A penetration tester discovers Heartbleed vulnerabilities in a target network Which of the following impacts would be a result of exploiting this vulnerability?

• A.The attacker can steal session IDs to impersonate other users
• B.Man-in-the-middle attacks can be used to eavesdrop cookie contents.
• C.Code execution can be achieved on the affected systems
• D.Public certificate contents can be used lo decrypt traffic

Comment: *

Name: *

Email: *

Verification: *

A penetration tester is performing an annual security assessment for a repeat client The tester finds indicators of previous compromise Which of the following would be the most logical steps to follow NEXT?

• A.Report the incident to the clients Chief Information Security Officer (CISO) immediately and alter the terms of engagement accordingly
• B.Report the incident to the tester's immediate manager and follow up with the client immediately
• C.Report the incident to the client's legal department and then follow up with the client's security operations team
• D.Make note of the anomaly, continue with the penetration testing and detail it in the final report

Comment: *

Name: *

Email: *

Verification: *

A company performed an annual penetration test of its environment. In addition to several new findings, all of the previously identified findings persisted on the latest report. Which of the following is the MOST likely reason?

• A.Infrastructure is being replaced with similar hardware and software.
• B.Systems administrators are applying the wrong patches.
• C.The penetration testing tools were misconfigured.
• D.The organization is not taking action to remediate identified findings.

Comment: *

Name: *

Email: *

Verification: *

A penetration tester locates a few unquoted service paths during an engagement. Which of the following can the tester attempt to do with these?

• A.Attempt privilege escalation attacks.
• B.Attempt DLL hijacking attacks.
• C.Attempt to crack the service account passwords.
• D.Attempt to locate weak file and folder permissions.

Comment: *

Name: *

Email: *

Verification: *

A penetration tester has successfully deployed an evil twin and is starting to see some victim traffic. The next step the penetration tester wants to take is to capture all the victim web traffic unencrypted. Which of the following would BEST meet this goal?

• A.Perform an HTTP downgrade attack.
• B.Implement a CA attack by impersonating trusted CAs.
• C.Harvest the user credentials to decrypt traffic.
• D.Perform an MITM attack.

Comment: *

Name: *

Email: *

Verification: *