80 Free PenTest+ PT0-003 Practice Questions and Answers

Play from 04:39 Question 4. While researching a company from outside, a tester finds that a public web page has been taken offline. What is the best way to keep gathering its details? Here are the options. Option A. Use a different browser identification string. Option B. Switch the proxy configuration. Option C. Ask the client to unblock the site. Option D. Find an archived copy of the page. Pause the video now if you want time to think about the answer.

The correct answer is D. Find an archived copy of the page. Search engine caches and web archives keep older copies of pages, so a tester can still read the content passively. Network tweaks or requests to the client do not bring back a page that has been removed. Now, why are the other options incorrect? Option A is incorrect. Changing the browser identity does not restore a removed page. Option B is incorrect. A different proxy cannot show a page that is gone. Option C is incorrect. The page is removed, not blocked, and asking the client would break the passive approach. Therefore, D, Find an archived copy of the page, is the correct answer.

Play from 06:05 Question 5. A testing firm is wrapping up and restoring the client's environment. Which step keeps the deliverables from being discarded during that teardown? Here are the options. Option A. Tracking who handled each piece of evidence. Option B. Preserving artifacts. Option C. Exporting credential data. Option D. Undoing settings that were changed. Pause the video now if you want time to think about the answer.

The correct answer is B. Preserving artifacts. The findings, evidence and documentation are the product of the engagement. Deliberately preserving these artifacts before systems are reset keeps the results available for the report and later follow-up. Now, why are the other options incorrect? Option A is incorrect. Handler tracking documents custody but does not by itself keep the outputs from being removed. Option C is incorrect. Exporting credentials copies sensitive secrets and does not safeguard the engagement results. Option D is incorrect. Reverting changes is part of the teardown itself and does not protect the results from being lost. Therefore, B, Preserving artifacts, is the correct answer.

Play from 07:34 Question 6. A report lists three suggestions: put a web application firewall in place, replace unsupported operating systems, and adopt a secure development life cycle. Which report section would contain them? Here are the options. Option A. Detailed findings. Option B. Attack narrative. Option C. Recommendations. Option D. Executive summary. Pause the video now if you want time to think about the answer.

The correct answer is C. Recommendations. These are actions the client should take to reduce risk, and such guidance is gathered in the recommendations section. The summary gives an overview, the narrative describes what the tester did, and the findings describe individual issues. Now, why are the other options incorrect? Option A is incorrect. Detailed findings describe individual issues rather than suggested improvements. Option B is incorrect. The narrative recounts what the tester did and does not give advice. Option D is incorrect. The summary gives a high-level overview and does not list specific fixes. Therefore, C, Recommendations, is the correct answer.

Play from 08:59 Question 7. While scoping a new job, a consultant lists items that can be put forward for testing. Which of these is an example of a testable target? Here are the options. Option A. HTTP. Option B. API. Option C. IPA. Option D. ICMP. Pause the video now if you want time to think about the answer.

The correct answer is B. API. An application programming interface is a concrete asset that can be listed in scope and assessed. HTTP and ICMP are communication protocols rather than assets, and IPA is not a recognized asset category. Now, why are the other options incorrect? Option A is incorrect. HTTP is a protocol, not an asset that is placed in scope. Option C is incorrect. IPA is not a recognized category of testable asset. Option D is incorrect. ICMP is a protocol used for network messages and is not a target in itself. Therefore, B, API, is the correct answer.

Play from 10:20 Question 8. After a scan of several hosts, an analyst uses EPSS and CVSS scores to decide which host an attacker is most likely to pursue. Which host fits that description? Here are the options. Option A. The host with an EPSS of 0.3 and a CVSS of 2. Option B. The host with an EPSS of 0.6 and a CVSS of 1. Option C. The host with an EPSS of 0.4 and a CVSS of 4.5. Option D. The host with an EPSS of 0.6 and a CVSS of 4. Pause the video now if you want time to think about the answer.

The correct answer is D. The host with an EPSS of 0.6 and a CVSS of 4. EPSS estimates how likely a flaw is to be exploited in the wild, while CVSS rates how severe it is. The host with the top exploit probability and the better severity among the tied hosts is the most probable target. Now, why are the other options incorrect? Option A is incorrect. Both numbers are low, so this host is the least attractive. Option B is incorrect. It ties on exploit probability but its severity is much lower, so it is less appealing. Option C is incorrect. Its severity is slightly higher, but the exploit probability is clearly lower, and that probability is the better predictor of attack. Therefore, D, The host with an EPSS of 0.6 and a CVSS of 4, is the correct answer.

Play from 12:13 Question 9. What distinguishes the MITRE ATT&CK knowledge base from the PTES standard? Here are the options. Option A. ATT&CK keeps asset inventories, whereas PTES provides steps for responding to breaches. Option B. ATT&CK defines scoring models for vulnerability severity, whereas PTES concentrates on defensive controls. Option C. ATT&CK supplies sample exploit code, whereas PTES profiles threat actors. Option D. ATT&CK catalogs observed adversary behavior, whereas PTES lays out the phases of a structured test. Pause the video now if you want time to think about the answer.

The correct answer is D. ATT&CK catalogs observed adversary behavior, whereas PTES lays out the phases of a structured test. ATT&CK documents tactics and techniques seen in real attacks, while PTES is a methodology that divides a test into defined phases. The other statements attribute functions to each that neither provides. Now, why are the other options incorrect? Option A is incorrect. Neither framework manages inventories or provides breach response procedures. Option B is incorrect. Severity scoring is CVSS territory and PTES is about conducting tests, not defense. Option C is incorrect. ATT&CK is not a code library and PTES is not a threat actor catalog. Therefore, D, ATT&CK catalogs observed adversary behavior, whereas PTES lays out the phases of a structured test, is the correct answer.

Play from 14:17 Question 10. A tester must discover which input fields on a client's live website can be abused with malformed data. Which kind of tool fits best? Here are the options. Option A. SCA. Option B. DAST. Option C. IAST. Option D. SAST. Pause the video now if you want time to think about the answer.

The correct answer is B. DAST. Dynamic testing interacts with a running application, sending inputs and watching the responses. That makes it ideal for finding weak input fields on a deployed site when no source code is provided. Now, why are the other options incorrect? Option A is incorrect. Composition analysis inspects third-party components, not how input fields behave. Option C is incorrect. Interactive testing needs instrumentation inside the application, which an outside tester does not have. Option D is incorrect. Static analysis reads source code and cannot be used when only the live site is available. Therefore, B, DAST, is the correct answer.

Play from 15:43 Question 11. A scan finding shows unsafe object deserialization caused by how a Python library call is used in the program. The scanner never looked at what data is fed into that call at runtime. Which scan type most likely produced it? Here are the options. Option A. IAST. Option B. DAST. Option C. SAST. Option D. SCA. Pause the video now if you want time to think about the answer.

The correct answer is C. SAST. A finding based purely on how code calls a library function, with no look at live data, comes from analysing source without running it. That is static analysis. Now, why are the other options incorrect? Option A is incorrect. Interactive testing watches the application from inside while it runs, which would involve runtime data. Option B is incorrect. Dynamic scanning needs a running application and sends actual input, which this scan did not do. Option D is incorrect. Composition analysis reports known vulnerable library versions and does not judge how code uses a function. Therefore, C, SAST, is the correct answer.

Play from 17:11 Question 12. A tester wants to gather information about example.com through DNS in a quiet way. Which tool is the best fit? Here are the options. Option A. Recon-ng. Option B. Nikto. Option C. masscan. Option D. InSSIDer. Pause the video now if you want time to think about the answer.

The correct answer is A. Recon-ng. Recon-ng is a modular reconnaissance framework that can perform DNS lookups and other passive gathering with little noise. Nikto scans web servers, InSSIDer looks at wireless signals, and masscan does fast port scanning. Now, why are the other options incorrect? Option B is incorrect. Nikto scans web servers and does not collect DNS data. Option C is incorrect. masscan performs fast port scanning, which is noisy and not DNS based. Option D is incorrect. InSSIDer analyzes wireless networks and has no DNS function. Therefore, A, Recon-ng, is the correct answer.

Play from 18:33 Question 13. A tester is mapping which of a client's devices can be seen from the public internet and might be weak spots, using only third-party data. Which resource should the tester use? Here are the options. Option A. Hunter.io. Option B. WiGLE.net. Option C. theHarvester. Option D. Shodan. Pause the video now if you want time to think about the answer.

The correct answer is D. Shodan. Shodan indexes devices connected to the internet along with the open ports and services they present, so a tester can see likely entry points without sending any traffic to the client. Now, why are the other options incorrect? Option A is incorrect. Hunter.io looks up email addresses tied to a domain and does not catalog exposed devices. Option B is incorrect. WiGLE.net maps wireless networks and has nothing to do with internet-facing devices. Option C is incorrect. theHarvester collects names, emails and hostnames from public sources but does not index devices and their open services. Therefore, D, Shodan, is the correct answer.

Play from 19:58 Question 14. A consultant compares the time-to-live numbers seen in replies from several machines. What is the consultant most likely trying to achieve? Here are the options. Option A. Working out which operating systems the machines run. Option B. Finding which hosts are alive. Option C. Learning the overall layout of the network. Option D. Charting routes an attacker could follow. Pause the video now if you want time to think about the answer.

The correct answer is A. Working out which operating systems the machines run. Different operating systems start packets with different default time-to-live values, commonly 64 for Linux-type systems and 128 for Windows. Comparing those numbers helps identify the system type, which is fingerprinting. Now, why are the other options incorrect? Option B is incorrect. Finding live hosts only needs a reply and not an analysis of the number inside it. Option C is incorrect. Layout discovery relies on topology and routing information rather than on comparing time-to-live defaults. Option D is incorrect. Mapping attack paths connects weaknesses and access, which time-to-live values do not show. Therefore, A, Working out which operating systems the machines run, is the correct answer.

Play from 21:31 Question 15. A team lead wants the vulnerability scan report to be more accurate and trustworthy before it reaches the client. What would help most? Here are the options. Option A. Client acceptance. Option B. Risk analysis. Option C. Root cause analysis. Option D. Peer review. Pause the video now if you want time to think about the answer.

The correct answer is D. Peer review. Having independent qualified reviewers read the report catches errors, gaps and unclear wording before delivery. The other choices relate to analysing or accepting results and do not directly improve the report. Now, why are the other options incorrect? Option A is incorrect. Acceptance happens after delivery and does not improve the report's quality. Option B is incorrect. Risk analysis rates exposure and does not verify the report's accuracy. Option C is incorrect. Root cause analysis explains why problems occur and does not check the report itself. Therefore, D, Peer review, is the correct answer.

Play from 22:51 Question 16. A consultant has completed an assessment for a hospital operator, and some findings suggest patient records could be exposed. What must be done before the engagement is closed? Here are the options. Option A. Encrypt patient data that might be needed later. Option B. Record cryptographic hashes of the patient files. Option C. Make sure no local copies of the patient data remain. Option D. Make a copy of the patient records on an external drive. Pause the video now if you want time to think about the answer.

The correct answer is C. Make sure no local copies of the patient data remain. Health information is tightly regulated, so any copies the tester collected must be deleted before closing out. Keeping, copying or merely encrypting it still leaves confidential data in the tester's hands. Now, why are the other options incorrect? Option A is incorrect. Encryption helps, but holding the data at all conflicts with privacy rules. Option B is incorrect. Hashing does not remove the data from the tester's systems. Option D is incorrect. Making more copies increases the exposure of regulated data. Therefore, C, Make sure no local copies of the patient data remain, is the correct answer.

Play from 24:27 Question 17. A consultant takes a Java archive used in a client's live environment and inspects what is inside it to spot weak third-party parts. Which activity is this? Here are the options. Option A. SCA. Option B. SAST. Option C. ICS. Option D. SBOM. Pause the video now if you want time to think about the answer.

The correct answer is A. SCA. Examining the components and dependencies packaged in a software artifact to find vulnerable ones is software composition analysis. Static analysis reads code logic, an SBOM is only a list, and ICS refers to industrial systems. Now, why are the other options incorrect? Option B is incorrect. SAST examines code logic for flaws and not the packaged dependencies. Option C is incorrect. ICS means industrial control systems and is not an analysis activity. Option D is incorrect. An SBOM is an inventory document and not the activity of analyzing components. Therefore, A, SCA, is the correct answer.

Play from 25:57 Question 18. A tester finds an old directory whose files can be read by anyone. Which approach would best help uncover sensitive information there without drawing attention? Here are the options. Option A. Checking which services are reachable from outside. Option B. Scanning the domain for open ports. Option C. Looking up known flaws and ready-made exploits. Option D. Examining cached copies of the site's pages. Pause the video now if you want time to think about the answer.

The correct answer is D. Examining cached copies of the site's pages. Cached copies show what was indexed earlier and can be read without touching the client's servers, so they raise no alarms. Port scans and exploit searches generate traffic or are unrelated to the old directory. Now, why are the other options incorrect? Option A is incorrect. Service checks send traffic and say nothing about the old files. Option B is incorrect. Port scanning is active and noisy and does not reveal directory contents. Option C is incorrect. Searching for exploits does not reveal what the directory contains. Therefore, D, Examining cached copies of the site's pages, is the correct answer.

Play from 27:26 Question 19. A law firm is carrying out a security assessment for a large corporation and sends weekly progress emails. Which subject line is most suitable? Here are the options. Option A. Important Weekly Progress Note. Option B. Urgent: Progress Report. Option C. Privileged and Confidential: Progress Report. Option D. Action Needed: Progress Report. Pause the video now if you want time to think about the answer.

The correct answer is C. Privileged and Confidential: Progress Report. Messages about a test contain sensitive findings, so the subject should signal legal privilege and confidentiality, which prompts careful handling and limits forwarding. Labels that only suggest urgency or importance say nothing about protection. Now, why are the other options incorrect? Option A is incorrect. Importance is vague and offers no protection signal. Option B is incorrect. Urgency says nothing about confidentiality or legal protection. Option D is incorrect. This label asks for a response and does not mark the content as sensitive. Therefore, C, Privileged and Confidential: Progress Report, is the correct answer.

Play from 29:02 Question 20. A tester has the full source code of a web application made of thousands of files and little time. Which approach finds embedded passwords and keys most efficiently? Here are the options. Option A. Use composition analysis software on the code. Option B. Run a secrets scanner such as TruffleHog on a local copy of the repository. Option C. Read through the repository by hand. Option D. Scan the live site with Nikto. Pause the video now if you want time to think about the answer.

The correct answer is B. Run a secrets scanner such as TruffleHog on a local copy of the repository. TruffleHog searches repository files and history for secrets automatically, which suits a large codebase and a short schedule. Manual reading is slow, Nikto examines a running server, and composition analysis looks for vulnerable libraries. Now, why are the other options incorrect? Option A is incorrect. Composition analysis finds vulnerable libraries, not embedded secrets. Option C is incorrect. Reading thousands of files manually is too slow for the schedule. Option D is incorrect. Nikto examines a running web server and does not read source repositories. Therefore, B, Run a secrets scanner such as TruffleHog on a local copy of the repository, is the correct answer.

Play from 30:43 Question 21. At the start of a project, a consultant adopts a testing methodology that divides its life cycle into fourteen parts. Which framework is it? Here are the options. Option A. OWASP MASVS. Option B. MITRE ATT&CK. Option C. CREST. Option D. OSSTMM. Pause the video now if you want time to think about the answer.

The correct answer is D. OSSTMM. The Open Source Security Testing Methodology Manual lays out security testing in fourteen sections, which matches the detail in the question. The others are a mobile standard, an adversary knowledge base, and a professional accreditation body. Now, why are the other options incorrect? Option A is incorrect. MASVS is a verification standard for mobile app security. Option B is incorrect. ATT&CK catalogs adversary tactics and techniques and is not a testing life cycle. Option C is incorrect. CREST is a body that accredits testers and is not a framework with fourteen parts. Therefore, D, OSSTMM, is the correct answer.

Play from 32:15 Question 22. A tester wants to learn what hardware and software a client uses, relying only on freely available sources and sending nothing to the client. Which source is most likely to reveal this? Here are the options. Option A. Cached pages. Option B. Job boards. Option C. Protocol scanning. Option D. Cryptographic flaws. Pause the video now if you want time to think about the answer.

The correct answer is B. Job boards. Companies advertise the tools and platforms they expect new staff to know, so postings on career sites often reveal the products and technologies in use. Gathering this involves no contact with the client's systems. Now, why are the other options incorrect? Option A is incorrect. Cached pages show old copies of web content and rarely list the hardware and software in use. Option C is incorrect. Protocol scanning means sending traffic to the client, which breaks the passive requirement. Option D is incorrect. Cryptographic flaws are weaknesses found through testing and not a public source about technologies. Therefore, B, Job boards, is the correct answer.

Play from 33:43 Question 23. After finishing a security assessment, a lead consultant wants the client's remediation team to know which problems to fix first. Which part of the deliverable serves this purpose best? Here are the options. Option A. Executive summary. Option B. Risk score. Option C. Methodology. Option D. Complete list of individual findings. Pause the video now if you want time to think about the answer.

The correct answer is B. Risk score. Ranking each issue by severity and likely impact lets the client work from the most serious items downward. A score or rating gives that ordering across every finding, which the other sections do not. Now, why are the other options incorrect? Option A is incorrect. The summary gives leaders a short overview but not an ordering of every issue. Option C is incorrect. The methodology explains how testing was carried out and does not rank anything. Option D is incorrect. A list of issues without ratings leaves the reader unable to tell which matter most. Therefore, B, Risk score, is the correct answer.

Play from 35:08 Question 24. A consultant is closing out a test and must make sure leftover test material does not threaten the client's privacy. Which procedure is best? Here are the options. Option A. Close down the attacker infrastructure on premises and in the cloud. Option B. Go through changed configuration files to find and strip credentials. Option C. Take off the configuration changes and any tools placed on compromised systems. Option D. Securely wipe or delete all engagement data from the testing systems. Pause the video now if you want time to think about the answer.

The correct answer is D. Securely wipe or delete all engagement data from the testing systems. Privacy is protected by making sure no engagement-related data stays behind on the testing systems after the work ends. The other tasks are part of cleanup but each covers only a piece of the problem. Now, why are the other options incorrect? Option A is incorrect. Shutting down infrastructure does not by itself remove client data. Option B is incorrect. This covers only credentials inside configuration files. Option C is incorrect. This is valid cleanup but does not address all the data that was collected. Therefore, D, Securely wipe or delete all engagement data from the testing systems, is the correct answer.

Play from 36:49 Question 25. A project manager at a testing firm wants to lower the chance that a customer refuses the final report. What should the team do? Here are the options. Option A. Goal reprioritization. Option B. Non-disclosure agreement. Option C. Stakeholder alignment. Option D. Business impact analysis. Pause the video now if you want time to think about the answer.

The correct answer is C. Stakeholder alignment. Agreeing up front on scope, goals and what the deliverable will contain means the customer knows what to expect, so a rejection is less likely. The other items deal with changing goals, confidentiality or business disruption. Now, why are the other options incorrect? Option A is incorrect. Reprioritizing goals adjusts objectives when obstacles arise and does not guarantee that the deliverable meets expectations. Option B is incorrect. An NDA protects confidentiality and has no bearing on whether the report is accepted. Option D is incorrect. A business impact analysis estimates how disruption would affect operations, not report acceptance. Therefore, C, Stakeholder alignment, is the correct answer.

Play from 38:20 Question 26. After running a vulnerability scanner, a tester queries a device with a read-only SNMP walk using the default community string. What is the tester most likely trying to do? Here are the options. Option A. Confirm what the scanner reported and weed out wrong alerts. Option B. Automate the attack steps. Option C. Get around the defenses to gather extra data. Option D. Write scripts to break into the hosts. Pause the video now if you want time to think about the answer.

The correct answer is A. Confirm what the scanner reported and weed out wrong alerts. Querying the device directly shows whether the information the scanner reported is really exposed. That is how a tester confirms results and weeds out false positives before reporting. Now, why are the other options incorrect? Option B is incorrect. A single query is not automation of an attack. Option C is incorrect. A read-only query is not an attempt to evade defenses. Option D is incorrect. One query does not involve scripting access to the systems. Therefore, A, Confirm what the scanner reported and weed out wrong alerts, is the correct answer.

Play from 39:51 Question 27. A scan against a client cannot be completed because the customer's web application firewall keeps dropping the traffic. The tester must tell the client and agree on changing what the engagement will set out to achieve, given the obstacle. Which activity covers this? Here are the options. Option A. Client acceptance. Option B. Peer review. Option C. Stakeholder alignment. Option D. Goal reprioritization. Pause the video now if you want time to think about the answer.

The correct answer is D. Goal reprioritization. When an obstacle stops planned work, the tester and client need to revisit what the engagement can realistically achieve and adjust the objectives. That conversation is goal reprioritization. Now, why are the other options incorrect? Option A is incorrect. Acceptance is the final sign-off on delivered results, long after this kind of obstacle appears. Option B is incorrect. Peer review is an internal quality check of the report and not a client discussion about obstacles. Option C is incorrect. Alignment is done up front to agree on expectations for the final deliverable and does not itself revise objectives when something blocks the work. Therefore, D, Goal reprioritization, is the correct answer.

Play from 41:26 Question 28. An analyst reviewing a company's public files plans to read the hidden descriptive data stored inside photographs and similar media. Which standard defines how that embedded data is formatted? Here are the options. Option A. COFF. Option B. ELF. Option C. GIF. Option D. EXIF. Pause the video now if you want time to think about the answer.

The correct answer is D. EXIF. EXIF defines how camera details, timestamps, location coordinates and other descriptive tags are stored inside image and audio files. That embedded data can be read during passive research on files a company has posted online. Now, why are the other options incorrect? Option A is incorrect. COFF is a format for object code and executables, not for media metadata. Option B is incorrect. ELF is the executable format used on Unix-like systems and has no role in media tags. Option C is incorrect. GIF is a picture format and does not describe embedded metadata tags. Therefore, D, EXIF, is the correct answer.

Play from 42:54 Question 29. A team uses generative AI to help write a penetration testing report. Which two considerations matter most? (Choose two.) Here are the options. Option A. Inspect the output for possible bias. Option B. Check that the model's training material is relevant to the topic. Option C. Name the exact language model and version in the report. Option D. Run the same prompt through a second model and compare. Option E. Keep client information from being fed into a model. Option F. Have a person confirm that summaries are accurate. Pause the video now if you want time to think about the answer.

The correct answers are E. Keep client information from being fed into a model, and F. Have a person confirm that summaries are accurate. Client data is confidential, so it must not be ingested by external models, and generated summaries can contain mistakes, so a human has to verify them. The other steps are nice-to-have checks and are less important. Now, why are the other options incorrect? Option A is incorrect. Bias is less pressing here than confidentiality and accuracy. Option B is incorrect. Training data relevance is not something the report author can control. Option C is incorrect. Naming the model is optional documentation and not a top concern. Option D is incorrect. Comparing models is optional and does not replace human review. Therefore, E and F are the correct answers.

Play from 44:41 Question 30. Ahead of an authorized assessment, a consultant must check a very large address range, a whole Class B network, for open ports in the shortest time. Which tool suits this best? Here are the options. Option A. Burp Suite. Option B. hping. Option C. masscan. Option D. Nmap. Pause the video now if you want time to think about the answer.

The correct answer is C. masscan. Masscan is built for extremely fast scanning of very large address spaces. Nmap is more thorough but slower, Burp Suite is for web applications, and hping is for crafting individual packets. Now, why are the other options incorrect? Option A is incorrect. Burp Suite tests web applications and does not sweep networks for ports. Option B is incorrect. hping crafts individual packets and is not optimized for sweeping a large network. Option D is incorrect. Nmap is capable but slower on a range this large when speed is the priority. Therefore, C, masscan, is the correct answer.

Play from 46:03 Question 31. While planning an assessment, a team picks DREAD instead of PTES. What is the most likely reason? Here are the options. Option A. The team intends to build a threat model. Option B. The work concerns a browser-based application. Option C. The target is a program installed on a desktop that talks to a server. Option D. The target is an app on a phone. Pause the video now if you want time to think about the answer.

The correct answer is A. The team intends to build a threat model. DREAD scores a threat on five factors, from the harm it could do to how easily it is found, so it suits the planning step when a threat model is being produced. PTES is a broad standard for carrying out tests, and the kind of application does not decide between them. Now, why are the other options incorrect? Option B is incorrect. The type of application being tested does not determine whether DREAD is chosen. Option C is incorrect. Application architecture is not what makes DREAD the better pick. Option D is incorrect. Mobile targets do not call for DREAD over PTES. Therefore, A, The team intends to build a threat model, is the correct answer.

Play from 47:32 Question 32. Why would a security consulting firm give its analysts a standard report template? Here are the options. Option A. So every report holds the same required information in the same layout. Option B. So the risks are described correctly. Option C. So the testing itself finishes faster. Option D. So the gathered data is placed in context. Option E. So the testing method becomes stronger. Pause the video now if you want time to think about the answer.

The correct answer is A. So every report holds the same required information in the same layout. A template fixes the sections and details every report must contain, so reports from different people look and read alike. It does not by itself make risk descriptions accurate, improve the test, or speed up the testing work. Now, why are the other options incorrect? Option B is incorrect. Accuracy comes from the analyst's skill and review, not from a document layout. Option C is incorrect. Templates affect writing, not how long the technical work takes. Option D is incorrect. Putting data in context is an analysis task and not the purpose of a template. Option E is incorrect. A layout for the document has no effect on how the testing itself is performed. Therefore, A, So every report holds the same required information in the same layout, is the correct answer.

Play from 49:11 Question 33. Months after a test ended, a client disputes several findings that are now blocking a compliance certification. Which document would most help the tester calm the situation? Here are the options. Option A. Business impact analysis. Option B. Terms of use. Option C. Client acceptance. Option D. Testing methodology. Pause the video now if you want time to think about the answer.

The correct answer is C. Client acceptance. Client acceptance is the documented agreement that the client reviewed and accepted the findings and scope. Pointing to it gives an objective basis for settling a later dispute. Now, why are the other options incorrect? Option A is incorrect. A business impact analysis estimates operational impact and does not settle a dispute. Option B is incorrect. Terms of use are general conditions and do not show the client agreed to the findings. Option D is incorrect. The methodology describes how testing was done, not that the client agreed. Therefore, C, Client acceptance, is the correct answer.

Play from 50:34 Question 34. A consultant reviewing a web application wants to find out whether it relies on open-source libraries with known flaws. Which approach should be used? Here are the options. Option A. SCA. Option B. IAST. Option C. DAST. Option D. VM. Pause the video now if you want time to think about the answer.

The correct answer is A. SCA. Software composition analysis inventories third-party and open-source components and compares them against databases of known vulnerabilities, which is exactly the question being asked. Now, why are the other options incorrect? Option B is incorrect. Interactive testing watches code run from the inside and is not aimed at library inventory. Option C is incorrect. Dynamic testing exercises a running application and does not inventory its libraries. Option D is incorrect. A virtual machine is an environment for running software, not a technique for finding vulnerable libraries. Therefore, A, SCA, is the correct answer.

Play from 51:57 Question 35. A consulting team is drafting the rules of engagement for a prospective customer. Which of these would typically appear in that document? Here are the options. Option A. Authorization letter. Option B. Shared responsibilities. Option C. Terms of service. Option D. The permitted testing window. Pause the video now if you want time to think about the answer.

The correct answer is D. The permitted testing window. The rules of engagement fix operational limits such as the period during which testing is allowed, so business activity is not disrupted. Contractual terms of service and shared-duty models belong to other documents. Now, why are the other options incorrect? Option A is incorrect. The authorization letter is a separate formal permission, not an operating limit written into the rules. Option B is incorrect. Shared responsibilities describe how duties are split between parties, not testing limits. Option C is incorrect. Terms of service are general usage conditions in a separate document. Therefore, D, The permitted testing window, is the correct answer.

Play from 53:17 Question 36. A client warns that touching a vendor-managed industrial application's host could void its support agreement. How can the tester check whether the application encrypts its traffic in transit? Here are the options. Option A. Put capture software on the server. Option B. Change the application so it uses a proxy. Option C. Mirror traffic at the firewall. Option D. Ask for certificate pinning to be switched off. Pause the video now if you want time to think about the answer.

The correct answer is C. Mirror traffic at the firewall. Mirroring traffic at the firewall allows passive observation without modifying the application host, so the support terms are not affected. Installing software or changing configuration on the host would count as tampering. Now, why are the other options incorrect? Option A is incorrect. Installing software on the host is the tampering the client warned about. Option B is incorrect. Reconfiguring the application is also tampering. Option D is incorrect. Changing the application's security settings modifies the host and weakens it. Therefore, C, Mirror traffic at the firewall, is the correct answer.

Play from 54:47 Question 37. Why does a testing report include the individual steps that led to each finding? Here are the options. Option A. They let others independently confirm the results. Option B. They illustrate how hard certain weaknesses are to abuse in an attack chain. Option C. They show the customer how skilled the tester is. Option D. They make it simple to list suggested fixes. Pause the video now if you want time to think about the answer.

The correct answer is A. They let others independently confirm the results. Documenting the steps allows the client or another professional to repeat and confirm the findings, which makes the results trustworthy and helps verify fixes. Showing off skill, listing fixes or rating difficulty are not the main purpose. Now, why are the other options incorrect? Option B is incorrect. Showing difficulty is a side effect and not the main reason for including the steps. Option C is incorrect. Demonstrating skill is not the purpose of a professional report. Option D is incorrect. Fixes are covered by the recommendations and do not depend on the steps. Therefore, A, They let others independently confirm the results, is the correct answer.

Play from 56:20 Question 38. An analyst gathering open-source intelligence uses several tools and accounts and wants a single product that pulls their results together for analysis and visualization. Which is the best choice? Here are the options. Option A. Maltego. Option B. Caldera. Option C. WiGLE.net. Option D. SpiderFoot. Pause the video now if you want time to think about the answer.

The correct answer is A. Maltego. Maltego pulls data from many sources and shows relationships between them in one visual workspace, which suits consolidating intelligence output. Caldera emulates adversaries, SpiderFoot automates collection, and WiGLE only covers wireless networks. Now, why are the other options incorrect? Option B is incorrect. Caldera is a platform for emulating adversaries and does not consolidate research output. Option C is incorrect. WiGLE.net is a database of wireless networks and not a consolidation platform. Option D is incorrect. SpiderFoot automates data collection but does not act as a link-analysis hub the way the correct answer does. Therefore, A, Maltego, is the correct answer.

Play from 57:49 Question 39. A tester sniffing network traffic sees FTP, Modbus, DNS and SSH. Based on these protocols, what should the tester do next? Here are the options. Option A. Learn more about the operational technology and industrial control systems on the network. Option B. Intercept the traffic of the weaker protocols. Option C. Run an automated vulnerability scan across the network. Option D. Set up a way to stay connected if the link drops. Pause the video now if you want time to think about the answer.

The correct answer is A. Learn more about the operational technology and industrial control systems on the network. Modbus is widely used in industrial control, so its presence signals that operational technology is on the network. The sensible next step is to learn what those systems and protocols are before doing anything more intrusive or disruptive. Now, why are the other options incorrect? Option B is incorrect. Nothing in the observed protocols justifies jumping to interference. Option C is incorrect. Automated scans can disrupt industrial systems, so understanding them comes first. Option D is incorrect. Holding on to access is premature before understanding the environment. Therefore, A, Learn more about the operational technology and industrial control systems on the network, is the correct answer.

Play from 59:29 Question 40. In a company that is about to hire a testing provider, which item is typically produced by the legal team? Here are the options. Option A. Authorization letters. Option B. Shared responsibility model. Option C. Rules of engagement. Option D. Third-party responsibilities. Pause the video now if you want time to think about the answer.

The correct answer is A. Authorization letters. The legal team issues the formal written permission that allows testing to take place and protects both the organization and the testers. The other choices describe duty-sharing models or technical conduct rather than that permission. Now, why are the other options incorrect? Option B is incorrect. A shared responsibility model divides security duties between a cloud provider and customer. Option C is incorrect. Rules of engagement set the technical boundaries and conduct of testing and are drafted jointly with the testers, not the legal team's formal permission. Option D is incorrect. Third-party responsibilities describe obligations of outside vendors, not the permission to test. Therefore, A, Authorization letters, is the correct answer.

Play from 1:00:59 Question 41. Why would a report's findings section show base, temporal and environmental CVSS metrics? (Choose two.) Here are the options. Option A. To attach a risk level to every asset. Option B. To link to the exploit code used as proof. Option C. To explain step by step how to fix each flaw. Option D. To put audit-driven compliance information first. Option E. To give details on attack complexity and attack vector. Option F. To help rank remediation using threat context. Pause the video now if you want time to think about the answer.

The correct answers are E. To give details on attack complexity and attack vector, and F. To help rank remediation using threat context. These metric groups describe how a flaw can be attacked and how it fits the organization's circumstances, which supports ordering the fixes. They are not instructions for repairing a flaw, a source of exploit links, a compliance format, or a per-asset risk rating. Now, why are the other options incorrect? Option A is incorrect. The metrics score vulnerabilities, not whole assets. Option B is incorrect. Metrics are numbers and do not supply links to proof material. Option C is incorrect. The metrics rate flaws and do not provide repair instructions. Option D is incorrect. The metrics are not a compliance reporting format. Therefore, E and F are the correct answers.

Play from 1:02:46 Question 42. What should the tester do to make sure that web shells uploaded during testing cannot be used by anyone else? Here are the options. Option A. Shut down the testing infrastructure. Option B. Securely destroy the collected data. Option C. Keep the artifacts as evidence. Option D. Delete the footholds that were left behind. Pause the video now if you want time to think about the answer.

The correct answer is D. Delete the footholds that were left behind. Anything left behind could be abused by another party, so the leftovers that give access must be removed during cleanup. Shutting down infrastructure, keeping artifacts and destroying data do not by themselves close the exposure. Now, why are the other options incorrect? Option A is incorrect. Turning off infrastructure does not remove what is already on the client's systems. Option B is incorrect. Destroying data does not remove access that was left in place. Option C is incorrect. Keeping evidence does not stop the uploaded items from being misused. Therefore, D, Delete the footholds that were left behind, is the correct answer.

Play from 1:04:12 Question 43. A consultant runs kube-hunter against a client's Kubernetes cluster. What kind of issues can this tool uncover? Here are the options. Option A. Security gaps and wrong settings inside the cluster. Option B. Errors in the network settings of cluster services. Option C. Mistakes in how applications were deployed. Option D. Flaws that apply only to Docker containers. Pause the video now if you want time to think about the answer.

The correct answer is A. Security gaps and wrong settings inside the cluster. kube-hunter probes a cluster for security weaknesses and misconfigurations in the cluster infrastructure, such as exposed services and insecure interfaces. It is not limited to network settings, deployment mistakes or Docker-only flaws. Now, why are the other options incorrect? Option B is incorrect. Network settings are only a slice of the cluster issues it checks. Option C is incorrect. Deployment mistakes are only a part of what it looks for. Option D is incorrect. The tool targets the cluster and is not restricted to Docker. Therefore, A, Security gaps and wrong settings inside the cluster, is the correct answer.

Play from 1:05:41 Question 44. Which document would lay out how a penetration testing service will be performed and how long it will last? Here are the options. Option A. NDA. Option B. SoW. Option C. ToS. Option D. MSA. Pause the video now if you want time to think about the answer.

The correct answer is B. SoW. A statement of work spells out the approach, scope, schedule and length of a testing engagement. The other documents cover general usage terms, confidentiality, or the broad relationship between the two parties. Now, why are the other options incorrect? Option A is incorrect. An NDA covers confidentiality and does not describe methods or timing. Option C is incorrect. Terms of service are general usage conditions and not engagement details. Option D is incorrect. A master services agreement sets the overall legal relationship, while specifics of a particular project live elsewhere. Therefore, B, SoW, is the correct answer.

Play from 1:06:58 Question 45. During peer review of a finished assessment, a reviewer notices that debugging is still switched on in a production system. What is the most probable explanation? Here are the options. Option A. The server needs a complete restore from backup. Option B. Changes made during testing were never undone. Option C. The test ran past its deadline. Option D. The tester lost access to the system. Pause the video now if you want time to think about the answer.

The correct answer is B. Changes made during testing were never undone. Debug mode left on after testing usually means that settings changed during the engagement were not reverted at cleanup. Time overruns, backups or lockouts would not explain a leftover setting. Now, why are the other options incorrect? Option A is incorrect. A restore is not implied by a single setting being left on. Option C is incorrect. Running late does not leave debugging enabled. Option D is incorrect. Losing access would not change a production setting. Therefore, B, Changes made during testing were never undone, is the correct answer.

Play from 1:08:24 Question 46. A tester has to check several hundred public web addresses quickly for risky files and out-of-date server software. Which tool is purpose-built for this? Here are the options. Option A. Nmap. Option B. Nikto. Option C. ZAP. Option D. BloodHound. Pause the video now if you want time to think about the answer.

The correct answer is B. Nikto. Nikto is a web server scanner that checks many sites for dangerous files, default content and outdated server versions. The others do not specialize in that bulk check: Nmap maps ports and services, ZAP focuses on application behavior, and BloodHound analyzes directory relationships. Now, why are the other options incorrect? Option A is incorrect. Nmap maps hosts, ports and services and is not aimed at dangerous web server files. Option C is incorrect. ZAP is an interactive proxy for in-depth application testing and is less suited to bulk checks of server files. Option D is incorrect. BloodHound analyzes relationships inside a directory service and does not scan websites. Therefore, B, Nikto, is the correct answer.

Play from 1:09:52 Question 47. A tester wants the broadest picture of a company's domains, subdomains and exposed hosts using public sources. Which tool gives the most complete results? Here are the options. Option A. Shodan. Option B. Aircrack-ng. Option C. nslookup/dig. Option D. theHarvester. Pause the video now if you want time to think about the answer.

The correct answer is D. theHarvester. theHarvester pulls hostnames, subdomains, addresses and emails from many search engines and public data sets in a single run, so it gives the widest view of a target's footprint. The alternatives each cover only a slice or have a different purpose. Now, why are the other options incorrect? Option A is incorrect. Shodan reports devices and services but is weaker for enumerating subdomains and domains across sources. Option B is incorrect. Aircrack-ng is a wireless toolset and is unrelated to domain research. Option C is incorrect. These utilities answer individual DNS queries one at a time and do not aggregate many sources. Therefore, D, theHarvester, is the correct answer.

Play from 1:11:22 Question 48. A consultant is checking a containerized environment for weaknesses and settings problems. Which tool is the most likely choice? Here are the options. Option A. Nessus. Option B. Nikto. Option C. Trivy. Option D. Nmap. Pause the video now if you want time to think about the answer.

The correct answer is C. Trivy. Trivy is a scanner made for containers, covering images, registries and running environments for known flaws and misconfigurations. Nikto targets web servers, Nessus is a general scanner, and Nmap discovers network services. Now, why are the other options incorrect? Option A is incorrect. Nessus is a general purpose scanner and not tailored to container content. Option B is incorrect. Nikto checks web servers and not container images. Option D is incorrect. Nmap discovers hosts and services and does not inspect container images. Therefore, C, Trivy, is the correct answer.

Play from 1:12:38 Question 49. Which item belongs in the deliverable that a testing firm hands over at the end of an engagement? Here are the options. Option A. Handling of encryption keys. Option B. A chronological account of the attack path. Option C. A log of end-user behavior. Option D. The client's own plan for fixing issues. Pause the video now if you want time to think about the answer.

The correct answer is B. A chronological account of the attack path. The report should walk the reader through what was done and how it unfolded, so findings can be understood and verified. That is the narrative of the attack path. The other items fall outside what a report normally contains. Now, why are the other options incorrect? Option A is incorrect. Key management is a separate operational topic and not a report component. Option C is incorrect. End-user activity records are not a normal part of a testing report. Option D is incorrect. The client builds its own remediation plan; the report only supplies recommendations. Therefore, B, A chronological account of the attack path, is the correct answer.

Play from 1:14:07 Question 50. An analyst doing outside-in research wants to find industrial control and smart-device systems that are exposed to the public internet. Which tool is best suited? Here are the options. Option A. theHarvester. Option B. Nmap. Option C. Shodan. Option D. Amass. Pause the video now if you want time to think about the answer.

The correct answer is C. Shodan. Shodan continuously crawls the internet and indexes service banners, so it can be searched for exposed industrial and smart devices without sending any probes of your own. Now, why are the other options incorrect? Option A is incorrect. theHarvester gathers email addresses, names and hostnames from public sources rather than indexing devices. Option B is incorrect. Nmap actively probes chosen targets and is not a searchable index of internet-facing devices. Option D is incorrect. Amass maps domains and subdomains, not exposed control systems. Therefore, C, Shodan, is the correct answer.

Play from 1:15:23 Question 51. A client asks for an external attack surface review and gives its main domain name as the starting point. What should the tester do? Here are the options. Option A. Carry out a physical security walk-through to find weaknesses. Option B. Use information-gathering methods to review the assets the company exposes on the internet. Option C. Run a vulnerability assessment against only the main domain address. Option D. Run a phishing exercise to reach more users' computers. Pause the video now if you want time to think about the answer.

The correct answer is B. Use information-gathering methods to review the assets the company exposes on the internet. A review of the external attack surface starts with discovering what the organization exposes online, such as web and mail servers, name records and subdomains. Phishing, physical reviews and scanning only one address are different activities. Now, why are the other options incorrect? Option A is incorrect. A physical review does not look at internet exposure. Option C is incorrect. Scanning one address misses the rest of the exposed assets. Option D is incorrect. Phishing tests people and is not an attack surface discovery task. Therefore, B, Use information-gathering methods to review the assets the company exposes on the internet, is the correct answer.

Play from 1:17:03 Question 52. While mapping a target's hosts, an analyst wants location data for addresses plus a broad summary of the services they expose. Which tool is best? Here are the options. Option A. Censys.io. Option B. WiGLE.net. Option C. theHarvester. Option D. WHOIS. Pause the video now if you want time to think about the answer.

The correct answer is A. Censys.io. Censys scans the internet and reports geographic location, certificates and open services for each address, which matches both needs. WiGLE maps wireless networks, WHOIS reports registration details, and theHarvester collects names and emails. Now, why are the other options incorrect? Option B is incorrect. WiGLE.net catalogs wireless networks and not internet-facing services. Option C is incorrect. theHarvester gathers emails and hostnames and gives no broad service summary with location data. Option D is incorrect. WHOIS returns registration details for a domain and does not summarize exposed services. Therefore, A, Censys.io, is the correct answer.

Play from 1:18:29 Question 53. While gathering open-source intelligence, a consultant sees that a site's crawler-exclusion file stops one large search engine from listing some pages. What would most likely help the consultant still find that content? Here are the options. Option A. Searching with a different search provider. Option B. Editing the exclusion file on the target's server. Option C. Running a port scan against the web server. Option D. Adjusting the target's firewall settings. Pause the video now if you want time to think about the answer.

The correct answer is A. Searching with a different search provider. The exclusion file only asks particular crawlers to stay away. Another search provider may have indexed or cached those pages anyway, so querying it can show what the first engine hides. Changing the target's own systems is not passive research. Now, why are the other options incorrect? Option B is incorrect. Altering the target's files is unauthorized and not an open-source technique. Option C is incorrect. A port scan is active probing and shows services, not hidden pages. Option D is incorrect. Changing the target's firewall is not passive research and would not reveal indexed content. Therefore, A, Searching with a different search provider, is the correct answer.

Play from 1:20:06 Question 54. Which framework helps a security team sort threats into categories? Here are the options. Option A. STRIDE. Option B. PTES. Option C. OSSTMM. Option D. OCTAVE. Pause the video now if you want time to think about the answer.

The correct answer is A. STRIDE. STRIDE groups threats into six named types, which is its whole purpose. The other choices are a testing standard, a testing manual and an organizational risk evaluation method. Now, why are the other options incorrect? Option B is incorrect. PTES is a standard for carrying out penetration tests and does not categorize threats. Option C is incorrect. OSSTMM is a testing methodology manual rather than a threat classification scheme. Option D is incorrect. OCTAVE evaluates organizational risk and is not primarily a threat categorization model. Therefore, A, STRIDE, is the correct answer.

Play from 1:21:30 Question 55. Testing and reporting have finished. How should the tester help confirm that systems touched during the engagement are back to their original condition? Here are the options. Option A. Hand the customer a record of every change that was made. Option B. Put environment variables back to their earlier values. Option C. Shut down the active remote-control payload. Option D. Raise a ticket asking for the system to be rebuilt from an image. Pause the video now if you want time to think about the answer.

The correct answer is A. Hand the customer a record of every change that was made. A complete record of changes gives the customer's teams a definitive reference for checking restoration themselves. Stopping payloads and resetting values are individual cleanup tasks, and requesting a rebuild goes beyond verification. Now, why are the other options incorrect? Option B is incorrect. Resetting a value is a single fix and does not document the whole restoration. Option C is incorrect. Stopping a payload is one cleanup task and does not verify overall restoration. Option D is incorrect. Requesting a rebuild goes beyond what was asked and does not verify anything. Therefore, A, Hand the customer a record of every change that was made, is the correct answer.

Play from 1:23:11 Question 56. A tester's vulnerability scanner returns nothing useful. What term describes the work of investigating why this happened? Here are the options. Option A. Goal reprioritization. Option B. Secure distribution. Option C. Root cause analysis. Option D. Peer review. Pause the video now if you want time to think about the answer.

The correct answer is C. Root cause analysis. Digging into the reason something failed is root cause analysis. Here it would involve checking for scanner misconfiguration, blocked traffic or missing permissions. The other choices concern report quality, delivery or changing objectives. Now, why are the other options incorrect? Option A is incorrect. Reprioritizing goals changes the plan but does not explain the failure. Option B is incorrect. Secure distribution is about delivering the report safely. Option D is incorrect. Peer review is a check of someone's work product, not troubleshooting a tool. Therefore, C, Root cause analysis, is the correct answer.

Play from 1:24:29 Question 57. A scan stops short of listing vulnerabilities and reports that identifying the operating system failed. What is the most likely cause? Here are the options. Option A. The scanner's signature database is outdated. Option B. A firewall rule stopped the scan from reaching the target. Option C. The scanner could not collect enough fingerprints from the target. Option D. The scanner is reporting a wrongly flagged issue. Pause the video now if you want time to think about the answer.

The correct answer is C. The scanner could not collect enough fingerprints from the target. Operating system detection relies on fingerprints taken from the target's responses, such as packet characteristics. When the scanner cannot gather enough of them, identification fails. That differs from a blocked scan, stale data or a false alarm. Now, why are the other options incorrect? Option A is incorrect. An old database could cause missed findings but is not what this message describes. Option B is incorrect. A scan that never arrived would produce an unreachable-host result rather than a failed identification. Option D is incorrect. A false positive is a wrong finding and does not explain a failed identification. Therefore, C, The scanner could not collect enough fingerprints from the target, is the correct answer.

Play from 1:26:06 Question 58. A consultant must assess the network-level weaknesses of power plant control systems that are offline, and the rules forbid touching production systems. Which technique fits? Here are the options. Option A. Write blocker. Option B. Storyboarding. Option C. Port mirroring. Option D. SAST tool. Pause the video now if you want time to think about the answer.

The correct answer is C. Port mirroring. Mirroring lets the tester watch the traffic passively, so nothing is sent to the control systems and the rule against interaction is respected. Storyboarding is a design technique, write blockers protect evidence drives, and static analysis needs source code. Now, why are the other options incorrect? Option A is incorrect. A write blocker protects evidence drives and does not observe network traffic. Option B is incorrect. Storyboarding is a design and planning technique and does not reveal network weaknesses. Option D is incorrect. Static analysis needs source code and does not examine network behavior. Therefore, C, Port mirroring, is the correct answer.

Play from 1:27:30 Question 59. A consultant is assessing a company that occupies several office buildings downtown and needs to learn which building houses the intended target. What is the most effective technique? Here are the options. Option A. Searching through discarded paper. Option B. Searching the web with search engines. Option C. Driving around to detect wireless networks. Option D. Sending unsolicited messages to nearby Bluetooth devices. Pause the video now if you want time to think about the answer.

The correct answer is B. Searching the web with search engines. Companies publish office addresses on their websites, directories, maps and social pages, and search engines index them. Searching this open information is legal, easy and needs no physical presence. Now, why are the other options incorrect? Option A is incorrect. Digging through trash is slow, physical and unlikely to reveal building locations efficiently. Option C is incorrect. Roaming for wireless signals finds networks but does not identify a specific target building. Option D is incorrect. This sends data to devices and does not reveal which building holds a target. Therefore, B, Searching the web with search engines, is the correct answer.

Play from 1:29:07 Question 60. A new tester is about to use Hunter.io for reconnaissance. What kind of information will it return? Here are the options. Option A. Name records for the domain and its subdomains that widen the exposed footprint. Option B. A list of email addresses for the target domain gathered from many internet sources. Option C. Details from the main web page that gather usernames, metadata and data exposures. Option D. Breach details about the organization that help further enumeration. Pause the video now if you want time to think about the answer.

The correct answer is B. A list of email addresses for the target domain gathered from many internet sources. Hunter.io is an email discovery service that aggregates addresses tied to a domain from public sources. It does not provide name records, breach history or page metadata. Now, why are the other options incorrect? Option A is incorrect. Hunter.io does not return name records. Option C is incorrect. Hunter.io does not analyze page content. Option D is incorrect. Breach data comes from other sources. Therefore, B, A list of email addresses for the target domain gathered from many internet sources, is the correct answer.

Play from 1:30:44 Question 61. An authorized testing team has just finished its work for a client. Which action belongs in the closing cleanup phase? Here are the options. Option A. Power off any host that was affected. Option B. Wipe every log that records what happened. Option C. Restore the systems to how they were before testing. Option D. Seal all ports that are currently open on the hosts. Pause the video now if you want time to think about the answer.

The correct answer is C. Restore the systems to how they were before testing. Once testing ends, everything the team added or altered must be undone, including tools, payloads, accounts and settings, so the environment matches its starting condition and nothing from the assessment lingers. Now, why are the other options incorrect? Option A is incorrect. Switching systems off causes an outage and does not undo what the team changed. Option B is incorrect. Logs are evidence the client may need, so erasing them is the opposite of good cleanup. Option D is incorrect. Only changes the testers made should be undone; shutting every open port would break services the client relies on. Therefore, C, Restore the systems to how they were before testing, is the correct answer.

Play from 1:32:16 Question 62. During an engagement, a tester causes a problem on a critical system that could seriously affect the organization. What should the tester do? Here are the options. Option A. Perform a BIA. Option B. Select the target. Option C. Restore the configuration. Option D. Report it through the agreed escalation path. Pause the video now if you want time to think about the answer.

The correct answer is D. Report it through the agreed escalation path. A serious unplanned impact must be reported immediately through the escalation process defined in the engagement documents, so the right people are told and can respond. Restoring things, running analyses or choosing targets come afterward or belong elsewhere. Now, why are the other options incorrect? Option A is incorrect. A business impact analysis is a planning exercise, not an immediate response. Option B is incorrect. Choosing targets is a planning activity done before testing. Option C is incorrect. Restoring is a later recovery step and the proper people must be notified first. Therefore, D, Report it through the agreed escalation path, is the correct answer.

Play from 1:33:45 Question 63. A consultant preparing for an authorized network assessment wants an automated utility that maps the DNS layout of the client's domain and lists the matching addresses. Which utility is the best fit? Here are the options. Option A. Wireshark. Option B. Netcat. Option C. Nmap. Option D. Dnsenum. Pause the video now if you want time to think about the answer.

The correct answer is D. Dnsenum. The goal is to learn how the domain is laid out and which addresses belong to it. Dnsenum was built for exactly this job: it queries name servers and tries name guesses to list subdomains with their addresses. Now, why are the other options incorrect? Option A is incorrect. Wireshark captures and inspects packets that are already flowing, so it does not query DNS to map a domain. Option B is incorrect. Netcat is a general purpose tool for reading and writing network connections and has no DNS mapping function. Option C is incorrect. Nmap discovers hosts and open ports, but it is not built to work out how a domain is organized. Therefore, D, Dnsenum, is the correct answer.

Play from 1:35:13 Question 64. A consultant must list every encryption cipher accepted by the secure web services on a client's public and internal servers, and wants it automated across many hosts. Which option supports this best? Here are the options. Option A. Impacket. Option B. Netcat. Option C. Burp Suite. Option D. Shodan. Option E. Nmap Scripting Engine. Pause the video now if you want time to think about the answer.

The correct answer is E. Nmap Scripting Engine. The scripting engine bundled with Nmap includes a ready-made script that lists the ciphers a TLS service accepts, and it can run against many targets in one pass. That makes it the natural choice for broad automated cipher checks. Now, why are the other options incorrect? Option A is incorrect. Impacket is a library for working with network protocols and is not a cipher checker. Option B is incorrect. Netcat opens raw connections and cannot report supported ciphers by itself. Option C is incorrect. Burp Suite is a web application testing proxy and not a bulk cipher enumerator. Option D is incorrect. Shodan is a search index of internet devices and would not cover internal servers. Therefore, E, Nmap Scripting Engine, is the correct answer.

Play from 1:36:53 Question 65. A staff member doing an on-site review of company-issued phones wants to learn which wireless networks are nearby. Which resource suits this best? Here are the options. Option A. theHarvester. Option B. WiGLE.net. Option C. Wireshark. Option D. Recon-ng. Pause the video now if you want time to think about the answer.

The correct answer is B. WiGLE.net. WiGLE keeps a worldwide map of wireless networks with names and locations, so it shows which networks exist around a site. Wireshark inspects traffic from a network you are already on, and the other tools collect internet-based information. Now, why are the other options incorrect? Option A is incorrect. theHarvester collects emails and hostnames from internet sources. Option C is incorrect. Wireshark inspects traffic on a network that is already joined and does not list nearby networks. Option D is incorrect. Recon-ng is a framework for web-based reconnaissance, not wireless coverage. Therefore, B, WiGLE.net, is the correct answer.

Play from 1:38:17 Question 66. During a vulnerability assessment, a consultant wants a view of weaknesses that anyone on the internet could see, using no logins. Which scan type fits? Here are the options. Option A. Unauthenticated. Option B. Host-based. Option C. Sidecar. Option D. SAST. Pause the video now if you want time to think about the answer.

The correct answer is A. Unauthenticated. A scan run without any credentials sees only what an outsider would see, which is exactly the external view requested. Static code analysis, a deployment pattern and host-level scans all need inside access or are not scans of exposure. Now, why are the other options incorrect? Option B is incorrect. A host-based scan needs access to the system itself, which is an inside viewpoint. Option C is incorrect. A sidecar is a deployment pattern for helper containers and is not a scan type. Option D is incorrect. Static analysis reviews source code and does not show what is exposed to the outside. Therefore, A, Unauthenticated, is the correct answer.

Play from 1:39:44 Question 67. A company keeps the systems covered by a regulatory agreement apart from the rest of its environment. Which control supports that arrangement? Here are the options. Option A. Key management. Option B. Data isolation. Option C. Penetration test. Option D. Network monitoring. Pause the video now if you want time to think about the answer.

The correct answer is B. Data isolation. Keeping regulated systems and data walled off from everything else is called data isolation, and it limits exposure of covered information. Monitoring, key handling and testing are valuable but do not create that separation. Now, why are the other options incorrect? Option A is incorrect. Key management protects cryptographic keys and does not separate environments. Option C is incorrect. A penetration test evaluates controls and is not itself a control that separates systems. Option D is incorrect. Monitoring watches traffic but does not keep systems apart. Therefore, B, Data isolation, is the correct answer.

Play from 1:41:06 Question 68. A reviewer new to the quality assurance team asks where, in a finished testing report, to look for the overall impact, the main security findings and high-level statements. Which section holds that? Here are the options. Option A. Methodology. Option B. Executive summary. Option C. Risk scoring. Option D. Quality control. Pause the video now if you want time to think about the answer.

The correct answer is B. Executive summary. Management-level readers get the overall impact and major findings in the executive summary, which is written for non-technical audiences. Methodology explains procedure, risk scoring ranks issues, and quality control covers review processes. Now, why are the other options incorrect? Option A is incorrect. The methodology explains how the testing was done. Option C is incorrect. Risk scoring ranks individual issues and is not an overview of impact. Option D is incorrect. Quality control covers how the report was reviewed, not what it concludes. Therefore, B, Executive summary, is the correct answer.

Play from 1:42:30 Question 69. Which section of a testing report describes the way the testing was carried out? Here are the options. Option A. Scope of work. Option B. Executive summary. Option C. Methodology. Option D. Detailed findings. Pause the video now if you want time to think about the answer.

The correct answer is C. Methodology. The methodology part tells readers which techniques, tools and processes were used, giving transparency about the approach. Scope tells what was covered, findings tell what was discovered, and the summary gives a brief overview. Now, why are the other options incorrect? Option A is incorrect. Scope states what was included in the engagement, not how the work was done. Option B is incorrect. The summary is a brief overview for leaders and not a description of procedure. Option D is incorrect. Detailed findings list the individual issues discovered rather than the procedures used. Therefore, C, Methodology, is the correct answer.

Play from 1:43:50 Question 70. A facility adds a double-door entry chamber where each person must authenticate before the second door opens. Which threat does this mainly discourage? Here are the options. Option A. USB drops. Option B. Badge cloning. Option C. Tailgating. Option D. Lock picking. Pause the video now if you want time to think about the answer.

The correct answer is C. Tailgating. A two-stage entry chamber lets only one person pass per authentication, so someone cannot slip in behind an authorized employee. This directly discourages following people through a door, known as tailgating. Now, why are the other options incorrect? Option A is incorrect. USB drops involve leaving devices lying around and are unrelated to door control. Option B is incorrect. Cloned badges would still authenticate, so the chamber does not prevent that. Option D is incorrect. Lock picking defeats the lock mechanism itself, which the chamber does not address. Therefore, C, Tailgating, is the correct answer.

Play from 1:45:11 Question 71. A tester must find weaknesses in a power plant's network without any risk of disturbing the grid. Which approach is most appropriate? Here are the options. Option A. Use a validation toolkit to confirm flaws on the equipment. Option B. Run a network mapping tool to learn what devices exist. Option C. Set up a network scanner and run it against the plant. Option D. Mirror the network traffic to a monitoring port and analyze it. Pause the video now if you want time to think about the answer.

The correct answer is D. Mirror the network traffic to a monitoring port and analyze it. Mirroring traffic lets the tester observe communications passively, without sending anything toward fragile control equipment. Active scanning, mapping and validation tools all generate traffic that could upset industrial devices. Now, why are the other options incorrect? Option A is incorrect. Validating weaknesses actively could crash or disrupt the devices. Option B is incorrect. Mapping tools send probes that could disrupt sensitive industrial devices. Option C is incorrect. Active scans can upset control equipment and risk an outage. Therefore, D, Mirror the network traffic to a monitoring port and analyze it, is the correct answer.

Play from 1:46:41 Question 72. Before a security firm may begin work for a new customer, which document must be in place during the planning stage? Here are the options. Option A. Peer review. Option B. Risk scoring. Option C. Client acceptance. Option D. Statement of work. Pause the video now if you want time to think about the answer.

The correct answer is D. Statement of work. The statement of work is the contract-level document that sets scope, schedule, deliverables and terms, and it has to exist before testing starts. Acceptance, scoring and peer review all happen later, after the work has been done. Now, why are the other options incorrect? Option A is incorrect. Peer review is a quality check on results and happens after testing. Option B is incorrect. Scores are assigned to findings, which only exist after testing. Option C is incorrect. Acceptance is the sign-off on delivered results at the end. Therefore, D, Statement of work, is the correct answer.

Play from 1:47:59 Question 73. A consultant has to assess an industrial control environment that is completely isolated from both the internet and the corporate network. What approach should be used? Here are the options. Option A. Reading the program source. Option B. Wireless channel scanning. Option C. Hands-on review done by a person. Option D. Low-noise scanning. Pause the video now if you want time to think about the answer.

The correct answer is C. Hands-on review done by a person. Automated probing can crash or disturb fragile control equipment, and an isolated environment gives nothing to scan remotely. A careful hands-on review lets the assessor understand the process and avoid interruptions. Now, why are the other options incorrect? Option A is incorrect. Source review needs code, which is not usually available for such equipment. Option B is incorrect. Channel scanning looks at wireless signals and is not how an isolated control network is assessed. Option D is incorrect. Even quiet scans can disrupt sensitive control equipment. Therefore, C, Hands-on review done by a person, is the correct answer.

Play from 1:49:27 Question 74. In a staging copy of a live web application, a tester wants to learn whether it is open to injection and script flaws using custom test inputs. Which discovery approach fits? Here are the options. Option A. Software composition analysis. Option B. Dynamic testing of the running application. Option C. Protocol fuzzing. Option D. Static analysis. Pause the video now if you want time to think about the answer.

The correct answer is B. Dynamic testing of the running application. Sending crafted inputs to a running application and studying how it responds is dynamic testing, the right way to check for injection and scripting weaknesses. Static review reads code, fuzzing targets protocols, and composition analysis inventories libraries. Now, why are the other options incorrect? Option A is incorrect. Composition analysis inventories third-party libraries. Option C is incorrect. Protocol fuzzing stresses network protocol handling and is not aimed at web injection flaws. Option D is incorrect. Static analysis reads code without running the application. Therefore, B, Dynamic testing of the running application, is the correct answer.

Play from 1:50:59 Question 75. A consultancy is scoping a project in which only the client's internet-exposed systems will be tested from the outside. Which assessment type describes this scope? Here are the options. Option A. External. Option B. Web. Option C. Segmentation. Option D. Mobile. Pause the video now if you want time to think about the answer.

The correct answer is A. External. Testing the systems that face the internet from outside the organization's perimeter is called an external assessment. Segmentation work concerns internal boundaries, mobile work concerns handheld devices and apps, and web work is only one slice of what is exposed. Now, why are the other options incorrect? Option B is incorrect. Web testing covers web applications only, which is narrower than everything exposed to the internet. Option C is incorrect. Segmentation testing checks the boundaries between internal network zones. Option D is incorrect. Mobile testing focuses on phone apps and devices. Therefore, A, External, is the correct answer.

Play from 1:52:24 Question 76. A consultant must confirm which version of web server software a client is running. Which technique is the most direct? Here are the options. Option A. Banner grabbing. Option B. Inspecting the SSL certificate. Option C. Following links to build a site map. Option D. Guessing hidden folder names. Pause the video now if you want time to think about the answer.

The correct answer is A. Banner grabbing. Reading the response information a server returns usually reveals its software name and version straight away from one connection. That is banner grabbing. Now, why are the other options incorrect? Option B is incorrect. A certificate describes identity and validity and generally does not reveal server software versions. Option C is incorrect. Crawling gathers pages and links rather than version details. Option D is incorrect. Guessing folder names finds content paths, not the version. Therefore, A, Banner grabbing, is the correct answer.

Play from 1:53:42 Question 77. Which technique applies the "five whys" idea when a team is carrying out the testing phase of an engagement? Here are the options. Option A. STRIDE. Option B. Articulation of risk. Option C. OCTAVE. Option D. Root cause analysis. Pause the video now if you want time to think about the answer.

The correct answer is D. Root cause analysis. Repeatedly asking why to move from a symptom to its underlying cause is the essence of root cause analysis. The other options classify threats, evaluate organizational risk, or communicate risk, and none of them trace causes. Now, why are the other options incorrect? Option A is incorrect. STRIDE sorts threats into categories and is not a questioning technique. Option B is incorrect. Articulating risk is about explaining it to stakeholders. Option C is incorrect. OCTAVE is an approach for evaluating organizational risk and does not drill into causes by repeating questions. Therefore, D, Root cause analysis, is the correct answer.

Play from 1:55:06 Question 78. Which practice is the most important when preparing and handling a penetration testing report? Here are the options. Option A. Capping the report at five to ten pages. Option B. Writing a clear report that covers every objective, with a precise executive summary. Option C. Tying the recommendations to the risk score. Option D. Recording video and audio of every activity. Pause the video now if you want time to think about the answer.

The correct answer is B. Writing a clear report that covers every objective, with a precise executive summary. A report must be easy for every audience to follow and must address all the stated objectives, which a precise executive summary supports. Fixed page counts, constant recording, or a single basis for recommendations are not the crucial factor. Now, why are the other options incorrect? Option A is incorrect. Length should follow the findings, not an arbitrary limit. Option C is incorrect. Risk scores can inform recommendations, but this is a detail and not the main requirement. Option D is incorrect. Recording everything is not a report requirement and creates extra privacy burdens. Therefore, B, Writing a clear report that covers every objective, with a precise executive summary, is the correct answer.

Play from 1:56:48 Question 79. A consultant is about to run a vulnerability scan against a container orchestration cluster. Which tool is the best choice? Here are the options. Option A. NSE. Option B. Trivy. Option C. Nessus. Option D. CME. Pause the video now if you want time to think about the answer.

The correct answer is B. Trivy. Trivy is purpose-built to scan container images, file systems and repositories, which makes it the right pick for a cluster that runs containers. The other options are general network or Windows-oriented tools. Now, why are the other options incorrect? Option A is incorrect. NSE is a scripting feature of a network scanner and is not specialized for container content. Option C is incorrect. Nessus is a general vulnerability scanner without the container focus of the correct answer. Option D is incorrect. CME is aimed at assessing Windows and directory networks rather than clusters. Therefore, B, Trivy, is the correct answer.

Play from 1:58:07 Question 80. What should accompany a tester's detailed findings in a report to back them up with evidence? Here are the options. Option A. Remediations. Option B. Methodologies. Option C. Vulnerabilities. Option D. Screenshots. Pause the video now if you want time to think about the answer.

The correct answer is D. Screenshots. Captured images show exactly what the tester saw and give the reader proof of each finding. Methods, issues and fixes are all report content, but only screenshots work as direct supporting evidence. Now, why are the other options incorrect? Option A is incorrect. Remediations are recommended fixes and do not prove that a finding exists. Option B is incorrect. The methodology explains the approach in general and is not evidence for one finding. Option C is incorrect. Vulnerabilities are the findings themselves, not the support for them. Therefore, D, Screenshots, is the correct answer.