A penetration tester is looking for a vulnerability that enables attackers to open doors via a specialized TCP service that is used for a physical access control system. The service exists on more than 100 different hosts, so the tester would like to automate the assessment. Identification requires the penetration tester to:
Have a full TCP connection
Send a "hello" payload
Walt for a response
Send a string of characters longer than 16 bytes
Which of the following approaches would BEST support the objective?

• A.Run nmap -Pn -sV -script vuln <IP address>.
• B.Employ an OpenVAS simple scan against the TCP port of the host.
• C.Create a script in the Lua language and use it with NSE.
• D.Perform a credentialed scan with Nessus.

Comment: *

Name: *

Email: *

Verification: *

A company hired a penetration-testing team to review the cyber-physical systems in a manufacturing plant. The team immediately discovered the supervisory systems and PLCs are both connected to the company intranet. Which of the following assumptions, if made by the penetration-testing team, is MOST likely to be valid?

• A.Supervisors and controllers are on a separate virtual network by default.
• B.Supervisory systems will detect a malicious injection of code/commands.
• C.Controllers will not validate the origin of commands.
• D.PLCs will not act upon commands injected over the network.

Comment: *

Name: *

Email: *

Verification: *

A penetration tester was able to gain access to a plaintext file on a user workstation. Upon opening the file, the tester notices some strings of randomly generated text. The tester is able to use these strings to move laterally throughout the network by accessing the fileshare on a web application. Which of the following should the organization do to remediate the issue?

• A.Sanitize user input.
• B.Implement password management solution.
• C.Rotate keys.
• D.Utilize certificate management.

Comment: *

Name: *

Email: *

Verification: *

During a security assessment, a penetration tester decides to write the following Python script: import requests x= ['OPTIONS', 'TRACE', 'TEST'l for y in x; z - requests.request(y, 'http://server.net') print(y, z.status_code, z.reason) Which of the following is the penetration tester trying to accomplish? (Select two).

• A.Web server denial of service
• B.HTTP methods availability
• C.'Web application firewall detection
• D.'Web server fingerprinting
• E.Web server error handling
• F.Web server banner grabbing

Comment: *

Name: *

Email: *

Verification: *

During a vulnerability scan a penetration tester enters the following Nmap command against all of the non- Windows clients:
nmap -sX -T4 -p 21-25, 67, 80, 139, 8080 192.168.11.191
The penetration tester reviews the packet capture in Wireshark and notices that the target responds with an RST packet flag set for all of the targeted ports. Which of the following does this information most likely indicate?

• A.All of the ports in the target range are closed.
• B.Nmap needs more time to scan the ports in the target range.
• C.The ports in the target range cannot be scanned because they are common UDP ports.
• D.All of the ports in the target range are open.

Comment: *

Name: *

Email: *

Verification: *