Which of the following web-application security risks are part of the OWASP Top 10 v2017? (Choose two.)

• A.Buffer overflows
• B.Zero-day attacks
• C.Injection flaws
• D.Cross-site scripting
• E.Race-condition attacks
• F.Ransomware attacks

Comment: *

Name: *

Email: *

Verification: *

A client has requested that the penetration test scan include the following UDP services: SNMP, NetBIOS, and DNS. Which of the following Nmap commands will perform the scan?

• A.nmap -vv sUV -p 53,137-139,161-162 10.10.1.20/24 -oA udpscan
• B.nmap -vv sUV -p 53,123,161-162 10.10.1.20/24 -oA udpscan
• C.nmap -vv sUV -p 53, 122-123, 160-161 10.10.1.20/24 -oA udpscan
• D.nmap -vv sUV -p 53, 123-159 10.10.1.20/24 -oA udpscan

Comment: *

Name: *

Email: *

Verification: *

A penetration tester is testing a web application that is hosted by a public cloud provider. The tester is able to query the provider's metadata and get the credentials used by the instance to authenticate itself. Which of the following vulnerabilities has the tester exploited?

• A.Cross-site request forgery
• B.Server-side request forgery
• C.Local file inclusion
• D.Remote file inclusion

Comment: *

Name: *

Email: *

Verification: *

A penetration tester conducted a discovery scan that generated the following:

Which of the following commands generated the results above and will transform them into a list of active hosts for further analysis?

• A.nmap -o 192.168.0.1-254, cut -f 2
• B.nmap --open 192.168.0.1-254, uniq
• C.nmap -oG list.txt 192.168.0.1-254 , sort
• D.nmap -sn 192.168.0.1-254 , grep "Nmap scan" | awk '{print S5}'

Comment: *

Name: *

Email: *

Verification: *

A company is concerned that its cloud VM is vulnerable to a cyberattack and proprietary data may be stolen.
A penetration tester determines a vulnerability does exist and exploits the vulnerability by adding a fake VM instance to the IaaS component of the client's VM. Which of the following cloud attacks did the penetration tester MOST likely implement?

• A.Direct-to-origin
• B.Malware injection
• C.Cross-site scripting
• D.Credential harvesting

Comment: *

Name: *

Email: *

Verification: *