[Oct-2023] GPEN Free PDF from Free4Dump [Q71-Q95]

NO.71 You work as a professional Ethical Hacker. You are assigned a project to perform blackhat testing on www.we-are-secure.com. You visit the office of we-are-secure.com as an air-condition mechanic. You claim that someone from the office called you saying that there is some fault in the air-conditioner of the server room. After some inquiries/arguments, the Security Administrator allows you to repair the air- conditioner of the server room.
When you get into the room, you found the server is Linux-based. You press the reboot button of the server after inserting knoppix Live CD in the CD drive of the server. Now, the server promptly boots backup into Knoppix. You mount the root partition of the server after replacing the root password in the /etc/ shadow file with a known password hash and salt. Further, you copy the netcat tool on the server and install its startup files to create a reverse tunnel and move a shell to a remote server whenever the server is restarted. You simply restart the server, pull out the Knoppix Live CD from the server, and inform that the air-conditioner is working properly.
After completing this attack process, you create a security auditing report in which you mention various threats such as social engineering threat, boot from Live CD, etc. and suggest the countermeasures to stop booting from the external media and retrieving sensitive data. Which of the following steps have you suggested to stop booting from the external media and retrieving sensitive data with regard to the above scenario?
Each correct answer represents a complete solution. Choose two.

NO.72 John works as a professional Ethical Hacker. He has been assigned a project to test the security of www.we-are-secure.com. He copies the whole structure of the We-are-secure Web site to the local disk and obtains all the files on the Web site. Which of the following techniques is he using to accomplish his task?

NO.73 John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. In order to do so, he performs the following steps of the preattack phase successfully:
Information gathering
Determination of network range
Identification of active systems
Location of open ports and applications
Now, which of the following tasks should he perform next?

NO.74 When DNS is being used for load balancing, why would a penetration tester choose to identify a scan target by its IP address rather than its host name?

NO.75 Which of the following statements are true about the Enum tool?
Each correct answer represents a complete solution. Choose all that apply.

NO.76 You have obtained the hash below from the /etc/shadow file. What are you able to discern simply by looking at this hash?

NO.77 You run the following PHP script:
<?php $name = mysql_real_escape_string($_POST[“name”]);
$password = mysql_real_escape_string($_POST[“password”]);?>
What is the use of the mysql_real_escape_string() function in the above script.
Each correct answer represents a complete solution. Choose all that apply

NO.78 You have compromised a Windows XP system and Injected the Meterpreter payload into the lsass process.
While looking over the system you notice that there is a popular password management program on the system. When you attempt to access the file that contains the password you find it is locked. Further investigation reveals that it is locked by the passmgr process. How can you use the Meterpreter to get access to this file?

NO.79 CORRECT TEXT
Fill in the blank with the appropriate act name.
The___ act gives consumers the right to ask emailers to stop spamming them.

NO.80 You have been contracted to perform a black box pen test against the Internet facing servers for a company. They want to know, with a high level of confidence, if their servers are vulnerable to external attacks. Your contract states that you can use all tools available to you to pen test the systems. What course of action would you use to generate a report with the lowest false positive rate?

NO.81 John works as a professional Ethical Hacker. He is assigned a project to test the security of www.we-are- secure.com. John has gained the access to the network of the organization and placed a backdoor in the network. Now, he wants to clear all event logs related to previous hacking attempts. Which of the following tools can John use if we-are-secure.com is using the Windows 2000 server?
Each correct answer represents a complete solution. Choose two.

NO.82 Which of the following tools can be used as a Linux vulnerability scanner that is capable of identifying operating systems and network services?
Each correct answer represents a complete solution. Choose all that apply.

NO.83 Which of the following is generally practiced by the police or any other recognized governmental authority?

NO.84 John works as a Penetration Tester in a security service providing firm named you-are-secure Inc.
Recently, John’s company has got a project to test the security of a promotional Website www.missatlanta.com and assigned the pen-testing work to John. When John is performing penetration testing, he inserts the following script in the search box at the company home page:
<script>alert(‘Hi, John’)</script>
After pressing the search button, a pop-up box appears on his screen with the text – “Hi, John.”
Which of the following attacks can be performed on the Web site tested by john while considering the above scenario?

NO.85 You work as a Penetration Tester for the Infosec Inc. Your company takes the projects of security auditing. Recently, your company has assigned you a project to test the security of the wearesecure. com network. Now, when you have finished your penetration testing, you find that the weare- secure.com server is highly vulnerable to SNMP enumeration. You advise the we-aresecure Inc. to turn off SNMP; however, this is not possible as the company is using various SNMP services on its remote nodes. What other step can you suggest to remove SNMP vulnerability?
Each correct answer represents a complete solution. Choose two.

NO.86 Which of the following is a passive information gathering tool?

NO.87 Analyze the screenshot below, which of the following sets of results will be retrieved using this search?

NO.88 What is the main difference between LAN MAN and NTLMv1 challenge/responses?

NO.89 John works as a professional Ethical Hacker. He has been assigned a project to test the security of www.we-are-secure.com. He successfully performs a brute force attack on the We-are-secure server. Now, he suggests some countermeasures to avoid such brute force attacks on the We- aresecure server. Which of the following are countermeasures against a brute force attack?
Each correct answer represents a complete solution. Choose all that apply.

NO.90 Which of the following tools is used for the 802.11 HTTP, HTTPS based MITM attacks?

NO.91 Which of the following tools can be used to perform brute force attack on a remote database?
Each correct answer represents a complete solution. Choose all that apply.

NO.92 Which of the following is the correct sequence of packets to perform the 3-way handshake method?

NO.93 Analyze the output of the two commands below:

Which of the following can be factually inferred from the results of these commands?

NO.94 In which of the following attacking methods does an attacker distribute incorrect IP address?

NO.95 Which of the following is NOT an example of passive footprinting?