Ethical Hacking v13 (312-50) Practice Test – 148 Free Exam Questions with Answers

Correct answer: D. Running an intensive port scan against the competitor's public IP addresses to gain information on their internal network and server structure.

A port scan is active reconnaissance, directly probing the target system and risking detection. Passive methods like public records or archived sites do not directly interact with the target.

Correct answer: A. Monitor file hashes of sensitive executables for unauthorized changes.

Monitoring file hashes detects unauthorized changes to legitimate executables, a key defense against living-off-the-land attacks. The other options are good practices but less specific.

Correct answer: A. Using a tool like Nmap to scan the company's public IP range.

Nmap is an active reconnaissance tool that directly interacts with the target. Passive reconnaissance involves gathering information without direct system interaction.

Correct answer: C. Differential Power Analysis (DPA)

Differential Power Analysis is the specific technique of analyzing power consumption to find cryptographic keys. This is a classic side-channel attack method.

Correct answer: B. Wireshark

Wireshark is the industry standard for capturing and analyzing network traffic to inspect packet contents. Other tools listed are not protocol analyzers.

Correct answer: C. Squiblydoo

Squiblydoo is the precise term for using Regsvr32.exe to execute remote SCT files. The other options describe distinct fileless malware techniques.

Correct answer: C. Saving data today for future quantum decryption

Saving data for future quantum decryption is the exact threat described. The other options involve active quantum attacks or unrelated quantum concepts.

Correct answer: B. Because BITS packets appear identical to normal Windows update traffic.

BITS is the correct answer because its traffic mimics legitimate Windows updates, allowing it to blend in and evade detection by firewalls. The other options are incorrect because BITS does not use encrypted DNS, exclusively HTTP, or IP fragmentation.

Correct answer: D. Pretexting

Pretexting is the correct answer as it involves creating a fabricated scenario to trick victims into revealing information. Baiting and phishing are different social engineering methods, while quid pro quo involves a service-for-information exchange.

Correct answer: D. Use behavioral analytics to monitor for irregular outbound requests and abnormal application behavior.

Behavioral analytics is the correct answer because it detects anomalies in process activity and network requests, which is necessary for fileless malware that evades signature-based detection. The other options are ineffective against this sophisticated threat.

Correct answer: A. Hardcoded API keys or credentials might be pushed to the container image or public repo.

This is correct because disabled secret scanning risks exposing credentials during build. The trap is technical issues, not misconfigurations like GPL licensing.

Correct answer: A. Numerous MAC addresses that correspond to a single switch port.

This is correct because MAC flooding floods a port with fake addresses. The trap is confusing MAC overflow with IP-MAC mapping issues.

Correct answer: C. MobSF (Mobile Security Framework)

MobSF automates APK analysis for hardcoded secrets and vulnerabilities, making it the ideal tool for this scenario. Wireshark and Nmap are network-focused, while John the Ripper is for password cracking, not secret discovery.

Correct answer: C. Sarah, a new recruit, receives a call from someone claiming to be from the IT department, who asks for her login credentials to solve a non-existing issue.

The caller impersonating IT to get credentials is classic social engineering. The other options describe physical security, accidental malware, or legitimate monitoring.

Correct answer: A. The target machine responds with a TCP RST packet.

A TCP RST packet means the port is closed. The RST resets the connection, indicating no service is listening on that specific port.

Correct answer: D. Monitor for parent-child process anomalies and network connections initiated by system binaries like certutil.

Monitoring parent-child process anomalies is the best detection method. Blocking or renaming system binaries breaks legitimate functionality and is not a practical solution.

Correct answer: A. It bypasses disk-based signature scanning by running in memory.

Fileless malware using 'mshta.exe' runs in memory, bypassing disk-based signature scanning. Option B describes encryption, not evasion; C and D are unrelated to this specific technique.

Correct answer: B. Differential cryptanalysis on input-output differences

Differential cryptanalysis analyzes ciphertext differences from small input changes to deduce key patterns in symmetric algorithms. A, C, and D are unrelated cryptographic attack methods.

Correct answer: A. Utilize Session Fixation to manipulate a user into utilizing a session ID that an attacker already has access to.

Session Fixation manipulates a user into using an attacker-controlled session ID, bypassing MFA and encryption. Sidejacking requires interception, CSRF relies on user actions, and deserialization is unrelated.

Correct answer: B. A Pulse Wave attack leveraging high-volume short bursts to overwhelm network resources.

A Pulse Wave attack uses high-volume short bursts to overwhelm resources, matching the periodic 300 Gbps spikes. Other options describe sustained attacks, mimicry, or hardware damage.

Correct answer: A. Modifying the training dataset to include samples that misclassify specific malware as 'Benign'.

A poisoning attack corrupts the training data to misclassify malware as benign. Option B is a denial-of-service attempt, not a poisoning attack that manipulates model logic.

Correct answer: D. The attacker uses a Slowloris attack to keep many open connections alive, slowly exhausting the server's connection pool.

Slowloris attacks keep many connections open at a slow rate to exhaust server resources. Option A is a UDP flooding attack, which is not the application-layer technique described.

Correct answer: B. Reconnaissance, Scanning, Gaining Access, Maintaining Access, Covering Tracks

The correct order is Reconnaissance, Scanning, Gaining Access, Maintaining Access, Covering Tracks. Option A incorrectly starts with Scanning instead of Reconnaissance.

Correct answer: A. Utilize a proxy tool to intercept and modify the client-side controls before they reach the server.

A proxy tool is the most effective method for bypassing client-side controls, as it intercepts and modifies data before it reaches the server, preventing server-side validation from ever seeing the bypass.

Correct answer: C. It ensures any new device subscribing to that topic immediately receives the malicious message.

The 'Retain' flag ensures any new subscriber to a topic receives the last message, allowing an attacker to persist malicious commands that infect new devices without sending new messages.

Correct answer: B. Implementing an automatic patch management process and using a patch management tool to monitor the patched systems.

Automatic patch management is the most effective strategy as it ensures timely, consistent application of patches across all systems, reducing the window of vulnerability.

Correct answer: A. Enforcing timely user de-provisioning

This question effectively tests identity and access management (IAM) best practices, a fundamental security control. The other options are secondary controls that don't directly solve the access de-provisioning issue.

Correct answer: C. The LDAP directory data is protected by Access Control Lists (ACLs).

ACLs restrict access to LDAP directory data, preventing enumeration of protected information. This is a fundamental concept of directory service security.

Correct answer: C. Temporary security tokens (Access Key, Secret Key, and Session Token) associated with the instance's IAM role.

The metadata URL returns temporary IAM credentials, allowing the attacker to access AWS resources. The other options are incorrect, as this URL doesn't return root passwords or VPC keys.

Correct answer: B. An attacker intercepts network traffic, captures unencrypted session cookies, and uses these to impersonate the user.

Side jacking specifically involves capturing unencrypted session cookies from network traffic. The other options describe firewall exploits, XSS, or credential phishing.

Correct answer: D. Isolate the implicated traffic light from the overarching network for a detailed investigation into its firmware to identify any possible security breaches.

Isolating the device is the critical first step to contain the threat and safely investigate the firmware. Continuing to allow network traffic is dangerous.

Correct answer: C. Secret Scanning (e.g., TruffleHog or Gitleaks)

Secret Scanning tools, like TruffleHog, are built specifically to find exposed keys in code. SAST and DAST find code vulnerabilities, not secrets.

Correct answer: C. Session fixation by pre-setting the token in a URL.

Session fixation works when a non-regenerated session ID is sent via URL. The attacker can predict this ID before the user authenticates.

Correct answer: B. A person gains access to the building by following an employee through a secure door before it closes.

Tailgating is physically following an authorized person into a restricted area. This is a physical security breach, not a digital one.

Correct answer: D. Indirect Prompt Injection

Indirect prompt injection is correct because the attacker manipulated external data the LLM processed, not the direct prompt. The other options involve direct manipulation or evasion techniques not applicable here.

Correct answer: A. The SNMP agent allowed anonymous bulk data queries due to default settings.

Anonymous bulk data queries via SNMP's default community string enabled this. The other options describe unrelated vulnerabilities like FTP or registry access.

Correct answer: C. The analyst is using conditional logic to infer database behavior from page responses.

Conditional logic testing is correct because the analyst inferred database behavior from page differences. The other options describe error-based or time-based techniques.

Correct answer: A. Man-in-the-Browser (MitB) Attack Installing Malicious Browser Extensions to Intercept User Sessions

Man-in-the-Browser (MitB) is the correct answer because it attacks the browser layer after authentication, making it exceptionally hard for servers to detect and severely compromising real-time transactions. The other options are detectable by network or server-side security controls.

Correct answer: D. Utilize SSRF (Server-Side Request Forgery) to make unauthorized API calls from the server itself.

SSRF is the correct answer because it abuses server trust to make internal calls, bypassing client-side defenses. The other options are direct and more likely to leave traces, whereas SSRF allows for stealthy, indirect exploitation.

Correct answer: B. Unauthorized access to cloud resources

Unauthorized access to cloud resources is the correct answer, as API flaws are a direct vector for compromising cloud environments. Physical security and data encryption are less likely threats from an API vulnerability.

Correct answer: C. The pod can sniff traffic from the node's network interfaces and potentially escape the container.

This is correct because 'hostNetwork: true' and 'privileged: true' allow the pod to access the host's network, enabling packet sniffing. The trap is confusing network access with isolation or encryption.

Correct answer: A. Implement a strategy of Virtual Patching, providing a protective layer around the vulnerability until the actual patch can be applied.

This is correct because virtual patching mitigates risk without downtime. The trap is reactive monitoring versus proactive protection.

Correct answer: C. It quantifies technical impact and ease of exploitation, guiding structured risk response based on impact and environment.

This is correct because severity scores quantify exploitability and impact. The trap is prioritizing automation over risk-based decisions.

Correct answer: D. The NTP daemon is configured to accept queries from external sources without restriction.

This is correct because unrestricted NTP queries leak internal hostnames. The trap is misinterpreting firewall misconfigurations as DNS issues.

Correct answer: C. Accessing the host's /proc directory to inject code into a host process.

The 'hostPID: true' flag allows a privileged pod to access the host's /proc directory, enabling process injection onto the node. This is a direct path to root escape, whereas brute-forcing certificates is less reliable and scanning NodePorts doesn't grant host access.

Correct answer: C. Covert Channel Communication Exploiting Unused IP Header Fields to Conceal Malicious Traffic and Evade Detection by Security Devices

Covert channels hide malicious traffic within protocol fields, making it invisible to traditional IDS and firewall inspection. This is more challenging to detect than polymorphic malware or protocol fragmentation, which are more easily flagged by signature-based systems.

Correct answer: A. TEMPEST / Analysis of emanations

TEMPEST involves analyzing electromagnetic emanations to extract data, which is a classic side-channel technique. The other options are unrelated—session hijacking, social engineering, and brute force exploit different attack vectors entirely.

Correct answer: A. The APT group will exploit zero-day vulnerabilities present in the IoT device firmware.

APT groups commonly exploit zero-day vulnerabilities in IoT firmware since patches are unavailable, giving them direct system access. Credential theft or MITM attacks require initial compromises, which zero-days bypass entirely.

Correct answer: D. Deriving linear patterns from cipher behavior

Linear cryptanalysis is correct because it exploits statistical relationships between plaintext and ciphertext bits to find the key. The other options describe different attacks like brute force or differential cryptanalysis.

Correct answer: D. Google Hacking can help identify weaknesses in the client's website code.

Google Hacking finds exposed code vulnerabilities. It can't map internal networks reliably or access the deep web directly, making it less suitable for those tasks.

Correct answer: D. Implementing 'Link Layer' encryption and using sequence numbers or timestamps.

Link Layer encryption and sequence numbers or timestamps prevent a GATT Replay Attack by making each transmission unique and ensuring data integrity, which is the correct defense.

Correct answer: B. Whaling attack aimed at high-ranking personnel

A whaling attack targets high-ranking executives with highly personalized and convincing emails, as seen in this scenario where the email impersonates the CEO.

Correct answer: B. SYN Flood: This attack floods a target with SYN requests in an attempt to consume enough server resources to make the system unresponsive, aligning with the high volume of incomplete TCP handshakes.

A SYN Flood attack is identified by a high volume of incomplete TCP three-way handshakes, which leaves connections in a SYN_RECEIVED state to saturate server resources.

Correct answer: D. Spearphone attack exploiting accelerometer-based vulnerabilities.

The Spearphone attack exploits accelerometer-based vulnerabilities to eavesdrop on loudspeaker audio without special permissions. The other options focus on unrelated attack vectors like NFC or application manipulation, which are less relevant to this specific sensor-based privacy risk.

Correct answer: D. Implement uniform encryption strength across all user roles, eliminating disparities in session token lengths.

Implementing uniform encryption strength eliminates variable token lengths, ensuring consistent protection against cryptographic attacks. MFA, key rotation, and logging are good practices but don't directly address the core cryptographic vulnerability.

Correct answer: C. To provide mTLS (mutual TLS) and fine-grained traffic encryption between microservices.

A Sidecar Container provides mTLS and fine-grained encryption between microservices in a Service Mesh. Options A, B, and D describe unrelated functions like logging, performance, or redundancy.

Correct answer: D. IP addresses being resolved to multiple MAC addresses.

IPs resolving to multiple MACs indicate a MitM attack, as one IP should map to one MAC. Other options suggest general anomalies but not specific MitM behavior.

Correct answer: B. Implementing DNSSEC on the DNS server

DNSSEC prevents DNS hijacking by digitally signing records to prevent tampering. Updating software or changing IPs doesn't stop DNS redirection, and LAMP is unrelated.

Correct answer: A. An attack where compromised internal devices participate in a botnet and flood external targets with traffic.

The correct answer describes a botnet-based DDoS where compromised internal devices flood external targets. Option B is a misdirection to amplify traffic through DNS, which isn't occurring here.

Correct answer: C. By querying the Instance Metadata Service (IMDS) to get a token and then using Azure CLI to manage resources.

An attacker on the VM can query IMDS to get a token and use Azure CLI to manage resources with the 'Contributor' permissions. Option A is invalid as Managed Identity has no password to brute-force.

Correct answer: D. Implementing an anomaly-based IDS that can recognize the irregular traffic patterns caused by packet fragmentation.

Anomaly-based IDS detects irregular patterns from packet fragmentation, unlike signature-based methods. Option B is a poor choice as rejecting all fragments breaks normal network traffic.

Correct answer: C. Develop a custom exploit code that uses obfuscation techniques to avoid detection.

A custom obfuscated exploit avoids detection by signature-based antivirus. Option A is weak because Metasploit payloads are well-known and likely detected.

Correct answer: D. Extract and analyze stream objects using PDFStreamDumper.

PDFStreamDumper directly examines embedded streams where malicious JavaScript hides. Option A is passive, B finds signatures but not code, and C applies to PE files, not PDFs.

Correct answer: A. Search engines don't index the Deep Web, and there could be non-indexed company information lying there.

Search engines do not index the Deep Web, so information stored there remains hidden. Options B, C, and D are misinformed or irrelevant to passive reconnaissance.

Correct answer: B. Conduct real-time monitoring of the server, scrutinize the logs for unusual patterns, and identify the nature of the activities to devise an immediate countermeasure.

The correct initial action is real-time monitoring to understand the threat before acting. This prevents premature actions like disconnecting the server, which could destroy evidence needed for a proper investigation.

Correct answer: C. Tempting the victim to engage with a malicious device using curiosity.

This is a classic baiting attack, exploiting the victim's curiosity. The 'Employee Salary Info' label is designed to trigger an emotional response, leading to the malicious act of plugging in the device.

Correct answer: C. The attacker has used a SYN scan, also known as half-open scanning, which involves sending SYN packets and waiting for SYN/ACK responses.

The attack is a SYN scan because it sends SYN packets to initiate a connection but does not complete the handshake, allowing it to scan for open ports without logging a full connection attempt.

Correct answer: A. Exploitation of misconfigured security groups

Misconfigured security groups are a primary cause of data breaches in cloud environments, as they can accidentally expose storage buckets or virtual machines to the public internet.

Correct answer: B. Stealth Scan (SYN Scan)

A SYN scan is the ideal choice because it's a half-open connection that doesn't complete the TCP handshake, making it stealthy and less likely to trigger traditional IDS signatures.

Correct answer: A. A security professional hired to identify and exploit vulnerabilities with permission

This correctly defines a penetration tester as an authorized professional who mimics an attack to find vulnerabilities, which distinguishes them from malicious hackers.

Correct answer: C. Intranet DNS poisoning via local spoofed responses.

This is intranet DNS poisoning because the attack is happening internally with rogue DNS responses, confirmed by the faster spoofed replies and ARP spoofing on the local network.

Correct answer: A. Gaining physical access by assuming the identity of a trusted internal staff.

This question perfectly tests social engineering tactics, specifically physical impersonation, a core red teaming skill. The wrong options are weaker because they describe different attack vectors like dumpster diving and phishing.

Correct answer: D. Engage a specialized steganalysis tool to scrutinize questionable files, decode the obscured data, and reveal the hacker's exfiltration methodology.

This directly tests steganalysis knowledge for detecting data exfiltration, a key forensic skill. The trap is that network-based tools can't detect hidden data within files.

Correct answer: B. Implementing a function-level permission model and enforcing the principle of least privilege.

This is an excellent question for modern cloud security, testing least privilege in serverless architectures. It correctly identifies that function-level permissions are the most direct countermeasure to the attack described.

Correct answer: A. White Hat Hacking

White Hat Hacking is correct because it explicitly involves authorized, ethical penetration testing with permission. Other options imply unauthorized or malicious activity.

Correct answer: D. WPA3 uses the Simultaneous Authentication of Equals (SAE) protocol, which is resistant to passive observation and key reinstallation.

WPA3 uses SAE, which is resistant to key reinstallation. Option C is a trap because SAE replaces, not disables, the handshake.

Correct answer: D. ' AND BENCHMARK(5000000,ENCODE('test','test')); —

The BENCHMARK payload introduces a delay to test time-based vulnerabilities. Option B is a trap because it tests for basic SQL injection, not blind injection.

Correct answer: C. Use of weak Initialization Vectors (IV).

TKIP's weak IVs are a known flaw that allows for decryption and packet injection attacks. While WPA2 with AES is secure, WPA with TKIP is vulnerable.

Correct answer: D. Employ an intrusion prevention system (IPS) on the network to detect and block any malicious activities.

An IPS can detect and block malicious activity from compromised IoT devices. While other options are good long-term strategies, the immediate action is to block the attack.

Correct answer: D. AI-powered malware using machine learning to tailor its execution.

The malware's adaptive behavior and use of machine learning points to AI-powered malware. Polymorphic viruses change signatures, but don't adapt based on user behavior.

Correct answer: A. The specific usernames and passwords used by the organization's employees.

DNS queries reveal domain mappings, not private credentials like usernames and passwords. Other options are valid DNS data points, making option A the clear incorrect answer.

Correct answer: D. Swiftly apply a virtual patch to the affected web server using a web application firewall to temporarily safeguard against potential exploits.

A virtual patch via a WAF provides immediate protection against an unpatched zero-day. Shutting down the server is not the 'first' step.

Correct answer: A. Model Extraction (or Inversion)

Model Extraction involves repeatedly querying an AI model to steal its underlying data or logic. This is a direct threat to intellectual property.

Correct answer: B. Time-Based Blind SQL Injection

Time-based blind SQL injection is right because it uses response delays to infer truths when standard techniques fail. The other options require visible errors or known database structures.

Correct answer: C. The attacker captured a valid token before its expiry and used it to gain access.

Capturing a valid token before expiry matches the observed pattern. The other options don't explain the expired token attempts followed by success.

Correct answer: C. The IDS is configured with very high sensitivity settings, leading to many false positives.

High sensitivity settings cause false positives by flagging normal activity as threats. The other options imply system failures rather than configuration issues.

Correct answer: D. State-sponsored hackers

State-sponsored hackers is the correct answer as they act directly for a government's national interests. Organized, gray hat, and hacktivists lack the official government backing described in the scenario.

Correct answer: C. Heavy query-based SQL injection

Heavy query-based SQL injection is the correct answer because the payload causes a significant delay by overloading the database with complex queries. The WAITFOR DELAY technique is specific to SQL Server, while this payload is a generic stress test.

Correct answer: C. The attacker is utilizing a 'zombie' machine to transmit the scan, thus making the true source of the scan difficult to determine.

Using a 'zombie' machine is the correct answer because it obscures the attacker's true source, making the scan stealthy. The other methods are more direct and easier to trace back to the source.

Correct answer: B. Remote Access Trojan (RAT) Implanting Malicious Software on Mobile Devices to Gain Unauthorized Remote Access and Monitor User Activities, such as Keystrokes and Screen Capture

This is correct because RATs provide stealthy remote access, making them hard to detect. The trap is distinguishing between active attacks and passive vulnerabilities.

Correct answer: B. Monitor wireless signals for abnormal jamming or interference.

This is correct because signal jamming reveals key fob replay attacks. The trap is confusing digital security with physical measures.

Correct answer: B. Employ a systematic, multi-layered strategy, starting with the deployment of a specialized rootkit detection tool to verify the presence and type of rootkit, followed by an appropriately tailored removal procedure, specific to the identified rootkit.

This is correct because kernel rootkits need specialized detection and removal. The trap is overreacting with honeypots or full reinstallation.

Correct answer: B. Exploiting MRI machine firmware vulnerabilities to intercept real-time patient scans.

Exploiting MRI firmware vulnerabilities is a sophisticated attack targeting medical devices directly, making it highly difficult to detect without specialized monitoring. The other options focus on administrative manipulation rather than direct network-level interception.

Correct answer: C. Measure unusual fluctuations during device operations at the hardware level.

Side-channel attacks exploit physical characteristics like power fluctuations, requiring hardware-level monitoring to detect. Network latency or UI reviews might indicate other issues, but hardware-level analysis is the definitive method for confirming side-channel leakage.

Correct answer: A. Disable "Discoverable Mode" and activate "Non-discoverable Mode" on all Bluetooth devices.

Disabling discoverable mode prevents attackers from detecting Bluetooth devices, the first step in Bluesnarfing. Firmware updates and strong PINs are secondary defenses; encryption doesn't prevent discovery-based attacks.

Correct answer: B. Zero-Day Exploits Leveraging Previously Unknown Vulnerabilities in Mobile Operating Systems or Applications to Gain Unauthorized Access to Healthcare Data and Patient Records

Zero-day exploits are correct because they use unknown vulnerabilities, making them extremely hard to detect. App spoofing and bluejacking are easier to spot with mobile device management.

Correct answer: B. Set up Google Alerts to receive email notifications whenever new web content includes their competitors' names or other key terms.

Google Alerts are the best choice for automated monitoring. VPNs don't track changes, hacking is unethical, and forum engagement is inefficient and risky.

Correct answer: D. SMTP user verification commands are exposed without restrictions.

Unrestricted user verification commands allow easy username enumeration. Disabling STARTTLS or allowing auth without credentials are different security issues.

Correct answer: A. Changing the source IP address of packets to appear as if the traffic is coming from a trusted source.

IP spoofing allows attackers to bypass firewall rules that rely on trusted source IP addresses. This is a classic firewall evasion technique that attackers frequently use to appear legitimate.

Correct answer: C. By monitoring command-line arguments and unusual network connections from system binaries.

EDR detects LotL activities by monitoring suspicious command-line arguments from trusted system binaries and their corresponding unusual network connections.

Correct answer: B. Restrict and monitor the execution of scripts and system tools, especially those invoked by unsanctioned processes.

Restricting and monitoring script execution counters fileless malware like ShadowFlee that exploits system tools. Option A is too broad; C and D don't directly address memory-based threats.

Correct answer: B. Polymorphic Malware: Employ advanced threat detection tools that use behavior-based detection techniques and ensure all systems are patched.

Polymorphic malware changes its code to evade detection, making behavior-based tools and patching the best defense. Option A is a generic worm response that misses the evasion clue.

Correct answer: C. Impose rate-limiting to slow down the brute-force attack.

Rate-limiting is the most direct counter to a brute-force attack, slowing the attacker down. Option D is a trap because increasing key length doesn't stop brute-force of the DH exchange.

Correct answer: C. Session Replay Attack Capturing and Replaying Encrypted Session Tokens to Gain Unauthorized Access

Session replay attacks are stealthy, using real captured tokens to impersonate users. Option A is client-side, B requires user action, and D relies on known credentials.

Correct answer: A. Consider the possibility of a firewall blocking the FIN packets and investigate further.

Firewalls often block FIN scans, so a lack of response requires investigation. Option C is incorrect because only RST/ACK indicates a closed port in this context.

Correct answer: B. Adopting the 3-2-1 backup model.

The 3-2-1 model ensures backups are stored offsite and redundant, preventing single points of failure. Options A, C, and D are unrelated to data integrity.

Correct answer: C. The analyst instigated a de-authentication attack, purposely causing a mass disconnection of all clients from the access point. The analyst then attentively observed the four-way handshake process that occurred during the clients' reconnection attempts.

De-authentication attacks force clients to reconnect, allowing capture of the four-way handshake. Options A, B, and D describe different attacks or incorrect methods.

Correct answer: C. Establishing and enforcing a rigorous policy that unequivocally mandates the disabling of ADB, except when absolutely necessary and only within strictly regulated environments.

Disabling ADB is the most potent response because it eliminates the attacker's primary attack vector. Other options, while good security practices, do not directly close this specific access point.

Correct answer: B. A coordinated UDP flood attack exploiting vulnerabilities in the institution's DNS infrastructure, flooding authoritative DNS servers to disrupt domain resolution services.

A coordinated UDP flood against DNS is most challenging because it disrupts fundamental services, and legitimate DNS traffic can mask malicious packets, making detection difficult.

Correct answer: D. Deploy a Web Application Firewall (WAF) with built-in evasion detection features.

A WAF is the most effective countermeasure because it sits between the application and traffic, providing real-time inspection and filtering to block injection attempts with evasion techniques.

Correct answer: A. Transition Disable element

The Transition Disable element is specifically designed to prevent downgrade attacks, stopping a client from being forced to revert to the less secure WPA2 protocol.

Correct answer: B. Attempt SQL Injection to extract database information.

SQL injection is the logical next step after footprinting and identifying a session hijack vulnerability, as it directly exploits the web application and could provide database credentials for a session takeover.

Correct answer: A. The attacker executed a second malicious query alongside the first.

The most likely method is executing a second query, as deleting a table like 'users' requires a separate SQL command appended to the original query, not just error exploitation.

Correct answer: C. Worm: Quarantine the affected systems, perform an immediate network-wide sweep with the latest antivirus definitions, and update the operating system on all network systems.

A worm is the probable cause because it self-replicates and spreads autonomously over the network, which matches the described behavior of increased traffic and system crashes.

Correct answer: C. It is the domain master browser or Primary Domain Controller (PDC).

This is a strong question for legacy network enumeration, testing knowledge of NetBIOS roles. The <1B> entry is a classic exam cue for identifying the PDC or domain master browser.

Correct answer: D. Perform detailed inspections of device software for hidden, unauthorized modifications.

This question accurately tests OT security incident response, focusing on verifying firmware compromise. The correct answer prioritizes verification before containment, a crucial exam principle.

Correct answer: C. File and printer sharing is disabled on the target system.

This is a solid question for legacy Windows network assessment, testing understanding of NetBIOS service dependencies. The failure to enumerate shares is a key cue that file sharing is disabled.

Correct answer: B. The attacker splits malicious data packets into smaller segments to avoid detection.

This effectively tests IDS evasion techniques, a core intrusion detection skill. Packet fragmentation is a classic method to bypass signature-based detection systems.

Correct answer: A. Install the backdoor on a non-web file referenced in a URL.

Placing the backdoor on a non-web file avoids typical web monitoring tools, increasing stealth. Option C is a trap because updating the file would likely expose the backdoor.

Correct answer: B. HTTP flood attack

HTTP floods target the application layer by overwhelming the server with requests. Options A, C, and D are network/transport layer attacks, not application layer.

Correct answer: D. Tautology-based SQL injection

Tautology-based SQL injection works because the injected condition '1=1' is always true, bypassing authentication. Option B is a trap because it involves UNION queries.

Correct answer: B. Strategic pattern-based input using known logic.

Strategic pattern-based input uses logic-based guesses like birthdates or sports teams. Option D is a trap because it lacks the strategic element.

Correct answer: B. Assessing multi-tenant isolation techniques

Multi-tenant isolation prevents one customer's malicious activity from affecting others. Option A is a trap because logging doesn't stop cross-tenant issues.

Correct answer: B. Session Sidejacking Intercepting Unencrypted Session Tokens over Public Wi-Fi Networks

Session sidejacking exploits unencrypted tokens on public networks. This is highly effective and hard to detect without proper encryption protocols.

Correct answer: C. Load Balancing: This approach distributes network or application traffic across many resources to optimize resource use, minimize latency, and maximize throughput. This is consistent with the company's strategy of distributing incoming traffic.

Load balancing distributes traffic across servers, which absorbs and mitigates DDoS attacks. Blackhole routing drops all traffic, which is not the described strategy.

Correct answer: C. Analyze and document the activities of the unauthorized user in real-time, then use this data to implement immediate countermeasures and isolate the affected server from the network.

Analyzing and documenting attacker activities first ensures informed containment. This prioritizes live threat response over scanning or forensics, avoiding disruption.

Correct answer: B. Apply an IPsec VPN solution that encrypts the entire IP packet, thereby making session hijacking attempts more difficult.

IPsec VPN is the correct answer as it encrypts the entire session, making hijacking much harder. While IPS and awareness are good practices, they don't prevent the attack at the transport layer like encryption does.

Correct answer: C. The operation cannot continue without the LTK.

This is correct because the LTK is essential for BLE decryption. The trap is confusing packet types with exploitable data.

Correct answer: C. Asymmetric encryption

Asymmetric encryption uses public/private keys for secure key exchange without a pre-shared secret. Symmetric encryption requires secure key distribution, while hashing and disk encryption aren't key management solutions.

Correct answer: B. Directly interacting with the threat actor on the forums using a pseudonym to gain more information about their plans.

Directly engaging the threat actor is risky because it can expose your identity. Passive tools like Tor, WHOIS, and archives are safer for reconnaissance.

Correct answer: D. It involves the ethical hacker trying to break into a system without any prior knowledge about the system.

Black box testing simulates a real attacker by providing no prior system knowledge, forcing the ethical hacker to find vulnerabilities through exploration.

Correct answer: A. Without delay, apply the patch recommended by the vendor. Subsequently, initiate a system-wide reboot during the next downtime scheduled for system maintenance.

For a severe, high-risk vulnerability like a potential remote code execution, patching immediately is the top priority to close the attack window.

Correct answer: B. Prioritize a behavioral analytics solution that profiles normal system behaviors and alerts on deviations, focusing on the interaction patterns of the identified systems.

Behavioral analytics is the most direct method because it identifies unsanctioned exchanges by profiling normal system interaction patterns and alerting on deviations.

Correct answer: B. Implement strict access control lists (ACLs), ensure regular updates of security patches, and conduct an extensive audit of user accounts and privileges periodically.

Strict access controls, regular patching, and user account audits are fundamental for neutralizing backdoors and preventing privilege escalation attacks.

Correct answer: A. They are novices in the hacking world who mainly use scripts and codes developed by others.

Script kiddies are novice hackers who use pre-existing scripts. Option C is a trap for sophisticated attackers, while D describes skilled developers, not script kiddies.

Correct answer: C. Digital signatures

Digital signatures provide non-repudiation, ensuring data hasn't been tampered with. SHA-256 only verifies hashes but doesn't prove origin or prevent modification.

Correct answer: C. Every new subscriber to that topic will immediately receive the malicious update message.

MQTT's 'Retain' flag sends the stored message to all new subscribers. The impact is widespread delivery, not automatic TLS, battery drain, or broker crashing.

Correct answer: C. No client from the DNS server's network has recently accessed the domain.

A NOERROR but empty answer in DNS cache snooping indicates the domain isn't in the cache. Option A would return the cached record, while B suggests a SERVFAIL error.

Correct answer: B. To test which permissions their current token has without triggering many 'Access Denied' logs.

SimulatePrincipalPolicy is a stealthy way to test permissions without logging 'Access Denied' errors. Option A and D are unrelated actions, while C is unlikely.

Correct answer: D. Regularly updating and patching the server software

Regular patching is the most direct way to address vulnerabilities in any server, regardless of its architecture. This action closes security holes that could be exploited, unlike reorganizing directory structures.

Correct answer: D. The firewall or another security control is probably blocking the ICMP Echo Requests.

The lack of Echo Replies while other services are normal points to a security control like a firewall blocking the ICMP traffic, which is a common and intentional security measure.

Correct answer: B. Direct Prompt Injection

Direct prompt injection is correct because the attacker bypasses the model by injecting malicious input directly into the system prompt, causing it to leak sensitive data.

Correct answer: D. Leveraging secure coding practices and automated code review processes in the development stage.

This tests secure development practices for mobile applications. While a good topic, the question could be clearer by specifying 'prevent future' instead of 'barrier to additional' exploitation.

Correct answer: B. The scanned port on the target IP address is open, as the receipt of a SYN/ACK packet indicates that the port is prepared to establish a connection.

A SYN/ACK response indicates the port is open and accepting connections. Option A is a trap because it incorrectly describes port closure logic.

Correct answer: C. Harden the web server security, add multi-factor authentication for API users, and restrict the execution of scripts server-side.

Hardening the server, MFA, and script restrictions directly prevent webshells and unauthorized access. Option B is a trap because a WAF alone isn't sufficient.

Correct answer: A. An ethical hacker is primarily focused on securing the system, while a penetration tester tries to exploit the system's vulnerabilities.

The answer correctly contrasts securing systems (ethical hacker) with exploiting them (penetration tester). However, the wording is slightly vague; ethical hackers also exploit vulnerabilities to secure systems.

Correct answer: C. Exposure of proprietary business logic or data filtering rules.

Prompt leaking directly exposes the hidden system instructions, which often include proprietary business logic or data filtering rules that are meant to be confidential.

Correct answer: C. RSA

RSA is an asymmetric algorithm that obscures traffic patterns more than symmetric AES, but the question is misleading since all listed algorithms encrypt traffic. The exam expects RSA as the best answer for pattern obscuration, though the premise is weak.