Front

21. 21. A company is expanding its threat surface program and allowing individuals to security test the company's internet-facing application. The company will compensate researchers based on the vulnerabilities discovered. Which of the following best describes the program the company is setting up?

Back

B. Bug bounty

Front

23. A company hired a consultant to perform an offensive security assessment covering penetration testing and social engineering.

Which of the following teams will conduct this assessment activity?

Back

D. Red

Front

51. An organization wants a third-party vendor to do a penetration test that targets a specific device.

The organization has provided basic information about the device. Which of the following best describes this kind of penetration test?

Back

A. Partially known environment

Front

74. An employee fell for a phishing scam, which allowed an attacker to gain access to a company PC. The attacker scraped the PC's memory to find other credentials. Without cracking these credentials, the attacker used them to move laterally through the corporate network. Which of the following describes this type of attack?

Back

D. Pass-the-hash

Front

135. Which of the following provides the details about the terms of a test with a third-party penetration tester?

Back

A. Rules of engagement

Front

150. A penetration tester begins an engagement by performing port and service scans against the client environment according to the rules of engagement. Which of the following reconnaissance types is the tester performing?

Back

A. Active

Front

167. Which of the following teams combines both offensive and defensive testing techniques to protect an organization's critical systems?

Back

C. Purple

Front

176. A security analyst is investigating an application server and discovers that software on the server is behaving abnormally. The software normally runs batch jobs locally and does not generate traffic, but the process is now generating outbound traffic over random high ports. Which of the following vulnerabilities has likely been exploited in this software?

Back

A. Memory injection

Front

179. Which of the following vulnerabilities is exploited when an attacker overwrites a register with a malicious address?

Back

C. Buffer overflow

Front

256. Which of the following teams is best suited to determine whether a company has systems that can be exploited by a potential, identified vulnerability?

Back

C. Red team