amass in passive mode and save the output to a text file, then manually review the results each morning.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A red team is automating exploitation of a set of web applications. The team must ensure that the automation is repeatable and does not cause denial-of-service conditions. They also need to prioritize vulnerabilities based on a risk score. The automation should only exploit vulnerabilities with a risk score above a threshold, and it should limit the number of concurrent exploitation attempts to avoid overwhelming the target. Which design best meets these constraints?

   • ARun all exploits sequentially, but use a risk score threshold to decide which to run.
   • BUse a vulnerability scanner that automatically exploits all found vulnerabilities without any threshold or concurrency control.
   • CUse a custom script that runs all exploits in parallel but with a delay between each to reduce load.
   • DUse an orchestration platform that schedules exploitation tasks with a concurrency limit and a conditional gate based on the risk score.
   Reveal Solution Discussion Select an answer first