Exploit Methodology and Analysis GMON Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What does it mean for an exploit to be 'reliable'?

   • AThe exploit is written in a programming language that is widely used
   • BThe exploit is signed by a trusted certificate authority
   • CThe exploit does not require any user interaction
   • DThe exploit consistently produces the intended result across different runs or target environments
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A vulnerability scanner identifies a critical remote code execution vulnerability in a third-party application. The security team needs to decide whether to apply the vendor's patch immediately or wait for the next maintenance window. Which factor should be the primary consideration in this decision?

   • AThe time required to test the patch in a staging environment.
   • BThe number of systems affected by the vulnerability.
   • CThe availability of a working exploit in the wild.
   • DThe cost of the vendor's support contract.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In exploit development, what is a 'payload'?

   • AA tool used to scan for vulnerable systems
   • BA method of delivering the exploit to the target
   • CThe initial portion of the exploit that triggers the vulnerability
   • DThe code that is delivered and executed on the target system after the vulnerability is triggered
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   After compromising a low-privilege account, an attacker attempts to gain administrative access. Which post-exploitation technique is specifically aimed at privilege escalation?

   • AClearing bash history to hide commands.
   • BCreating a new user account for persistence.
   • CExploiting a local privilege escalation vulnerability.
   • DPivoting to another system via SSH.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A penetration tester is crafting an exploit for a legacy application that does not support modern encryption. The tester needs to deliver a payload that will execute when the target user opens a malicious document. Which payload delivery mechanism is most appropriate for this scenario?

   • AEmbed a macro in a Microsoft Office document that downloads and executes a secondary payload from a staging server.
   • BDeploy a USB Rubber Ducky that types the payload into the target's keyboard.
   • CCraft a self-extracting archive that requires the user to manually run it.
   • DUse a direct network exploit that sends the payload over an unencrypted channel.
   Reveal Solution Discussion Select an answer first