Penetration Testing Application GCED Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A penetration tester has exploited a SQL injection vulnerability in a web application and gained a low-privileged database account. The tester's objective is to demonstrate the maximum impact of the vulnerability without causing data loss. Which post-exploitation action is most appropriate?

   • AAttempt to use the database account to access the operating system shell
   • BUse the database account to read the contents of the application's configuration file
   • CDrop a non-critical table to show the ability to modify data
   • DEnumerate database tables and extract a small sample of non-sensitive data to prove access
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A penetration tester has identified a remote code execution vulnerability in a web application. The tester's goal is to gain a foothold on the target system. Which exploitation technique is most appropriate?

   • AUse a public exploit for the vulnerability to execute a command on the target
   • BPerform a brute-force attack on the application's login page
   • CAttempt to access the application's database directly
   • DRun a vulnerability scanner to confirm the vulnerability exists
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A penetration tester is assessing a network and has identified an open port 22 (SSH) on a server. The tester wants to determine if the SSH service is vulnerable to a known exploit. Which technique is most appropriate?

   • ARun a brute-force attack on the SSH password.
   • BUse Nmap to perform a version detection scan on the SSH service.
   • CDisconnect and move on to the next host.
   • DAttempt to log in with default credentials.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A penetration tester has gained access to a domain-joined Windows server with a standard user account. The tester's objective is to access a file server that requires domain administrator privileges. The tester has identified a service running with SYSTEM privileges that has a known privilege escalation vulnerability. However, exploiting the vulnerability may crash the service and cause a brief outage. The client has stated that any outage must be avoided. What should the tester do?

   • AExploit the vulnerability despite the risk of outage to achieve the objective.
   • BLook for an alternative privilege escalation method that does not risk an outage.
   • CSkip the privilege escalation and report that the objective cannot be achieved.
   • DAsk the client to allow a brief outage for the test.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A penetration testing firm is contracted to assess a client's external web application. The client requires that the test be completed within a strict 5-day window and that the production system must not be disrupted. The tester has identified a potential SQL injection in a search form but is unsure if it is exploitable. The tester also needs to provide a final report with risk ratings. Which approach best balances the constraints?

   • ARun an automated SQLmap scan with default settings to quickly confirm the vulnerability.
   • BManually test the SQL injection with low-impact payloads and document the result in the report.
   • CUse a vulnerability scanner to confirm the SQL injection and then immediately patch it.
   • DSkip the SQL injection test to save time and focus on other vulnerabilities.
   Reveal Solution Discussion Select an answer first