Penetration Testing Application GCED Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A penetration tester is assessing a web application that uses a WAF. The tester has identified a potential SQL injection but the WAF is blocking common attack payloads. The tester needs to confirm the vulnerability without triggering a block that could alert the client. Which technique is most appropriate?

   • AUse encoding and obfuscation techniques to bypass the WAF while testing the SQL injection.
   • BStop testing the SQL injection and report it as a potential vulnerability.
   • CAsk the client to disable the WAF for the test.
   • DRun a full SQLmap scan with high speed to overwhelm the WAF.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A penetration tester is contracted to assess the external perimeter of a financial services company. The client has provided a scope document listing only the company's public IP ranges and domain names, but explicitly forbids any active scanning that could trigger the IDS/IPS before the testing window begins. The tester needs to build an initial profile of the target's technology stack and employee behaviors. Which approach best fits the constraint?

   • AQuery public DNS records, review SSL certificate transparency logs, and search job postings and social media for technology mentions.
   • BUse theHarvester to collect email addresses and then send phishing emails to test employee awareness.
   • CPerform a zone transfer attempt on the client's DNS servers to enumerate internal hostnames.
   • DRun Nmap SYN scans against all IPs in scope to enumerate open ports and services.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A penetration tester has gained access to a domain-joined Windows workstation with a standard user account. The tester's objective is to access a file server that requires domain administrator privileges. The tester has identified a service running with SYSTEM privileges that has a known privilege escalation vulnerability. What should the tester do?

   • AExploit the service vulnerability to escalate privileges to SYSTEM and then access the file server.
   • BUse a pass-the-hash attack with the current user's hash.
   • CAttempt to brute-force the domain administrator password.
   • DDisconnect from the network and try a different workstation.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A penetration tester has gained access to a Windows server as a low-privileged user. The tester's objective is to escalate privileges to domain administrator. Which post-exploitation technique is most appropriate?

   • ASearch for plaintext credentials in the current user's files
   • BRun a vulnerability scanner against the server to find missing patches
   • CEnumerate the system for misconfigured services or scheduled tasks
   • DAttempt to use the current user's credentials to access other systems
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security manager wants to understand the difference between a vulnerability scan and a penetration test to decide which to conduct. The manager's primary concern is identifying exploitable vulnerabilities that could lead to a data breach. Which statement accurately describes the key difference?

   • AA vulnerability scan provides proof of exploitation, while a penetration test only lists potential issues
   • BA vulnerability scan is more expensive than a penetration test
   • CA vulnerability scan is manual, while a penetration test is automated
   • DA vulnerability scan identifies potential vulnerabilities, while a penetration test attempts to exploit them to prove impact
   Reveal Solution Discussion Select an answer first